Methods, devices and computer programs for managing a group temporal key for privacy beacon

Abstract

Managing group keys among multi-link devices in an IEEE 802.11 network is described. Using the same key for encrypting different types of frames (data / management_ and different purposes (security / priv

Claims

1. A method in a communication network, the method comprising, at an access point, AP, affiliated with an AP multi-link device, MLD:transmitting, to a non-AP station, STA, affiliated with a non-AP MLD, a management frame comprising a body field encrypted with a first group key; andtransmitting, to the STA, a frame including the first group key and a second group key, wherein the second group key is for encrypting data frames transmitted by the AP to the STA.

2. The method of claim 1, wherein the management frame is a beacon frame.

3. The method of claim 2, wherein the beacon frame is a privacy beacon frame.

4. The method of claim 3, wherein the body field comprises a Basic Service Set, BSS, Parameter Change Count, BPCC, a Traffic Indication Map, TIM, a Reduced Neighbor Report, and / or an Extended Channel.

5. The method of any one of claims 1 to 4, wherein the first group key is generated by the non-AP MLD and shared among all APs affiliated with the non-AP MLD.

6. The method of any one of claims 1 to 4, wherein several APs, comprising the AP, are affiliated with the non-AP MLD, each of the several APs generating its own first group key, all the generated first group keys being transmitted to the STA in the frame including the first group key and a second group key in a MLO element.

7. The method of any one of claims 1 to 6, wherein a same cipher suite is used in relation to the first and the second group key to encrypt the data frame and the body field of the management frame.

8. The method of any one of claims 1 to 7, wherein the first group key and the second group key are transmitted in a Key Delivery element included in a (Re)Association Response frame during an association procedure.

9. The method of any one of claims 1 to 8, wherein the first group key and the second group key are updated and transmitted during a group key handshake.

10. The method of claim 9, wherein the group key handshake is carried out upon determining sleep mode exit of the non-AP MLD.

11. The method of any one of claims 1 to 10, further comprising creating a privacy security association in a robust security network association, RSNA, between the AP MLD and the STA, the first group key and the second group key being stored in the AP MLD, in the privacy security association.

12. The method of claim 11, wherein the privacy security association is created upon determining a successful group key handshake, reassociation response frame of a fast basic service set, BSS, transition protocol, or successful fast initial link setup, FILS, or authentication.

13. The method of claim 11 or claim 12, further comprising deleting the privacy security association storing the first group key and the second group key upon determining that the AP MLD is in an independent basic service set, IBSS, or upon determining an association, reassociation or dissociation procedure of the non-AP MLD.

14. The method of any one of claims 1 to 13, wherein the first group key and the second group key are transmitted to the STA as wrapped keys with key identifiers in a frame subelement.

15. The method of any one of claims 1 to 14, wherein the first group key is a privacy management group temporal key, PMGTK, which value is a random number.

16. The method of any one of claims 1 to 15, further comprising deleting the first group key upon determining dissociation of the STA.

17. A method in a communication network, the method comprising, at a non accesspoint, AP, station, STA, affiliated with a non-AP multi-link device, MLD:receiving, from an AP affiliated with an AP M LD, a management frame comprising a body field encrypted with a first group key; andreceiving, from the AP, a frame including the first group key and a second group key, wherein the second group key is for decrypting data frames received from the AP.

18. The method of claim 17, wherein the management frame is a beacon frame.

19. The method of claim 18, wherein the beacon frame is a privacy beacon frame.

20. The method of claim 19, further comprising associating or reassociating the STA with the AP using elements of the body field of the beacon frame.

21. The method of any one of claims 17 to 20, wherein the first group key and the second group key are obtained in a Key Delivery element included in a (Re)Association Response frame during an association procedure mechanism.

22. The method of any one of claims 17 to 21, wherein the first group key and the second group key are updated during a group key handshake.

23. The method of any one of claims 17 to 20, further comprising creating a privacy security association in a robust security network association, RSNA, between the AP MLD and the non-AP MLD, the first group key and the second group key being stored in the non-AP MLD, in the privacy security association.

24. The method of claim 23, further comprising deleting the privacy security association storing the first group key and the second group key upon determining an association, reassociation, or dissociation procedure of the non-AP MLD.

25. The method of any one of claims 17 to 24, wherein the first group key and the second group key are received as wrapped keys with key identifiers in a frame subelement.

26. A computer program product for a programmable apparatus, the computer program product comprising a sequence of instructions for implementing each of the steps of the method according to any one of claims 1 to 25 when loaded into and executed by the programmable apparatus.

27. A non-transitory computer-readable storage medium storing instructions of a computer program for implementing each of the steps of the method according to any one of claims 1 to 25.

28. A communication device comprising a processing unit configured for carrying out each of the steps of the method according to any one of claims 1 to 25.

Images