Systems for and methods of communication in network using probe message

Abstract

To provide a connection control method that reduces communication overhead and reduces the opportunity for security breaches.SOLUTION: In a method using a secure probe exchange protocol, an access point (AP) 212 provides at least one frame across a connection including an unprotected (having no management frame protection) unicast probe response frame, to a client device (e.g., station (STA) 208) in response to an unprotected broadcast probe request message. The frame includes an unprotected unicast probe request message. An unprotected broadcast probe request message may refer to a broadcast message (e.g., a management frame) that requests a response and is not encrypted.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] Field of Disclosure The present disclosure relates generally to systems and methods for communication between access points (APs) and client devices (e.g., stations (STAs)) or other communication devices. In some embodiments, the present disclosure relates generally to systems and methods related to probe and / or probe response messages, including, but not limited to, secure probe exchange protocols.

[0002] Background of the disclosure In the past few decades, the market for wireless communication devices has grown by orders of magnitude, driven by the use of portable devices, increasing connectivity and data transfer between all aspects of the device. Digital switching technology has facilitated the large-scale deployment of affordable, easy-to-use wireless communication networks. Furthermore, improvements in digital and radio frequency (RF) circuit fabrication, as well as advances in circuit integration and other aspects, have made wireless devices smaller, cheaper and more reliable. Wireless communication can operate according to various standards, such as IEEE 802.11x, Bluetooth, Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), and others. As higher data throughput and other changes evolve, newer standards are constantly being developed for adoption, such as the progression from IEEE 802.11n to IEEE 802.11ac.

[0003] Establishing a connection for communication between an access point (AP) and a client device (e.g., a station (STA)), or for communication between other communication devices, may require probe and / or probe response messages. Protocols for establishing connections using probe messages (e.g., discovering, authenticating / deauthenticate, and associating / disassociating) may contribute to communication overhead and may provide an opportunity for security breaches.

[0004] Various objects, aspects, features, and advantages of the present disclosure will become more apparent and better understood by reference to the detailed description taken in conjunction with the accompanying drawings, in which like reference characters identify corresponding elements throughout and generally indicate identical, functionally similar, and / or structurally similar elements. [Brief description of the drawings]

[0005] [Figure 1A] FIG. 1 is a block diagram illustrating a network environment including one or more access points (APs) that communicate with one or more devices or stations (STAs), according to some embodiments.

[0006] [Figure 1B] FIG. 1 is a block diagram illustrating a computing device useful in connection with the methods and systems described herein, according to some embodiments. [Figure 1C] FIG. 1 is a block diagram illustrating a computing device useful in connection with the methods and systems described herein, according to some embodiments.

[0007] [Figure 2A] 1 is a block diagram illustrating a network including APs and STAs according to some embodiments.

[0008] [Figure 2B] 2B is a more detailed block diagram of an AP or STA of the network shown in FIG. 2A configured for probe request / probe response operations, according to some embodiments.

[0009] [Diagram 3] 2C is a flow diagram illustrating a probe request operation involving the AP or STA shown in FIG. 2B according to some embodiments.

[0010] [Figure 4]2C is a flow diagram illustrating a protected unicast probe request operation involving the AP or STA illustrated in FIG. 2B according to some embodiments.

[0011] [Diagram 5] 2C is a flow diagram illustrating an unprotected unicast probe request operation involving the AP or STA shown in FIG. 2B according to some embodiments.

[0012] [Figure 6] 1 is a flow diagram illustrating a protected unicast probe request operation when re-establishing a connection between an AP and a STA due to a reset / reboot without sending a disassociation request to the associated AP.

[0013] The details of various embodiments of the methods and systems are set forth in the accompanying drawings and the description below. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Detailed Description The following IEEE standard(s), including any drafts of the IEEE standard(s), namely, the Wi-Fi Alliance standard, and the IEEE 802.11 standards, including but not limited to, the IEEE 802.11a standard, the IEEE 802.11b standard, the IEEE 802.11g standard, the IEEE 802.11be standard, the IEEE P802.11n standard, the IEEE 802.11ax standard, and the IEEE 802.11ac standard, are incorporated herein by reference in their entirety and made a part of this disclosure for all purposes. Although this disclosure may refer to aspects of these standard(s), this disclosure is in no way limited by these standard(s).

[0015] To read the following description of the various embodiments, the following sections on the present specification and their respective contents may be useful: Section A describes network and computing environments that may be useful for implementing the embodiments described herein; and - Section B describes embodiments of a protocol for probe request / response operations and methods and apparatus that use such a protocol.

[0016] Some embodiments disclosed herein relate to a protocol for secure probe request / response exchange between a connected client and an AP. In some embodiments, the protocol is provided for WiFi networks (e.g., IEEE 802.11 networks, etc.), cellular networks, point-to-point communications, or a combination thereof. In some embodiments, the protocol can be used with WiFi APs to enhance connection security and reduce the time to establish a connection. In some embodiments, devices that support protected management frames and beacon protection capabilities utilize the protocol. In some embodiments, the system and method provide secure probe request / response between an AP and a STA that complements beacon protection features (e.g., beacon protection features of the 802.11 standard). In some embodiments, the system and method use the protocol to re-establish a connection between an AP and a STA in a secure manner, thereby reducing connection time. In some embodiments, the AP is a beacon protection enabled AP and the STA is a beacon protection supported STA.

[0017] In some embodiments, the systems and methods avoid using unprotected individually addressed probe request frames and processing unprotected probe response frames that can tamper with or weaken the protection mechanisms introduced by the beacon protection process. In some embodiments, the systems and methods provide better security for unicast probe and / or response frames.

[0018] Some embodiments relate to a method, including establishing a connection between a first device and a second device and providing an unprotected broadcast probe request message from the first device to the second device over the connection, and receiving, at the first device, an unprotected unicast probe response message from the second device, where the first device is a station device for which beacon protection is supported and the second device is an access point for which beacon protection is enabled.

[0019] In some embodiments, the method also includes providing a protected unicast probe request message from the first device to the second device over the connection and receiving a protected unicast probe response message from the second device at the first device. In some embodiments, the method also includes filtering out unprotected unicast probe response messages at the first device for the protected unicast probe request message sent from the first device. In some embodiments, the method also includes providing an unprotected broadcast probe request message from the first device to the second device over the connection and receiving an unprotected unicast probe response message from the second device at the first device.

[0020] In some embodiments, the method also includes receiving, at the second device, an unprotected unicast probe request message. The method also includes providing a security association query request from the second device to the first device to receive a security association query response, excluding sending the unicast probe response message.

[0021] In some embodiments, the method also includes resetting / rebooting the first device without any disassociation request from the first device, re-establishing a connection between the first device and the second device after the reset / reboot, and providing an unsecured unicast probe request message from the first device to the second device over the connection. The method also includes initiating a secure association query request from the second device, sending an unsecured unicast probe response message to the first device upon interruption, and receiving an unsecured unicast probe request message from the second device at the first device to continue re-establishing the connection. The first device is a station device for which beacon protection is supported, and the second device is an access point for which beacon protection is enabled.

[0022] A connection, in some embodiments, may refer to a communication provided between nodes (e.g., wireless communication between nodes) to exchange data according to a protocol. In some embodiments, a connection is established using a three-way or four-way handshake mechanism (through a discovery operation, an authentication operation, and an association operation) in some embodiments. In some embodiments, a secure connection may refer to a connection that provides data in a format that cannot be easily obtained by another party. Various methods can establish a secure connection, including, but not limited to, data encryption methods. In some embodiments, data encryption utilizes algorithms to encrypt and decrypt information (e.g., Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES)), including, but not limited to, WPA and WPA2 operation under the 802.11 standard. A connection can be a wireless connection to / from a client device (e.g., a STA) and an AP, or can be between other types of communication devices. In some embodiments, the wireless network can be an 802.11 WiFi network (e.g., IEEE 802.11be). A client device or AP may be embodied in a device that includes one or more integrated circuits (ICs) packaged in an IC package. In some embodiments, re-establishing or re-establishing a connection may mean re-forming a connection after the connection has been disabled, disassociated, deauthenticated, or otherwise down so that normal communication is interrupted or does not take place over the connection.

[0023] An authentication operation may refer to a procedure regarding how a client device accesses a network. Authentication provides a proof of identity to ensure that a client device or user is allowed access to the network. An association operation may refer to a procedure in which an authenticated client device or user associates with an AP. Association allows the network to determine where to send data intended for the client device (e.g., the data is sent through the AP to which the client device is associated). Generally, a client device is only associated with a single AP. In some embodiments, disassociation may refer to a procedure in which a client device is no longer associated with an AP. In some embodiments, disassociation prevents the AP from continuing to attempt to send data to the client device after a connection has been cancelled. In some embodiments, disassociation generally involves sending a disassociation frame or message from the AP to the client device or from the client device to the AP. In some embodiments, a disassociation request may refer to a message (e.g., a frame) that requests a disassociation operation. A client device may be disassociated from an AP while still maintaining authentication on the network. In some embodiments, deauthentication may refer to a procedure that does not allow any further services to be provided to the client device. In some embodiments, deauthentication generally involves sending a deauthentication frame or message from the AP to the client device or from the client device to the AP.

[0024] In some embodiments, the systems and methods reduce discovery operations (e.g., discovering APs using scanning for beacon signals or probe requests). In some embodiments, discovery operations may refer to the communication of frames to discover the availability and / or identity (ID) of APs or other wireless devices. Discovery operations may include the communication of probe request frames and probe response frames.

[0025] Some embodiments relate to a first device, the first device including circuitry configured to provide at least one frame over a connection to a second device in response to an unsecured broadcast probe request message, the frame including an unsecured unicast probe request message.

[0026] In some embodiments, an unprotected broadcast probe request message may refer to a broadcast message (e.g., a management frame) that requests a response and is not encrypted. In some embodiments, an unprotected broadcast probe request message may refer to a response that includes information about the capabilities of one or more service set identities in the network to be sent and provided without key information provided during a four-way handshake associated with the connection. In some embodiments, an unprotected unicast probe response message may refer to a unicast message (e.g., a management frame) that provides a response to a request and is not encrypted. In some embodiments, an unprotected unicast probe response message may include information about the capabilities of one or more service set identities in the network and may be provided without key information provided during a four-way handshake associated with the connection. In some embodiments, a probe response is similar to a beacon frame that includes capability information, authentication information, etc., and is sent only in response to a probe request message.

[0027] In some embodiments, an unprotected unicast probe request message may refer to a unicast message (e.g., a management frame) that requests a response and is not encrypted. In some embodiments, a protected unicast probe request message may refer to a unicast message (e.g., a management frame) that requests a response and is encrypted or otherwise secured. In some embodiments, a protected unicast probe response message may refer to a unicast message (e.g., a management frame) that provides a response to a request and is encrypted or otherwise secured. In some embodiments, a message may refer to data provided between a first device and a second device to convey parameters, commands, signals, or other data, and may include or be in the form of a frame.

[0028] In some embodiments, the frames are provided according to an 802.11 protocol, and the connection is established by using an association or authentication operation. In some embodiments, the first device is a beacon protection enabled access point. In some embodiments, a beacon protection enabled access point may refer to an access point that can operate according to a beacon protection protocol. In some embodiments, the beacon protection protocol may rely on an AP to provide a beacon integrity key to a STA during security association setup, and adds a Message Integrity Check (MIC) element to the beacon frame that encompasses everything except a timestamp field of the beacon frame contents. In some embodiments, a beacon protection supported station device may refer to a STA or client device that can operate according to the beacon protection protocol.

[0029] In some embodiments, the circuitry is configured to provide a protected unicast probe request message over the connection to the second device in response to the protected unicast probe response message.

[0030] In some embodiments, the second device is a station device for which beacon protection is supported. In some embodiments, the circuitry is configured to provide a security association query request message in response to an unprotected unicast probe request message from another origin.

[0031] In some embodiments, a security association query request may refer to a message (e.g., a management frame) that requests a response and that is encrypted or otherwise secured. In some embodiments, a security association query response may refer to a message (e.g., a management frame) that responds to a security association query request and that is encrypted or otherwise secured. The security association query request and security association query response may be provided according to the 802.11 standard.

[0032] In some embodiments, the circuitry is configured to provide an unprotected unicast probe response message in response to expiration of a suspension period after the security association query request message is transmitted. In some embodiments, the suspension period may refer to a period of time during which the device waits for a response. After the suspension period, the device may determine that the desired response is not received.

[0033] In some embodiments, the circuitry is configured to provide an unprotected unicast probe response message in response to expiration of an abstention period after the security association query request message is transmitted.

[0034] Some embodiments relate to a first device, the first device including circuitry configured to provide at least one frame over a connection to a second device in response to a protected unicast probe request message, the frame including a protected unicast probe response message.

[0035] In some embodiments, the frames are provided according to an 802.11 protocol and the connection is established using an association or authentication operation. The first device is an access point with beacon protection enabled.

[0036] In some embodiments, the circuitry is configured to provide an unsecured unicast probe response message over the connection to the second device in response to an unsecured broadcast probe request message. In some embodiments, the circuitry is configured to provide a security association query request message in response to an unsecured unicast probe request message, and the circuitry is configured to provide an unsecured unicast probe response message in response to expiration of an abstention period after the security association query request message is transmitted.

[0037] Some embodiments relate to a first device. The first device includes circuitry configured to provide at least one frame over a connection to a second device, the frame including a protected unicast probe request message. The circuitry is configured to filter out unprotected unicast messages provided after a protected unicast probe response message is received from the second device in response to the protected unicast probe request message. Filtering out or filtering out may refer to an action in which a message is not processed in its entirety. In some embodiments, the message may be discarded or ignored. In some embodiments, the first device is a station device for which beacon protection is supported.

[0038] Some embodiments relate to a method, including establishing a connection between a first device and a second device, providing an unprotected broadcast probe request message from the first device to the second device over the connection, and receiving an unprotected unicast probe request message at the first device from the second device, where the first device is a station device for which beacon protection is supported and the second device is an access point for which beacon protection is enabled.

[0039] In some embodiments, the method also includes providing a secured unicast probe request message from the first device to the second device over the connection and receiving at the first device a secured unicast probe response message from the second device. In some embodiments, the method also includes filtering out unsecured unicast probe response messages at the first device after a secured unicast probe response message is received from the second device. In some embodiments, the method also includes providing a security association query response message from the first device to the second device over the connection in response to a security association query request message from the second device. In some embodiments, the method also includes receiving a security association query request message from the second device over the connection after sending an unsecured unicast probe request message after a reboot or refresh of the first device. In some embodiments, rebooting or refreshing or resetting may refer to restarting, using a boot program, performing an off / on cycle, or resetting a device without sending a disassociation request frame from the first device. In some embodiments, the method also includes receiving an unprotected unicast probe response message from the second device over the connection after a period of suspension of Security Association Query Request messages.

[0040] In some embodiments, a frame may refer to a digital data transmission unit. For example, a frame may refer to a container for a single network packet. In some embodiments, a data frame may refer to a frame that contains data. In some embodiments, an encrypted frame may refer to a frame that is encrypted. In some embodiments, a broadcast message or frame may refer to a message or frame that is sent to two or more devices in a Basic Service Set (BSS) that is connected to or in communication with an AP. In some embodiments, a broadcast message or frame is sent to all devices in a BSS that is connected to an AP. A unicast message or frame may refer to a message or frame that has a single destination. In some embodiments, a management frame may refer to a frame for control or management operations, including, but not limited to, beacon frames, probe request / response frames, authentication request / response frames, association request / response frames, deauthentication frames, disassociation requests (e.g., frames), and the like.

[0041] A. Computing and Network Environment Before considering specific embodiments of the present solution, it may be beneficial to describe aspects of the operating environment and associated system components (e.g., hardware elements) in the context of the methods and systems described herein. Referring to FIG. 1A, an embodiment of a network environment is shown. In overview, the network environment includes a wireless communication system including one or more access points (APs) or network devices 106, one or more client devices (e.g., STAs) or wireless communication devices 102, and network hardware components or network hardware 192. The wireless communication devices 102 may include, for example, laptops, tablets, personal computers, and / or mobile phone devices. Details of an embodiment of each station or wireless communication device 102 and APs or network devices 106 are described in more detail in conjunction with FIG. 1B and FIG. 1C. In one embodiment, the network environment may be an ad-hoc network environment, an infrastructure wireless network environment, a subnetwork environment, or the like. The network devices 106 or APs may be operatively coupled to the network hardware 192 via a local area network connection. In some embodiments, the network devices 106 are 5G base stations. Network hardware 192, which may include routers, gateways, switches, bridges, modems, system controllers, appliances, etc., may provide local area network connectivity to the communication system. Each of the network devices 106 or APs may have an associated antenna or antenna array for communicating with wireless communication devices in the area. A wireless communication device 102 may register with a particular network device 106 or AP to receive services from the communication system (e.g., via a SU-MIMO or MU-MIMO configuration). In the case of a direct connection (e.g., point-to-point communication), several wireless communication devices may communicate directly via an assigned channel and communication protocol. Some of the wireless communication devices 102 may be mobile or relatively stationary with respect to the network devices 106 or APs.

[0042] In some embodiments, the network device 106 or AP includes devices or modules (including combinations of hardware and software) that enable the wireless communication device 102 to connect to a wired network using Wireless Fidelity (WiFi) or other standards. The network device 106 or AP may sometimes be referred to as a wireless access point (WAP). The network device 106 or AP may be implemented (e.g., configured, designed and / or built) to operate in a wireless local area network (WLAN). In some embodiments, the network device 106 or AP may be connected to a router (e.g., via a wired network) as a stand-alone device. In other embodiments, the network device 106 or AP may be a component of a router. The network device 106 or AP may provide multiple devices access to a network. The network device 106 or AP may, for example, connect to a wired Ethernet connection and provide wireless connectivity to other devices 102 using a radio frequency link to utilize the wired connection. The network device 106 or AP may be implemented to support a standard for transmitting and receiving data using one or more radio frequencies. The standards and frequencies they use may be defined by the IEEE (e.g., the IEEE 802.11 standard). The network devices 106 or APs may be configured and / or used to support public Internet hotspots and / or to extend the Wi-Fi signal range of the network on the network.

[0043] In some embodiments, the access points or network devices 106 may be used in a (e.g., in-home, in-car, or in-building) wireless network (e.g., IEEE 802.11, Bluetooth, ZigBee, any other type of radio frequency based network protocol and / or variations thereof). Each of the wireless communication devices 102 may include and / or be coupled to a built-in radio. Such wireless communication devices 102 and / or access points or network devices 106 may operate according to various aspects of the disclosure as presented herein to enhance performance, reduce cost and / or size, and / or enhance broadband applications. Each wireless communication device 102 may have the capability to function as a client node seeking access to resources (e.g., data, and connections to networked nodes such as servers) via one or more access points or network devices 106.

[0044] The network connection may include any type and / or form of network, including any of the following: point-to-point network, broadcast network, telecommunications network, data communication network, computer network. The topology of the network may be a bus, star, or ring network topology. The network may be of any such network topology as known to those skilled in the art that can support the operations described herein. In some embodiments, different types of data may be transmitted via different protocols. In other embodiments, the same type of data may be transmitted via different protocols.

[0045] The communication device(s) 102 and the access point(s) or network device 106 may be arranged as and / or implemented on any type and form of computing device, such as a computer, network device, or appliance capable of communicating in any type and form of network and performing the operations described herein. FIGS. 1B and 1C show block diagrams of computing devices 100 useful for implementing an embodiment of the wireless communication device 102 or the network device 106. As shown in FIGS. 1B and 1C, each computing device 100 includes a processor 121 (e.g., a central processing unit), and a main memory 122. As shown in FIG. 1B, the computing device 100 may include a memory device 128, an installation device 116, a network interface 118, an I / O controller 123, a display device 124a-124n, a keyboard 126, and a pointing device 127, such as a mouse. The memory device 128 may include an operating system and / or software. As shown in FIG. 1C, each computing device 100 may also include additional optional elements, such as a memory port 103, a bridge 170, one or more input / output devices 130a-130n, and a cache memory 140 in communication with a central processing unit or processor 121.

[0046] Central processing unit or processor 121 is any logic circuitry that responds to and processes instructions fetched from main memory 122. In many embodiments, central processing unit or processor 121 is provided by a microprocessor device, such as those manufactured by Intel Corporation of Santa Clara, Calif., International Business Machines of White Plains, New York, or Advanced Micro Devices of Sunnyvale, Calif. Computing device 100 can be based on any of these processors, or any other processor capable of operating as described herein.

[0047] The primary memory 122 can be one or more memory chips that can store data and allow any memory location to be directly accessed by the microprocessor or processor 121, such as any type or variant of static RAM (SRAM), dynamic RAM (DRAM), ferroelectric memory (FRAM), NAND flash memory, NOR flash memory, and solid-state drive (SSD). The primary memory 122 can be based on any of the memory chips mentioned above, or any other available memory chip that can operate as described herein. In the embodiment shown in FIG. 1B, the processor 121 communicates with the primary memory 122 via a system bus 150 (described in more detail below). FIG. 1C illustrates an embodiment of a computing device 100 in which the processor communicates directly with the primary memory 122 via a memory port 103. For example, in FIG. 1C, the primary memory 122 can be a DRDRAM.

[0048] FIG. 1C illustrates an embodiment in which the main processor 121 communicates directly with the cache memory 140 through a secondary side bus, sometimes referred to as a backside bus. In another embodiment, the main processor 121 communicates with the cache memory 140 using a system bus 150. The cache memory 140 generally has a faster response time than the main memory 122 and is provided by, for example, SRAM, BSRAM, or EDRAM. In the embodiment illustrated in FIG. 1C, the processor 121 communicates with the various I / O devices 130 through a local system bus (e.g., system bus 150). Various buses can be used to connect either the central processing unit or the processor 121 to the I / O devices 130, such as, for example, a VESA VL bus, an ISA bus, an EISA bus, a Micro Channel Architecture (MCA) bus, a PCI bus, a PCI-X bus, a PCI-Express bus, or a NuBus. For embodiments in which the I / O device is a video display 124, the processor 121 may use an Advanced Graphics Port (AGP) to communicate with the display 124. Figure 1C illustrates an embodiment of a computer or computer system 100 in which the main processor 121 may communicate directly with I / O device 130b, for example, via HyperTransport, RapidIO, or InfiniBand communications technologies. Figure 1C also illustrates an embodiment in which local bus and direct communications are mixed, i.e., the processor 121 communicates directly with I / O device 130b while simultaneously using a local interconnect bus to communicate with I / O device 130a.

[0049] A wide variety of I / O devices 130a-130n may be present in computing device 100. Input devices include keyboards, mice, trackpads, trackballs, microphones, dials, touchpads, touch screens, and drawing tablets. Output devices include video displays, speakers, inkjet printers, laser printers, projectors, and dye-sublimation printers. The I / O devices may be controlled by an I / O controller 123, as shown in FIG. 1B. The I / O controller may control one or more I / O devices, such as a keyboard 126 and a pointing device 127 (e.g., a mouse or optical pen). Additionally, the I / O devices may provide storage and / or installation media to computing device 100. In yet another embodiment, computing device 100 may provide a USB connection (not shown) for accepting a portable USB storage device, such as the USB flash drive line of devices manufactured by Twintech Industry, Inc. of Los Alamitos, Calif.

[0050] Referring again to FIG. 1B, computing device 100 may support any suitable installation device 116, such as a disk drive, CD-ROM drive, CD-R / RW drive, DVD-ROM drive, flash memory drive, tape drives of various formats, USB device, hard drive, network interface, or any other device suitable for installing software and programs. Computing device 100 may further include storage devices, such as one or more hard disk drives or a redundant array of independent disks, for storing an operating system and other related software, and for storing application software programs, such as any program or software 120 for implementing (e.g., configured and / or designed for) the systems and methods described herein. If desired, any of installation devices 116 may also be used as storage devices. Additionally, operating systems and software may be executed from a bootable medium.

[0051] Additionally, computing device 100 may include network interface 118 for coupling to a network through various connections including, but not limited to, standard telephone lines, LAN or WAN links (e.g., 802.11, T1, T3, 56kb, X.25, SNA, DECnet), broadband connections (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet over Sonnet), wireless connections, or some combination of any or all of the above. Connections may be established using a variety of communication protocols (e.g., TCP / IP, IPX, SPX, NetBIOS, Ethernet, ArcNet, SONET, SDH, Fiber Distributed Data Interface (FDDI), RS232, IEEE 802.11, IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, IEEE 802.11ad, CDMA, GSM, WiMax, and direct asynchronous connections). In one embodiment, computing device 100 communicates with other computing devices 100' via any type and / or form of gateway or tunneling protocol, such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS). Network interface 118 may include a built-in network adapter, a network interface card, a PCMCIA network card, a card bus network adapter, a wireless network adapter, a USB network adapter, a modem, or any other device suitable for coupling computing device 100 to any type of network capable of communicating with and performing the operations described herein.

[0052] In some embodiments, computing device 100 may include or be connected to one or more display devices 124a-124n. As such, any of I / O devices 130a-130n and / or I / O controller 123 may include any type and / or form of suitable hardware, software, or combination of hardware and software to support, enable, or effect the connection and use of display device(s) 124a-124n by computing device 100. For example, computing device 100 may include any type and / or form of video adapter, video card, drivers, and / or libraries to interface with, communicate with, connect to, or otherwise use display device(s) 124a-124n. In one embodiment, the video adapter may include multiple connectors for interfacing to display device(s) 124a-124n. In other embodiments, computing device 100 may include multiple video adapters, with each video adapter connected to a display device(s) 124a-124n. In some embodiments, some portion of the operating system of computing device 100 may be configured to use multiple display devices 124a-124n. In further embodiments, I / O device 130 may be a bridge between system bus 150 and an external communications bus, such as a USB bus, an Apple Desktop bus, an RS-232 serial connection, a SCSI bus, a Firewire bus, a Firewire 800 bus, an Ethernet bus, an AppleTalk bus, a Gigabit Ethernet bus, an Asynchronous Transfer Mode bus, a Fibre Channel bus, a Fiber Optic bus, a Serial Attached SCSI (SAS) bus, a USB connection, or an HDMI bus.

[0053] 1B and 1C may operate under the control of an operating system that controls the scheduling of tasks and access to system resources. Computing device 100 may be running any operating system, such as any version of the Microsoft Windows operating system, various publicly available Unix and Linux operating systems, any version of MAC OS for Macintosh computers, any embedded operating system, any real-time operating system, any open source operating system, any proprietary operating system, any operating system for mobile computing devices, or any other operating system capable of running on a computing device and performing the operations described herein. Representative operating systems include, but are not limited to, Android® produced by Google Inc.; Windows® 7, 8, and 10 produced by Microsoft Corporation of Redmond, Washington; MAC OS produced by Apple Computer of Cupertino, California; WebOS produced by Research In Motion (RIM); OS / 2 produced by International Business Machines of Armonk, New York; and Linux, a freely available operating system distributed by Caldera Corp. of Salt Lake City, Utah, or any type and / or form of Unix operating system, among others.

[0054] Computer system or computing device 100 can be any workstation, telephone, desktop computer, laptop or notebook computer, server, portable computer, mobile phone or other portable communication device, media playback device, gaming console, mobile computing device, or any other type and / or form of computing device, communication device, or media device capable of communicating. In some embodiments, computing device 100 can have a variety of processors, operating systems, and input devices compatible with the device. For example, in one embodiment, computing device 100 is a smartphone, mobile device, tablet, or personal digital assistant. Furthermore, computing device 100 can be any workstation, desktop computer, laptop or notebook computer, server, portable computer, mobile phone, any other computer, or other form of computing device or communication device capable of communicating and having sufficient processor power and memory capacity to perform the operations described herein.

[0055] Aspects of the operating environment and components described above will become apparent in the context of the systems and methods disclosed herein.

[0056] B. PROTOCOL FOR PROBE / RESPONSE OPERATIONS AND METHODS AND APPARATUS USING SUCH PROTOCOLS Disclosed herein are systems and methods that may be used in any communication system, including, but not limited to, Wi-Fi and LTE networks. The systems and methods may be used with APs or STAs in a communication network, such as the devices described in connection with Figures 1A-1C. Although embodiments of probe / response operations for communications according to the IEEE 802.11 standard are described herein, the systems and methods may be used with other networks, including cellular and satellite networks, and in point-to-point communications.

[0057] 2A, a wireless communication network or system 200 includes client devices or STAs 204, 206, 208, and 224, and APs 212, 214, 216, and 222. The STAs 204, 206, 208, and 224, and APs 212, 214, 216, and 222 may be used in the systems described in connection with FIGS. 1A-1C. Any number of the STAs 204, 206, 208, and 224, and APs 212, 214, 216, and 222 may be used in the network or system 200. In some embodiments, the STA or client device may refer to any device for communicating in a communication system, including, but not limited to, a fixed, portable, or mobile laptop computer, desktop computer, personal digital assistant, workstation, wearable device, smartphone, or WiFi phone. In some embodiments, an access point or AP may refer to a device for communicatively coupling one or more "non-AP" devices (e.g., client devices or STAs) to a network. In some embodiments, an AP may enable non-AP devices to connect and communicate with a network. In some embodiments, an AP is a wireless access point (WAP) configured to enable wireless communication between non-AP devices. APs include, but are not limited to, mobile, portable or fixed hotspots, routers, bridges, gNB nodes, eNodeBs, evolved node Bs, or other communication devices. An AP may provide services to STAs, such as serving as an attachment point to another network.

[0058] Each of the STAs 204, 206, 208, and 224, and the APs 212, 214, 216, and 222 may include a wireless transceiver and various modules for communicating over the connection. The modules may be software (e.g., firmware), hardware components, and combinations thereof. In some embodiments, each of the STAs 204, 206, 208, and 224, and the APs 212, 214, 216, and 222 may include IEEE 802.11 compliant medium access control (MAC) layer circuitry and physical layer (PHY) interface to the wireless medium and may be part of a larger device or system. In some embodiments, each of the STAs 204, 206, 208, and 224, and the APs 212, 214, 216, and 222 may operate according to a standard other than the IEEE 802.11 standard.

[0059] A connection for wireless communication may be established between at least one of the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222 after authentication and association operations. For example, the STA 208 has a connection 218 to the AP 212. The STAs 204, 206, 208, and 224 each include circuitry (e.g., a processor or processing circuit 221), and the APs 212, 214, 216, and 226 each include circuitry (e.g., a processing circuit 233) for establishing and canceling the connection 218 and communicating data across the connection. In another example, the STA 204 has a connection 228 to the AP 212, and the STA 206 has a connection 229 to the AP 222. Each of the STAs 204, 206, 208, and 224 includes circuitry (e.g., a processor or processing circuit 221), and each of the APs 212, 214, 216, and 222 includes circuitry (e.g., processing circuit 233) for operating in accordance with probe and probe response operations as described below. In some embodiments, the connections 218, 228, 229, and 226 are wireless connections that are formed using association and / or authentication operations and canceled using disassociation and / or deauthentication operations. In some embodiments, the connections 218, 228, 229, and 226 can be single-link, multi-link, or dual-link connections associated with the APs 212 and 222, and can be secure connections (e.g., using encryption). In some embodiments, connections 218, 228, 229, and 226 provide data communication and control and manage communications on one or more channels in the 5G, 6G, 60G, or 2G bands.

[0060] 2B, device 220 is an AP 212 or a STA 208 (FIG. 2A) configured for a secure probe request / response protocol according to some embodiments. In some embodiments, device 220 includes a processing circuit 233 and a probe request / response module 238. In some embodiments, the term probe response module may refer to a module that processes probe request messages. In some embodiments, processing circuit 233 is any circuit element or component capable of executing logic and communication processing operations and may include a processor 234 and a memory 236.

[0061] In some embodiments, the processing circuitry 230 is implemented as a field programmable gate array, an application specific integrated circuit, hardware, a software-implemented processor, or a state machine. In some embodiments, the processing circuitry 230 is part of an equipment layer (e.g., MAC layer, network layer, PHY layer) of the IEEE 802.11 standard. In some embodiments, the processing circuitry 230 may be configured to perform communication operations, frame construction and processing, probe request and response operations, discovery operations, association operations, authentication operations, connection setup, disassociation operations, handoff operations, and deauthentication operations. In some embodiments, instructions for the processing circuitry 230 are stored in a persistent medium such as memory 236. In some embodiments, the processing circuitry 221 of the STA 208 and the processing circuitry 233 of the AP 212 are similar to the processing circuitry 230.

[0062] The memory 236 may be one or more devices (e.g., RAM, ROM, flash memory, hard disk storage) for storing data and / or computer code for implementing and / or facilitating various processes described herein. The memory 236 may be or include non-transient non-volatile memory, non-volatile memory, and persistent computer storage media. The memory 236 may include database components, object code components, script components, or any other type of information structure for supporting various activities and information structures described herein. The memory 236 is communicatively coupled to the processor 234 and may include computer code or instructions for performing one or more processes described herein. The processor 234 may be realized as one or more application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), groups of processing components, software executing processors, state machines, or other suitable electronic processing components. As such, the AP, STA, or network device 106 (FIG. 1A) is configured to execute various modules and / or programs and store associated data in a database in memory 236. A module (e.g., module 238) may be implemented in AP software (e.g., MAC layer software or PHY layer software) or STA software (e.g., MAC layer software or PHY layer software). In some embodiments, the AP 212 or STA 208 (FIG. 2A) is configured and used to establish connections and handoff access to other computing systems and devices (e.g., wireless communication device(s) 102, network hardware 192, other access points or network devices 106) (FIGS. 1A-1C) over a network (e.g., a WAN connection, a LAN connection, a WLAN connection, etc.).

[0063] In some embodiments, the probe / response module 238 is configured to provide or process a probe message or a probe response message. For example, the probe / response module 238 is configured to cause the device 220 to provide a probe message and / or a probe response message for a secure exchange. In some embodiments, the probe / response module 238 is configured to cause the device 220 to provide a probe message and / or a probe response message for a secure exchange between the AP 212 and the STA 208 (FIG. 2A) that complements beacon protection and / or to re-establish a connection between the AP 212 and the STA 208 (FIG. 2A) with less connection time. In some embodiments, the probe / response module 238 is configured to implement a secure probe exchange (SPX) implemented through management frame protection (MFP) for individually addressed / unicast probe request messages (e.g., frames) and unicast probe response messages (e.g., frames). When the probe request / response frames are secured, the information present in the probe response frame can generally be considered trustworthy, and non-AP STAs can update the AP's capabilities based on the secure probe response without security loopholes.

[0064] Discovery of an AP (e.g., AP 212) or the continued presence of an AP is detected through beacon messages or probe request / probe response exchanges. Beacon messages are provided using beacon protection. The probe / response module 238 is configured to cause the device 220 to provide secure probe request / response frames in a beacon protection enabled network by processing broadcast probe requests, processing protected unicast probe requests, processing unprotected unicast probe requests, establishing a connection between an AP and a STA with reduced connection time, and processing unprotected unicast probe requests during a desired association.

[0065] Referring to FIG. 3, the probe / response module 238 (FIG. 2B) processes (handles) broadcast probe request / response operations between the AP 212 and the STA 208. In some embodiments, the STA 208 and the AP 212 support beacon protection. The STA 208 and the AP 212 execute a flow 300 to process a broadcast probe request frame using a secure probe request / response protocol. The STA 208 provides a broadcast probe request frame when an active scan is issued in operation 302. An AP 212 with beacon protection enabled responds to the broadcast probe request frame by providing an unprotected (no Management Frame Protection (MFP)) unicast probe response frame in operation 304. In some embodiments, the unprotected probe response frame for the broadcast probe request frame is sent regardless of whether the STA 208 is associated or unassociated with the AP 212. In operation 306, the association is completed. In operation 307, the AP 212 provides a beacon frame in operation 307. The beacon frame includes a management message integrity code (MIC) or information element (IE) for the management MIC element (MME). The four-way handshake is completed in operation 308, and the connection between the STA 208 and the AP 212 is completed. The beacon frame can be provided using the MME after the connection is established in operations 310a-310n. In operation 314, an unprotected broadcast probe request frame can be provided to the AP 212, and in response to the unprotected broadcast probe request frame, an unprotected unicast probe response frame can be provided to the STA 208 in operation 316.The unprotected unicast probe response frame in operation 316 is provided regardless of whether the STA 208 is associated or unassociated with the AP 212 .

[0066] 4, the probe / response module 238 (FIG. 2B) processes (handles) unicast probe request / response operations between the AP 212 and the STA 208. In some embodiments, the STA 208 and the AP 212 support beacon protection. In some embodiments, the unicast probe request / response operations between the AP 212 and the STA 208 are processed using a secured individually addressed / unicast probe request to ensure the integrity of the association between the beacon protection enabled AP and the beacon protection supported STA. In some embodiments, the STA 208 and the AP 212 execute flow 400 to process the unicast probe request frame using a secure probe request / response protocol.

[0067] The STA 208 uses operations 304, 306, 307, and 308 described in connection with flow 300 (FIG. 3) to provide a broadcast probe request frame and establish a connection when an active scan is issued in operation 302. Beacon frames can be provided with the MME after the connection is established in operations 310a-310n.

[0068] The protected unicast probe request frame can be provided to the AP 212 in operation 414, and the protected unicast probe response frame can be provided to the STA 208 in operation 416. The unprotected unicast probe response frame received by the STA 208 is filtered out if there is any unprotected probe response to the corresponding protected probe request in operation 422. In some embodiments, the STA 208 that supports the beacon protection feature transmits an individually addressed protected probe request frame to its associated beacon protection enabled AP (e.g., the AP 212) in operation 414. In some embodiments, the AP 212 transmits a protected probe response to the corresponding protected unicast probe request frame to the STA 208 in operation 416.

[0069] 5, the probe / response module 238 (FIG. 2B) processes (handles) unsecured unicast probe request / response operations between the AP 212 and the STA 208. In some embodiments, the STA 208 and the AP 212 support beacon protection. In some embodiments, the unicast probe request / response operations between the AP 212 and the STA 208 are processed using unsecured individually addressed / unicast probe requests to ensure the integrity of the association between the beacon protection enabled AP and the beacon protection supported STA. In some embodiments, the STA 208 and the AP 212 execute flow 500 to process unsecured unicast probe request frames using a secure probe request / response protocol.

[0070] The STA 208 uses operations 304, 306, 307, and 308 described in connection with flow 300 (FIG. 3) to provide a broadcast probe request frame and establish a connection when an active scan is issued in operation 302. Beacon frames can be provided with the MME after the connection is established in operations 310a-310n.

[0071] In some embodiments, an unprotected unicast probe request frame is provided from a source (e.g., an attacker) to the AP 212 in operation 514. The STA 208 provides a Security Association (SA) Query Request frame in operation 516 in response to the unprotected unicast probe request frame sent in operation 514 to ensure that the STA 208 is securely associated. The AP 212 provides a SA Query Response frame in operation 518 in response to the SA Query Request frame sent in operation 516 to ensure that the STA 208 is securely associated. Upon receipt of the SA Query Response from the STA 208, the AP 212 filters out the unprotected probe request from operation 514 because the STA 208 has the appropriate key information to send a protected unicast probe request. The unprotected probe request frame from operation 514 is filtered out. The reason is that the AP 212 determined that the unprotected probe request frame from operation 514 was not from a legitimate associated STA for which beacon protection is supported.

[0072] 6, the probe / response module 238 (FIG. 2B) handles re-establishing a connection between the AP 212 and the STA 208. In some embodiments, the connection is established using a directed association. In some embodiments, the STA 208 and the AP 212 execute flow 600 to process an unsecured individually addressed / unicast probe request to process an association with the STA 208 after the most recent reboot / refresh.

[0073] In operation 306, the association is completed. In operation 307, the AP 212 provides a beacon frame in operation 307. The beacon frame includes a management message integrity code (MIC) or information element (IE) for the management MIC element (MME). The four-way handshake is completed in operation 308, and the connection between the STA 208 and the AP 212 is completed. The beacon frame can be provided using the MME after the connection is established in operations 310a-310n.

[0074] In operation 612, a reboot or refresh occurs. In some embodiments, due to a reboot or refresh of the WiFi interface of the STA 208 where beacon protection is supported, the exchanged key information may become invalid after the reboot / refresh. In some embodiments, the AP 212 still retains information with the old key value of the STA 208. In particular, a new association request sent from the STA 208 to associate with a previously associated AP (e.g., the AP 212) may be rejected by the AP since the STA information is already present. The association may be delayed until the lifetime expires on the AP side to clean up the old associated STA information. In some embodiments, this delay is advantageously reduced by the following flow 600, which overcomes the delay in re-establishing a new connection when the AP 212 is unaware of the reboot or refresh of the STA 208 and still retains the old security key exchange value associated with the STA 208.

[0075] In some embodiments, an unsecured broadcast probe request frame is provided from the STA 208 to the AP 212 in operation 614. To ensure that the STA 208 is securely associated, the AP 212 provides an SA Query request frame in operation 615 in response to the unsecured unicast probe request frame sent in operation 614. In some embodiments, an unsecured unicast probe request sent from an associated STA 208 triggers an SA Query request frame from the AP 212.

[0076] After the SA Query Request frame is sent in operation 616, a SA Query Response timeout occurs in operation 616. The SA Query timeout occurs because the STA 208 does not have the proper key information to respond to the SA Query Response frame. After the timeout expires at the AP end, the AP 212 sends an unprotected Probe Response frame to the STA 208 to erase the previous association information associated with the STA 208 and establish a new association in operation 618. Upon receiving the Probe Response frame from the AP 212, the STA 208 continues the (re)association process. With flow 600, the association of the AP and the STA occurs more quickly without the need to reject the association request from the STA 208.

[0077] The association or reassociation is completed in operation 622. The four-way handshake is completed in operation 626 to complete the connection or reconnection between the STA 208 and the AP 212. After the connection is established in operation 628, beacon frames may be provided with the MME.

[0078] It should be noted that certain passages of this disclosure may refer to terms such as "first" and "second" in connection with a subset of frames, responses, and devices to identify or distinguish one from the other(s). These terms are not intended to merely relate the entities (e.g., first device and second device) temporally or according to a sequence, although in some cases the entities may include such a relationship. Nor do these terms limit the number of possible entities (e.g., STAs, APs, beamformers, and / or beamformees) that may operate within a system or environment. It should be understood that the systems described above may provide multiples of any or each of these components, which may be provided on standalone machines or, in some embodiments, on multiple machines in a distributed system. Additionally, bit field positions may be changed and multi-bit words may be used. Additionally, the systems and methods described above may be provided as one or more computer readable programs or executable instructions embodied on one or more articles of manufacture (e.g., floppy disks, hard disks, CD-ROMs, flash memory cards, PROMs, RAMs, ROMs, or magnetic tapes). The programs may be implemented in any programming language, such as LISP, PERL, C, C++, C#, or in any bytecode language, such as JAVA. The software programs or executable instructions may be stored in one or more articles of manufacture as object code. A circuit element may refer to any electronic circuit(s) or circuits.

[0079] A circuit element or circuit may refer to any electronic circuit or combination of circuits. To the extent that a claim describes or recites an apparatus, circuit, processor, or circuit element as performing or configured to perform one or more operations or functions, the implementation of the recited function(s) or operation(s) may be distributed across two or more devices, circuits, or processors without departing from the scope of the claim, unless the function or operation is expressly recited as being performed in a particular single circuit or set of circuits, processor, or device (e.g., using the phrase "in a single circuit," "in a set of circuits including," or "in a single device").

[0080] The above description of the method and system will enable one skilled in the art to make and use the embodiments, but one skilled in the art will understand and recognize the existence of variations, combinations, and equivalents of the specific embodiments, methods, and examples herein. For example, the specific values ​​of bandwidth, channels, and sub-bands provided above are exemplary. Thus, the method and system should not be limited by the embodiments, methods, and examples described above, but by all embodiments and methods within the scope and spirit of the present disclosure.

Claims

1. 1. A first device, comprising: A first device including circuitry configured to provide at least one frame across a connection to a second device in response to an unprotected broadcast probe request message, the frame including an unprotected unicast probe request message.

2. 2. The first device of claim 1, wherein the frames are provided according to an 802.11 protocol, and the connection is established by using an association or authentication operation.

3. The first device of claim 1 , wherein the first device is a beacon protection enabled access point.

4. 2. The first device of claim 1, wherein the circuitry is configured to provide a secured unicast probe request message over the connection to the second device in response to a secured unicast probe response message.

5. The first device of claim 1 , wherein the second device is a station device for which beacon protection is supported.

6. 2. The first apparatus of claim 1, wherein the circuitry is configured to provide a security association query request message in response to an unprotected unicast probe request message from another source.

7. 7. The first apparatus of claim 6, wherein the circuitry is configured to provide an unprotected unicast probe response message in response to expiration of a suspension period after the security association query request message is transmitted.

8. 2. The first apparatus of claim 1, wherein the circuitry is configured to provide an unprotected unicast probe response message in response to expiration of a suspension period after a security association query request message is transmitted.

9. 1. A first device, comprising: A first device including circuitry configured to provide at least one frame over a connection to a second device in response to a protected unicast probe request message, the frame including a protected unicast probe response message. , a first device.

10. 10. The first device of claim 9, wherein the frames are provided according to an 802.11 protocol, the connection is established by using an association or authentication operation, and the first device is an access point with beacon protection enabled.

11. 11. The first device of claim 10, wherein the circuitry is configured to provide an unsecured unicast probe response message over the connection to the second device in response to an unsecured broadcast probe request message.

12. 11. The first apparatus of claim 10, wherein the circuitry is configured to provide a security association query request message in response to an unsecured unicast probe request message, and wherein the circuitry is configured to provide an unsecured unicast probe response message in response to expiration of a suspension period after the security association query request message is transmitted.

13. 1. A first device, comprising:

1. A first device comprising: circuitry configured to provide at least one frame over a connection to a second device, the frame including a protected unicast probe request message, the circuitry configured to filter out unprotected unicast messages provided after a protected unicast probe response message is received from the second device in response to the protected unicast probe request message.

14. The first device of claim 13 , wherein the first device is a station device for which beacon protection is supported.

15. 1. A method comprising: Establishing a connection between a first device and a second device; providing an unsecured broadcast probe request message from the first device to the second device over the connection; receiving, at the first device, an unprotected unicast probe response message from the second device; The method, wherein the first device is a beacon protection supported station device and the second device is a beacon protection enabled access point.

16. providing a secured unicast probe request message from the first device to the second device over the connection; 16. The method of claim 15, further comprising receiving, at the first device, a protected unicast probe response message from the second device.

17. 17. The method of claim 16, further comprising filtering out unprotected unicast probe response messages at the first device for the protected unicast probe request messages sent from the first device.

18. providing an unsecured broadcast probe request message from the first device to the second device over the connection; 16. The method of claim 15, further comprising receiving, at the first device, an unprotected unicast probe response message from the second device.

19. receiving an unsecured unicast probe request message at the second device; 16. The method of claim 15, further comprising providing a security association query request from the second device to the first device to receive a security association query response, excluding sending the unicast probe response message.

20. resetting / rebooting / refreshing the first device without any disassociation request from the first device; re-establishing a connection between the first device and the second device after a reset / reboot / refresh; providing an unsecured unicast probe request message from the first device to the second device over the connection; initiating a secure association query request from the second device and sending an unsecured unicast probe response message to the first device upon interruption; receiving, at the first device, an unprotected unicast probe request message from the second device to continue re-establishing the connection; 16. The method of claim 15, wherein the first device is a beacon protection supported station device and the second device is a beacon protection enabled access point.

Images