Systems and methods for reassociation in network

Abstract

To provide systems and methods for secure reassociation exchanges between a previously connected client and AP.SOLUTION: There is provided a method for an STA 208 and an AP 212 handling a broadcast probe request frame using a secure probe request / response protocol. The STA provides the broadcast probe request frame when an active scan is issued. An AP with beacon protection enabled: provides an unprotected unicast probe response frame; transmits an unprotected probe response frame irrespective of whether or not the STA is associated with the AP; completes isolation in an operation 306; and provides a beacon frame in operations 308 to 310n. The STA generates an event 312 and transmits to the AP in operations 313 and 314. The AP provides a protected reassociation response message or frame 316 in an operation 315, if necessary.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] Field of Disclosure The present disclosure relates generally to systems and methods for communication between an access point (AP) and a client device (e.g., a station (STA)), or other communication devices. In some embodiments, the present disclosure relates generally to systems and methods related to re-association operations and / or messages therefor, including, but not limited to, messages used in a secure or protected re-association protocol.

[0002] Background of the disclosure In the past few decades, the market for wireless communication devices has grown by orders of magnitude, driven by the use of portable devices, increasing connectivity and data transfer between all aspects of the device. Digital switching technology has facilitated the large-scale deployment of affordable, easy-to-use wireless communication networks. Furthermore, improvements in digital and radio frequency (RF) circuit fabrication, as well as advances in circuit integration and other aspects, have made wireless devices smaller, cheaper and more reliable. Wireless communication can operate according to various standards, such as IEEE 802.11x, Bluetooth, Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), and others. As higher data throughput and other changes evolve, newer standards are constantly being developed for adoption, such as the progression from IEEE 802.11n to IEEE 802.11ac.

[0003] Establishing a connection for communication between an access point (AP) and a client device (e.g., a station (STA)), or for communication between other communication devices, can require the exchange of numerous messages. A connection may be re-established after it has been terminated. Protocols for re-establishing a connection can contribute to communication overhead and can provide an opportunity for a security breach.

[0004] Various objects, aspects, features, and advantages of the present disclosure will become more apparent and better understood by reference to the detailed description taken in conjunction with the accompanying drawings, in which like reference characters identify corresponding elements throughout and generally indicate identical, functionally similar, and / or structurally similar elements. [Brief description of the drawings]

[0005] [Figure 1A] FIG. 1 is a block diagram illustrating a network environment including one or more access points (APs) that communicate with one or more devices or stations (STAs), according to some embodiments.

[0006] [Figure 1B] FIG. 1 is a block diagram illustrating a computing device useful in connection with the methods and systems described herein, according to some embodiments. [Figure 1C] FIG. 1 is a block diagram illustrating a computing device useful in connection with the methods and systems described herein, according to some embodiments.

[0007] [Figure 2A] 1 is a block diagram illustrating a network including APs and STAs according to some embodiments.

[0008] [Figure 2B] 2B is a more detailed block diagram of an AP or STA of the network shown in FIG. 2A configured for a reassociation operation according to some embodiments.

[0009] [Diagram 3] 2C is a flow diagram illustrating a reassociation operation involving the AP or STA shown in FIG. 2B according to some embodiments.

[0010] [Figure 4]FIG. 2C is a general block diagram illustrating a reassociation response message of the AP or STA shown in FIG. 2B according to some embodiments.

[0011] The details of various embodiments of the methods and systems are set forth in the accompanying drawings and the description below. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Detailed Description The following IEEE standard(s), including any drafts of the IEEE standard(s), namely, the Wi-Fi Alliance standard, and the IEEE 802.11 standards, including but not limited to, the IEEE 802.11a standard, the IEEE 802.11b standard, the IEEE 802.11g standard, the IEEE 802.11be standard, the IEEE P802.11n standard, the IEEE 802.11ax standard, and the IEEE 802.11ac standard, are incorporated herein by reference in their entirety and made a part of this disclosure for all purposes. Although this disclosure may refer to aspects of these standard(s), this disclosure is in no way limited by these standard(s).

[0013] To read the following description of the various embodiments, the following sections on the present specification and their respective contents may be useful: Section A describes network and computing environments that may be useful for implementing the embodiments described herein; and - Section B describes embodiments of a protocol for data request / response operations and a method and apparatus for using such a protocol.

[0014] Some embodiments disclosed herein relate to a protocol for secure reassociation exchange between a previously connected client and an AP. In some embodiments, the protocol is provided for a WiFi network (e.g., an IEEE 802.11 network), a cellular network, point-to-point communications, or a combination thereof. In some embodiments, the protocol may be used with a WiFi AP to enhance connection security and reduce the time to re-establish a connection. In some embodiments, devices that support protected management frames and beacon protection capabilities utilize the protocol. In some embodiments, the system and method provide protected management frames for reassociation (e.g., protected or secure reassociation request and / or response frames). In some embodiments, a WiFi network may refer to a wireless network with Internet access. In some embodiments, a cellular network may refer to a wireless network distributed across a land via cells, where each cell includes a transceiver (e.g., a node or base station).

[0015] In some embodiments, the system and method re-establishes a connection between an AP and a STA in a secure manner using a protocol, thereby reducing connection time. In some embodiments, the protected reassociation request / response frames may be used in a client's attempt to reassociate for a purpose (e.g., to update its configuration after roaming, after going out of range, after a WiFi off / on cycle, after reboot, restart, or other event). In some embodiments, the system and method reduces the time required to onboard a homecoming client to an existing connected AP. Although the time to onboard may be related to a temporary rejection, a secure association (SA) query validation is implemented to distinguish a genuine reassociation attempt from some kind of denial of service (DoS) attack from an intruder device emulating the client's media access control (MAC) address. The time to onboard can also relate to the time for the AP to terminate the existing client connection (which results in a teardown of the upper network layer connection) before accepting the new reassociation request as the latest connection, and can also include the four-way handshake procedure to complete the secure connection.

[0016] Changing or updating a non-AP STA configuration may require reassociation, including but not limited to changing or modifying operational capabilities such as Modulation and Coding Scheme (MCS), a Number of Spatial Streams (NSS), Bandwidth (BW), adding or removing a link(s) (e.g., for 802.11be multilink operation), Out of Band (OB), etc. This includes changing or modifying keys (such as Pairwise Transient Keys (PTKs)) derived for a STA or AP connection via an OOB (Out of Band) mechanism. In some embodiments, the system and method allows for transient changes in configuration without requiring a fresh connection and teardown.

[0017] In some embodiments, the system and method is used in an IEEE 802.11 infrastructure network but uses a protected reassociation request and response frame exchange under the Protected Management Frame (PMF) category (e.g., Secured Reassociation or Reconfiguration Exchange (SRX)). In some embodiments, the system and method uses association / reassociation request and association / reassociation response frames when the AP and client have valid keys for the connection (no teardown and no recent connection).

[0018] A connection, in some embodiments, may refer to a communication provided between nodes (e.g., wireless communication between nodes) to exchange data according to a protocol. In some embodiments, a connection is established using a three-way or four-way handshake mechanism (through a discovery operation, an authentication operation, and an association operation) in some embodiments. In some embodiments, a secure connection may refer to a connection that provides data in a format that cannot be easily obtained by another party. Various methods can establish a secure connection, including, but not limited to, data encryption methods. In some embodiments, data encryption utilizes algorithms to encrypt and decrypt information (e.g., Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES)), including, but not limited to, WPA and WPA2 operation under the 802.11 standard. A connection can be a wireless connection to / from a client device (e.g., a STA) and an AP, or can be between other types of communication devices. In some embodiments, the wireless network can be an 802.11 WiFi network (e.g., IEEE 802.11be). A client device or AP may be embodied in a device that includes one or more integrated circuits (ICs) packaged within an IC package.

[0019] An authentication operation may refer to a procedure regarding how a client device accesses a network. Authentication provides a proof of identity to ensure that a client device or user is allowed access to the network. An association operation may refer to a procedure in which an authenticated client device or user associates with an AP. Association allows the network to determine where to send data intended for the client device (e.g., data is sent through the AP to which the client device is associated). Generally, a client device is only associated with a single AP. In some embodiments, disassociation may refer to a procedure in which a client device is no longer associated with an AP. In some embodiments, disassociation prevents the AP from continuing to attempt to send data to the client device after a connection has been cancelled. In some embodiments, disassociation generally involves sending a disassociation frame or message from the AP to the client device or from the client device to the AP. A client device may disassociate from an AP while still maintaining authentication on the network. In some embodiments, deauthentication may refer to a procedure that does not allow any further services to be provided to the client device. In some embodiments, deauthentication generally involves sending a deauthentication frame or message from the AP to the client device or from the client device to the AP.

[0020] Some embodiments relate to a first device, the first device including circuitry configured to provide at least one frame to a second device, the frame including a protected reassociation request message.

[0021] In some embodiments, the frames are provided according to an 802.11 protocol and the connection is re-established by using a reassociation operation. In some embodiments, the first device is a beacon protection enabled station (STA). In some embodiments, the circuitry is configured to receive a protected reassociation response message from the second device. In some embodiments, the second device is an access point for which beacon protection is supported.

[0022] In some embodiments, the circuitry is configured to receive a protected reassociation response message from the second device and provide an acknowledgement message in response to the protected reassociation response message. In some embodiments, the circuitry is configured to provide the message with information regarding links for multi-link operation. In some embodiments, the information is regarding a reduced number of links. In some embodiments, the information is related to traffic identifier mapping to the links.

[0023] In some embodiments, the protected reassociation request message may refer to a message (e.g., a management frame) that requests reassociation and is encrypted or otherwise secured. In some embodiments, the protected reassociation request message may request a response to be sent that includes information regarding capabilities of one or more service sets identified in the network and that is provided using key information provided during a four-way handshake associated with the connection. In some embodiments, the protected reassociation response message may refer to a message (e.g., a management frame) that responds to the reassociation request and is encrypted or otherwise secured. In some embodiments, the protected reassociation response message may be similar to the protected reassociation request message and include capabilities information, authentication information, etc., as well as an acknowledgement (positive response) of the reassociation. In some embodiments, the reassociation operation may refer to any operation in which a connection between two devices is re-established after an event. In some embodiments, the event may refer to a reboot or refresh of a WiFi interface, a failed roaming attempt, a capability / parameter reconfiguration, a multilink configuration change, or a situation where a connection requires a connection to be re-established. In some embodiments, a link may refer to a communication channel or band used to communicate between two devices. In some embodiments, an access point and a STA have the capability to transmit and receive data from the same traffic flow over multiple wireless interfaces or multiple links. In some embodiments, a multilink operation may refer to any communication using two or more links. In some embodiments, an acknowledgement message may refer to any message that provides an indication that data has been received and / or acknowledged. In some embodiments, a traffic identifier mapping to a link may refer to providing data that correlates a traffic identification or address with a corresponding link.

[0024] Some embodiments relate to a first device, the first device including circuitry configured to provide at least one frame to a second device in response to a protected reassociation request message, the frame including a protected reassociation response message.

[0025] In some embodiments, the frame is provided according to an 802.11 protocol, and the connection is established by using an association operation or an authentication operation. The first device is an access point with beacon protection enabled. In some embodiments, the frame includes information confirming a reassociation of the connection between the first device and the second device. In some embodiments, the circuitry is configured to provide the frame if the second device is in a list of associated devices stored in the second device. In some embodiments, the circuitry is configured to not provide the frame if the second device is not in a list of associated devices stored in the second device. In some embodiments, an associated device refers to a device that has been associated and / or remains associated with another device according to an association operation within a certain period of time.

[0026] Some embodiments relate to a method of operating a first device. The first device has a connection with a second device, the connection having associated key information. The method includes providing a protected reassociation request message using the key information over the connection from the first device to the second device after an event affecting the connection. The method also includes receiving a protected reassociation response message at the first device from the second device using the key information. In some embodiments, the key information can refer to any data used to provide protected communications. The key information can be a Wired Equivalent Privacy (WEP) key used to encrypt frames (e.g., in an 802.11 network).

[0027] In some embodiments, the protected reassociation request message is a protected management frame. In some embodiments, the event includes a failed roaming attempt, a capability / parameter reconfiguration, or a multilink configuration change. In some embodiments, the protected reassociation response message from the second device is provided if the first device is in a list of associated devices stored in the second device. In some embodiments, the event is a change in the multilink configuration. In some embodiments, the event includes a roam from the second device. In some embodiments, a change in the multilink configuration may refer to a change in parameters used for multilink communication operation.

[0028] In some embodiments, a frame may refer to a digital data transmission unit. For example, a frame may refer to a container for a single network packet. In some embodiments, a data frame may refer to a frame that contains data. In some embodiments, an encrypted frame may refer to a frame that is encrypted. In some embodiments, a broadcast message or frame may refer to a message or frame that is sent to two or more devices in a BSS that is connected to or in communication with an AP. In some embodiments, a broadcast message or frame is sent to all devices in a BSS that is connected to an AP. In some embodiments, a unicast message or frame may refer to a message or frame that has a single destination. A management frame may refer to a frame for control or management operations, including, but not limited to, beacon frames, probe request / response frames, authentication request / response frames, association request / response frames, deauthentication frames, disassociation frames, reassociation request frames, reassociation response frames, etc. In some embodiments, a protected management frame may refer to a management frame that is configured to provide protection for unicast and multicast management actions. The frames can be protected from both eavesdropping and forgery and can have privacy protection along with mechanisms to improve resilience. Management Frame Protection (MFP) is a wireless feature that enhances security of management frames. The frames can be provided according to a wireless standard, which is IEEE 802.11w-2009, that seeks to provide data confidentiality for management frames and protect wireless connectivity. In some embodiments, the management frame protection feature of the STAs and APs can provide a set of information elements in the frames that enhance or ensure security.

[0029] A. Computing and Network Environment Before considering specific embodiments of the present solution, it may be beneficial to describe aspects of the operating environment and associated system components (e.g., hardware elements) in the context of the methods and systems described herein. Referring to FIG. 1A, an embodiment of a network environment is shown. In overview, the network environment includes a wireless communication system including one or more access points (APs) or network devices 106, one or more client devices (e.g., STAs) or wireless communication devices 102, and network hardware components or network hardware 192. The wireless communication devices 102 may include, for example, laptops, tablets, personal computers, and / or mobile phone devices. Details of an embodiment of each station or wireless communication device 102 and APs or network devices 106 are described in more detail in conjunction with FIG. 1B and FIG. 1C. In one embodiment, the network environment may be an ad-hoc network environment, an infrastructure wireless network environment, a subnetwork environment, or the like. The network devices 106 or APs may be operatively coupled to the network hardware 192 via a local area network connection. In some embodiments, the network devices 106 are 5G base stations. Network hardware 192, which may include routers, gateways, switches, bridges, modems, system controllers, appliances, etc., may provide local area network connectivity to the communication system. Each of the network devices 106 or APs may have an associated antenna or antenna array for communicating with wireless communication devices in the area. A wireless communication device 102 may register with a particular network device 106 or AP to receive services from the communication system (e.g., via a SU-MIMO or MU-MIMO configuration). In the case of a direct connection (e.g., point-to-point communication), several wireless communication devices may communicate directly via an assigned channel and communication protocol. Some of the wireless communication devices 102 may be mobile or relatively stationary with respect to the network devices 106 or APs.

[0030] In some embodiments, the network device 106 or AP includes devices or modules (including combinations of hardware and software) that enable the wireless communication device 102 to connect to a wired network using Wireless Fidelity (WiFi) or other standards. The network device 106 or AP may sometimes be referred to as a wireless access point (WAP). The network device 106 or AP may be implemented (e.g., configured, designed and / or built) to operate in a wireless local area network (WLAN). In some embodiments, the network device 106 or AP may be connected to a router (e.g., via a wired network) as a stand-alone device. In other embodiments, the network device 106 or AP may be a component of a router. The network device 106 or AP may provide multiple devices access to a network. The network device 106 or AP may, for example, connect to a wired Ethernet connection and provide wireless connectivity to other devices 102 using a radio frequency link to utilize the wired connection. The network device 106 or AP may be implemented to support a standard for transmitting and receiving data using one or more radio frequencies. The standards and frequencies they use may be defined by the IEEE (e.g., the IEEE 802.11 standard). The network devices 106 or APs may be configured and / or used to support public Internet hotspots and / or to extend the Wi-Fi signal range of the network on the network.

[0031] In some embodiments, the access points or network devices 106 may be used in a (e.g., in-home, in-car, or in-building) wireless network (e.g., IEEE 802.11, Bluetooth, ZigBee, any other type of radio frequency based network protocol and / or variations thereof). Each of the wireless communication devices 102 may include and / or be coupled to a built-in radio. Such wireless communication devices 102 and / or access points or network devices 106 may operate according to various aspects of the disclosure as presented herein to enhance performance, reduce cost and / or size, and / or enhance broadband applications. Each wireless communication device 102 may have the capability to function as a client node seeking access to resources (e.g., data, and connections to networked nodes such as servers) via one or more access points or network devices 106.

[0032] The network connection may include any type and / or form of network, including any of the following: point-to-point network, broadcast network, telecommunications network, data communication network, computer network. The topology of the network may be a bus, star, or ring network topology. The network may be of any such network topology as known to those skilled in the art that can support the operations described herein. In some embodiments, different types of data may be transmitted via different protocols. In other embodiments, the same type of data may be transmitted via different protocols.

[0033] The communication device(s) 102 and the access point(s) or network device 106 may be arranged as and / or implemented on any type and form of computing device, such as a computer, network device, or appliance capable of communicating in any type and form of network and performing the operations described herein. FIGS. 1B and 1C show block diagrams of computing devices 100 useful for implementing an embodiment of the wireless communication device 102 or the network device 106. As shown in FIGS. 1B and 1C, each computing device 100 includes a processor 121 (e.g., a central processing unit), and a main memory 122. As shown in FIG. 1B, the computing device 100 may include a memory device 128, an installation device 116, a network interface 118, an I / O controller 123, a display device 124a-124n, a keyboard 126, and a pointing device 127, such as a mouse. The memory device 128 may include an operating system and / or software. As shown in FIG. 1C, each computing device 100 may also include additional optional elements, such as a memory port 103, a bridge 170, one or more input / output devices 130a-130n, and a cache memory 140 in communication with a central processing unit or processor 121.

[0034] Central processing unit or processor 121 is any logic circuitry that responds to and processes instructions fetched from main memory 122. In many embodiments, central processing unit or processor 121 is provided by a microprocessor device, such as those manufactured by Intel Corporation of Santa Clara, Calif., International Business Machines of White Plains, New York, or Advanced Micro Devices of Sunnyvale, Calif. Computing device 100 can be based on any of these processors, or any other processor capable of operating as described herein.

[0035] The primary memory 122 can be one or more memory chips that can store data and allow any memory location to be directly accessed by the microprocessor or processor 121, such as any type or variant of static RAM (SRAM), dynamic RAM (DRAM), ferroelectric memory (FRAM), NAND flash memory, NOR flash memory, and solid-state drive (SSD). The primary memory 122 can be based on any of the memory chips mentioned above, or any other available memory chip that can operate as described herein. In the embodiment shown in FIG. 1B, the processor 121 communicates with the primary memory 122 via a system bus 150 (described in more detail below). FIG. 1C illustrates an embodiment of a computing device 100 in which the processor communicates directly with the primary memory 122 via a memory port 103. For example, in FIG. 1C, the primary memory 122 can be a DRDRAM.

[0036] FIG. 1C illustrates an embodiment in which the main processor 121 communicates directly with the cache memory 140 through a secondary side bus, sometimes referred to as a backside bus. In another embodiment, the main processor 121 communicates with the cache memory 140 using a system bus 150. The cache memory 140 generally has a faster response time than the main memory 122 and is provided by, for example, SRAM, BSRAM, or EDRAM. In the embodiment illustrated in FIG. 1C, the processor 121 communicates with the various I / O devices 130 through a local system bus (e.g., system bus 150). Various buses can be used to connect either the central processing unit or the processor 121 to the I / O devices 130, such as, for example, a VESA VL bus, an ISA bus, an EISA bus, a Micro Channel Architecture (MCA) bus, a PCI bus, a PCI-X bus, a PCI-Express bus, or a NuBus. For embodiments in which the I / O device is a video display 124, the processor 121 may use an Advanced Graphics Port (AGP) to communicate with the display 124. Figure 1C illustrates an embodiment of a computer or computer system 100 in which the main processor 121 may communicate directly with I / O device 130b, for example, via HyperTransport, RapidIO, or InfiniBand communications technologies. Figure 1C also illustrates an embodiment in which local bus and direct communications are mixed, i.e., the processor 121 communicates directly with I / O device 130b while simultaneously using a local interconnect bus to communicate with I / O device 130a.

[0037] A wide variety of I / O devices 130a-130n may be present in computing device 100. Input devices include keyboards, mice, trackpads, trackballs, microphones, dials, touchpads, touch screens, and drawing tablets. Output devices include video displays, speakers, inkjet printers, laser printers, projectors, and dye-sublimation printers. The I / O devices may be controlled by an I / O controller 123, as shown in FIG. 1B. The I / O controller may control one or more I / O devices, such as a keyboard 126 and a pointing device 127 (e.g., a mouse or optical pen). Additionally, the I / O devices may provide storage and / or installation media to computing device 100. In yet another embodiment, computing device 100 may provide a USB connection (not shown) for accepting a portable USB storage device, such as the USB flash drive line of devices manufactured by Twintech Industry, Inc. of Los Alamitos, Calif.

[0038] Referring again to FIG. 1B, computing device 100 may support any suitable installation device 116, such as a disk drive, CD-ROM drive, CD-R / RW drive, DVD-ROM drive, flash memory drive, tape drives of various formats, USB device, hard drive, network interface, or any other device suitable for installing software and programs. Computing device 100 may further include storage devices, such as one or more hard disk drives or a redundant array of independent disks, for storing an operating system and other related software, and for storing application software programs, such as any program or software 120 for implementing (e.g., configured and / or designed for) the systems and methods described herein. If desired, any of installation devices 116 may also be used as storage devices. Additionally, operating systems and software may be executed from a bootable medium.

[0039] Additionally, computing device 100 may include network interface 118 for coupling to a network through various connections including, but not limited to, standard telephone lines, LAN or WAN links (e.g., 802.11, T1, T3, 56kb, X.25, SNA, DECnet), broadband connections (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet over Sonnet), wireless connections, or some combination of any or all of the above. Connections may be established using a variety of communication protocols (e.g., TCP / IP, IPX, SPX, NetBIOS, Ethernet, ArcNet, SONET, SDH, Fiber Distributed Data Interface (FDDI), RS232, IEEE 802.11, IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, IEEE 802.11ad, CDMA, GSM, WiMax, and direct asynchronous connections). In one embodiment, computing device 100 communicates with other computing devices 100' via any type and / or form of gateway or tunneling protocol, such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS). Network interface 118 may include a built-in network adapter, a network interface card, a PCMCIA network card, a card bus network adapter, a wireless network adapter, a USB network adapter, a modem, or any other device suitable for coupling computing device 100 to any type of network capable of communicating with and performing the operations described herein.

[0040] In some embodiments, computing device 100 may include or be connected to one or more display devices 124a-124n. As such, any of I / O devices 130a-130n and / or I / O controller 123 may include any type and / or form of suitable hardware, software, or combination of hardware and software to support, enable, or effect the connection and use of display device(s) 124a-124n by computing device 100. For example, computing device 100 may include any type and / or form of video adapter, video card, drivers, and / or libraries to interface with, communicate with, connect to, or otherwise use display device(s) 124a-124n. In one embodiment, the video adapter may include multiple connectors for interfacing to display device(s) 124a-124n. In other embodiments, computing device 100 may include multiple video adapters, with each video adapter connected to a display device(s) 124a-124n. In some embodiments, some portion of the operating system of computing device 100 may be configured to use multiple display devices 124a-124n. In further embodiments, I / O device 130 may be a bridge between system bus 150 and an external communications bus, such as a USB bus, an Apple Desktop bus, an RS-232 serial connection, a SCSI bus, a Firewire bus, a Firewire 800 bus, an Ethernet bus, an AppleTalk bus, a Gigabit Ethernet bus, an Asynchronous Transfer Mode bus, a Fibre Channel bus, a Fiber Optic bus, a Serial Attached SCSI (SAS) bus, a USB connection, or an HDMI bus.

[0041] 1B and 1C may operate under the control of an operating system that controls the scheduling of tasks and access to system resources. Computing device 100 may be running any operating system, such as any version of the Microsoft Windows operating system, various publicly available Unix and Linux operating systems, any version of MAC OS for Macintosh computers, any embedded operating system, any real-time operating system, any open source operating system, any proprietary operating system, any operating system for mobile computing devices, or any other operating system capable of running on a computing device and performing the operations described herein. Representative operating systems include, but are not limited to, Android® produced by Google Inc.; Windows® 7, 8, and 10 produced by Microsoft Corporation of Redmond, Washington; MAC OS produced by Apple Computer of Cupertino, California; WebOS produced by Research In Motion (RIM); OS / 2 produced by International Business Machines of Armonk, New York; and Linux, a freely available operating system distributed by Caldera Corp. of Salt Lake City, Utah, or any type and / or form of Unix operating system, among others.

[0042] Computer system or computing device 100 can be any workstation, telephone, desktop computer, laptop or notebook computer, server, portable computer, mobile phone or other portable communication device, media playback device, gaming console, mobile computing device, or any other type and / or form of computing device, communication device, or media device capable of communicating. In some embodiments, computing device 100 can have a variety of processors, operating systems, and input devices compatible with the device. For example, in one embodiment, computing device 100 is a smartphone, mobile device, tablet, or personal digital assistant. Furthermore, computing device 100 can be any workstation, desktop computer, laptop or notebook computer, server, portable computer, mobile phone, any other computer, or other form of computing device or communication device capable of communicating and having sufficient processor power and memory capacity to perform the operations described herein.

[0043] Aspects of the operating environment and components described above will become apparent in the context of the systems and methods disclosed herein.

[0044] B. Protocol for Reassociation Operations and Method and Apparatus Using Such Protocol Disclosed herein are systems and methods that may be used in any communication system, including, but not limited to, Wi-Fi and LTE networks. The systems and methods may be used with APs or STAs in a communication network, such as the devices described in connection with Figures 1A-1C. Although embodiments of reassociation request and / or reassociation response operations for communications according to the IEEE 802.11 standard are described herein, the systems and methods may be used with other networks, including cellular and satellite networks, and in point-to-point communications.

[0045] 2A, a wireless communication network or system 200 includes client devices or STAs 204, 206, 208, and 224, and APs 212, 214, 216, and 222. The STAs 204, 206, 208, and 224, and APs 212, 214, 216, and 222 may be used in the systems described in connection with FIGS. 1A-1C. Any number of the STAs 204, 206, 208, and 224, and APs 212, 214, 216, and 222 may be used in the network or system 200. In some embodiments, the STA or client device may refer to any device for communicating in a communication system, including, but not limited to, a fixed, portable, or mobile laptop computer, desktop computer, personal digital assistant, workstation, wearable device, smartphone, or WiFi phone. In some embodiments, an access point or AP may refer to a device for communicatively coupling one or more "non-AP" devices (e.g., client devices or STAs) to a network. In some embodiments, an AP may enable non-AP devices to connect and communicate with a network. In some embodiments, an AP is a wireless access point (WAP) configured to enable wireless communication between non-AP devices. APs include, but are not limited to, mobile, portable or fixed hotspots, routers, bridges, gNB nodes, eNodeBs, evolved node Bs, or other communication devices. An AP may provide services to STAs, such as serving as an attachment point to another network.

[0046] Each of the STAs 204, 206, 208, and 224, and the APs 212, 214, 216, and 222 may include a wireless transceiver and various modules for communicating over the connection. The modules may be software (e.g., firmware), hardware components, and combinations thereof. In some embodiments, each of the STAs 204, 206, 208, and 224, and the APs 212, 214, 216, and 222 may include IEEE 802.11 compliant medium access control (MAC) layer circuitry and physical layer (PHY) interface to the wireless medium and may be part of a larger device or system. In some embodiments, each of the STAs 204, 206, 208, and 224, and the APs 212, 214, 216, and 222 may operate according to a standard other than the IEEE 802.11 standard.

[0047] A connection for wireless communication may be established between at least one of the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222 after authentication and association operations. For example, the STA 208 has a connection 218 to the AP 212. The STAs 204, 206, 208, and 224 each include circuitry (e.g., a processor or processing circuit 221), and the APs 212, 214, 216, and 226 each include circuitry (e.g., a processing circuit 233) for establishing and canceling the connection 218 and communicating data across the connection. In another example, the STA 204 has a connection 228 to the AP 212, and the STA 206 has a connection 229 to the AP 222. Each of the STAs 204, 206, 208, and 224 includes circuitry (e.g., a processor or processing circuit 221), and each of the APs 212, 214, 216, and 222 includes circuitry (e.g., processing circuit 233) for operating in accordance with data request and response operations as described below. In some embodiments, the connections 218, 228, 229, and 226 are wireless connections that are formed using association and / or authentication operations and canceled using disassociation and / or deauthentication operations. In some embodiments, the connections 218, 228, 229, and 226 can be single-link, multi-link, or dual-link connections associated with the APs 212 and 222, and can be secure connections (e.g., using encryption). In some embodiments, connections 218, 228, 229, and 226 provide data communication and control and manage communications on one or more channels in the 5G, 6G, 60G, or 2G bands.

[0048] In some embodiments, the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222 are configured to use a reassociation request / response protocol to facilitate communications between the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222. In some embodiments, the reassociation request / response protocol can be used to facilitate secured reassociation while reducing onboarding time.

[0049] 2B, the device 220 is an AP 212 or a STA 208 (FIG. 2A) configured for a secure probe / response protocol according to some embodiments. In some embodiments, the device 220 includes a processing circuit 233 and a reassociation module 238 (e.g., a reassociation request / response module). In some embodiments, the reassociation request / response module may refer to a module that processes or provides a reassociation request message, a reassociation response message in response to a reassociation request message, or a reassociation request message and a response message. In some embodiments, the processing circuit 233 is any circuit element or component capable of executing logic and communication processing operations and may include a processor 234 and a memory 236.

[0050] In some embodiments, the processing circuitry 230 is implemented as a field programmable gate array, an application specific integrated circuit, hardware, a software-implemented processor, or a state machine. In some embodiments, the processing circuitry 230 is part of an equipment layer (e.g., a MAC layer, a network layer, a PHY layer) of the IEEE 802.11 standard. In some embodiments, the processing circuitry 230 may be configured to perform communication operations, frame construction and processing, probe request and response operations, discovery operations, association operations, authentication operations, connection setup, disassociation operations, handoff operations, reassociation operations, and deauthentication operations. In some embodiments, instructions for the processing circuitry 230 are stored in a persistent medium such as memory 236. In some embodiments, the processing circuitry 221 of the STA 208 and the processing circuitry 233 of the AP 212 are similar to the processing circuitry 230.

[0051] The memory 236 may be one or more devices (e.g., RAM, ROM, flash memory, hard disk storage) for storing data and / or computer code for implementing and / or facilitating various processes described herein. The memory 236 may be or include non-transient non-volatile memory, non-volatile memory, and persistent computer storage media. The memory 236 may include database components, object code components, script components, or any other type of information structure for supporting various activities and information structures described herein. The memory 236 is communicatively coupled to the processor 234 and may include computer code or instructions for performing one or more processes described herein. The processor 234 may be realized as one or more application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), groups of processing components, software executing processors, state machines, or other suitable electronic processing components. As such, the AP, STA, or network device 106 (FIG. 1A) is configured to execute various modules and / or programs and store associated data in a database in memory 236. A module (e.g., module 238) may be implemented in AP software (e.g., MAC layer software or PHY layer software) or STA software (e.g., MAC layer software or PHY layer software). In some embodiments, the AP 212 or STA 208 (FIG. 2A) is configured and used to establish connections and handoff access to other computing systems and devices (e.g., wireless communication device(s) 102, network hardware 192, other access points or network devices 106) (FIGS. 1A-1C) over a network (e.g., a WAN connection, a LAN connection, a WLAN connection, etc.).

[0052] In some embodiments, the reassociation module 238 is configured to provide a reassociation request message. For example, the reassociation module 238 is configured to cause the device 220 to provide a reassociation response message and / or a reassociation request message for a secure reassociation operation. In some embodiments, the reassociation module 238 is configured to cause the device 220 to provide a reassociation request / response message (e.g., a frame) for a secure exchange between the AP 212 and the STA 208 (FIG. 2A) using the PMF. In some embodiments, the reassociation module 238 is configured to perform a secure reassociation request / exchange (SRX) using an existing key for the connection (e.g., a previous connection).

[0053] The reassociation module 238 of the SRX device uses the PMF method (e.g., under 802.11) to protect each association / reassociation request frame and association / reassociation response frame as long as both sides have valid keys. When the AP 212 has a valid key and can successfully retrieve a secure or protected reassociation request frame from the STA 208, the AP 212 can respond with a secure or protected reassociation response frame using its existing key. In some embodiments, a reassociation operation is not necessarily considered a new connection request, but may be treated as an amendment request on an existing connection (e.g., connection 212 for the AP 212 and the STA 208). In some embodiments, the subsequent onboarding process of initiating the communication of the association operation and the four-way handshake may be avoided. In some embodiments, during a reassociation operation, the AP 212 can advantageously process a reassociation request frame from the STA 208 and adopt the updated client capabilities or parameters by accepting these parameters.

[0054] In some embodiments, the reassociation module 238 may not respond to the SRX request message of the STA 208 if the AP 212 removes the STA 208 from its associated list due to extended inactivity or due to security reasons. In such cases, the STA 208 falls back to traditional connection procedures (e.g., discovery, association, authentication, and four-way handshake operations).

[0055] In some embodiments, if the STA 208 sends a secure reassociation request message and the AP responds with an unsecure reassociation response, the reassociation module 238 of the STA 208 rejects the unsecure reassociation response and follows a conventional connection procedure. If the STA 208 sends an unsecure reassociation request message (e.g., as part of a recent roaming attempt to a target AP) and the AP does not have the STA 208 in its associated list, the target AP follows a conventional operation of sending an unsecure reassociation response followed by initiating a four-way handshake with an authentication operation. When the STA 208 sends an unsecure reassociation request message (if the STA 208 has cleared previous connection details with the AP, including keys) and the AP has the STA 208 on its associated list, the AP may follow the existing 802.11w specification recommended SA Query procedure for reassociation.

[0056] In some embodiments, the reassociation module 238 of the SRX-aware AP 212 may schedule a unicast key rotation or refresh after the STA onboards as an additional security measure. In certain cases, when the device 220 (e.g., the STA 208) roams from the connected AP (e.g., the AP 212), the device 220 does not communicate any messages with the existing AP, but searches for a new target AP. The device 220 attempts to connect to the new target AP by assuming that the device 220 may improve performance by moving to the new target AP (e.g., because the device 220 is closer to the new target AP). However, this assumption may not be correct, and the device 220 may temporarily go out of range of the connected AP and return, or the roaming attempt with the connected AP may fail (e.g., during the 4-way handshake), and the device may have no choice but to return to the existing AP. During such a situation, if device 220 performs an unsecured reassociation request, the existing AP may treat device 220 as an intruder and initiate an SA-Query procedure. After the SA-Query timeout, the AP will terminate 220's existing connection and initiate onboarding this client as a new connection followed by a four-way handshake.

[0057] In some embodiments, device 220 operates according to the SRX protocol in the above situation, device 220 holds the key and provides a secure reassociation request message, and if the AP has the device in its associated list, the AP sends a secure reassociation response and device 220 is connected in the same network, making roaming much faster.

[0058] In some embodiments, the reassociation module 238 of the SRX-aware AP 212 is intended to change its association time configuration parameters for various reasons of its own, such as upgrading / downgrading transmit (Tx) / receive (Rx) chains for power saving purposes or parallel processing purposes, or temporarily changing the supported rates for power saving purposes, and the reassociation module 238 can dynamically configure all such parameters (e.g., number of supported Tx & Rx chains, upgrade / download, and supported rates-EHT, VHT, HE, etc.). In some embodiments, the reassociation module 238 can dynamically configure all non-secure related change parameters. In some embodiments, the device 220 operates according to the SRX protocol to update the number of operating links for multi-link (ML) operation with the AP. Any unsecured (re)association frame generally results in an SA Query operation. However, device 220 may use the SRX protocol (e.g., with an 802.11be multilink operating mode) according to the following circumstances: 1) The AP 212 adds a new link and the STA 208 wants to use the newly added link for its ML operation (MLO); 2) the STA 208 is initially associated only on a subset of the AP's supported links and wishes to increase the number of operational links (e.g., from a 2-link MLO association to a 3-link MLO association); 3) The STA 208 is initially associated with all or a subset of the AP 212's supported links and wishes to reduce the number of currently operational links (e.g., from a 3-link MLO association to a 2-link MLO association); 4) Traffic Identifier to Link (TID2LINK) mapping can be changed by the STA 208 according to its needs. The secured reassociation request may be used to communicate new communication parameters and to reassociate the device 220 with the AP.

[0059] Referring to FIG. 3, the reassociation module 238 (FIG. 2B) handles (processes) a reassociation operation between the AP 212 and the STA 208. In some embodiments, the STA 208 and the AP 212 support beacon protection. The STA 208 and the AP 212 execute a flow 300 to handle a broadcast probe request frame using a secure probe request / response protocol. The STA 208 provides a broadcast probe request frame when an active scan is issued in operation 302. The AP 212 with beacon protection enabled responds to the broadcast probe request frame by providing an unprotected (no Management Frame Protection (MFP)) unicast probe response frame in operation 304. In some embodiments, the unprotected probe response frame for the broadcast probe request frame is sent regardless of whether the STA 208 is associated or unassociated with the AP 212. In operation 306, the association is completed. In operation 307, the AP 212 provides a beacon frame in operation 307. The beacon frame includes a management message integrity code (MIC) or information element for the management MIC element (MME). The four-way handshake is completed in operation 308, and the connection between the STA 208 and the AP 212 is completed. The beacon frame can be provided using the MME after the connection is established in operations 310a-310n.

[0060] In operation 312, an event occurs. In some embodiments, the event can be a failed roaming attempt (e.g., a response to a previously connected AP), a capabilities / parameter reconfiguration (e.g., a STA configuration change), or a multilink configuration change. In some embodiments, the AP 212 still retains information with the old key value for the STA 208. Also, in some embodiments, operation 312 can be a failed roaming attempt, a capabilities / parameter reconfiguration, or a multilink configuration change.

[0061] A protected reassociation request message (e.g., frame 313) is sent from the STA 208 after operation 312, specifically to reassociate with the previously associated AP (e.g., AP 212). In some embodiments, the protected reassociation request message (e.g., frame 313) is provided from the STA 208 to the AP 212 in operation 314. The AP 212 enables the secure reassociation request message and optionally provides a protected reassociation response message or frame 316 in operation 315 in response to the protected reassociation request frame 313 sent in operation 314. The frames 313 and 316 in operations 314 and 315 may include information to complete the reassociation. The reassociation is completed in operation 322.

[0062] With flow 300, AP and STA reassociation occurs more quickly without the need for a teardown (e.g., higher levels remain intact) and a new four-way handshake. In some embodiments, an optional refresh unicast key may be sent from the AP 212 to the STA 208 in operation 317. For example, with flow 300, the STA 208 retains the key information and performs a secure reassociation request as long as the AP 212 also already has the client in its associated list. The AP 212 sends a secure reassociation response and the STA 208 can operate in the same network, thereby achieving faster roaming.

[0063] 4, a reassociation request frame 400 may include a MAC header 402 and a frame body 404 and may be configured as a protected frame (e.g., a protected management frame having subtype 2). Frame 400 is transmitted by a STA (e.g., STA 208). Frame body 404 may include fields for parameters, such as capability or configuration parameters, that may be changed during reassociation. For example, frame body 404 may include information elements in fields for device capabilities (e.g., supported rates, number of supported Rx and Tx chains, and multilink parameters). A reassociation response frame may be similar to frame 400 and is transmitted by an AP (AP 212). In some embodiments, the reassociation response frame may be an acknowledgment (positive acknowledgement) of the reassociation request frame and may be configured as a secure frame. In some embodiments, the reassociation response frame can be configured as a protected frame (e.g., a protected management frame having subtype 3) and can indicate whether the STA is allowed to rejoin. In some embodiments, the STA can send an acknowledgment of the reassociation response frame to the AP.

[0064] It should be noted that certain passages of this disclosure may refer to terms such as "first" and "second" in connection with a subset of frames, responses, and devices to identify or distinguish one from the other(s). These terms are not intended to merely relate the entities (e.g., first device and second device) temporally or according to a sequence, although in some cases the entities may include such a relationship. Nor do these terms limit the number of possible entities (e.g., STAs, APs, beamformers, and / or beamformees) that may operate within a system or environment. It should be understood that the systems described above may provide multiples of any or each of these components, which may be provided on standalone machines or, in some embodiments, on multiple machines in a distributed system. Additionally, bit field positions may be changed and multi-bit words may be used. Additionally, the systems and methods described above may be provided as one or more computer readable programs or executable instructions embodied on one or more articles of manufacture (e.g., floppy disks, hard disks, CD-ROMs, flash memory cards, PROMs, RAMs, ROMs, or magnetic tapes). The programs may be implemented in any programming language, such as LISP, PERL, C, C++, C#, or in any bytecode language, such as JAVA. The software programs or executable instructions may be stored in one or more articles of manufacture as object code. A circuit element may refer to any electronic circuit(s) or circuits.

[0065] A circuit element or circuit may refer to any electronic circuit or combination of circuits. To the extent that a claim describes or recites an apparatus, circuit, processor, or circuit element as performing or configured to perform one or more operations or functions, the implementation of the recited function(s) or operation(s) may be distributed across two or more devices, circuits, or processors without departing from the scope of the claim, unless the function or operation is expressly recited as being performed in a particular single circuit or set of circuits, processor, or device (e.g., using the phrase "in a single circuit," "in a set of circuits including," or "in a single device").

[0066] The above description of the method and system will enable one skilled in the art to make and use the embodiments, but one skilled in the art will understand and recognize the existence of variations, combinations, and equivalents of the specific embodiments, methods, and examples herein. For example, the specific values ​​of bandwidth, channels, and sub-bands provided above are exemplary. Thus, the method and system should not be limited by the embodiments, methods, and examples described above, but by all embodiments and methods within the scope and spirit of the present disclosure.

Claims

1. 1. A first device, comprising: A first device including circuitry configured to provide at least one frame to a second device, the frame including a protected reassociation request message.

2. The first device of claim 1 , wherein the frames are provided according to an 802.11 protocol and the connection is re-established by using a reassociation operation.

3. The first device of claim 1 , wherein the first device is a beacon protection enabled station (STA).

4. The first device of claim 1 , wherein the circuitry is configured to receive a protected reassociation response message from the second device.

5. The first device of claim 1 , wherein the second device is a beacon protection supported access point.

6. 2. The first device of claim 1, wherein the circuitry is configured to receive a protected re-association response message from the second device and to provide an acknowledgment message in response to the protected re-association response message.

7. The first device of claim 6 , wherein the circuitry is configured to provide the protected reassociation response message with information regarding a link for multi-link operation.

8. The first device of claim 7 , wherein the information concerns a reduced number of links.

9. The first apparatus of claim 7 , wherein the information relates to a traffic identifier mapping for a link.

10. 1. A first device, comprising: A first device including circuitry configured to provide at least one frame to a second device in response to a protected reassociation request message, the frame including a protected reassociation response message.

11. The first device of claim 10, wherein the frames are provided according to an 802.11 protocol, the connection is established by using an association or authentication operation, and the first device is an access point with beacon protection enabled.

12. The first device of claim 10 , wherein the frame includes information indicating a confirmation of reassociation of a connection between the first device and the second device.

13. The first device of claim 10 , wherein the circuitry is configured to provide the frame if the second device is in a list of associated devices stored in the second device.

14. 11. The first device of claim 10, wherein the circuitry is configured to not provide the frame if the second device is not in a list of associated devices stored on the second device.

15. 1. A method of operating a first device, the first device having a connection with a second device, the connection having associated key information, the method comprising: providing a protected re-association request message using the key information over a connection from the first device to the second device after an event affecting the connection; receiving, at the first device, a protected re-association response message from the second device using the key information.

16. 16. The method of claim 15, wherein the protected re-association request message is a protected management frame.

17. The method of claim 15 , wherein the events include a failed roaming attempt, a capability / parameter reconfiguration, or a multilink configuration change.

18. 16. The method of claim 15, wherein the protected reassociation response message from the second device is provided if the first device is in a list of associated devices stored on the second device.

19. The method of claim 15 , wherein the event is a change in a multilink configuration.

20. The method of claim 15 , wherein the event includes roaming from the second device.

Images