Method and system for WLAN multilink management frame addressing

Abstract

Aspects of the present disclosure provide a method of communication between a first multi-link device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, and the second MLD belonging to a second STA and a fourth STA. Such a method includes receiving, by the first multi-link device (MLD), a management frame from the first station (STA) including a header indicating address information associated with the second MLD. Such a method further includes encrypting, by the first MLD, the management frame based on a security association established between the first MLD and the second MLD. Such a method further includes transmitting, by the first MLD, the encrypted management frame toward the second MLD via one of the first STA and the third STA.

Description

[Technical field]

[0002] The present invention relates to the field of communication networks, and in particular to a system and method for WLAN multilink management frame addressing. [Background technology]

[0003] In IEEE 802.11, unicast management frames are encrypted based on the established security association. In the case of multi-link operation (MLO), a security association is established between an access point (AP) multi-link device (MLD) and a non-AP MLD. Therefore, there is no security association between an AP that belongs to an AP MLD and a station (STA) that belongs to a non-AP MLD. Therefore, due to the nature of the security association between an AP MLD and a non-AP MLD, the processing of unicast management frames, such as wireless-specific management frames, in the belonging AP and the belonging STA may be limited.

[0004] What is needed, therefore, is a system and method for WLAN multilink management frame addressing that avoids or mitigates one or more limitations of the prior art.

[0005] This background information is provided to identify information believed by the applicant to be of possible relevance to the present invention. No admission is necessarily intended, nor should it be construed, that any of the above information constitutes prior art against the present invention. Summary of the Invention [Means for solving the problem]

[0006] Aspects of the present disclosure provide a method of communication between a first multi-link device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, and the second MLD belonging to a second STA and a fourth STA. Such a method includes receiving, by the first multi-link device (MLD), a management frame from the first station (STA) including a header indicating address information associated with the second MLD. Such a method further includes encrypting, by the first MLD, the management frame based on a security association established between the first MLD and the second MLD. Such a method further includes transmitting, by the first MLD, the encrypted management frame toward the second MLD via one of the first STA and the third STA.

[0007] Such a solution would use security associations between the MLDs to enable secure communication between the MLDs via the affiliated STAs without the need to establish separate security associations between each affiliated STA.

[0008] In some embodiments, the header of the management frame indicates one of a destination address of the second station and a source address of the first station. In some embodiments, the header of the management frame further indicates a receiver address of the second STA and a transmitter address of the first STA.

[0009] In some embodiments, such a method further includes updating, by the first MLD, a header of the encrypted management frame to indicate one or more of a receiver address of the second MLD and a transmitter address of the first MLD.

[0010] In some embodiments, the first MLD comprises a media access control (MAC) instance of the first MLD.

[0011] In some embodiments, the first STA comprises a Station Management Entity (SME) instance of the first STA, hi some embodiments, the third STA comprises a MAC instance of the third STA.

[0012] In some embodiments, the first STA includes a first internal connection to the first MLD and the third STA includes a third internal connection to the first MLD, and the receiving step includes receiving via the first internal connection;

[0013] The transmitting step includes transmitting the encrypted management frame using an over-the-air (OTA) connection.

[0014] In some embodiments, the transmitting step includes transmitting the encrypted management frame to the first STA via a first internal connection, and transmitting the encrypted management frame from the first STA to the second STA via an OTA connection, wherein a header of the encrypted management frame is updated to indicate a receiver address of the second STA and a transmitter address of the first STA.

[0015] In some embodiments, the transmitting step includes transmitting the encrypted management frame to a third STA via a third internal connection, and transmitting the encrypted management frame from the third STA to a fourth STA via an OTA connection, wherein a header of the encrypted management frame is updated to indicate a receiver address of the fourth STA and a transmitter address of the third STA.

[0016] Another aspect of the present disclosure provides a method of communication between a first multi-link device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, and the second MLD belonging to a second STA and a fourth STA. Such a method includes receiving, by the first multi-link device (MLD), an encrypted management frame from the second MLD using an over-the-air (OTA) connection, the encrypted management frame including a header indicating address information associated with the second MLD. Such a method also includes decrypting, by the first MLD, the encrypted management frame based on an associated security established between the first MLD and the second MLD, and transmitting, by the first MLD, the decrypted management frame based on the header of the decrypted management frame.

[0017] In some embodiments, the header of the encrypted management frame indicates one of a destination address of the first STA and a source address of the second STA.

[0018] In some embodiments, the header of the encrypted management frame further indicates the receiver address of the first MLD and the sender address of the second MLD.

[0019] In some embodiments, the OTA connection is between a first STA and a second STA, the first STA including a first internal connection to a first MLD, and the receiving step includes receiving the encrypted management frame via the OTA connection and transmitting the encrypted management frame from the first STA to the first MLD via the first internal connection.

[0020] In some embodiments, the OTA connection is between a third STA and a fourth STA, the third STA including a third internal connection to the first MLD, and the receiving step includes receiving the encrypted management frame via the OTA connection and transmitting the encrypted management frame from the third STA to the first MLD via the third internal connection.

[0021] In some embodiments, the method further includes updating, by the first MLD, a header of the decoded management frame to indicate one or more of a receiver address of the first STA, a transmitter address of the third STA.

[0022] In some embodiments, the step of transmitting, by the first MLD, the decoded management frame based on a header of the decoded management frame includes a step of transmitting, by the first MLD, the decoded management frame to the first STA.

[0023] In some embodiments, the first MLD is a MAC instance of the first MLD.

[0024] In some embodiments, the first STA is a Station Management Entity (SME) of the first STA.

[0025] In some embodiments, the second STA has a MAC instance of the second STA.

[0026] In some embodiments, the first STA is the same as or different from the second STA. In some embodiments, the first MLD is one of an access point (AP) MLD or a non-AP MLD.

[0027] Another aspect of the present disclosure provides a system of communication between a first multi-link device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, and the second MLD belonging to a second STA and a fourth STA. In such a system, the first STA is configured to generate a management frame including a header indicating the second MLD and transmit the generated management frame to the first MLD. In such a system, the first MLD is configured to receive the management frame from the first STA, encrypt the management frame based on a security association established between the first MLD and the second MLD, and transmit the encrypted management frame toward the second MLD via one of the first STA and the third STA.

[0028] In some embodiments, the header of the management frame indicates one of a destination address of the second station and a source address of the first station.

[0029] In some embodiments, the header of the management frame further indicates a receiver address of the second STA and a transmitter address of the first STA.

[0030] In some embodiments, the first MLD is further configured to update a header of the encrypted management frame to indicate one or more of the receiver address of the second MLD, the transmitter address of the first MLD.

[0031] In some embodiments, the first STA includes a first internal connection to the first MLD and the third STA includes a third internal connection to the first MLD. In such a system, receiving management frames from the first STA includes receiving via the first internal connection and transmitting the encrypted management frames towards the second MLD via one of the first STA and the third STA includes transmitting the encrypted management frames using an over-the-air (OTA) connection.

[0032] In some embodiments, the transmitting step includes transmitting the encrypted management frame to the first STA via a first internal connection, and transmitting the encrypted management frame from the first STA to the second STA via an OTA connection, wherein a header of the encrypted management frame is updated to indicate a receiver address of the second STA and a transmitter address of the first STA.

[0033] In some embodiments, the transmitting step includes transmitting the encrypted management frame to a third STA via a third internal connection, and transmitting the encrypted management frame from the third STA to a fourth STA via an OTA connection, wherein a header of the encrypted management is updated to indicate a receiver address of the fourth STA and a transmitter address of the third STA.

[0034] Another aspect of the present disclosure provides a system of communication between a first multilink device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, and the second MLD belonging to the second STA. In such a system, the first STA is configured to receive an encrypted management frame including a header indicating the second MLD from the second MLD using an over-the-air (OTA) connection, and transmit the encrypted management frame to the first MLD. In such a system, the first MLD is configured to receive the encrypted management frame from the first STA, decrypt the encrypted management frame based on a security association established between the first MLD and the second MLD, and transmit the encrypted management frame based on the header of the decrypted management frame.

[0035] In some embodiments, the header of the encrypted management frame indicates one of a destination address of the first STA, a destination address of the third STA, and a source address of the second STA. In some embodiments, the header of the encrypted management frame further indicates a receiver address of the first MLD and a transmitter address of the second MLD.

[0036] In some embodiments, the OTA connection is between a first STA and a second STA, the first STA including a first internal connection to a first MLD. In such a system, transmitting the encrypted management frame to the first MLD includes transmitting the encrypted management frame over the first internal connection;

[0037] Receiving the encrypted management frame from the first STA includes receiving the encrypted management frame via the first internal connection.

[0038] In some embodiments, the first MLD is further configured to update a header of the decoded management frame to indicate one or more of a receiver address of one of the first STA and the third STA, and a transmitter address of the second STA.

[0039] In some embodiments, the receiver address indicates a first STA, and transmitting the encrypted management frame based on a header of the decrypted management frame includes transmitting the decrypted encrypted management frame to the first STA.

[0040] In some embodiments, the receiver address indicates a third STA, and transmitting the encrypted management frame based on a header of the decrypted management frame includes transmitting the decrypted encrypted management frame to the third STA.

[0041] Another aspect of the present disclosure provides devices for carrying out the methods described herein.

[0042] The embodiments have been described above in conjunction with the aspects of the invention in which they may be implemented. Those skilled in the art will understand that the embodiments may be implemented in conjunction with the described aspect, but may also be implemented with other embodiments of that aspect. If the embodiments are mutually exclusive or inconsistent with each other, it will be apparent to those skilled in the art. Some embodiments may be described in relation to one aspect, but may also be applicable to other aspects, as will be apparent to those skilled in the art.

[0043] Further features and advantages of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings. [Brief description of the drawings]

[0044] [Figure 1] FIG. 2 illustrates an MLD architecture according to one embodiment of the present disclosure. [Diagram 2] FIG. 2 illustrates an MLD security association according to one embodiment of the present disclosure. [Diagram 3] FIG. 2 illustrates IEEE 802.11 management frame addressing according to one embodiment of the present disclosure. [Figure 4] FIG. 2 illustrates 802.11 data frame addressing according to one embodiment of the present disclosure. [Diagram 5] A diagram illustrating a unicast management frame transmission in an MLD context according to one embodiment of the present disclosure. [Figure 6] FIG. 1 illustrates enhanced management frame addressing in an MLO in accordance with one embodiment of the present disclosure. [Figure 7] FIG. 2 illustrates a unicast management frame path according to one embodiment of the present disclosure. [Figure 8] FIG. 1 is a call flow diagram of a link-specific uplink (UL) management frame flow according to one embodiment of the present disclosure. [Figure 9] FIG. 1 is a call flow diagram of a link-specific downlink (DL) management frame flow according to one embodiment of the present disclosure. [Figure 10] FIG. 1 is a schematic diagram of a user equipment (UE) capable of performing any or all of the operations of the above methods and features explicitly or implicitly described herein according to different embodiments of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0045] It should be noted that throughout the accompanying drawings, like features are identified with like numerals.

[0046] The wireless communication system to which the embodiments of the present disclosure are applicable may be a wireless local area network (WLAN). The communication device may be a wireless communication device that supports parallel transmission on multiple links. Such a communication device may be called a multi-link device (MLD) or a multi-band device. The MLD may have higher transmission efficiency and higher throughput than a device that supports only single-link transmission.

[0047] An MLD may be described as a WLAN entity having multiple wireless links to another MLD entity, as further described with reference to Figure 1. An AP MLD may refer to an MLD, where each station (STA) that belongs to the MLD is an AP. A non-AP MLD may be referred to as an MLD, where each STA that belongs to the MLD is a non-AP STA. Thus, a STA may refer to an AP STA or a non-AP STA.

[0048] 1 illustrates an MLD architecture 100 according to one embodiment of the present disclosure. As can be appreciated by those skilled in the art, an MLD may be a logical entity that may have two or more associated STAs and a single Media Access Control (MAC) Service Access Point (SAP) to a Logical Link Control (LLC) that may include one Media Access Control (MAC) data service. Thus, an MLD has an internal connection to its associated STAs. It should be appreciated that such an internal connection may be wired, Bluetooth, or some other connection that forms an association between an MLD and associated STAs.

[0049] A typical use case of MLD may be an access point (AP) MLD 102 connected to a non-AP MLD (WLAN terminal) 112 using two wireless links in the 2.4 GHz (link 140) and 5 GHz (link 150) WLAN bands. The individual wireless links 140 and 150 may be referred to as links. The wireless units 104, 105 in the AP MLD 102 are referred to as their APs (e.g., 2.4 GHz AP-1 (AP-1 104) and 5 GHz AP-2 (AP-2 105)). The wireless units 114, 115 in the non-AP MLD 112 are referred to as their STAs (e.g., 2.4 GHz STA-1 (STA-1 114) and 5 GHz STA-2 (STA-2 115)).

[0050] Each of the affiliated APs 104 and 105 can also serve legacy non-AP STAs. For example, the AP MLD 102 with the 2.4 GHz wireless link 140 can also operate as a legacy AP serving legacy 802.11 ax non-AP STAs. In this case, as shown, the source of the 2.4 GHz wireless link is the affiliated AP 104 in the AP MLD 102.

[0051] As can be appreciated by those skilled in the art, the operation of MLD may differ from the operation of two logical stations (STAs) (multi-band clients) within the same physical entity (e.g., two non-AP STAs in the same handset). In MLD, traffic is coordinated between two links and security associations are maintained across those links. This offers several advantages over the concept of multiple logical STAs.

[0052] As mentioned above, the MLD can include one or more affiliated STAs, as shown in FIG. 1. The AP MLD 102 can be connected to a local area network (LAN), e.g., LAN 1, which can be connected to a wired G / W (gateway), as illustrated. The AP MLD 102 can have a basic service set (BSS) identifier (ID) for the MLD. FIG. 1 illustrates SSIDA as an SSID (service set identifier) ​​that identifies the network. In this case, the AP MLD 102 can provide access to the LAN to non-AP MLDs via the affiliated APs (AP-1 104 and AP-2 105). The AP-1 104 and AP-2 105 can also provide access to the LAN for legacy devices. The STAs (e.g., 104, 105, 114, and 115) are logical stations that can each operate on one link. The logical stations 104 and 105 belonging to the AP MLD may be access points (APs), and the logical stations 114 and 115 belonging to the non-AP MLD may be non-access point stations (non-AP STAs).

[0053] Without limiting the scope of the present disclosure, a multilink device 102 belonging to an AP may be referred to as a multilink AP, a multilink AP device, or an AP multilink device (AP multilink device, AP MLD). Similarly, a multilink device 112 belonging to a non-AP STA may be referred to as a multilink STA, a multilink STA device, or a STA multilink device (STA multilink device, STA MLD). Furthermore, a "member STA" may be referred to as an "STA," so that a "multilink device including a member STA" may be described as a "multilink device including a STA."

[0054] The MLD 102 or 112 may be a single antenna device or may be a multi-antenna device. For example, a device having three or more antennas may be used. The number of antennas included in the multi-link device is not limited in the embodiments of the present disclosure. The multi-link device 102 or 112 may allow services of the same access type to be transmitted on different links, or may even allow the same data packets to be transmitted on different links. Alternatively, services of the same access type may not be transmitted on different links, but services of different access types may be transmitted on different links.

[0055] IEEE 802.11 security is established between a STA and an AP to protect the traffic exchanged by the two entities. The security framework is an authentication and key management framework built on the IEEE 802.1X standard. IEEE 802.1X defines a protocol that allows a supplicant (mapped to a non-AP STA in an IEEE 802.11 infrastructure network) and an authenticator (mapped to an AP in an IEEE 802.11 infrastructure network) to mutually authenticate and establish a security association. In an IEEE 802.11 infrastructure network, the supplicant's identity may be the MAC address of the STA, and the authenticator's identity may be the MAC address of the AP.

[0056] FIG. 2 illustrates an MLD security association according to one embodiment of the present disclosure. FIG. 2 illustrates that the non-AP MLD 112 can associate with the AP MLD 102 using its non-AP MLD MAC address. The non-AP MLD 112 and the AP MLD 102 can establish a communication state to authenticate each other and exchange data. The MLDs 102 and 112 can communicate via links 140 and 150 between the STAs they belong to (link 140 between AP-1 104 and STA-1 114 and link 150 between AP-2 105 and STA-2 115). Upon successful completion of the authentication and association protocol, the STAs 114 and 115 belonging to the non-AP MLD 112 can associate with the APs 104 and 105 belonging to the AP MLD 102, respectively.

[0057] When the non-AP MLD 112 is associated with the AP MLD 102, the non-AP MLD 112 can establish a security association 202 via the authenticator associated with the AP MLD 102. From an MLD security perspective, a security association 202 is established between the non-AP MLD 112 and the AP MLD 102, but there is no security association between the affiliated non-AP STAs (STA-1 114 and STA-2 115) and their respective affiliated APs (2.4 GHz AP-1 104 and 5 GHz AP-2 105). Thus, there is no security association between STA-1 114 and its affiliated AP-1 104, since communications over link 140 may use the AP MLD security association 202.

[0058] As described, the MLD concept allows for multiple WLAN connections between the AP MLD 102 and the non-AP MLD 112. Traffic can flow on any of the multiple connections (e.g., links 140 or 150), which can provide performance gains (due to the use of multiple channels).

[0059] As mentioned above, a security association 202 is established between an AP and a non-AP MLD. A link (e.g., 140 and 150) including a member AP (104 and 105) and a member STA (114 and 115) does not participate in the MLD security association 202. Therefore, when operating as a link for AP MLD and non-AP MLD, there is no security association between the member AP (104 and 105) and the member STA (114 and 115). An embodiment of the present disclosure provides a solution to this problem.

[0060] As can be appreciated by those skilled in the art, 802.11 can include various types of frames, two of which include data frames and management frames. Management frames can be unicast between the AP and the STA and vice versa. In the base 802.11 standard, unicast management frames can be encrypted with a Pairwise Transient Key Security Association (PTKSA), which can be encrypted with a key negotiated between the AP and the STA, for example. However, in the case of multi-link operation (MLO), a PTKSA is established between the non-AP MLD and the AP MLD. Thus, in the case of MLO, there can be two possible unicast management frame transmissions: That is, between an AP MLD (e.g., AP MLD 102) and a non-AP MLD (e.g., non-AP MLD 112) for general management frames, and between a home AP (e.g., AP-1 104 or AP-2 105) and a home STA (e.g., STA-1 114 or STA-2 115) for radio-specific management frames (e.g., Radio Resource Management (RRM)).

[0061] As will be understood by those skilled in the art, in MLO, the STAs and APs that belong to it have the ability to map addresses to corresponding MLD addresses, and each of the APs that belong to it can have a unique BSSID. For example, the AP MLD 102 can send frames to the non-AP MLD 112 via the APs that belong to it (e.g., AP-1 104 or AP-2 105) and the STAs that belong to it (e.g., STA-1 114 or STA-2 115). The AP MLD 102 can relay the frames to the APs that belong to it (e.g., AP-1 104 or AP-2 105), which in turn transmit the frames to the STAs that belong to it (e.g., STA-1 114 or STA-2 115). The STAs that belong to it (e.g., STA-1 114 or STA-2 115) can then relay the frames to the non-AP MLD 112.

[0062] 3 illustrates an IEEE 802.11 management frame addressing according to one embodiment of the present disclosure. In the base 802.11 standard, when a management frame is exchanged between an AP and a STA, the MAC header may comprise one or more fields including Address 1 (A1), Address 2 (A2), and Address 3 (A3).

[0063] For base 802.11 standard operation, a management frame in the UL direction may have A1 set to BSSID, A2 set to STA, and A3 set to BSSID, as shown in row 302. Similarly, a management frame in the DL direction may have A1 set to STA, A2 set to BSSID, and A3 set to BSSID, as illustrated in row 304.

[0064] The base 802.11 standard may refer to the current addressing scheme for 802.11 non-MLDs. Unicast management frames for the MLO may be encrypted with the PTKSA, which is established between the non-AP MLD 112 and the AP MLD 102, as previously described.

[0065] As can be appreciated by those skilled in the art, the A1, A2, and A3 field requirements may depend on the type of frame being transmitted. Thus, in MLO, A1, A2, and A3 in a frame may vary based on the link selected to transmit the frame.

[0066] FIG. 4 illustrates 802.11 data frame addressing according to one embodiment of the present disclosure.

[0067] For base 802.11 standard operation, in the UL direction, a unicast data frame, before being encrypted, may have a receiver address (RA), e.g., A1, set to the BSSID, a transmitter address (TA), e.g., A2, set to the STA (that is sending the data frame), and a destination address (DA), e.g., A3, set to the STA (that is sending the data frame), as shown in line 402. The DA may be, e.g., any DA accessible over the LAN via the STA (that is sending the data frame). As will be appreciated by those skilled in the art, the LAN may be a wireless LAN or a segment of a wired LAN to which the AP is attached.

[0068] Similarly, for base 802.11 standard operation in the DL direction, a unicast data frame may have A1 set to the STA, A2 set to the BSSID, and A3 set to the Source Address (SA), as shown in row 404.

[0069] For MLO in the UL direction (e.g., 802.11be), a unicast data frame may have A1 set to AP MLD, A2 set to non-AP MLD, and A3 set to DA, as shown in row 406. Similarly, for MLO in the DL direction, a unicast data frame may have A1 set to non-AP MLD, A2 set to AP MLD, and A3 set to SA, as shown in row 408. As will be appreciated by those skilled in the art, in the addressing scheme of Figure 4, the AP MLD address may replace the BSSID of the MLO, as shown.

[0070] As can be understood by those skilled in the art, the addressing illustrated by Figure 4 for base 802.11 operation and MLO operation is applied before the data frame is encrypted and after the data frame is decrypted. In MLO, the RA and TA may be replaced after encapsulation with link-specific addresses. Before encapsulation, the MLD AP address may replace the BSSID.

[0071] However, when a data frame is transmitted, for example, over a wireless medium, the AP MLD address (e.g., in the UL direction) may be replaced by the home AP for the receiver address (RA=A1), and the transmitter address (TA=A2), for example a non-AP MLD, may be replaced by the home STA address associated with the non-AP MLD. Then, when the data frame is decoded, for example for processing, the home AP address for A1 is replaced by the AP address and the home STA address for A2 is replaced by the non-AP MLD address.

[0072] FIG. 5 illustrates unicast management frame transmission in the MLD context according to one embodiment of the present disclosure. As described, in the case of MLO, there can be two possible unicast management frame transmissions: between an AP MLD (e.g., AP MLD 102) and a non-AP MLD (e.g., non-AP MLD 112) for general management frame transmission 502, and between a belonging AP (e.g., AP-1 104 or AP-2 105) and a belonging STA (e.g., STA-1 114 or STA-2 115) for radio-specific management frame transmissions 504 and 505 (e.g., RRM). As can be appreciated by those skilled in the art, in 802.11be, a pairwise transient key (PTK) is derived using the MLD MAC address, and thus it is bound to the MLD entity. Thus, only the MLD is permitted to transmit frames encrypted with its PTK.

[0073] In the base 802.11 standard, the addressing of unicast management frames may be as follows: A1=DEST_BSSID / STA, A2=SRC_STA / BSSID, A3=BSSID, which is also shown in Figure 3, where BSSID is the address of the AP.

[0074] In MLO, legacy APs are split into two logical entities (the APs they belong to and the AP MLD) and are managed by the AP MLD as shown in Figure 2. The AP MLD 102 and non-AP MLD 112 have the option to transmit frames on either link (e.g., 140 or 150, via their APs and STAs), which may be radio-specific unicast management frames.

[0075] However, because, for example, no security association exists between AP-1 104 and STA-1 114 or between AP-2 105 and STA-2 115, a frame originating at, for example, STA-1 114 may not be encrypted at STA-1 114 for transmission to AP-1 114. Thus, the frame may be transmitted via the security association 202 between the AP MLD 102 and the non-AP MLD 104.

[0076] As a result, the addressing of unicast management frames may no longer be correct, as the existing base 802.11 scheme dictates that the frames can be directed to serving APs (e.g., AP-1 104 and AP-2 105) that do not manage security and therefore cannot encrypt or decrypt unicast management frames.

[0077] Embodiments may provide updates to the base 802.11 standard addressing scheme for unicast management frames for multi-link operation (MLO). Embodiments may enable unicast management frames to be forwarded within the MLD (e.g., a partitioned logical entity) between the affiliated STAs and the MLD. Embodiments may further enable transmission and reception of frames at the affiliated STAs, and security encapsulation and decapsulation of frames at the MLD.

[0078] Embodiments may further provide for link-specific routing of unicast management frames (e.g., RRM) by setting the A3 to the AP / BSSID or AP MLD to which it belongs. Thus, the A3 may be utilized to indicate the particular link associated with the management frame.

[0079] 6 illustrates an improved management frame addressing scheme in an MLO according to one embodiment of the present disclosure. FIG. 6 may provide an improved management frame addressing scheme for an MLO in IEEE 802.11.

[0080] 6 shows addressing of MLD management frame transmissions in the UL (row 602) and DL (row 604) between MLD entities (AP MLD 102 and non-AP MLD 112). Additionally, home AP management frames are shown in the UL (row 606) and DL (row 608) between home STA entities (home APs (AP-1 104 and AP-2 105) and home non-AP STAs (STA-1 114 and STA-2 115)).

[0081] For MLO in the UL direction, row 602, the MLD management frame (sent between the AP MLD 102 and the non-AP MLD 112) may have A1 set to AP MLD, A2 set to non-AP MLD, and A3 set to AP MLD. Similarly, for MLO in the DL direction, row 604, the MLD management frame may have A1 set to non-AP MLD, A2 set to AP MLD, and A3 set to AP MLD.

[0082] Additionally, the UL direction home AP management frame, row 606, may have A1 set to the AP MLD (the entity decoding the frame), A2 set to the non-AP MLD (the STA transmitting the frame), and A3 set to the home AP BSSID before the frame is encapsulated. As previously mentioned, A1 may be set to the AP MLD, which is the entity decoding the frame. A2 may be set to the non-AP MLD, which is the STA transmitting the frame. A3 may be set to the home AP BSSID, which is the home AP that the STA is transmitting the frame to.

[0083] In the DL direction, in row 608, a home AP management frame can have A1 set to non-AP MLD, A2 set to AP MLD, and A3 set to the home AP BSSID (associated with the home STA receiving the frame).

[0084] 5, for management frames being transmitted by STA-1 114 to AP-1 104, A1 may be set to AP MLD, A2 may be non-AP MLD, and A3 may be set to AP-1. Similarly, for frames being transmitted from AP-1 104 to STA-1 114, A1 may be set to non-AP MLD, A2 may be set to AP MLD, and A3 may be set to AP-1.

[0085] In one embodiment, in MLO, STA-1 114 may send a management frame to AP-1. In doing so, STA-1 114 may construct a frame and forward it to non-AP MLD 112. The non-AP MLD may encrypt the frame and send it to AP MLD 102 over its own link, e.g., link 140 or 150. AP MLD 102 may decapsulate the encrypted frame. AP MLD 102 may determine that the frame has A1 set to the AP MLD and A3 set to AP-1. Thus, the AP MLD may send the frame to AP-1.

[0086] As can be appreciated by those skilled in the art, the associated APs (e.g., AP-1 104 and AP-2 105) and associated STAs (e.g., STA-1 114 and STA-2 115) can participate in constructing and transmitting frames as described herein.

[0087] 7 illustrates a unicast management frame path according to one embodiment of the present disclosure. Frame path 720 illustrates the unicast management frame path from serving AP-1 104 to serving STA-1 114 as shown.

[0088] 7, the AP MLD 102 may include an AP MLD MAC instance 701 and an AP MLD Station Management Entity (SME) instance 702. The affiliated AP-1 104 may include an affiliated AP-1 MAC instance 703 and an affiliated AP-1 SME instance 704. The affiliated AP-2 105 may include an affiliated AP-2 MAC instance 705 and an affiliated AP-2 SME instance 706.

[0089] Similarly, non-AP MLD 112 may include a non-AP MLD MAC instance 711 and a non-AP MLD SME instance 712. Attached STA-1 114 may include an attached STA-1 MAC instance 713 and an attached STA-1 SME instance 714. Attached STA-2 115 may include an attached STA-2 MAC instance 715 and an attached STA-2 SME instance 716.

[0090] As discussed above, path 720 is shown illustrating the path of a unicast management frame from the serving AP-1 SME instance 704 to the serving STA-1 SME 714. As will be appreciated by those skilled in the art, the serving AP SME and the serving STA SME can transmit management frames to each other.

[0091] At 722, the belonging AP-1 SME instance 704 may generate a unicast management frame (UMF) for transmission to the belonging STA-1 SME 714. At 724, the belonging AP-1 SME instance 704 may forward the UMF to the AP MLD MAC instance 701 for encryption of the frame since MLD security is managed in the AP MLD. The message at 724 may be an internal communication between the belonging AP-1 SME 704 and the AP MLD MAC instance 701.

[0092] At 726, the AP MLD MAC instance 701 can encrypt and enqueue the UMF. The AP MLD MAC instance 701 can set the UMF SA (A3) to the belonging AP-1 SME. As can be understood by those skilled in the art, the UMF A3 can be set to the BSSID and can be the SA in this direction (DL). The AP MLD MAC instance 701 can then determine the belonging AP MAC instance (e.g., belonging AP-2 MAC instance 705) of the set of belonging AP MAC instances (e.g., belonging AP-1 MAC instance 703 or belonging AP-2 MAC instance 705) to send the UMF for transmission to the belonging STA-1 SME 714.

[0093] Thus, at 728, the AP MLD MAC instance 701 can transmit the encrypted UMF to the serving AP (e.g., the serving non-AP STA (Serving STA-1 114 or Serving STA-2 115) for transmission to the serving STA (e.g., Serving AP-2 MAC 705).

[0094] At 730, the belonging AP-2 MAC instance 705 can transmit the encrypted UMF to the belonging STA-2 MAC instance 715 as shown. At 732, the belonging STA-2 MAC instance 715 can forward the encrypted UMF to the non-AP MLD MAC instance 711 for decryption.

[0095] At 734, the non-AP MLD MAC instance 711 may decode the UMF. The non-AP MLD MAC instance 711 may determine that the UMF is addressed to the home STA-1 SME instance 714 based on A3 of the frame. A3 may indicate the address of the home AP SME (e.g., home AP-1 SME instance 704), and based on the security association 202 between the AP MLD 102 and the non-AP MLD 112, the non-AP MLD MAC instance 711 may determine that the home STA SME instance of the home AP-1 SME instance 704 may be the home STA-1 SME instance 714. Thus, at 736, the non-AP MLD MAC instance 711 may forward the decoded UMF to the home STA-1 SME instance 714.

[0096] As will be appreciated by those skilled in the art, the transmission at 730 may occur on any of the available links between the AP MLD 102 and the non-AP MLD 112 (e.g., link 140 or link 150). Either link may be used since the link (e.g., link 140 or 150) communicates frames between the AP MLD 102 and the non-AP MLD 112. Thus, in another embodiment, the operations performed at 728, 730, and 732 may be replaced with the operations performed at 738, 740, and 742, respectively. For example, at 738, the AP MLD MAC instance 701 may send the encrypted UMF to its serving AP (e.g., its serving AP-1 MAC instance 703) for transmission to its serving non-AP STA (e.g., its serving STA-1 114). At 740, the serving AP-1 MAC instance 703 may send the encrypted UMF to its serving STA-1 MAC instance 713, as shown. At 742, the serving STA-1 MAC instance 713 may forward the encrypted UMF to the non-AP MLD MAC instance 711 for decryption.

[0097] 8 is a call flow diagram of a link-specific management frame flow according to one embodiment of the present disclosure. Call flow 800 may illustrate the transmission of a UMF from serving STA-2 to serving AP-2 105.

[0098] 8, at 802, the serving STA-2 SME instance 716 may construct a link-specific Management MAC Protocol Data Unit (MMPDU) for transmission to the serving AP2 (e.g., serving AP-2 105). A typical example of a link-specific MMPDU may be a Radio Resource Measurement Frame.

[0099] At 804, the affiliated STA-2 SME instance 716 can transmit an MMPDU to the non-AP MLD MAC instance 711 using addressing of A1 configured in AP2, A2 configured in STA2, and A3 (DA) configured in AP2.

[0100] As can be understood by those skilled in the art, the non-AP MLD 112 (e.g., the non-AP MLD MAC instance 711) may determine from A3 of the received MMPDU frame that AP-2 is the destination address. Based on the security association 202, the non-AP MLD 112 may determine that AP-2 belongs to the AP MLD 102. Thus, the non-AP MLD may transmit the encapsulated MMPDU to the AP MLD via a belonging STA MAC instance (e.g., the belonging STA-2 MAC instance 715) selected from a set of STA MAC instances (e.g., the belonging STA-1 MAC 713 and the belonging STA-2 MAC 715 in this embodiment). The non-AP MLD may transmit the encapsulated MMPDU using any of the belonging STAs (e.g., STA1 or STA2).

[0101] When the non-AP MLD 112 is associated with the AP MLD 102, their corresponding affiliates are mapped to each other such that STA-1 is mapped to AP-1, STA-2 is mapped to AP-2, and so on. Additionally, although the non-AP MLD 112 and the AP MLD 102 are shown as having two links (e.g., 140 and 150) through their respective serving STAs and serving APs, one skilled in the art can appreciate that there may be more than two links between the non-AP MLD 112 and the AP MLD 102 (e.g., there may be more than two serving APs for an AP MLD and more than two serving STAs for a non-AP MLD).

[0102] At 806, the non-AP MLD MAC instance 711 may encapsulate the MMPDU with the PTK (encryption).

[0103] As used herein, the term encapsulation refers to encryption and forwarding, such that when a frame is encapsulated, the frame is encrypted and forwarded within another frame. It should be understood by those skilled in the art that in some embodiments, the payload is received and encrypted, inserted into a new frame with new header information, and transmitted by the forwarding, transmitting, or sending entity.

[0104] The non-AP MLD MAC instance 711 may then forward the frame to its owning STA-2 MAC instance 715 with addressing A1 set to AP MLD, A2 set to non-AP MLD, and A3 set to AP2, at 808. Since the encapsulation is based on the security association 202 between the non-AP MLD 112 and the AP MLD 102, the addressing of the frame is changed, at 808, accordingly.

[0105] At 810, the affiliated STA-2 MAC instance 715 may transmit the encrypted MMPDU over the air (OTA) to the affiliated AP-2 105 (e.g., affiliated AP-2 MAC instance 705) using the addressing A1 set to AP2, A2 set to STA2, and A3 set to AP2. As can be appreciated by one skilled in the art, the transmitted frame OTA may be enhanced by having its A3 to AP2 (remain unchanged). In this context, OTA refers to the external wireless interface as defined by IEEE 802.11, as opposed to, for example, an internal connection between the MLD and its affiliated station.

[0106] At 812, the frame is encapsulated based on the security association 202 between the non-AP MLD 112 and the AP MLD 102, so the embodiment allows the affiliated AP-2 MAC instance 705 to decapsulate and process the received frame. Thus, the affiliated AP-2 MAC instance 705 can map the address of the frame, for example, by setting A1 to AP MLD, A2 to non-AP MLD, and keeping A3 as AP2. The affiliated AP-2 MAC instance 705 can then forward the frame with the updated address to the AP MLD 102 (e.g., AP MLD MAC instance 701) for decapsulation.

[0107] At 814, the AP MLD 102 (e.g., AP MLD MAC instance 701) may decapsulate (decode) the MMPDU using the PTK. The AP MLD 102 (e.g., AP MLD MAC instance 701) may determine that the frame is destined for AP-2 105 based on A3 (set to AP-2). Furthermore, the AP MLD 102 (e.g., AP MLD MAC instance 701) may determine that the transmitter address (TA) may be the belonging STA (e.g., STA-2 115) mapped to AP-2 105 based on A2 indicating non-AP MLD. Thus, the AP MLD 102 (e.g., AP MLD MAC instance 701) may then transmit the decapsulated frame to AP-2 105 using the addressing, i.e., A1 set to AP2, A2 set to STA2, and A3 set to AP2. As will be appreciated by those skilled in the art, the addressing of decapsulated frames sent by the AP MLD 102 (e.g., AP MLD MAC instance 701) may be similar to the addressing of the MMPDU header 804 sent by the attached STA2 SME to a non-AP MLD, as shown.

[0108] In another embodiment, as shown, the operations performed at 808, 810, and 812 may be alternatively performed by the operations at 828, 830, and 832, respectively. Once the non-AP MLD MAC instance 711 has encrypted the MMPDU with the PTK at 806, as described above, the non-AP MLD MAC instance 711 may transmit the encapsulated MMPDU to the AP MLD at 828 via a home STA MAC instance (e.g., home STA-1 MAC instance 713) selected from a set of STA MAC instances (e.g., home STA-1 MAC 713 and home STA-2 MAC 715 in this embodiment). The non-AP MLD MAC instance 711 may forward the frame to home STA-1 MAC instance 713 using addressing of A1 set for AP MLD, A2 set for non-AP MLD, and A3 set for AP2.

[0109] At 830, the affiliated STA-1 MAC instance 713 may transmit the encrypted MMPDU over the air (OTA) to the affiliated AP-1 104 (e.g., the affiliated AP-1 MAC instance 703) using addressing with A1 set to AP1, A2 set to STA1, and A3 set to AP2. As can be appreciated by one skilled in the art, the transmitted frame OTA may be enhanced by having its A3 set to AP2 (remain unchanged).

[0110] At 832, the affiliated AP-1 MAC instance 703 may not be able to decapsulate and process the received frame because the frame is encapsulated based on the security association 202 between the non-AP MLD 112 and the AP MLD 102. Thus, the affiliated AP-1 MAC instance 703 may map the address of the frame by, for example, setting A1 to AP MLD, A2 to non-AP MLD, and keeping A3 as AP2. The affiliated AP-1 MAC instance 703 may then forward the frame with the updated address to the AP MLD 102 (e.g., AP MLD MAC instance 701 for decapsulation).

[0111] 9 is a call flow diagram of a link-specific management frame flow in DL according to another embodiment of the present disclosure. The call flow of FIG. 9 may reflect the unicast management frame path of FIG. 7, as described further herein.

[0112] 9, a call flow 920 may mirror frame path 720 of FIG. 7, illustrating a unicast management frame path from the serving AP-1 104 to the serving STA-1 114, as shown. At 922, which may be similar to 722, the serving AP-1 SME instance 704 may construct a link-specific management MAC protocol data unit (MMPDU) for transmission to the serving STA-1 114 (STA-1 SME 714).

[0113] At 924, which may be similar to 724, the affiliated AP-1 SME instance 704 may forward the MMPDU to the AP MLD MAC instance 701 for frame encryption since MLD security is managed in the AP MLD. In forwarding the MMPDU, the affiliated AP-1 SME instance 704 may use addressing, i.e., A1 set to STA1, A2 set to AP1, and A3 set to AP1. The message at 924 may be an internal communication between the affiliated AP-1 SME 704 and the AP MLD MAC instance 701.

[0114] As can be understood by those skilled in the art, the AP MLD 102 (e.g., the AP MLD MAC instance 701) can determine from A1 of the received MMPDU frame that STA-1 114 is the receiver address. Based on the security association 202, the AP MLD 102 can determine that STA-1 belongs to the non-AP MLD 112. The AP MLD MAC instance 701 can then determine the belonging AP MAC instance (e.g., the belonging AP-2 MAC instance 705) of the set of belonging AP MAC instances (e.g., the belonging AP-1 MAC instance 703 or the belonging AP-2 MAC instance 705) to send the MMPDU for transmission to the belonging STA-1 SME 714. The AP MLD 102 can encrypt and send the MMPDU to the non-AP MLD via the belonging AP MAC instance (e.g., the belonging AP-2 MAC instance 705).

[0115] Thus, at 926, which may be similar to 726, the AP MLD MAC instance 701 may transmit an MMPDU with the PTK (encrypted). The AP MLD MAC instance 701 may then forward the encapsulated frame at 928 (similar to 728) to its AP-2 MAC instance 705 using addressing, i.e., A1 set to non-AP MLD, A2 set to AP MLD, and A3 (SA) set to AP1. Since the encapsulation is based on the security association 202 between the non-AP MLD 112 and the AP MLD 102, the addressing of the frame is changed accordingly at 928.

[0116] At 930, which may be similar to 730, the affiliated AP-2 MAC instance 705 may set addressing A1 to STA2, A2 to A2, and A3 to AP1 and send the encrypted MMPDU over the air to the affiliated STA-2 MAC instance 715.

[0117] At 932, which may be similar to 732, the belonging STA-2 MAC instance 715 may not be able to decapsulate and process the received frame because the frame is encapsulated based on the security association 202 between the non-AP MLD 112 and the AP MLD 102. Therefore, the belonging STA-2 MAC instance 715 may forward the encapsulated MMPDU to the non-AP MLD MAC instance 711 for decapsulation. In forwarding the encapsulated MMPDU, the belonging STA-2 MAC instance 715 may use the addressing, i.e., A1 set to the non-AP MLD, A2 set to the AP MLD, and A3 set to AP1.

[0118] At 934, which may be similar to 734, the non-AP MLD MAC instance 711 may decapsulate (decode) the MMPDU using the PTK. The non-AP MLD MAC instance 711 may determine that the MMPDU is destined for its STA-1 SME instance 714 based on A3 of the frame. A3 may indicate the address of its AP SME (e.g., its AP-1 SME instance 704), and based on the security association 202 between the AP MLD 102 and the non-AP MLD 112, the non-AP MLD MAC instance 711 may determine that its STA SME instance of its AP-1 SME instance 704 is its STA-1 SME instance 714. Thus, at 936 (which may be similar to 736), the non-AP MLD MAC instance 711 may forward the decapsulated MMPDU to its affiliated STA-1 SME instance 714 using addressing A1 set to STA1, A2 set to AP1, and A3 set to AP1.

[0119] As can be appreciated by one skilled in the art, the operations performed at 930 may occur on any of the available links (e.g., link 140 or link 150) between the AP MLD 102 and the non-AP MLD 112. Either link (e.g., link 140 or 150) may be used since the link communicates frames between the AP MLD 102 and the non-AP MLD 112. Thus, in another embodiment, the operations performed at 928, 930, and 932 may be replaced with operations performed at 938, 940, and 942, respectively.

[0120] Thus, in another embodiment, at 938, which may be similar to 738, the AP MLD MAC instance 701 may send the encapsulated MMPDU to its own AP (e.g., its own AP-1 MAC instance 703) for transmission using addressing, i.e., A1 set to AP MLD, A2 set to AP1, and A3 set to A1.

[0121] At 940, which may be similar to 740, the affiliated AP-1 MAC instance 703 may transmit the encrypted MMPDU over the air to the affiliated STA-1 MAC instance 713 using addressing, i.e., A1 set to STA1, A2 set to AP1, and A3 set to AP1, as shown.

[0122] At 942, which may be similar to 742, the belonging STA-1 MAC instance 713 may not be able to decapsulate and process the received frame because the frame is encapsulated based on the security association 202 between the non-AP MLD 112 and the AP MLD 102. Therefore, the belonging STA-1 MAC instance 713 may forward the encapsulated MMPDU to the non-AP MLD MAC instance 711 for decapsulation.

[0123] As described herein, embodiments may provide for transmission of management frames based on a change in MAC address. As described, for example, with reference to FIG. 7 and FIG. 9, management frames may be transmitted by a method between the AP MLD to the serving AP and the non-AP MLD to the serving STA. The method may include generating a management frame in the serving AP SME with A1 (RA) set to STA-1, A2 (TA) set to AP-1, and A3 set to AP-1. It should be appreciated that A3 may be SA in the DL case and DA in the UL case. The method may further include encapsulating the management frame and changing A1 to the non-AP MLD and A2 to the AP MLD while keeping A3 the same (e.g., AP-1). The method may further include changing A1 to the serving STA and A2 to the serving AP on the link that the frame is transmitted over the air. The method may further include receiving the frame at the serving STA and setting A1 to non-AP MLD, A2 to AP MLD, and leaving A3 as is. The method may further include encapsulating the frame and determining that the frame is directed to STA-1 based on the A1, A2, A3 settings. The method may further include receiving the frame from the non-AP MLD at the STA-1 SME.

[0124] Embodiments may provide for supporting unicast management frame security within an 802.11 MLD. As described herein, embodiments may further provide an extended 802.11 frame addressing scheme such that unicast management frames may be correctly received, transmitted, encoded (encrypted or encapsulated) and decoded (decoded or decapsulated) within the MLD. As will be appreciated by those skilled in the art, the frame addressing scheme may differ depending on whether the unicast management frames are link-specific (between a serving AP and a serving non-AP STA) or general (between a non-AP MLD and an AP MLD).

[0125] 10 is a schematic diagram of a UE 1000 capable of performing any or all of the operations of the above methods and features explicitly or implicitly described herein according to different embodiments of the present invention. For example, a computer with network capabilities may be configured as the UE 1000.

[0126] As shown, the UE 1000 may include a processor 1010, such as a central processing unit (CPU), or a dedicated processor, such as a graphics processing unit (GPU), or other such processor unit, memory 1020, non-transitory mass storage 1030, input / output interface 1040, network interface 1050, and transceiver 1060, all communicatively coupled via a bidirectional bus 1070. According to a particular embodiment, any or all of the illustrated elements may be utilized, or only a subset of the elements may be utilized. Furthermore, the UE 1000 may include multiple instances of a particular element, such as multiple processors, memories, or transceivers. Also, elements of a hardware device may be directly coupled to other elements without a bidirectional bus. In addition to or in place of the processor and memory, other electronic devices, such as integrated circuits, may be employed to perform the required logical operations.

[0127] The memory 1020 may include any type of non-transitory memory, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), read only memory (ROM), any combination of the like. The mass storage element 1030 may include any type of non-transitory storage device, such as a solid state drive, a hard disk drive, a magnetic disk drive, an optical disk drive, a USB drive, or any computer program product configured to store data and machine executable program code. According to certain embodiments, the memory 1020 or mass storage 1030 may include statements and instructions executable by the processor 1010 to perform any of the above-mentioned method operations described above.

[0128] Embodiments of the invention may be implemented using electronic hardware, software, or a combination thereof. In some embodiments, the invention is implemented by one or more computer processors executing program instructions stored in memory. In some embodiments, the invention is implemented partially or fully in hardware, for example, using one or more field programmable gate arrays (FPGAs) or application specific integrated circuits (ASICs) to rapidly perform processing operations.

[0129] Although specific embodiments of the present technology have been described herein for illustrative purposes, it should be understood that various modifications may be made without departing from the scope of the present technology.The specification and drawings should therefore be considered merely as illustrative of the present invention as defined by the appended claims, and are intended to cover any and all modifications, variations, combinations or equivalents that are within the scope of the present technology.In particular, it is within the scope of the present technology to provide a computer program product or program element, or a program storage or memory device, such as a magnetic or optical wire, tape, or disk, for storing a machine-readable signal, for controlling the operation of a computer in accordance with the method of the present technology, and / or for structuring some or all of its components in accordance with the system of the present technology.

[0130] The operations associated with the methods described herein may be implemented as coded instructions in a computer program product, in other words, a computer-readable medium having recorded thereon software code for performing the methods when the computer program product is loaded into a memory and executed on a microprocessor of a wireless communication device.

[0131] Furthermore, each operation of the method can be executed according to one or more, or one or more part of, program elements, modules, or objects generated from any programming language, such as C++, Java, etc., on any computing device, such as a personal computer, a server, a PDA, etc. In addition, each operation, or a file or object implementing each said operation, etc., may be executed by dedicated hardware or a circuit module designed for that purpose.

[0132] Through the description of the above embodiments, the present invention may be implemented using only hardware, or using software and a required universal hardware platform. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product. The software product may be stored in a non-volatile or non-transitory storage medium, which may be a compact disk read-only memory (CD-ROM), a USB flash memory, or a removable hard disk. The software product includes some instructions that enable a computer device (personal computer, server, or network device) to execute the method provided in the embodiments of the present invention. For example, such execution may correspond to the simulation of the logical operations described herein. The software product may additionally or alternatively include some instructions that enable a computer device to execute operations for programming or digital logic devices according to the embodiments of the present invention.

[0133] While the invention has been described with reference to particular features and embodiments thereof, it is apparent that various modifications and combinations can be made without departing from the invention. Accordingly, the specification and drawings should be regarded merely as illustrative of the invention as defined by the appended claims, and are intended to cover any and all modifications, variations, combinations or equivalents that are within the scope of the invention. [Explanation of symbols]

[0134] 100 MLD Architecture 102 Multilink Devices 104 Logical Station / Radio Unit 105 Logical Station / Radio Unit 112 Multilink Devices 114 Logical Station / Radio Unit 115 Logical Station / Radio Unit 140 Links 150 Links 202 Security Associations Line 302 304 rows 402 lines 404 lines 406 lines 408 lines 502 Management Frame Sent 504 Management Frame Sent 602 lines 604 lines 606 lines 608 lines 701 AP MLD MAC Instances 702 AP MLD Station Management Entity (SME) Instance 703 AP-1 MAC Instance 704 AP-1 SME instance 705 AP-2 MAC Instance 706 AP-2 SME Instance 711 Non-AP MLD MAC Instance 712 Non-AP MLD SME Instance 713 STA-1 MAC Instance 714 STA-1 SME instance 715 STA-2 MAC Instance 716 STA-2 SME Instance 720 Frame Pass 800 Call Flow 804 MMPDU Header 920 Call Flow 1010 Processor 1020 Memory 1030 Mass Storage 1040 Input / Output Interface 1050 Network Interface 1060 Transceiver 1070 Bidirectional Bus

Claims

1. 1. A method for communicating management frames between a first multi-link device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, and the second MLD belonging to a second STA and a fourth STA, the method comprising: receiving, by the first multi-link device (MLD), from the first station (STA), a management frame including a header indicating address information of the second station; encrypting, by the first MLD, the management frame based on a security association established between the first MLD and the second MLD; transmitting the encrypted management frame by the first MLD towards the second MLD via one of the first STA and the third STA; A method comprising:

2. The method of claim 1 , wherein the header of the management frame indicates one of a destination address of the second STA and a source address of the first STA.

3. The method of claim 1 or 2, wherein the header of the management frame further indicates a receiver address of the second STA and a transmitter address of the first STA.

4. updating, by the first MLD, a header of the encrypted management frame to indicate at least one address from a set including a receiver address of the second MLD and a sender address of the first MLD.

4. The method of claim 1, further comprising:

5. The method of claim 1 , wherein the first MLD has a Media Access Control (MAC) instance of the first MLD.

6. The method according to claim 1 , wherein the first STA has a Station Management Entity (SME) instance of the first STA.

7. The method according to claim 1 , wherein the third STA has a MAC instance of the third STA.

8. A method according to claim 7, wherein a first internal connection connects the first STA to the first MLD, and a third internal connection connects the third STA to the first MLD; the management frame is received from the first STA via the first internal connection; the step of transmitting includes transmitting the encrypted management frame using an over-the-air (OTA) connection.

8. The method according to any one of claims 1 to 7.

9. The step of transmitting transmitting the encrypted management frame to the first STA via the first internal connection; transmitting the encrypted management frame from the first STA to the second STA over the OTA connection, the header of the encrypted management frame being updated to indicate a receiver address of the second STA and a transmitter address of the first STA; 9. The method of claim 8, comprising:

10. The step of transmitting transmitting the encrypted management frame to the third STA via the third internal connection; transmitting the encrypted management frame from the third STA to the fourth STA via the OTA connection, wherein the header of the encrypted management frame is updated to indicate a receiver address of the fourth STA and a transmitter address of the third STA; 9. The method of claim 8, comprising:

11. 1. A method for communicating management frames between a first multi-link device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, and the second MLD belonging to a second STA and a fourth STA, the method comprising: receiving, by the first multilink device (MLD), from a second MLD using an over-the-air (OTA) connection, an encrypted management frame including a header indicating address information of the second STA; decrypting, by the first MLD, the encrypted management frame based on an associated security established between the first MLD and the second MLD; transmitting the decoded management frame by the first MLD based on a header of the decoded management frame; A method comprising:

12. 12. The method of claim 11, wherein the header of the encrypted management frame indicates one of a destination address of the first STA and a source address of the second STA.

13. The method of claim 11 or 12, wherein the header of the encrypted management frame further indicates a receiver address of the first MLD and a transmitter address of the second MLD.

14. The OTA connection is between the first STA and the second STA, a first internal connection connects the first STA to the first MLD, and the step of receiving the management frame from the first STA by the first MLD includes: receiving the encrypted management frame over the OTA connection; transmitting the encrypted management frame from the first STA to the first MLD via the first internal connection; 14. The method according to any one of claims 11 to 13, comprising:

15. The OTA connection is between the third STA and the fourth STA, and a third internal connection connects the third STA to the first MLD, and the receiving step includes: receiving the encrypted management frame over the OTA connection; transmitting the encrypted management frame from the third STA to the first MLD via the third internal connection; 14. The method according to any one of claims 11 to 13, comprising:

16. updating, by the first MLD, the header of the decoded management frame to indicate at least one address from a set including a receiver address of the first STA and a transmitter address of the third STA.

16. The method of any one of claims 11 to 15, further comprising:

17. the step of transmitting the decoded management frame based on a header of the decoded management frame by the first MLD, The method according to any one of claims 11 to 16, comprising the step of transmitting, by the first MLD, the decoded management frame to the first STA.

18. 18. The method of claim 11, wherein the first MLD has a MAC instance of the first MLD.

19. The method according to any one of claims 11 to 18, wherein the first STA comprises a Station Management Entity (SME) of the first STA.

20. The method of any one of claims 11 to 19, wherein the second STA has a MAC instance of the second STA.

21. 21. The method of any one of claims 11 to 20, wherein the first STA is the same as or different from the second STA.

22. 22. The method of claim 11, wherein the first MLD is one of an access point (AP) MLD or a non-AP MLD.

23. A system for communicating management frames between a first multilink device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, the second MLD belonging to a second STA and a fourth STA, The first STA, generating a management frame including a header indicating the second STA; Transmitting the generated management frame to the first MLD; It is configured as follows: The first MLD comprises: receiving the management frame from the first STA; encrypting the management frame based on a security association established between the first MLD and the second MLD; transmitting the encrypted management frame toward the second MLD via one of the first STA and the third STA; The system is configured as follows.

24. 24. The system of claim 23, wherein the header of the management frame indicates one of a destination address of the second STA and a source address of the first STA.

25. 25. The system of claim 23 or 24, wherein the header of the management frame further indicates a receiver address of the second STA and a transmitter address of the first STA.

26. The first MLD comprises:

24. The system of claim 23, further configured to update the header of the encrypted management frame to indicate one or more of a receiver address of the second MLD or a transmitter address of the first MLD.

27. A method according to claim 27, wherein a first internal connection connects the first STA to the first MLD, and a third internal connection connects the third STA to the first MLD; the management frame is received from the STA via the first internal connection; transmitting the encrypted management frame toward the second MLD via one of the first STA and the third STA includes transmitting the encrypted management frame using an over-the-air (OTA) connection.

27. A system according to any one of claims 23 to 26.

28. The method of claim 27, further comprising: transmitting the encrypted management frame to the first STA via the first internal connection; transmitting the encrypted management frame from the first STA to the second STA over the OTA connection, wherein the header of the encrypted management frame is updated to indicate a receiver address of the second STA and a transmitter address of the first STA; 28. The system of claim 27, comprising:

29. The method of claim 20, further comprising: transmitting the encrypted management frame to the third STA via the third internal connection; sending the encrypted management frame from the third STA to the fourth STA over the OTA connection, the header of the encrypted management frame being updated to indicate a receiver address of the fourth STA and a transmitter address of the third STA; 28. The system of claim 27, comprising:

30. A system for communicating management frames between a first multilink device (MLD) and a second MLD, the first MLD belonging to a first station (STA) and a third STA, the second MLD belonging to a second STA, The first STA, receiving an encrypted management frame from the second MLD using an over-the-air (OTA) connection, the management frame including a header indicating the second MLD; transmitting the encrypted management frame to the first MLD; It is configured as follows: The first MLD comprises: receiving the encrypted management frame from the first STA; decrypting the encrypted management frame based on a security association established between the first MLD and the second MLD; transmitting the encrypted management frame based on the header of the decrypted management frame; The system is configured as follows.

31. 31. The system of claim 30, wherein the header of the encrypted management frame indicates one of a destination address of the first STA, a destination address of the third STA, and a source address of the second STA.

32. 32. The system of claim 30 or 31, wherein the header of the encrypted management frame further indicates a receiver address of the first MLD and a transmitter address of the second MLD.

33. The OTA connection is between the first STA and the second STA, and a first internal connection connects the first STA to the first MLD; transmitting the encrypted management frame to the first MLD includes transmitting the encrypted management frame via the first internal connection; receiving the encrypted management frame from the first STA includes receiving the encrypted management frame via the first internal connection.

33. A system according to any one of claims 30 to 32.

34. 34. The system of claim 30 or 33, wherein the first MLD is further configured to update the header of the decoded management frame to indicate at least one address from a set including a receiver address of one of the first STA and the third STA, and a transmitter address of the second STA.

35. 35. The system of claim 34, wherein the receiver address indicates the first STA, and transmitting the encrypted management frame based on a header of the decrypted management frame includes transmitting the decrypted encrypted management frame to the first STA.

36. 35. The system of claim 34, wherein the receiver address indicates the third STA, and transmitting the encrypted management frame based on a header of the decrypted management frame includes transmitting the decrypted encrypted management frame to the third STA.

37. A non-transitory computer readable medium storing instructions that, when executed by a processor, cause a wireless communication device to perform the method of any one of claims 1 to 22.

Images