Devices and methods for secure communication in a wireless network

Abstract

An access point, AP, (120) for a wireless communication network (100) is disclosed. The AP (120) is configured to broadcast periodically a first type beacon frame (200) and a second type beacon frame (300) to a plurality of non-AP stations (110a-c) of the wireless communication network (100). The first type beacon frame (200) comprises first information allowing one or more un-associated non-AP stations (110b,c) of the plurality of non-AP stations (110a-c) to discover the AP (120) and capabilities of the AP (120) for association purposes. The second type beacon frame (300) comprises second information for managing one or more non-AP stations (110a) of the plurality of non-AP stations (110a-c) that are associated with the AP (120). Using the first type beacon frame (200) for discovery and association purposes and the second type beacon frame (300), which may be encrypted, for managing the associated non-AP stations (110a-c) allows, for instance, preventing man-in-the-middle attacks and, thus, making the wireless communication network (100) more secure.

Description

[0001] DEVICES AND METHODS FOR SECURE COMMUNICATION IN A WIRELESS NETWORK

[0002] TECHNICAL FIELD

[0003] The present invention relates to wireless communications. More specifically, the present invention relates to devices and methods for secure communication in a wireless network, in particular a Wi-Fi network.

[0004] BACKGROUND

[0005] IEEE 802.11-based WLANs (also referred to as Wi-Fi networks) have become popular at an unprecedented rate. Security of Wi-Fi networks is important, because in unsecure Wi-Fi networks adversaries may collect personal information and steal identities of users, compromise financial and other sensitive business data, eavesdrop on communications, and more. For instance, man-in-the-middle (MitM) attacks are a common form of security attack towards Wi-Fi networks that allow attackers to catch and manipulate communication between, for instance, an access point, AP, and a non-AP station of a Wi-Fi network. A multi-channel, MC, MitM attack is an advanced MitM attack using two different channels allowing the attacker to forward frames between both channels so that the attacker legitimately may manipulate, e.g., block, delay, modify, inject, and / or replay, encrypted frames between an AP and non-AP stations. Detecting an MitM and in particular an MC-MitM attack is challenging because the attacker acquires the MitM position between an already connected non-AP station and an AP in a Wi-Fi network without disconnecting the non-AP station from the Wi-Fi network.

[0006] SUMMARY

[0007] It is an objective to provide improved devices and methods for secure communication in a wireless network, in particular an IEEE 802.11 based Wi-Fi network, in particular allowing to avoid or at least mitigate an MitM and in particular an MC-MitM attack.

[0008] The foregoing and other objectives are achieved by the subject matter of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures.

[0009] According to a first aspect an access point, AP, for a wireless communication network is provided. The AP is configured to broadcast periodically a beacon frame of a first type (herein referred to as first type beacon frame) and a beacon frame of a second type (herein referred to as second type beacon frame) to a plurality of non-AP stations of the wireless communication network. The first type beacon frame comprises first information allowing one or more un-associated non-AP stations of the plurality of non-AP stations to discover the AP and the capabilities of the AP for association purposes. The second type beacon frame comprises second information for managing one or more non-AP stations of the plurality of non-AP stations that are associated with the AP. Using the first type beacon frame for discovery and association purposes and the second type beacon frame, which may be encrypted, for managing the associated non-AP stations allows, for instance, preventing man- in-the-middle attacks and, thus, making the wireless communication network more secure.

[0010] In a further possible implementation form, the AP is configured to start periodically broadcasting the second type beacon frame, in response to a request from at least one of the non-AP stations that is associated with the AP based on the first information.

[0011] In a further possible implementation form, the AP is configured to receive a request frame from at least one of the non-AP stations that is associated with the AP and to transmit, in response to the received request frame, an encrypted response frame to the at least one of the non-AP stations that is associated with the AP, wherein the encrypted response frame comprises the encrypted second information.

[0012] In a further possible implementation form, the request frame is a probe request frame and / or the encrypted response frame is an encrypted probe response frame.

[0013] In a further possible implementation form, the second type beacon frame comprises a frame body and the AP is configured to encrypt the entire frame body of the second type beacon frame using one or more cryptographic keys.

[0014] In a further possible implementation form, the first information of the first type beacon frame comprises a service set identifier, SSID, corresponding to the AP.

[0015] In a further possible implementation form, the first information of the first type beacon frame comprises information representative of one or more data rates supported by the AP.

[0016] In a further possible implementation form, the first information of the first type beacon frame comprises information representative of a beacon transmission interval of the first type beacon frame. In a further possible implementation form, the second information of the second type beacon frame comprises information representative of a beacon transmission interval of the second type beacon frame.

[0017] In a further possible implementation form, the second information of the second type beacon frame comprises information representative of a value of a timer, in particular a timing synchronization function, TSF, timer of the AP.

[0018] In a further possible implementation form, the second information of the second type beacon frame comprises one or more enhanced distributed channel access, EDCA, parameters per access category.

[0019] In a further possible implementation form, the second information of the second type beacon frame comprises information representative of a delivery traffic indication message, DTIM, interval.

[0020] In a further possible implementation form, the second information of the second type beacon frame comprises a channel switch announcement, CSA.

[0021] In a further possible implementation form, the second information of the second type beacon frame comprises an extended channel switch announcement, ECSA.

[0022] In a further possible implementation form, the second information of the second type beacon frame comprises a traffic indication map, TIM.

[0023] In a further possible implementation form, the second information of the second type beacon frame comprises a multi user enhanced distributed channel access, MU EDCA, Parameter Set.

[0024] In a further possible implementation form, the second information of the second type beacon frame comprises one or more multiple basic service set identifier, Multiple BSSID, elements.

[0025] In a further possible implementation form, the second information of the second type beacon frame comprises one or more Operation elements, such as: HT Operation, VHT Operation, HE Operation, EHT Operation, WUR Operation. In a further possible implementation form, the second information of the second type beacon frame comprises a Reduced Neighbour Report, RNR.

[0026] In a further possible implementation form, the second information of the second type beacon frame comprises a basic service set, BSS, Color Change Announcement.

[0027] In a further possible implementation form, the AP is configured to periodically broadcast the plurality of first type beacon frames with a different period than the plurality of second type beacon frames.

[0028] In a further possible implementation form, the AP is a multi-link device, MLD, configured to communicate via a plurality of links with the plurality of non-AP MLDs of the wireless communication network.

[0029] In a further possible implementation form, the wireless communication network is a Wi-Fi network.

[0030] According to a second aspect a method for operating an access point, AP, in a wireless communication network is provided. The method comprises the steps of: broadcasting periodically a first type beacon frames and a second type beacon frames to a plurality of non-AP stations of the wireless communication network, wherein the first type beacon frame comprises first information allowing an un-associated non- AP station of the plurality of non-AP stations to discover the AP and capabilities of the AP for association purposes, and wherein the second type beacon frame comprises information for managing one or more non- AP stations of the plurality of non-AP stations that are associated with that AP.

[0031] The method according to the second aspect of the present disclosure can be performed by the AP according to the first aspect of the present disclosure. Thus, further features of the method according to the second aspect of the present disclosure result directly from the functionality of the AP according to the first aspect of the present disclosure as well as its different implementation forms described above and below.

[0032] According to a third aspect a non-access point, AP, station for a wireless communication network is provided. The non-AP station is configured to receive periodically a first type beacon frame and a second type beacon frame from an AP of the wireless communication network. The first type beacon frame comprises first information allowing the un-associated non-AP station to discover the AP and the capabilities of the AP for association purposes. The second type beacon frame comprises second information for managing the non-AP station, once the non-AP station is associated with the AP. Using the first type beacon frame for discovery and association purposes and the second type beacon frame, which may be encrypted, for managing the associated non-AP station allows, for instance, preventing man-in-the-middle attacks and, thus, making the wireless communication network more secure.

[0033] In a further possible implementation form, the non-AP station is configured to send a request to the AP for triggering the AP to start periodically broadcasting the second type beacon frame, once the non-AP station is associated with the AP based on the first information of the first type beacon frame.

[0034] In a further possible implementation form, once the non-AP station is associated with the AP based on the first information of the first type beacon frame, the non-AP station is configured to send a request frame to the AP and to receive an encrypted response frame from the AP, wherein the encrypted response frame comprises the encrypted second information.

[0035] In a further possible implementation form, the request frame is a probe request frame and / or the encrypted response frame is an encrypted probe response frame.

[0036] In a further possible implementation form, the non-AP station is configured to decrypt the encrypted response frame from the AP based on one or more cryptographic keys derived during or after the association with the AP.

[0037] In a further possible implementation form, the second type beacon frame comprises a frame body and the non-AP station is configured to decrypt the entire frame body of the second type beacon frame using one or more cryptographic keys.

[0038] In a further possible implementation form, the first information of the first type beacon frame comprises a service set identifier, SSID, corresponding to the associated AP.

[0039] In a further possible implementation form, the first information of the first type beacon frame comprises information representative of one or more data rates supported by the associated AP.

[0040] In a further possible implementation form, the first information of the first type beacon frame comprises information representative of a beacon transmission interval of the first type beacon frame. In a further possible implementation form, the second information of the second type beacon frame comprises information representative of a beacon transmission interval of the second type beacon frame.

[0041] In a further possible implementation form, the second information of the second type beacon frame comprises information representative of a value of a timer, in particular a timing synchronization function, TSF, timer of the AP.

[0042] In a further possible implementation form, the second information of the second type beacon frame comprises one or more enhanced distributed channel access, EDCA, parameters per access category.

[0043] In a further possible implementation form, the second information of the second type beacon frame comprises information representative of a delivery traffic indication message, DTIM, interval.

[0044] In a further possible implementation form, the second information of the second type beacon frame comprises a channel switch announcement, CSA.

[0045] In a further possible implementation form, the second information of the second type beacon frame comprises an extended channel switch announcement, ECSA.

[0046] In a further possible implementation form, the second information of the second type beacon frame comprises a traffic indication map, TIM.

[0047] In a further possible implementation form, the second information of the second type beacon frame comprises a multi user enhanced distributed channel access, MU EDCA, Parameter Set.

[0048] In a further possible implementation form, the second information of the second type beacon frame comprises one or more multiple basic service set identifier, Multiple BSSID, elements.

[0049] In a further possible implementation form, the second information of the second type beacon frame comprises one or more Operation elements, such as: HT Operation, VHT Operation, HE Operation, EHT Operation, WUR Operation. In a further possible implementation form, the second information of the second type beacon frame comprises a Reduced Neighbour Report, RNR.

[0050] In a further possible implementation form, the second information of the second type beacon frame comprises a basic service set, BSS, Color Change Announcement.

[0051] In a further possible implementation form, the non-AP station is a multi-link device, MLD, i.e. a MLD station.

[0052] In a further possible implementation form, the wireless communication network is a Wi-Fi network.

[0053] According to a fourth aspect a method of operating a non-access point, AP, station for a wireless communication network is provided. The method comprises the step of receiving periodically a first type beacon frame and a second type beacon frame from an AP of the wireless communication network. The first type beacon frame comprises first information allowing the non-AP station to discover the AP and capabilities of the AP for association purposes. The second type beacon frame comprises second information for managing the non-AP station, once the non-AP station is associated with the AP.

[0054] The method according to the fourth aspect of the present disclosure can be performed by the non-AP station according to the third aspect of the present disclosure. Thus, further features of the method according to the fourth aspect of the present disclosure result directly from the functionality of the non-AP station according to the third aspect of the present disclosure as well as its different implementation forms described above and below.

[0055] According to a fifth aspect a computer program product is provided, comprising program code which causes a computer or a processor to perform the method according to the second aspect or the method according to the fourth aspect, when the program code is executed by the computer or the processor.

[0056] Details of one or more embodiments are set forth in the accompanying drawings and the description below. Other features, objects, and advantages will be apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In the following, embodiments of the present disclosure are described in more detail with reference to the attached figures and drawings, in which:

[0058] Fig. 1a is a schematic diagram showing a Wi-Fi network, including an AP according to an embodiment configured to periodically transmit a first beacon frame type and a second beacon frame type to a plurality of associated and unassociated non-AP stations according to an embodiment;

[0059] Fig. 1 b is a schematic diagram illustrating a man-in-the-middle attack performed by a malicious man-in-the-middle device between the AP and a non-AP station of figure 1a;

[0060] Fig. 2 is a schematic diagram illustrating a first beacon frame type transmitted periodically by an AP according to an embodiment to a plurality of non-AP stations according to an embodiment;

[0061] Fig. 3 is a schematic diagram illustrating a second beacon frame type transmitted periodically by an AP according to an embodiment to a plurality of non-AP stations according to an embodiment;

[0062] Fig. 4 shows a flow diagram illustrating steps of a method of operating an AP according to an embodiment; and

[0063] Fig. 5 shows a flow diagram illustrating steps of a method of operating a non-AP station according to an embodiment.

[0064] In the following, identical reference signs refer to identical or at least functionally equivalent features.

[0065] DETAILED DESCRIPTION OF THE EMBODIMENTS

[0066] In the following description, reference is made to the accompanying figures, which form part of the disclosure, and which show, by way of illustration, specific aspects of embodiments of the present disclosure or specific aspects in which embodiments of the present disclosure may be used. It is understood that embodiments of the present disclosure may be used in other aspects and comprise structural or logical changes not depicted in the figures. The following detailed description, therefore, is not to be taken in a limiting sense, and the scope of the present disclosure is defined by the appended claims.

[0067] For instance, it is to be understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if one or a plurality of specific method steps are described, a corresponding device may include one or a plurality of units, e.g. functional units, to perform the described one or plurality of method steps (e.g. one unit performing the one or plurality of steps, or a plurality of units each performing one or more of the plurality of steps), even if such one or more units are not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on one or a plurality of units, e.g. functional units, a corresponding method may include one step to perform the functionality of the one or plurality of units (e.g. one step performing the functionality of the one or plurality of units, or a plurality of steps each performing the functionality of one or more of the plurality of units), even if such one or plurality of steps are not explicitly described or illustrated in the figures. Further, it is understood that the features of the various exemplary embodiments and / or aspects described herein may be combined with each other, unless specifically noted otherwise.

[0068] Figure 1a shows an exemplary wireless communication network 100, in particular a Wi-Fi network 100 including an access point, AP, 120 and a plurality of non-AP stations 110a-c which may be un-associated, i.e. not associated yet or already associated with the AP 120. In an embodiment, the wireless communication network 100 is a WLAN in accordance with the IEEE 802.11 framework of standards (also referred to as a Wi-Fi network 100). In an embodiment, the AP 120 and / or the non-AP stations 110a-c may be a multi-link device, MLD, i.e. an AP MLD 120 and / or non-AP MLD stations 110a-c.

[0069] As illustrated in figure 1a, the non-AP station 110a (as an example for the other non-AP stations 110b,c) may comprise a processing circuitry 111a and a communication interface 113a, in particular a wireless communication interface 113a in accordance with the IEEE 802.11 framework of standards for communicating with the AP 120. The processing circuitry 111a of the non-AP station 110a may be implemented in hardware and / or software and may comprise digital circuitry, or both analog and digital circuitry. Digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The non- AP station 110a may further comprise a memory 115a configured to store executable program code which, when executed by the processing circuitry 111a, causes the non-AP station 110a to perform the functions and methods described herein.

[0070] Likewise, the AP 120 illustrated in figure 1a may comprise a processing circuitry 121 and a communication interface 123, in particular a wireless communication interface 123 in accordance with the IEEE 802.11 framework of standards for communication with the plurality of non-AP stations 110a-c. The processing circuitry 121 of the AP 120 may be implemented in hardware and / or software and may comprise digital circuitry, or both analog and digital circuitry. Digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. As illustrated in figure 1 , the AP 120 may further comprise a memory 125 configured to store executable program code which, when executed by the processing circuitry 121 , causes the AP 120 to perform the functions and methods described herein.

[0071] As illustrated in figure 1a, the AP 120 is configured to broadcast periodically a beacon frame of a first type (herein referred to as first type beacon frame 200 or inter beacon frame 200) and a beacon frame of a second type (herein referred to as second type beacon frame 300 or intra beacon frame) to the plurality of non-AP stations 110a-c of the wireless communication network 100. As will be described in more detail further below in the context of figures 2 and 3, the first type beacon frame 200, i.e. the inter beacon frame 200 comprises first information allowing one or more un-associated non-AP stations of the plurality of non-AP stations 110a- c to discover the AP 120 and the capabilities of the AP 120 for association purposes, while the second type beacon frame 300, i.e. the intra beacon frame 300 comprises second information for managing one or more non-AP stations of the plurality of non-AP stations 110a-c that are already associated with the AP 120.

[0072] The role of the first type beacon frame 200, i.e. the inter beacon frame 200 is to be used by the un-associated non-AP stations of the plurality of non-AP stations 110a-c, which are scanning the medium looking for potential APs to associate with or gathering statistics. Thus, in an embodiment, the first type beacon frame 200, i.e. the inter beacon frame 200 only includes information about the basic service set, BSS, capabilities defined by a respective AP, such as the AP 120. Moreover, in an embodiment, the first type beacon frame 200, i.e. the inter beacon frame 200 does not include any proactive elements, such as a Channel Switch Announcement. The role of the second type beacon frame 300, i.e. the intra beacon frame 300 is to manage the already associated non-AP stations of the plurality of non-AP stations. To this end, in an embodiment, the second type beacon frame 300, i.e. the intra beacon frame 300 includes mainly elements required for the on-going management of the BSS, including proactive elements, such as TSF, EDCA parameters per Access Category, DTIM, CSA (Channel Switch Announcement), ML Reconfiguration, Power Constraint.

[0073] As will be appreciated, the AP 120 according to an embodiment differs from a conventional AP 110 primarily in that the information conventionally included in a conventional beacon frame is divided into the first information included in the first type beacon frame 200, i.e. the inter beacon frame 200 and the second information included in the second type beacon frame 300, i.e. the intra beacon frame 300. Because of this split according to embodiments disclosed herein the AP 120 may encrypt at least parts of the second information included in the second type beacon frame 300, i.e. the intra beacon frame 300 using, for instance, a group temporal key, GTK, or a new dedicated cryptographic key known only to the AP 120 and the associated non- AP stations of the plurality of non-AP stations 110a-c

[0074] As will be described in more detail in the following in the context of figure 1b, using the first type beacon frame 200 for discovery and association purposes and the second type beacon frame 300, which may be encrypted, for managing the associated non-AP stations 110a-c allows, for instance, preventing man-in-the-middle attacks and, thus, making the wireless communication network 100 more secure.

[0075] Figure 1b is a schematic diagram illustrating a multi-channel man-in-the-middle, MC-MitM, attack performed by a MitM device 130 in the Wi-Fi network 100 of figure 1a. The MitM device 130 may be operated by an adversary or attacker trying to intercept the communication between the AP 120 and, by way of example, the non-AP station 110a via the channels 125,126. More specifically, the MitM device 130 may use two different channels, aka Multi Channel MiTM, 125 and 126 for simultaneously communicating with both the AP 120 and the non-AP station 110a.A first channel is used by the MitM device 130 for operating as a rogue STA with the AP 120 and is identical to the channel 125 used between the AP 120 and non- AP station 110a (therefore this channel is also referred to as channel 125 in figure 1b). The second channel 126 is used by the MitM device 130 for operating as a rogue AP with the non- AP station 110a. As will be appreciated, the AP 120 and the non-AP station 110a may remain unaware of such an MC-MitM attack since their original connection via the channel 125 (which may define a current security association) is not interfered by the MitM device 130 and the second channel 126. A malicious MC-MitM device 130 may send, for instance, its own conventional beacon frames to the non-AP station 110a with the MAC address of the AP 120 or alternatively forward the conventional beacon frames from the AP 120. For a MC-MitM attack the malicious MC-MitM device 130 with a dual interface setup may clone the targets, i.e. the AP 120 and the non-AP station 110 on a different channel, for instance, the second channel126. The rogue AP implemented by the malicious MC-MitM device 130 may send a Channel Switch Announcement (CSA) to the non-AP station 110a (on the first channel 125) using a spoof beacon or action frame or jam the channel and force the non-AP station 110a to switch to the second channel 126. Moreover, the rogue AP implemented by the malicious MC-MitM device 130 may advertise beacons on the rogue channel, i.e. the second channel 126. The non-AP station 110a switches the channel and keeps operating with the rogue AP implemented by the malicious MC-MitM device 130 that is “identified” by the MAC address of the original AP 120. As will be appreciated, there is no new connection flow, i.e. the non-AP station 110a switches the channel and simply continues the data traffic with the rouge AP that is “identified” as the original AP 120 via the second channel 126 and the malicious MC-MitM device 130. The malicious MC-MitM device 130, in turn, implements a rogue non-AP station “connected” to the AP 120, i.e. replacing the non-AP station 110a. The rogue non-AP station implemented by the malicious MC-MitM device 130 may send a frame to the AP 120 where it is “identified” as the original associated non-AP STA 110a such that the rogue non-AP station implemented by the malicious MC-MitM device 130 will send ACKs when it receives unicast frames from the AP 120.

[0076] As will be appreciated, by encrypting at least potions of the second type beacon frame 300, i.e. the intra beacon frame 300 by the AP 120 the rogue AP implemented by the malicious MC- MitM device 130 is no longer able to duplicate and tamper with the beacon frames before forwarding them to the non-AP station 110a.

[0077] In an embodiment, the AP 120 is configured to start periodically broadcasting the second type beacon frame 300, in response to a request from at least one of the plurality of non-AP stations 110a-c that is already associated with the AP 120 based on the first information included in the first type beacon frame 200.

[0078] In an embodiment, the AP 120 is configured to receive a request frame from at least one of the plurality of non-AP stations 110a-c that is already associated with the AP 120 and to transmit, in response to the received request frame, an encrypted response frame to the at least one of the non-AP stations 110a-c that is associated with the AP 120, wherein the encrypted response frame comprises the encrypted second information. In an embodiment, the request frame is a probe request frame and / or the encrypted response frame is an encrypted probe response frame.

[0079] In an embodiment, each non-AP station 110a-c is configured to send a request to the AP 120 for triggering the AP 120 to start periodically broadcasting the second type beacon frame 300, once the respective non-AP station 110a-c has been associated with the AP 120 based on the first information of the first type beacon frame 200.

[0080] As already mentioned above, figure 2 illustrates the format of the first beacon frame type 200, i.e. the inter beacon frame 200 according to an embodiment, while figure 3 illustrates the format of the second beacon frame type 300, i.e. the intra beacon frame 300 transmitted periodically by the AP 120 according to an embodiment.

[0081] The first beacon frame type 200, i.e. the inter beacon frame 200 may comprise a MAC header 210, a frame body 220 and a frame check sequence, FCS, 250. In an embodiment the MAC header 210 may be a conventional MAC header 210 including a frame control field 211 , duration fields 212, 213, a DA field 214, a SA field 215 and a BSS identifier 216.

[0082] The frame body 220 of the first beacon frame type 200, i.e. the inter beacon frame 200 comprises the first information described above, which may comprise a mandatory portion 230 and an optional portion 240. The mandatory portion 230 may comprise capability information 231 , a service set identifier, SSID, 232 corresponding to the associated AP 120, and / or information 233 representative of one or more data rates supported by the associated AP 120. The optional portion 240 may comprise an OS parameter set 241 , CF parameters set 242, I BSS parameters set 243, country information 244, ERP 245, information about extended rates 246, and / or robust security network information 247.

[0083] In a further embodiment, the first information of the first type beacon frame 200 may comprise information representative of a beacon transmission interval of the first type beacon frame 200.

[0084] As illustrated in figure 3, the second beacon frame type 300, i.e. the intra beacon frame 300 may also comprise a MAC header 310, a frame body 320 and a frame check sequence, FCS, 350. In an embodiment the MAC header 310 may be a conventional MAC header 310 including a frame control field 311 , duration fields 312, 313, a DA field 314, a SA field 315, a BSS identifier 316 and a Seq-Ctl field 317. As already described above, in an embodiment, the entire frame body 320 of the second beacon frame type 300, i.e. the intra beacon frame 300 may be encrypted by the AP 120.

[0085] The frame body 320 of the second beacon frame type 300, i.e. the intra beacon frame 300 comprises the second information described above, which may comprise a mandatory portion 330 and an optional portion 340. The mandatory portion 330 may comprise a timer value, e.g. timestamp 331 , and / or information about a beacon interval, i.e. the period of the second beacon frame type 300, i.e. the intra beacon frame 300. The optional portion 340 of the frame body 320 of the second beacon frame type 300, i.e. the intra beacon frame 300 may comprise: a traffic indication map (TIM) 341 , power constraint information 342, a channel switch announcement (CSA) 343 or an extended channel switch announcement (ECSA), a QUIET field 344, and / or a Quiet field 344, and / or a transmit power control (TPC) report 345.

[0086] In a further embodiment, the second type beacon frame 300 may further comprise: one or more enhanced distributed channel access, EDCA, parameters per access category; information representative of a delivery traffic indication message, DTIM, interval; a multi user enhanced distributed channel access, MU EDCA, Parameter Set; one or more multiple basic service set identifier, Multiple BSSID, elements; one or more Operation elements, such as HT Operation, VHT Operation, HE Operation, EHT Operation, WUR Operation; a Reduced Neighbour Report, RNR; and / or a basic service set, BSS, Color Change Announcement.

[0087] Figure 4 shows a flow diagram illustrating steps of a method 400 for operating the AP 120 in the wireless communication network 100 according to an embodiment. The method 400 comprises broadcasting 401 periodically the first type beacon frame 200 and the second type beacon frame 300 to the plurality of non-AP stations 110a-c of the wireless communication network 100. As already described above, the first type beacon frame 300 comprises first information allowing an un-associated non-AP station 110b,c of the plurality of non-AP stations 110a-c to discover the AP 120 and capabilities of the AP 120 for association purposes, while the second type beacon frame 300 comprises second information for managing one or more non-AP stations 110a of the plurality of non-AP stations 110a-c that are associated with the AP 120.

[0088] As the method 400 can be implemented by the AP 120, further features of the method 400 result directly from the functionality of the AP 120 as well as its different embodiments described above and below. Figure 5 shows a flow diagram illustrating steps of a method 500 for operating the non-AP station 110a-c in the wireless communication network 100 according to an embodiment. The method 500 comprises receiving 501 periodically the first type beacon frame 200 and the second type beacon frame 300 from the AP 120 of the wireless communication network 100. As already described above, the first type beacon frame 200 comprises first information allowing the non-AP station 110a-c to discover the AP 120 and capabilities of the AP 120 for association purposes, while the second type beacon frame 300 comprises second information for managing the non-AP station 110a-c, once the non-AP station 110a-c is associated with the AP 120.

[0089] As the method 500 can be implemented by the non-AP stations 110a-c, further features of the method 500 result directly from the functionality of the non-AP stations 1110a-c as well as their different embodiments described above and below.

[0090] The person skilled in the art will understand that the "blocks" ("units") of the various figures (method and apparatus) represent or describe functionalities of embodiments of the present disclosure (rather than necessarily individual "units" in hardware or software) and thus describe equally functions or features of apparatus embodiments as well as method embodiments (unit = step).

[0091] In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described embodiment of an apparatus is merely exemplary. For example, the unit division is merely logical function division and may be another division in an actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.

[0092] The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments. In addition, functional units in the embodiments of the invention may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.

Claims

CLAIMS1. An access point, AP, (120) for a wireless communication network (100), wherein the AP (120) is configured to: broadcast periodically a first type beacon frame (200) and a second type beacon frame (300) to a plurality of non-AP stations (110a-c) of the wireless communication network (100), wherein the first type beacon frame (200) comprises first information allowing one or more unassociated non-AP stations (110b,c) of the plurality of non-AP stations (110a-c) to discover the AP (120) and capabilities of the AP (120) for association purposes; and wherein the second type beacon frame (300) comprises second information for managing one or more non-AP stations (110a) of the plurality of non-AP stations (110a-c) that are associated with the AP (120).

2. The AP (120) of claim 1 , wherein the AP (120) is configured to start periodically broadcasting the second type beacon frame (300), in response to a request from at least one of the non-AP stations (110a) that is associated with the AP (120) based on the first information.

3. The AP (120) of claim 1 or 2, wherein the AP (120) is configured to receive a request frame from at least one of the non-AP stations (110a) that is associated with the AP (120) and to transmit, in response to the received request frame, an encrypted response frame to the at least one of the non-AP stations (110a) that is associated with the AP (120), wherein the encrypted response frame comprises the second information.

4. The AP (120) of claim 3, wherein the request frame is a probe request frame and / or the encrypted response frame is an encrypted probe response frame.

5. The AP (120) of any one of the preceding claims, wherein the second type beacon frame (300) comprises a frame body (320) and wherein the AP (120) is configured to encrypt the frame body (320) of the second type beacon frame (300) using one or more cryptographic keys.

6. The AP (120) of any one of the preceding claims, wherein the first information comprises a service set identifier, SSID, (232) corresponding to the AP (120).

7. The AP (120) of any one of the preceding claims, wherein the first information comprises information (233) representative of one or more data rates supported by the AP (120).

8. The AP (120) of any one of the preceding claims, wherein the first information comprises information representative of a beacon transmission interval of the first type beacon frame (200).

9. The AP (120) of any one of the preceding claims, wherein the second information comprises information representative of a beacon transmission interval of the second type beacon frame (300).

10. The AP (120) of any one of the preceding claims, wherein the second information comprises information representative of a value of a timer (331) of the AP (120).

11. The AP (120) of any one of the preceding claims, wherein the second information comprises one or more enhanced distributed channel access, EDCA, parameters per access category.

12. The AP (120) of any one of the preceding claims, wherein the second information comprises information representative of a delivery traffic indication message, DTIM, interval.

13. The AP (120) of any one of the preceding claims, wherein the second information comprises a channel switch announcement, CSA, (343).

14. The AP (120) of any one of the preceding claims, wherein the second information comprises an extended channel switch announcement, ECSA.

15. The AP (120) of any one of the preceding claims, wherein the second information comprises a traffic indication map, TIM, (341).

16. The AP (120) of any one of the preceding claims, wherein the second information comprises a multi-user enhanced distributed channel access, MU EDCA, Parameter Set.

17. The AP (120) of any one of the preceding claims, wherein the second information comprises one or more multiple basic service set identifier, Multiple BSSID, elements.

18. The AP (120) of any one of the preceding claims, wherein the second information comprises one or more Operation elements, such as: HT Operation, VHT Operation, HE Operation, EHT Operation, WUR Operation.

19. The AP (120) of any one of the preceding claims, wherein the second information comprises a Reduced Neighbour Report, RNR.

20. The AP (120) of any one of the preceding claims, wherein the second information comprises a basic service set, BSS, Color Change Announcement.

21. The AP (120) of any one of the preceding claims, wherein the AP (120) is configured to periodically broadcast the plurality of first type beacon frames (200) with a different period than the plurality of second type beacon frames (300).

22. The AP (120) of any one of the preceding claims, wherein the AP (120) is a multi-link device, MLD, configured to communicate via a plurality of links with the plurality of non-AP MLDs of the wireless communication network.

23. The AP (120) of any one of the preceding claims, wherein the wireless communication network (100) is a Wi-Fi network (100).

24. A method (400) for operating an access point, AP, (120) in a wireless communication network (100), wherein the method (400) comprises: broadcasting (401) periodically a first type beacon frame (200) and a second type beacon frame (300) to a plurality of non-AP stations (110a-c) of the wireless communication network (100), wherein the first type beacon frame (300) comprises first information allowing a un-associated non-AP station (110b,c) of the plurality of non-AP stations (110a-c) to discover the AP (120) and capabilities of the AP (120) for association purposes; and wherein the second type beacon frame (300) comprises second information for managing one or more non-AP stations (110a) of the plurality of non-AP stations (110a-c) that are associated with the AP (120).

25. A non-access point, AP, station (110a-c) for a wireless communication network (100), wherein the non-AP station (110a-c) is configured to: receive periodically a first type beacon frame (200) and a second type beacon frame (300) from an AP (120) of the wireless communication network (100), wherein the first type beacon frame (200) comprises first information allowing the unassociated non-AP station (110b,c) to discover the AP (120) and capabilities of the AP (120) for association purposes; and wherein the second type beacon frame (300) comprises second information for managing the non-AP station (110a), once the non-AP station (110a) is associated with the AP (120).

26. The non-AP station (110a-c) of claim 25, wherein the non-AP station (110a-c) is configured to send a request to the AP (120) for triggering the AP (120) to start periodically broadcasting the second type beacon frame (300), once the non-AP station (110a-c) is associated with the AP (120) based on the first information.

27. The non-AP station (110a-c) of claim 25 or 26, wherein, once the non-AP station (110a- c) is associated with the AP (120), the non-AP station (110a-c) is configured to send a request frame to the AP (120) and to receive an encrypted response frame from the AP (120), wherein the encrypted response frame comprises the second information.

28. The non-AP station (110a-c) of claim 27, wherein the request frame is a probe request frame and / or the encrypted response frame is an encrypted probe response frame.

29. The non-AP station (110a-c) of claim 27 or 28, wherein the non-AP station (110a-c) is configured to decrypt the encrypted response frame from the AP based on one or more cryptographic keys derived during or after the association with the AP (120).

30. The non-AP station (110a-c) of any one of claims 25 to 29, wherein the second type beacon frame (300) comprises a frame body (320) and wherein the non-AP station (110a-c) is configured to decrypt the frame body (320) of the second type beacon frame (300) using one or more cryptographic keys.31 . The non-AP station (110a-c) of any one of claims 25 to 30, wherein the first information of the first type beacon frame (200) comprises a service set identifier, SSID, (232) corresponding to the associated AP (120).

32. The non-AP station (110a-c) of any one of claims 25 to 31 , wherein the first information of the first type beacon frame (200) comprises information (233) representative of one or more data rates supported by the associated AP (120).

33. The non-AP station (110a-c) of any one of claims 25 to 32, wherein the first information comprises information representative of a beacon transmission interval of the first type beacon frame (200).

34. The non-AP station (110a-c) of any one of claims 25 to 33, wherein the second information of the second type beacon frame (300) comprises information representative of a beacon transmission interval of the second type beacon frame (300).

35. The non-AP station (110a-c) of any one of claims 25 to 34, wherein the second information of the second type beacon frame (300) comprises information representative of a value of a timer (331) of the AP (120).

36. The non-AP station (110a-c) of any one of claims 25 to 35, wherein the second information of the second type beacon frame (300) comprises one or more enhanced distributed channel access, EDCA, parameters per access category.

37. The non-AP station (110a-c) of any one of claims 25 to 36, wherein the second information of the second type beacon frame (300) comprises information representative of a delivery traffic indication message, DTIM, interval.

38. The non-AP station (110a-c) of any one of claims 25 to 37, wherein the second information of the second type beacon frame (300) comprises a channel switch announcement, CSA, (343).

39. The non-AP station (110a-c) of any one of claims 25 to 38, wherein the second information of the second type beacon frame (300) comprises an extended channel switch announcement, ECSA.

40. The non-AP station (110a-c) of any one of claims 25 to 39, wherein the second information of the second type beacon frame (300) comprises a traffic indication map, TIM, (341).

41. The non-AP station (110a-c) of any one of claims 25 to 40, wherein the second information of the second type beacon frame (300) comprises a multi user enhanced distributed channel access, MU EDCA, Parameter Set.

42. The non-AP station (110a-c) of any one of claims 25 to 41 , wherein the second information of the second type beacon frame (300) comprises one or more multiple basic service set identifier, Multiple BSSID, elements.

43. The non-AP station (110a-c) of any one of claims 25 to 42, wherein the second information of the second type beacon frame (300) comprises one or more Operation elements, such as: HT Operation, VHT Operation, HE Operation, EHT Operation, WUR Operation.

44. The non-AP station (110a-c) of any one of claims 25 to 43, wherein the second information of the second type beacon frame (300) comprises a Reduced Neighbour Report, RNR.

45. The non-AP station (110a-c) of any one of claims 25 to 44, wherein the second information of the second type beacon frame (300) comprises a basic service set, BSS, Color Change Announcement.

46. The non-AP station (110a-c) of any one of claims 25 to 45, wherein the non-AP station (110a-c) is a multi-link device, MLD.

47. The non-AP station (110a-c) of any one of claims 25 to 46, wherein the wireless communication network (100) is a Wi-Fi network (100).

48. A method (500) of operating a non-access point, AP, station (110a-c) for a wireless communication network (100), wherein the method (500) comprises: receiving (501) periodically a first type beacon frame (200) and a second type beacon frame (300) from an AP (120) of the wireless communication network (100),wherein the first type beacon frame (200) comprises first information allowing the non-AP station (110a-c) to discover the AP (120) and capabilities of the AP (120) for association purposes; and wherein the second type beacon frame (300) comprises second information for managing the non-AP station (110a-c), once the non-AP station (110a-c) is associated with the AP (120).

49. A computer program product comprising a computer-readable storage medium for storing program code which causes a computer or a processor to perform the method (400) of claim 24 or the method (500) of claim 48 when the program code is executed by the computer or the processor.

Images