Information frame transmission method, network device, and storage medium

Abstract

The present application provides an information frame transmission method, a network device, and a storage medium. The method comprises: sending a first information frame to a second network device, wherein the first information frame comprises first frame number information and first key generation information of the first network device; receiving a second information frame of the second network device, wherein the second information frame comprises second frame number information, second key generation information of the second network device, and a first MIC; generating a first PTK, wherein the first PTK is used for encrypting or decrypting a unicast packet between the first network device and the second network device; verifying the first MIC on the basis of the first PTK and generating a second MIC; and sending a third information frame, wherein the third information frame comprises third frame number information and the second MIC.

Description

Information frame transmission method, network device and storage medium Technical Field

[0001] The present application relates to the field of wireless communication technology, for example, to an information frame transmission method, network equipment and storage medium. Background Art

[0002] Each network device may support one or more multi-network device collaboration technologies. Network devices need to define specific signals (or unicast frames) to negotiate the specific method to achieve collaboration. During the network device negotiation process, without protection measures, the unicast frame exchanges between network devices are at risk of being intercepted and maliciously tampered with by third parties. Furthermore, during the network device collaboration process, a network device can send a trigger frame (TF) containing sensitive information to other nearby network devices. This frame is sent in plaintext as a broadcast, which poses the risk of being intercepted and tampered with by third parties. Therefore, the security of transmission between network devices needs to be improved.

[0003] Summary of the Invention

[0004] The present application provides a data frame transmission method, a network device and a storage medium.

[0005] An embodiment of the present application provides an information frame transmission method, applied to a first network device, including:

[0006] Sending a first information frame to a second network device, where the first information frame includes first frame number information and first key generation information of the first network device;

[0007] receiving a second information frame from the second network device, where the second information frame includes second frame number information, second key generation information of the second network device, and a first message integrity code (MIC);

[0008] generating a first pairwise transient key (PTK) for encrypting or decrypting unicast messages between the first network device and the second network device;

[0009] verifying the first MIC based on the first PTK and generating a second MIC;

[0010] A third information frame is sent, where the third information frame includes third frame number information and the second MIC.

[0011] The embodiment of the present application further provides an information frame transmission method, which is applied to a second network device, including:

[0012] receiving a first information frame from a first network device, where the first information frame includes first frame number information and first key generation information of the first network device;

[0013] generating a second PTK, where the second PTK is used to encrypt or decrypt unicast messages between the first network device and the second network device;

[0014] generating a first MIC according to the second PTK;

[0015] Sending a second information frame to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC;

[0016] A third information frame is received from the first network device, where the third information frame includes third frame number information and a second MIC generated by the first network device.

[0017] An embodiment of the present application further provides a network device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned information frame transmission method when executing the program.

[0018] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the above-mentioned information frame transmission method is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] FIG1 is a flowchart of an information frame transmission method provided by an embodiment;

[0020] FIG2 is a schematic diagram of transmitting an authentication frame between network devices according to an embodiment;

[0021] FIG3 is a schematic diagram of a format of a first authentication frame provided in one embodiment;

[0022] FIG4 is a schematic diagram of a format of a second authentication frame provided in one embodiment;

[0023] FIG5 is a schematic diagram of a format of a third authentication frame provided in one embodiment;

[0024] FIG6 is a schematic diagram of a PTK format provided in one embodiment;

[0025] FIG7 is a schematic diagram of a format provided to an RSNE according to an embodiment;

[0026] FIG8 is a flowchart of an information frame transmission method provided by an embodiment;

[0027] FIG9 is a schematic structural diagram of an information frame transmission device provided by an embodiment;

[0028] FIG10 is a schematic structural diagram of an information frame transmission device provided by an embodiment;

[0029] FIG11 is a schematic diagram of the hardware structure of a network device provided by an embodiment. DETAILED DESCRIPTION

[0030] The present application is described below in conjunction with the accompanying drawings and embodiments. It will be understood that the specific embodiments described herein are merely intended to explain the present application and are not intended to limit the present application. It should be noted that, unless there is a conflict, the embodiments and features within the embodiments of the present application may be combined with each other in any manner. It should also be noted that, for ease of description, the accompanying drawings only illustrate portions relevant to the present application, not all structures.

[0031] FIG1 is a flow chart of a method for transmitting an information frame provided in one embodiment. The method can be applied to a first network device. In the embodiment of the present application, the network device can be a station (Station) or an access point (Access Point, AP). The first network device and the second network device authenticate and interact with each other through three types of information frames, and negotiate and generate a secret key based on this. As shown in FIG1 , the method provided in this embodiment includes the following steps:

[0032] In step 110, a first information frame is sent to a second network device, where the first information frame includes first frame number information and first key generation information of the first network device.

[0033] In step 120, a second information frame of the second network device is received, where the second information frame includes second frame number information, second key generation information of the second network device, and a first MIC.

[0034] In step 130, a first PTK is generated, where the first PTK is used to encrypt or decrypt unicast messages between the first network device and the second network device.

[0035] In step 140, the first MIC is verified according to the first PTK and a second MIC is generated.

[0036] In step 150, a third information frame is sent, where the third information frame includes third frame number information and the second MIC.

[0037] In this embodiment, a first network device (e.g., AP1) exchanges three types of information frames with a second network device (e.g., AP2). The information frames may be authentication frames or Extensible Authentication Protocol over LAN (EAPOL) frames. The first information frame includes frame number information, first key generation information (e.g., public key information, S-Ephemeral Pub) of the first network device, and may also include a Robust Security Network Element (RSNE), an Extended Robust Security Network Element (RSNXE), and master / slave network device indication information.

[0038] After receiving the first information frame, the second network device generates the second key generation information (such as public key information, recorded as A-Ephemeral Pub) locally and generates PTK (i.e., the second PTK) according to a certain algorithm. In the case that the information frame is an authentication frame, it can also generate the second PTK according to the second PTK.<KEK2,KCK2,TCK2> KEK2 (the second KEK) is used to encrypt and decrypt authentication frames, KCK2 (the second KCK) is used to calculate the first MIC, and TCK2 (the second TCK) is used to encrypt and decrypt control frames. The second KEK can also encrypt the frame body and some information in the authentication frame, such as the group key (GK) and other information.

[0039] The second network device sends a second information frame to the first network device. The second information frame always includes frame number information, second key generation information of the second network device (such as public key information, A-Ephemeral Pub), and may also include RSNE, RSNXE, GK information, indication information of the master and slave network devices, the first MIC, etc.

[0040] After receiving the second authentication frame, the first network device locally generates a PTK (i.e., the first PTK). If the information frame is an authentication frame, KCK1 (i.e., the first KCK) and KEK1 (i.e., the first KEK) can be further generated based on the first PTK. The first KCK is used to verify the first MIC and generate the second MIC, and the first KEK can be used to decrypt the message and obtain the GK information.

[0041] In addition, the first network device sends a third information frame to the second network device, including frame number information and the second MIC.

[0042] Figure 2 is a schematic diagram of authentication frame transmission between network devices, provided by one embodiment. As shown in Figure 2, in multi-AP mode, APs exchange frames to generate and transmit protected keys. APs can exchange authentication frames three times to generate a unicast key PTK, and based on the PTK, further generate a key encryption key (KEK) for authentication frame encryption and decryption, as well as a TCK for control frame encryption and decryption. A master AP and slave APs can be negotiated in the three-way handshake process. The master AP is responsible for distributing and maintaining the GK, which can be transmitted via the second or third authentication frame.

[0043] The method of this embodiment can be applied to the multi-AP (MAP) collaboration process defined by Wi-Fi 8. AP1 and AP2 use the generated PTK to encrypt and decrypt unicast messages exchanged between APs. In addition, the GK can also be used to encrypt and decrypt broadcast messages exchanged between APs. It can also be applied to the interoperation process between AP and STA (the corresponding information frame is an EAPOL frame).

[0044] In one embodiment, when the information frame is an authentication frame, the first key generation information includes first public key information (S-Ephemeral Pub), and the second key generation information includes second public key information (A-Ephemeral Pub); when the information frame is an EAPOL frame, the first key generation information includes a first random number; and the second key generation information includes a second random number.

[0045] In one embodiment, the first network device includes a first station, a first access point, a first multi-link access point, or a first multi-link station; and the second network device includes a second station, a second access point, a second multi-link station, or a second multi-link access point. The network device in this embodiment may be a multi-link device (MLD), for example, the station may be a multi-link station (non-AP MLD), and the access point may be a multi-link access point (AP MLD).

[0046] In one embodiment, when the information frame is an authentication frame, the first information frame and the second information frame further include RSNE and RSNXE; when the information frame is an EAPOL frame, the second information frame and the third information frame further include RSNE and RSNXE.

[0047] In one embodiment, the first authentication frame, the second authentication frame, and the third authentication frame further include indication information for indicating whether the first network device is a master network device or a slave network device, and correspondingly indicating whether the second network device is a slave network device or a master network device. In this embodiment, the master / slave AP is indicated in an explicit manner, i.e., the first authentication frame and the second authentication frame include master / slave AP indication information. It should be noted that the indication information carried in the two authentication frames cannot simultaneously indicate master and slave.

[0048] In one embodiment, the method further includes: determining whether the first network device is a master network device or a slave network device based on a predefined field, and correspondingly determining whether the second network device is a slave network device or a master network device. In this embodiment, the master / salve AP is implicitly indicated, i.e., the authentication frame does not include the master / salve AP. Instead, a predefined specific field comparison method, such as comparing the Media Access Control (MAC) address information of both parties, automatically determines one party as the master and the other party as the slave. Based on this, the master acts as the party transmitting the GK, and the slave acts as the party receiving the GK.

[0049] In one embodiment, the method further includes: transmitting GK information to the second network device via a third authentication frame when the first network device is a master network device; and receiving GK information transmitted by the second network device via a second authentication frame when the first network device is a slave network device; wherein the GK information is used to encrypt or decrypt broadcast messages between network devices. In Figure 2, if AP2 is the master, the GK is transmitted via the second authentication frame; if AP1 is the master, the GK is transmitted via the third authentication frame.

[0050] In one embodiment, the method further includes: transmitting collaboration group identification information (Group ID) to the second network device via a third authentication frame when the first network device is a master network device; and receiving the collaboration group identification information transmitted by the second network device via a second authentication frame when the first network device is a slave network device. In this embodiment, the master AP can not only transmit the GK but also generate Group ID information that uniquely identifies a collaboration group. The Group ID may be sent to the slave AP along with the GK information in the second authentication frame or the third authentication frame.

[0051] Table 1 shows a MAP parameter table for transmitting MAP information. As shown in Table 1, the authentication frame may include indication information of master and slave network devices, cooperation group identification information and / or GK information.

[0052] Figure 3 is a schematic diagram of the format of a first authentication frame provided by an embodiment. As shown in Figure 3, the first authentication frame includes frame number and frame type information (1.PASN), status indication information (Status Code), STA-side RSNE (including STA-selected authentication and key management protocol (Authentication and Key Management Protocol, AKMP information), PASN parameters (PASN parameters, including STA-side public key information S-Ephemeral Pub, wired cyclic group information (Finite Cyclic Group ID, etc.), AKMP data-1 information corresponding to AKMP in RSNE located in the wrapped data (Wrapped Data) field, STA-side RSNXE and multi-AP collaboration parameters (including indication information of master and slave network devices).

[0053] Figure 4 is a schematic diagram of the format of a second authentication frame provided by an embodiment. As shown in Figure 4, the second authentication frame includes frame number and frame type information (2.PASN), status indication information (Status Code), AP-side RSNE (including AKMP information selected by the AP), PASN parameter information (PASN parameters, including AP-side public key information A-Ephemeral Pub), AKMP data-2 information located in the packaging data field corresponding to AKMP in RSNE, AP-side RSNXE, multi-AP collaboration parameters (including indication information of master and slave network devices, collaboration group identification information and GK information) and MIC1.

[0054] Figure 5 is a schematic diagram of the format of a third authentication frame provided by an embodiment. As shown in Figure 5, the third authentication frame includes frame number and frame type information (3.PASN), status indication information (Status Code), AKMP data-3 information corresponding to AKMP located in the package data field, multi-AP collaboration parameters (including indication information of master and slave network devices, collaboration group identification information and GK information) and MIC2.

[0055] In one embodiment, the method further includes: determining a first key confirmation key (KCK) and a first key encryption key KEK based on the first PTK, the first KCK is used to verify the first MIC and generate a second MIC, and the first KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

[0056] In one embodiment, the second authentication frame or the third authentication frame also includes GK information; the GK information includes at least one of the following: a group temporary key (GTK) used to encrypt or decrypt multicast data frames transmitted between the first network device and the second network device, an integrity group temporary key (IGTK) used to encrypt or decrypt multicast management frames transmitted between the first network device and the second network device, and an integrity control temporal key (ICTK) used to encrypt or decrypt multicast control frames transmitted between the first network device and the second network device.

[0057] In one embodiment, one GK may be used to encrypt and decrypt all frame types transmitted between APs.

[0058] In one embodiment, generating a second MIC includes: based on MAC address information of the first network device, MAC address information of the second network device, a hash value of a first Preassociation Security Negotiation (PASN) frame body, remaining information of a third authentication frame excluding a frame header and the second MIC, a first KCK, and a hash algorithm.

[0059] In this embodiment, MIC2 is generated based on the following information: MAC address information of two APs, F1 Auth, Frame Data, the first KCK, and a hash algorithm (HMAC-HASH). For example, the MIC2 generation algorithm is as follows:

[0060] HMAC-HASH(KCK1, AP1 MAC address information || AP2 MAC address information || F1 Auth || Frame Data)

[0061] Among them, HMAC-HASH: a HASH algorithm;

[0062] KCK1: key confirmation key, generated from the first PTK;

[0063] AP1 MAC address information: AP1 Basic Service Set Identifier (BSSID) information, or its corresponding AP Multi-Link Device (MLD) address information, or transmitter address (TA) information;

[0064] AP2 MAC address information: AP2 BSSID information, or its corresponding AP MLD address information, or receiver address (RA) information;

[0065] F1 Auth: Hash value of the first PASN frame body;

[0066] Frame Data: The remaining information in the third authentication frame excluding the frame header and MIC.

[0067] In one embodiment, generating a first PTK includes generating the first PTK based on the MAC address information of the first network device, the MAC address information of the second network device, a shared key generated by the Diffie-Huffman protocol, a pairwise master key (PMK), and a hash function. In this embodiment, the first PTK is generated using parameters: the AP1 MAC address information, the AP2 MAC address information, a shared key (DHss) generated by the Diffie-Huffman protocol, the PMK, and a key generation hash function. The AP1 / AP2 MAC address information may be the BSSID information of AP1 / AP2, or the MAC address information of the AP MLD corresponding to AP1 / AP2, respectively.

[0068] For example, a PTK generation formula is expressed as:

[0069] PTK = KDF-HASH-NNN (PMK, "PTK Derivation", AP1 MAC information || AP2 MAC information || DHss)

[0070] Among them, PMK is the pairwise master key information;

[0071] DHss is a shared key generated by the Diffie-Huffman protocol based on the public key;

[0072] AP1 MAC is the MAC address of AP1;

[0073] AP2 MAC is the MAC address of AP2;

[0074] “PASN PTK Derivation” is the label;

[0075] KDF-HASH-NNN: Generates hash algorithm information based on the key determined by the exchanged Authentication and Key Management Protocol (AKMP) parameters.

[0076] In one embodiment, the information frame may be an EAPOL frame or an authentication frame, and the method further includes:

[0077] Determining at least one of the following based on the first PTK: a first temporary key (Temporal Key, TK) for encryption or decryption of unicast data and management frames;

[0078] A first key derivation key (KDK) for generating key information;

[0079] The first temporary control key (TCK) used for encryption or decryption of unicast control frames;

[0080] A first KEK for encrypting or decrypting the authentication frame;

[0081] The first KCK used to verify the MIC.

[0082] Figure 6 is a schematic diagram of a PTK format provided by one embodiment. As shown in Figure 6, in addition to the traditional 256-bit KCK, 128- or 256-bit TK, and 256-bit KDK, it is extended to include a 128- or 256-bit TCK for control frame encryption and decryption, and a 128- or 256-bit KEK for authentication frame encryption and decryption. This PTK format is applicable to both the first PTK and the second PTK.

[0083] In one embodiment, the first TCK and the first KEK are generated based on the KDK. In this embodiment, the TCK for encryption and decryption of unicast control frames and the KEK for encryption and decryption of the second and third authentication frames are generated from the KDK according to a certain algorithm. For example, the TCK is generated by a key generation function and the input parameters KDK and the seed KDK_seed. The function expression is: TCK = KDF-Hash-Length(KDK, "TCK generation", KDK_seed)

[0084] KEK is generated by a key generation function KDF-Hash-Length and input parameters KEK and seed KEK_seed. The function expression is: KEK = KDF-Hash-Length (KDK, "KEK generation", KEK_seed).

[0085] In one embodiment, the method further includes: indicating at least one of the following to the target network device via RSNE information: unicast key suite information, authentication frame key suite information, multicast management frame key suite information, unicast control frame key suite information, and multicast control frame key suite information. In this embodiment, the RSNE information exchanged between AP1 and AP2 includes at least one of the following: unicast key suite information (Pairwise Cipher Suite), authentication frame key suite information (AKM Suite), multicast management frame key suite information (Group Management Cipher Suite), unicast control frame key suite information (Pairwise Cipher Suite for Control), and multicast control frame key suite information (Group Control Cipher Suite).

[0086] In one embodiment, the method further includes: indicating the key suite for the unicast control frame and the key suite for indicating the multicast control frame to the target network device through RSNE information.

[0087] Figure 7 is a schematic diagram of a RSNE format provided according to one embodiment. As shown in Figure 7, the RSNE contains unicast control frame key suite information and multicast control frame key suite information, each of 0 or 4 bytes in length, indicating the key suite for unicast control frames and the key suite for multicast control frames, respectively. Table 2 also provides a description of other fields in the RSNE.

[0088] Table 2 Description of some fields in RSNE

[0089] The method of this embodiment utilizes the PASN extended protocol to generate PTKs and transfer GKs between network devices. During the PASN process, the unicast control key (TCK) and the authentication frame encryption key (KEK) are generated. During the PASN process, master / slave network devices are negotiated and instructed. Unicast and multicast control frame key suites are indicated in the RSNE. During the PASN process, MIC information is generated. Furthermore, in addition to the PASN process, the unicast and multicast control frame key suites are indicated in the RSNE. Furthermore, in addition to the PASN process, the PTK is used to generate the TCK and KEK in other processes. This improves the security and reliability of transmission between network devices.

[0090] FIG8 is a flowchart of a method for transmitting an information frame according to an embodiment. As shown in FIG8 , the method provided by this embodiment includes the following steps:

[0091] In step 210, a first information frame of a first network device is received, where the first information frame includes first frame number information and first key generation information of the first network device.

[0092] In step 220, a second PTK is generated, where the second PTK is used to encrypt or decrypt unicast messages between the first network device and the second network device.

[0093] In step 230, a first MIC is generated according to the second PTK.

[0094] In step 240, a second information frame is sent to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC.

[0095] In step 250 , a third information frame from the first network device is received, where the third information frame includes third frame number information and a second MIC generated by the first network device.

[0096] In this embodiment, the first network device and the second network device perform authentication and interaction through three types of information frames, and generate a secret key through negotiation on this basis, thereby improving the reliability and security of information frame transmission.

[0097] In one embodiment, the first information frame includes a first authentication frame; the second information frame includes a second authentication frame; the third information frame includes a third authentication frame; or, the first information frame includes a first extended authentication protocol frame; the second information frame includes a second extended authentication protocol frame; and the third information frame includes a third extended authentication protocol frame.

[0098] In one embodiment, the first authentication frame, the second authentication frame and the third authentication frame further include indication information, and the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

[0099] In one embodiment, the method further includes: determining, according to a predefined field, whether the first network device is a master network device or a slave network device, and correspondingly determining whether the second network device is a slave network device or a master network device.

[0100] In one embodiment, the method further includes: when the second network device is a master network device, transmitting multicast key GK information to the first network device through the second authentication frame; when the second network device is a slave network device, receiving the GK information transmitted by the first network device through the third authentication frame; wherein the GK information is used to encrypt or decrypt broadcast messages between network devices.

[0101] In one embodiment, the method further includes: when the second network device is a master network device, transmitting collaboration group identification information to the first network device through the second authentication frame; when the second network device is a slave network device, receiving the collaboration group identification information transmitted by the first network device through the third authentication frame.

[0102] In one embodiment, the method further includes: generating a second KCK and a second KEK according to the second PTK, wherein the second KCK is used to calculate the first MIC, and the second KEK is used to encrypt the second authentication frame and decrypt the third authentication frame.

[0103] In one embodiment, generating a first MIC based on the second PTK includes: generating a first MIC based on the MAC address information of the first network device, the MAC address information of the second network device, the RSNE of the second network device, the RSNXE information of the second network device, the remaining information of the second authentication frame excluding the frame header and the first MIC, a second KCK and a hash algorithm.

[0104] In this embodiment, MIC1 is generated based on the following: the MAC address information of the two APs, the RSNE and RSNXE information of the AP2 beacon, Frame Data, KCK, and the HMAC-HASH algorithm. It may also include the RSNE and RSNXE information of the AP1 beacon.

[0105] For example, the generation of MIC1 is as follows:

[0106] MIC1=HMAC-HASH(KCK,AP2 MAC address information||AP1 MAC address information||AP2 Beacon RSNE||AP2 Beacon RSNXE||AP1 Beacon RSNE||AP1 Beacon RSNXE||Frame Data)

[0107] Among them, HMAC-HASH: a HASH algorithm;

[0108] KCK: key confirmation key (KCK), generated from PTK;

[0109] AP2 MAC address information: AP2's BSSID information, or its corresponding AP MLD address information, or transmitter address (TA) address information;

[0110] AP1 MAC address information: AP1's BSSID information, or its corresponding AP MLD address information, or receiver address (RA) address information;

[0111] AP2 Beacon RSNE: RSNE element information carried in the beacon frame sent by AP2;

[0112] AP2 Beacon RSNXE: RSNXE element information carried in the beacon frame sent by AP2;

[0113] AP1 Beacon RSNE: RSNE element information carried in the beacon frame sent by AP1;

[0114] AP1 Beacon RSNXE: RSNXE element information carried in the beacon frame sent by AP1;

[0115] Frame Data: The remaining information in the second authentication frame excluding the frame header and MIC;

[0116] ||: Connection symbol.

[0117] In one embodiment, generating the second PTK includes: generating the second PTK according to the MAC address information of the first network device, the MAC address information of the second network device, a shared key generated by the Diffie-Huffman protocol, the PMK, and a hash function.

[0118] In one embodiment, the method further includes: determining at least one of the following based on the second PTK: a second TK for encrypting or decrypting unicast data and management frames; a second KDK for generating key information; a second temporary control key TCK for encrypting or decrypting unicast control frames; a second KEK for encrypting or decrypting authentication frames; and a second KCK for verifying MIC.

[0119] The present application also provides an information frame transmission device. FIG9 is a schematic diagram of the structure of an information frame transmission device provided by an embodiment. As shown in FIG9, the information frame transmission device includes:

[0120] A first information frame sending module 310 is configured to send a first information frame to a second network device, where the first information frame includes first frame number information and first key generation information of the first network device;

[0121] A second information frame receiving module 320 is configured to receive a second information frame of the second network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC;

[0122] A first generating module 330 is configured to generate a first PTK, wherein the first PTK is used to encrypt or decrypt unicast messages between the first network device and the second network device;

[0123] A first verification module 340 is configured to verify the first MIC according to the first PTK and generate a second MIC;

[0124] The third information frame sending module 350 is configured to send a third information frame, where the third information frame includes third frame number information and the second MIC.

[0125] The information frame transmission device of this embodiment utilizes the PASN extended protocol to generate the PTK and transfer the GK. During the PASN process, the unicast control key (TCK) and the authentication frame encryption key (KEK) are generated. During the PASN process, master / slave network devices are negotiated and instructed. Unicast and multicast control frame key suites are indicated in the RSNE. MIC information is generated during the PASN process. Furthermore, during processes outside the PASN process, the unicast and multicast control frame key suites are indicated in the RSNE. Furthermore, during processes outside the PASN process, the PTK is used to generate the TCK and KEK. This improves the security and reliability of transmission between network devices.

[0126] In one embodiment, the first key generation information includes first public key information, and the second key generation information includes second public key information;

[0127] Alternatively, the first key generation information includes a first random number; and the second key generation information includes a second random number.

[0128] In one embodiment, the first network device includes a first station or a first access point or a first multi-link access point or a first multi-link station; the second network device includes a second station or a second access point or a second multi-link station or a second multi-link access point.

[0129] In one embodiment, the first information frame and the second information frame further include a robust security network element RSNE and an extended robust security network element RSNXE;

[0130] Alternatively, the second information frame and the third information frame further include a robust security network element RSNE and an extended robust security network element RSNXE.

[0131] In one embodiment, the first information frame includes a first authentication frame; the second information frame includes a second authentication frame; and the third information frame includes a third authentication frame.

[0132] In one embodiment, the first information frame includes a first Extended Authentication Protocol frame; the second information frame includes a second Extended Authentication Protocol frame; and the third information frame includes a third Extended Authentication Protocol frame.

[0133] In one embodiment, the first authentication frame and the second authentication frame further include indication information, where the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

[0134] In one embodiment, the apparatus further comprises:

[0135] The first master-slave determination module is configured to determine whether the first network device is a master network device or a slave network device according to a predefined field, and to determine whether the second network device is a slave network device or a master network device accordingly.

[0136] In one embodiment, the device further includes: a first transmission module configured to

[0137] In the case where the first network device is the primary network device, transmitting multicast key GK information to the second network device through the third authentication frame;

[0138] In a case where the first network device is a slave network device, receiving GK information transmitted by the second network device through the second authentication frame;

[0139] The GK information is used to encrypt or decrypt broadcast messages between network devices.

[0140] In one embodiment, the device further includes: a second transmission module, configured to

[0141] In the case where the first network device is a primary network device, transmitting the cooperation group identification information to the second network device through the third authentication frame;

[0142] In a case where the first network device is a slave network device, the collaboration group identification information transmitted by the second network device through the second authentication frame is received.

[0143] In one embodiment, the device further comprises: a decomposition module configured to

[0144] A first key confirmation key KCK and a first key encryption key KEK are determined according to the first PTK, the first KCK is used to verify the first MIC and generate a second MIC, and the first KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

[0145] In one embodiment, the second authentication frame or the third authentication frame further includes GK information; the GK information includes at least one of the following:

[0146] A group temporary key GTK used to encrypt or decrypt multicast data frames transmitted between the first network device and the second network device, an integrity group temporary key IGTK used to encrypt or decrypt multicast management frames transmitted between the first network device and the second network device, and an integrity control temporary key used to encrypt or decrypt multicast control frames transmitted between the first network device and the second network device.

[0147] In one embodiment, generating the second MIC includes:

[0148] According to the MAC address information of the first network device, the MAC address information of the second network device, the hash value of the first pre-connection security negotiation PASN frame body, the remaining information of the third authentication frame excluding the frame header and the second MIC, the first KCK and the hash algorithm.

[0149] In one embodiment, generating a first PTK includes:

[0150] The first PTK is generated according to the MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the PMK, and a hash function.

[0151] In one embodiment, the apparatus further comprises:

[0152] A first determining module is configured to determine at least one of the following based on the first PTK:

[0153] The first TK used for encryption or decryption of unicast data and management frames;

[0154] A first KDK for generating secret key information;

[0155] A first temporary control key TCK used for unicast control frame encryption or decryption;

[0156] A first KEK for encrypting or decrypting the authentication frame;

[0157] The first KCK used to verify the MIC.

[0158] In one embodiment, the first TCK and the first KEK are generated based on the KDK.

[0159] In one embodiment, the apparatus further comprises:

[0160] The RSNE information indicates at least one of the following to the target network device:

[0161] Unicast key suite information, authentication frame key suite information, multicast management frame key suite information, unicast control frame key suite information, and multicast control frame key suite information.

[0162] In one embodiment, the apparatus further comprises:

[0163] The key suite for unicast control frames and the key suite for multicast control frames are indicated to the target network device through RSNE information.

[0164] The information frame transmission device proposed in this embodiment and the information frame transmission method proposed in the above embodiment belong to the same inventive concept. Technical details not fully described in this embodiment can be referred to any of the above embodiments, and this embodiment has the same beneficial effects as executing the information frame transmission method.

[0165] The present application also provides an information frame transmission device. FIG10 is a schematic diagram of the structure of an information frame transmission device provided by an embodiment. As shown in FIG10, the information frame transmission device includes:

[0166] A first information frame receiving module 410 is configured to receive a first information frame from a first network device, where the first information frame includes first frame number information and first key generation information of the first network device;

[0167] A second information frame receiving module 420 is configured to generate a second PTK, where the second PTK is used to encrypt or decrypt unicast messages between the first network device and the second network device;

[0168] A second generating module 430 is configured to generate a first MIC according to the second PTK;

[0169] A second information frame sending module 440 is configured to send a second information frame to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC;

[0170] The third information frame receiving module 450 is configured to receive a third information frame from the first network device, where the third information frame includes third frame number information and a second MIC generated by the first network device.

[0171] The information frame transmission device of this embodiment utilizes the PASN extended protocol to generate the PTK and transfer the GK. During the PASN process, the unicast control key (TCK) and the authentication frame encryption key (KEK) are generated. During the PASN process, master / slave network devices are negotiated and instructed. Unicast and multicast control frame key suites are indicated in the RSNE. MIC information is generated during the PASN process. Furthermore, during processes outside the PASN process, the unicast and multicast control frame key suites are indicated in the RSNE. Furthermore, during processes outside the PASN process, the PTK is used to generate the TCK and KEK. This improves the security and reliability of transmission between network devices.

[0172] In one embodiment, the first information frame includes a first authentication frame; the second information frame includes a second authentication frame; and the third information frame includes a third authentication frame.

[0173] Alternatively, the first information frame includes a first Extended Authentication Protocol frame; the second information frame includes a second Extended Authentication Protocol frame; and the third information frame includes a third Extended Authentication Protocol frame.

[0174] In one embodiment, the first authentication frame, the second authentication frame and the third authentication frame further include indication information, and the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

[0175] In one embodiment, the device further includes: a second master-slave determination module configured to:

[0176] Determine whether the first network device is a master network device or a slave network device according to a predefined field,

[0177] And correspondingly determine whether the second network device is a slave network device or a master network device.

[0178] In one embodiment, the device further includes: a third transmission module, configured to

[0179] In the case where the second network device is the primary network device, transmitting multicast key GK information to the first network device through the second authentication frame;

[0180] In a case where the second network device is a slave network device, receiving GK information transmitted by the first network device through the third authentication frame;

[0181] The GK information is used to encrypt or decrypt broadcast messages between network devices.

[0182] In one embodiment, the device further includes: a fourth transmission module, configured to

[0183] In the case where the second network device is the primary network device, transmitting the cooperation group identification information to the first network device through the second authentication frame;

[0184] In a case where the second network device is a slave network device, the collaboration group identification information transmitted by the first network device through the third authentication frame is received.

[0185] In one embodiment, the device further comprises: a decomposition module configured to

[0186] A second KCK and a second KEK are generated according to the second PTK, the second KCK is used to calculate the first MIC, and the second KEK is used to encrypt the second authentication frame and decrypt the third authentication frame.

[0187] In one embodiment, generating a first MIC according to the second PTK includes:

[0188] According to the MAC address information of the first network device, the MAC address information of the second network device, the RSNE of the second network device, the RSNXE information of the second network device, the remaining information of the second authentication frame excluding the frame header and the first MIC, the second KCK and the hash algorithm.

[0189] In one embodiment, generating the second PTK includes:

[0190] The second PTK is generated according to the MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the PMK, and a hash function.

[0191] In one embodiment, the apparatus further includes a second determining module configured to determine at least one of the following based on the second PTK:

[0192] A second TK for encryption or decryption of unicast data and management frames;

[0193] A second KDK for generating secret key information;

[0194] A second temporary control key TCK used for encrypting or decrypting unicast control frames;

[0195] A second KEK for encrypting or decrypting the authentication frame;

[0196] The second KCK used to verify the MIC.

[0197] The information frame transmission device proposed in this embodiment and the information frame transmission method proposed in the above embodiment belong to the same inventive concept. Technical details not fully described in this embodiment can be referred to any of the above embodiments, and this embodiment has the same beneficial effects as executing the information frame transmission method.

[0198] An embodiment of the present application also provides a network device. Figure 11 is a schematic diagram of the hardware structure of a network device provided by an embodiment. As shown in Figure 11, the network device provided by the present application includes a processor 510 and a memory 520; the processor 510 in the network device can be one or more, and Figure 1 takes one processor 510 as an example; the memory 520 is configured to store one or more programs; the one or more programs are executed by the one or more processors 510, so that the one or more processors 510 implement the information frame transmission method as described in the embodiment of the present application.

[0199] The network device further includes: a communication device 530 , an input device 540 and an output device 550 .

[0200] The processor 510, memory 520, communication device 530, input device 540 and output device 550 in the network device can be connected via a bus or other means. FIG11 takes the bus connection as an example.

[0201] The input device 540 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the network device. The output device 550 may include a display device such as a display screen.

[0202] The communication device 530 may include a receiver and a transmitter. The communication device 530 is configured to perform information transmission and reception communication according to the control of the processor 510.

[0203] The memory 520, as a computer-readable storage medium, can be configured to store software programs, computer executable programs, and modules, such as program instructions / modules corresponding to the information frame transmission method described in the embodiment of the present application (for example, the first information frame sending module 310, the second information frame receiving module 320, the first generation module 330, the first verification module 340, and the third information frame sending module 350 in the information frame transmission device). The memory 520 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; and the data storage area may store data created based on the use of the network device. In addition, the memory 520 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 520 may further include a memory remotely located relative to the processor 510, and these remote memories may be connected to the network device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0204] The embodiment of the present application also provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the information frame transmission method described in any one of the embodiments of the present application is implemented. The method includes: sending a first information frame to a second network device, wherein the first information frame includes first frame number information and first key generation information of the first network device; receiving a second information frame of the second network device, wherein the second information frame includes second frame number information, second key generation information of the second network device, and a first MIC; generating a first PTK, wherein the first PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device; verifying the first MIC based on the first PTK and generating a second MIC; and sending a third information frame, wherein the third information frame includes third frame number information and the second MIC. Alternatively, the method includes: receiving a first information frame from a first network device, the first information frame including first frame number information and first key generation information of the first network device; generating a second PTK, the second PTK being used to encrypt or decrypt unicast messages between the first network device and the second network device; generating a first MIC based on the second PTK; sending a second information frame to the first network device, the second information frame including second frame number information, second key generation information of the second network device and the first MIC; receiving a third information frame from the first network device, the third information frame including third frame number information and the second MIC generated by the first network device.

[0205] The computer storage medium of the embodiment of the present application can adopt any combination of one or more computer-readable media.Computer-readable media can be computer-readable signal media or computer-readable storage media.Computer-readable storage media can be, for example, but not limited to: electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination of the above.More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM), flash memories, optical fibers, portable CD-ROMs, optical storage devices, magnetic storage devices, or any suitable combination of the above.Computer-readable storage media can be any tangible medium containing or storing a program, which can be used by an instruction execution system or device or used in combination with it.

[0206] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system or device.

[0207] The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0208] The computer program code for performing the operations of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect via the Internet).

[0209] The above description is merely an exemplary embodiment of the present application and is not intended to limit the scope of protection of the present application.

[0210] It will be appreciated by those skilled in the art that the term user terminal covers any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser or a vehicle-mounted mobile station.

[0211] In general, various embodiments of the present application may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device, although the present application is not limited thereto.

[0212] Embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example, in a processor entity, or by hardware, or by a combination of software and hardware. The computer program instructions may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages.

[0213] The block diagram of any logic flow in the drawings of this application may represent program steps, or may represent interconnected logic circuits, modules and functions, or may represent a combination of program steps and logic circuits, modules and functions. A computer program may be stored on a memory. The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as but not limited to read-only memory (ROM), random access memory (RAM), optical storage devices and systems (digital versatile discs (DVD) or compact disks (CD), etc.). Computer-readable media may include non-transitory storage media. The data processor may be of any type suitable for the local technical environment, such as but not limited to a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), and a processor based on a multi-core processor architecture.

[0214] The above description of exemplary embodiments of the present application has been provided by way of exemplary and non-limiting examples. However, various modifications and adaptations of the above embodiments will be apparent to those skilled in the art, when considered in conjunction with the accompanying drawings and the appended claims, without departing from the scope of the present application. Therefore, the proper scope of the present application will be determined by reference to the appended claims.

Claims

1. A method for transmitting an information frame, applied to a first network device, comprising: Sending a first information frame to a second network device, wherein the first information frame includes first frame number information and first key generation information of the first network device; Receive a second information frame of the second network device, where the second information frame includes second frame number information, second key generation information of the second network device, and a first information integrity check code MIC; Generate a first pairwise transmission key PTK, where the first PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device; Verify the first MIC according to the first PTK and generate a second MIC; A third information frame is sent, where the third information frame includes third frame number information and the second MIC.

2. The method according to claim 1, wherein: The first secret key generation information includes first public key information, and the second secret key generation information includes second public key information; Alternatively, the first secret key generation information includes a first random number; and the second secret key generation information includes a second random number.

3. The method according to claim 1, wherein: The first network device includes a first site or a first access point or a first multi-link access point or a first multi-link site; the second network device includes a second site or a second access point or a second multi-link site or a second multi-link access point.

4. The method according to claim 1, wherein: The first information frame and the second information frame also include a robust security network element RSNE and an extended robust security network element RSNXE; Alternatively, the second information frame and the third information frame also include RSNE and RSNXE.

5. The method according to claim 1, wherein: The first information frame also includes a first authentication frame; the second information frame also includes a second authentication frame; and the third information frame also includes a third authentication frame.

6. The method according to claim 1, wherein: The first information frame further includes a first extended authentication protocol frame; the second information frame further includes a second extended authentication protocol frame; and the third information frame further includes a third extended authentication protocol frame.

7. The method according to claim 5, wherein: The first authentication frame, the second authentication frame and the third authentication frame include indication information. The indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicates that the second network device is a slave network device or a master network device.

8. The method according to claim 5, further comprising: The first network device is determined to be a master network device or a slave network device according to the predefined field, and the second network device is determined to be a slave network device or a master network device accordingly.

9. The method according to claim 7 or 8, further comprising: In the case where the first network device is a main network device, transmitting multicast key GK information to the second network device through the third authentication frame; In the case where the first network device is a slave network device, receiving GK information transmitted by the second network device through the second authentication frame; The GK information is used to encrypt or decrypt broadcast messages between network devices.

10. The method according to claim 7 or 8, further comprising: In the case where the first network device is a primary network device, transmitting the cooperation group identification information to the second network device through the third authentication frame; When the first network device is a slave network device, the cooperation group identification information transmitted by the second network device through the second authentication frame is received.

11. The method according to claim 5, further comprising: A first key confirmation key KCK and a first key encryption key KEK are determined according to the first PTK, the first KCK is used to verify the first MIC and generate a second MIC, and the first KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

12. The method according to claim 5, wherein: The second authentication frame or the third authentication frame includes GK information; the GK information includes at least one of the following: A group temporary key GTK used to encrypt or decrypt multicast data frames transmitted between the first network device and the second network device, an integrity group temporary key IGTK used to encrypt or decrypt multicast management frames transmitted between the first network device and the second network device, and an integrity control temporary key used to encrypt or decrypt multicast control frames transmitted between the first network device and the second network device.

13. The method according to claim 5, wherein: The generating the second MIC comprises: The second MIC is generated according to the MAC address information of the first network device, the MAC address information of the second network device, the hash value of the first pre-connection security negotiation PASN frame body, the remaining information of the third authentication frame excluding the frame header and the second MIC, the first KCK and the hash algorithm.

14. The method according to claim 1, wherein: Generate the first PTK, including: The first PTK is generated according to the media access control MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the pairwise master key PMK and a hash function.

15. The method according to claim 1, further comprising: Determine at least one of the following based on the first PTK: A first temporary key TK used for encryption or decryption of unicast data and management frames; A first key generation key KDK for generating key information; A first temporary control key TCK used for encryption or decryption of unicast control frames; A first KEK for encrypting or decrypting the authentication frame; The first KCK used to verify the MIC.

16. The method according to claim 15, wherein: The first TCK and the first KEK are generated according to the first KDK.

17. The method according to claim 1, further comprising: The RSNE information indicates at least one of the following to the target network device: Unicast key suite information, authentication frame key suite information, multicast management frame key suite information, unicast control frame key suite information, and multicast control frame key suite information.

18. The method of claim 1, further comprising: The key suite for the unicast control frame and the key suite for indicating the multicast control frame are indicated to the target network device through the RSNE information.

19. An information frame transmission method, applied to a second network device, comprising: Receive a first information frame of a first network device, wherein the first information frame includes first frame number information and first key generation information of the first network device; Generate a second pairwise transmission key PTK, where the second PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device; Generate a first information integrity check MIC according to the second PTK; Sending a second information frame to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC; A third information frame from the first network device is received, where the third information frame includes third frame number information and a second MIC generated by the first network device.

20. The method according to claim 19, wherein: The first information frame also includes a first authentication frame; the second information frame also includes a second authentication frame; the third information frame also includes a third authentication frame; or, The first information frame further includes a first extended authentication protocol frame; the second information frame further includes a second extended authentication protocol frame; and the third information frame further includes a third extended authentication protocol frame.

21. The method according to claim 20, wherein: The first authentication frame, the second authentication frame and the third authentication frame include indication information, and the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

22. The method according to claim 20, further comprising: Determine, according to a predefined field, whether the first network device is a master network device or a slave network device, And correspondingly determine whether the second network device is a slave network device or a master network device.

23. The method of claim 20, further comprising: In the case where the second network device is the main network device, transmitting multicast key GK information to the first network device through the second authentication frame; In the case where the second network device is a slave network device, receiving the GK information transmitted by the first network device through the third authentication frame; The GK information is used to encrypt or decrypt broadcast messages between network devices.

24. The method of claim 20, further comprising: In the case where the second network device is a primary network device, transmitting the cooperation group identification information to the first network device through the second authentication frame; In the case where the second network device is a slave network device, the cooperation group identification information transmitted by the first network device through the third authentication frame is received.

25. The method of claim 20, further comprising: A second KCK and a second KEK are generated according to the second PTK, the second KCK is used to calculate the first MIC, and the second KEK is used to encrypt the second authentication frame and decrypt the third authentication frame.

26. The method of claim 20, wherein: Generating a first MIC according to the second PTK includes: The first MIC is generated according to the MAC address information of the first network device, the MAC address information of the second network device, the RSNE of the second network device, the RSNXE information of the second network device, the remaining information of the second authentication frame excluding the frame header and the first MIC, the second KCK and a hash algorithm.

27. The method of claim 19, wherein: Generating the second PTK includes: The second PTK is generated according to the media access control MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the pairwise master key PMK and a hash function.

28. The method of claim 19, further comprising: Determine at least one of the following based on the second PTK: A second temporary key TK used for encryption or decryption of unicast data and management frames; A second key generation key KDK for generating key information; A second temporary control key TCK used for encrypting or decrypting unicast control frames; A second KEK for encrypting or decrypting the authentication frame; The second KCK is used to verify the MIC.

29. A network device comprising: memory, and at least one processor; The memory is configured to store at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the information frame transmission method according to any one of claims 1 to 28.

30. A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the information frame transmission method according to any one of claims 1 to 28 is implemented.

Images