Method of communication with privacy management through privacy groups of non-AP stations

Abstract

With a view to optimize the privacy in the BSS, the proposed invention introduces privacy groups of non-AP STAs such that the obfuscation procedure of the privacy parameters is performed for each privacy group independently. In that case, a transition period is associated to each privacy group of non-AP stations. The information about the execution of the obfuscation procedure related to each privacy group is exchanged during the association procedure and afterwards within management frames. Each transition period is scheduled such as the number of available values, e.g., AID12 values, is sufficient to perform the obfuscation procedure. The transition periods preferably do not overlap each other, except if the number of available values is sufficient. The groups can be split or merged depending on the evolving number of non-AP stations within the BSS.

Description

[0001] METHOD OF COMMUNICATION WITH PRIVACY MANAGEMENT THROUGH PRIVACY GROUPS OF NON-AP STATIONS

[0002] FIELD OF THE INVENTION

[0003] The present invention relates to wireless communications and more specifically to user privacy during wireless communications.

[0004] BACKGROUND OF THE INVENTION

[0005] The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section. Furthermore, all embodiments are not necessarily intended to solve all or even any of the problems brought forward in this section.

[0006] Wireless communication networks are widely deployed to provide various communication services such as voice, video, packet data, messaging, broadcast, etc. These wireless networks may be multiple-access networks capable of supporting multiple users by sharing the available network resources. Examples of such multiple-access networks include Code Division Multiple Access (CDMA) networks, Time Division Multiple Access (TDMA) networks, Frequency Division Multiple Access (FDMA) networks, Orthogonal FDMA (OFDMA) networks, and Single-Carrier FDMA (SC-FDMA) networks. The 802.1 1 family of standards adopted by the Institute of Electrical and Electronics Engineers (IEEE) provides a great number of mechanisms for wireless communications between stations.

[0007] Today, the evolution of wireless systems has brought privacy concerns at the forefront, driven by user demand and requirements of the General Data Protection Regulation (GDPR). The global wireless industry is facing growing needs to protect users’ personally identifiable information from increasingly sophisticated user tracking and user profiling activities, while continuing to improve wireless services and the user experience.

[0008] In particular, the Media Access Control (MAC) address of a user device constitutes a piece of data that can be used to track this user. Indeed, the access points (APs) of wireless networks can monitor the locations of mobile devices (tablets, laptops, mobile phones, etc.) of a user without his / her consent, by means of their MAC addresses. This is because mobile phones are configured to discover surrounding access points to wireless networks. As a user moves, his / her mobile phone sends requests to determine whether there are any access points nearby, these requests identifying the mobile phone that sends these requests by including in particular the MAC address of the mobile phone. Access points that hear these requests can respond. In the context of Wi-Fi networks as defined by IEEE 802.11 standards (Wi-Fi is a trademark), this procedure is called Probe Request / Response exchange. So even when a mobile phone is not connected to a Wi-Fi network, surrounding access points may receive its MAC address. It is then possible to track a user by reconstructing his / her trajectory from access points to which his / her mobile phone has sent its MAC address. In addition, if the mobile phone has been associated with one of the access points (i.e., the user has connected to an associated Wi-Fi network through that access point) and the user has provided personal identification information (name, place of residence, etc.) in the past, the access point may have recorded in a database the MAC address of the phone in association with the identification information. Therefore, even if the user is not connected to the Wi-Fi network, this identity information could be recovered by comparing the MAC address contained in a Probe Request to the MAC address used for the past association.

[0009] In the context of Wi-Fi networks, a solution has been proposed by the IEEE 802.11 working group to limit the risk of a user being traced, and consists in dynamically modifying the MAC address of the user device. This mechanism is called Randomized and Changing MAC (RCM) procedure. It has been originally introduced as a privacy enhancing feature in the 802.11 aq Pre-Association Service Discovery Task Group and finally included in the standard IEEE Std 802.11-2020. It comprises periodical change of the MAC address of a non-AP station (i.e., a station which is not an access point, also referred to as STA) to a random value, while the non- AP station is not associated with a network (or, equivalently, with an access point). The non-AP station may construct the randomized MAC address from the locally administered address space as defined in IEEE Std 8020-2014 and IEEE Std 802c™-2017.

[0010] More specifically, a new Management Information Base (MIB) variable controllable by an external management entity has been specified. This variable is called ‘dot1 IMACPrivacyActivated’. When dot1 I MACPrivacyActivated is set to “true”, the non-AP station can apply specific mechanisms for enhancing the privacy at MAC level, including RCM.

[0011] Both the AP and the non-AP station operate the change of MAC address of the non-AP station at the same transition instant on their respective side.

[0012] SUMMARY OF THE INVENTION

[0013] To avoid synchronization issues, a transition period is defined during which the old MAC address and the new MAC address remain valid to guarantee that the acknowledgment of a current transmissions started before the transition period can be made. The transition period starts with a RCM ready event and ends with a RCM done event. The RCM ready event is a date when the new MAC address is allocated to a non-AP station and can be used by the AP and the non-AP station itself. The old MAC address associated to the non-AP station remain valid until the RCM done event that ends the transition period. After the RCM done event, the old MAC address can no longer be used and only the new MAC address remains valid.

[0014] Moreover, to enhance the obfuscation process in the network, it is interesting to perform the change of the MAC address for all non-AP stations associated with the AP. It means that a large amount of MAC addresses has to be doubled to ensure the privacy and to run the obfuscation procedure because all STAs associated to the AP run the obfuscation procedure at the same time. To minimize the number of MAC addresses in use, it is also interesting to optimize the length of the transition period.

[0015] Other privacy parameters than the MAC address can provide tracking information about the user. These include as a non-exhaustive list the Association IDentifier (AID12) of the non-AP stations, the sequence number and the packet number used in communication operations, the Traffic IDentifier (TID) used to identify a class of transmitted packets.

[0016] The privacy parameters are also named “PE (privacy enhancement) parameters”. The obfuscation procedure consists in performing a simultaneous change of the transmitted PE parameters (which are transmitted in clear in the frames) by the stations, to uncorrelated new values (with the previous ones) without any loss of connection. The PE parameters have to be changed (similar to the MAC address above) at the same time to ensure the privacy inside the network. It means that all STAs associated to the AP run the obfuscation procedure at the same time. During the transition period, two sets of PE parameters remain valid for each non-AP station being in the obfuscation procedure. Due to synchronization issue and clock drift between a STA and an AP and to finalize the already started transmissions, the new PE parameters and the old PE parameters must remain valid during the transition period. For example, the new PE parameters and the old PE parameters must remain valid at least for a short period of time, called a transition period. To ensure the transmission continuity, all STAs must end the data transmissions already initiated with the old PE parameters, before starting new transmissions with the new PE parameters.

[0017] It may however happen that the number of available values for a PE parameter is low compared to the number of stations. For instance, the AID12 parameter is allocated within a range of available values limited to 2007 as mentioned in the subclause 9.3.1 .22.1 ofthe 802.11 ax-2021 amendment. Should the number of non-AP stations be high (e.g., 1004), it becomes impossible to perform the obfuscation procedure because not all the non-AP stations can be provided with a second AID12 value for the transition period.

[0018] The AP’s policies may also degrade the situation.

[0019] For instance, when a non-AP station roams to another network, it does not necessarily perform a disassociation procedure, meaning that all parameters associated with the non-AP station remain valid for a long time from the AP’s point of view. As such “ghost” values are not released, they cannot be used as new values for the obfuscation procedure.

[0020] Another AP’s policy is when the AP decides to manage the AID12 allocation in a smaller range of values for any reason (for example to classify the AID12 allocated to the non-AP stations depending on their profile or enabled functionalities). Again, the number of available values for a given PE parameter may rapidly become low compared to the number of associated non-AP stations, and the obfuscation procedure cannot be performed.

[0021] This situation needs to be avoided as often as possible. New strategies to optimize privacy are therefore sought. In this context, the invention provides a method of communication in a wireless network comprising an access point, AP, station managing a Basic Station Set, BSS and non-AP stations associated with the AP station, the method comprising at the AP station: obfuscating current values of a privacy parameter for the non-AP stations into respective new values, wherein the current value and the respective new value for a non-AP station are both valid for communication operations by the non-AP station during a transition period after which the current value becomes invalid, wherein the non-AP stations are organized into two or more privacy groups, each privacy group having its own transition period.

[0022] By splitting the transitions in multiple groups, the number of new values required for a transition period is reduced from the total number of non-AP stations (before the split) to the number of such stations in the privacy group or groups concerned by the transition period. The obfuscation procedure for all the non-AP stations is thus spread over the time (over the multiple transition periods). It results that a lower number of available values for the privacy parameter is required at a given time.

[0023] A value is said to be valid when it can be considered by the non-AP station to perform communication operations (e.g., to filter or process or build a frame).

[0024] In some embodiments, the transition periods of the two or more privacy groups do not overlap one each other.

[0025] As the transition periods do not overlap throughout the privacy groups, only one privacy group performs the change of values at a time, meaning the number of available values needed can be limited to the number of stations within the privacy group concerned. The change of privacy parameter values is thus performed independently from one privacy group to the other.

[0026] Of course, some transition periods may overlap when others do not. In particular, they may overlap as long as the number of available values for the privacy parameter is high enough compared to the number of current values and new values required during the transition period.

[0027] In some embodiments, the transition period of one privacy group starts from a start time when the current and new values for a non-AP station of the privacy group are both valid for communication operations by the non-AP station, and ends at an end time when only the new value is valid for communication operations by the non-AP station. The transition period is therefore the time needed to switch from the old value (current one) to the new one. During that transition period, the non-AP station can use either of the two values. A transition time within the period may decide when the old one is actually changed or switched into the new one for communication purposes.

[0028] Some implementations may provide that, during the transition period, the two values are valid for reception operations only while only one of them is valid for transmission operations (which is changed from the old one to the new one at the transition time for instance).

[0029] In some embodiments, the method further comprises, at the AP station, adjusting the privacy groups when the number NTOTAL of non-AP stations associated with the AP station evolves, wherein the adjusting is based on a criterion comparing, for a reference transition period of a reference privacy group, on one hand twice the number NSTA of non-AP stations that have their current value and respective new value both valid for communication operations during at least a part of the reference transition period, and the number MOTHER of the other associated non- AP stations, with on the other hand a number NAVAILABLE of available values for the privacy parameter.

[0030] This allows the sizes (i.e., number of stations) of the groups to be adjusted, in particular to ensure the number of new values to be generated is compliant with the number of available values.

[0031] In particular embodiments where the reference transition period does not overlap any other transition period, NSTA is the number of non-AP stations within the reference privacy group.

[0032] In other particular embodiments where the transition periods overlap, NSTA is the summed number of non-AP stations within all privacy groups the transition periods of which at least partially overlap the reference transition period. Indeed, all the stations of these overlapping groups are likely to have two values valid at the same time, within the reference transition period. A sufficient number of available values is thus required for the privacy parameter to obfuscate.

[0033] To be noted that a more precise approach may consider twice the maximum number of non-AP stations that simultaneously have their current value and respective new value both valid for communication operations at the same time during the reference transition period. This takes into account non-overlapping transition periods that overlap the reference transition period.

[0034] In some embodiments, the criterion includes determining whether

[0035] 2 x NSTA + NOTHE S a. NAVAILABLE where a is a positive weight equal or less than 1 . A weight of 1 is preferably used.

[0036] The same weight or different weights can be used when considering merging two privacy groups into a single one and considering splitting one privacy group into two.

[0037] The higher the weight, the later the adjustment of the groups.

[0038] In some embodiments, the adjusting includes splitting a privacy group into two or more new privacy groups. The split may be triggered if the above criterion is met. Usually, one of the new privacy group is the initial privacy ground with, however, less non-AP stations.

[0039] Preferably, at least one of the new privacy groups has its transition period that does not overlap the reference transition period. This allows the number of stations to have two new values valid during the reference transition period to be decreased, hence to possibly satisfy the number of values available for the privacy parameter.

[0040] As an idea is to reduce overlap, the two new privacy groups may preferably be allocated respective transition periods that do not overlap each other.

[0041] In particular embodiments, the privacy group to split includes the reference privacy group or any “overlapping” privacy group the transition periods of which at least partially overlap the reference transition period. This seeks to reduce the number of new values needed for the reference transition period. In some particular embodiments, splitting a privacy group includes selecting the most populated one from the overlapping privacy groups including the reference privacy group or selecting randomly a privacy group from them, and then splitting the selected privacy group.

[0042] In some embodiments, the adjusting includes merging first and second privacy groups into a new privacy group. This may happen when enough values are available given the number of stations that obfuscate. Multiple strategies to detect when triggering the merger and to decide which groups to merge can be implemented. For example, the above criterion may be used (a can be lower than for a splitting process) and the merger may take place when the criterion is not met (meaning there are plenty of values available compared to the number of stations). Furthermore, any non-overlapping privacy group may be merged with the reference privacy group in that case.

[0043] The merger advantageously optimizes the obfuscation procedure because more stations can change their values of the privacy parameter at the same time.

[0044] In some embodiments, the number NTOTAL evolves when: one or more new non-AP stations associate with the AP station, or one or more associated non-AP stations disassociate from the AP station or are revoked by the AP station.

[0045] In some embodiments, the method further comprises sending a frame signaling the adjusted privacy groups.

[0046] In particular embodiments, the frame includes one or more group descriptions associated with one or more privacy groups, wherein a group description includes transition period indication and a list of the non-AP stations composing the associated privacy group. One or multiple transition periods may be defined for each privacy group. Such frame is sent after each merger or split of privacy groups, to report the new transition periods for each and every associated non-AP station.

[0047] A method is therefore proposed of communication in a wireless network comprising an access point, AP, station managing a Basic Station Set, BSS and non-AP stations associated with the AP station. The method comprises, at one of the non-AP stations: receiving, from the AP station, a frame signaling multiple privacy groups, each privacy group having its own transition period; determining one of the multiple privacy groups to which the non-AP station belongs; and obfuscating a current value of a privacy parameter into a new value during the transition period of the determined privacy group, wherein the current and new values are both valid for communication operations by the non-AP station during the transition period after which the current value becomes invalid.

[0048] Other aspects of the invention provide a frame to be sent by an access point, AP, station managing a Basic Station Set, BSS, of non-AP stations, the frame comprising multiple group descriptions defining multiple privacy groups, each group description including a list of the non- AP stations belonging to the corresponding privacy group and including a transition period during which a current value of a privacy parameter and a new value obfuscating the current value for any non-AP station of the privacy group are both valid for communication operations by the non- AP station.

[0049] In some embodiments, the frame includes one Element in the meaning of the 802.11 standard that comprises the multiple group descriptions. Reference is for instance made to IEEE Std 802.11 ™-2020 section 9.4.2. in which an Element is made of an Element ID field, a Length field, an Element ID Extension field, and an Information field.

[0050] In other embodiments, the frame is a Management frame in the meaning of the 802.11 standard family. Reference is for instance made to IEEE Std 802.11 ™-2020 section 9.3.3. The Frame Control field makes it possible to distinguish between Control frames, Data frames, Management frames and Extension frames. Exemplary Management frames from an AP station include Beacon frames, Association Response frames, Reassociation Response frames, Probe Response frames, Action frames.

[0051] Correlatively, the invention also provides a wireless communication device comprising at least one microprocessor configured for carrying out the steps of any of the above methods. The wireless communication device may be either of a non-AP MLD and an AP MLD.

[0052] Another aspect of the invention relates to a non-transitory computer-readable medium storing a program which, when executed by a microprocessor or computer system in a wireless device, causes the wireless device to perform any method as defined above.

[0053] At least parts of the methods according to the invention may be computer implemented. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit", "module" or "system". Furthermore, the present invention may take the form of a computer program product embodied in any tangible medium of expression having computer usable program code embodied in the medium.

[0054] Since the present invention can be implemented in software, the present invention can be embodied as computer readable code for provision to a programmable apparatus on any suitable carrier medium. A tangible, non-transitory carrier medium may comprise a storage medium such as a floppy disk, a CD-ROM, a hard disk drive, a magnetic tape device or a solid- state memory device and the like. A transient carrier medium may include a signal such as an electrical signal, an electronic signal, an optical signal, an acoustic signal, a magnetic signal or an electromagnetic signal, e.g., a microwave or RF signal.

[0055] BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Some embodiments of the present invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings, in which like reference numerals refer to similar elements and in which:

[0057] - Figure 1 illustrates an example of a network system in which some embodiments of the invention may be implemented;

[0058] - Figure 2a illustrates, using a flowchart, an example of steps performed at a non-AP station or its AP station before changing privacy parameter values of the non-AP station, according to some embodiments of an obfuscation procedure;

[0059] - Figure 2b illustrates, using a flowchart, an example of steps performed at a non-AP station or its AP station after having changed the privacy parameter values of the non-AP station, according to some embodiments of an obfuscation procedure;

[0060] - Figure 3 illustrates, using a timeline, an exemplary time sequence showing the simultaneous obfuscating procedure for a set of non-AP stations;

[0061] - Figure 4 illustrates, using a flowchart, an exemplary sequence of steps carried out by an AP station to manage one or more privacy groups, according to some embodiments of the invention;

[0062] - Figure 5 illustrates an exemplary Element format to carry out privacy group descriptions, according to some embodiments of the invention;

[0063] - Figure 6 illustrates, using a flowchart, general steps at a non-AP station receiving privacy group descriptions, according to embodiments of an obfuscation procedure;

[0064] - Figure 7 illustrates, using a timeline, an exemplary time sequence showing the management of multiple privacy groups of non-AP stations, according to some embodiments of the invention;

[0065] - Figure 8 illustrates an example of a communication device of a wireless network, configured to implement at least one embodiment of the present invention;

[0066] - Figure 9a illustrates, using a timeline, an exemplary time sequence illustrating the identified issues related to the AID12 management during the transition period; and

[0067] - Figure 9b illustrates, using a timeline, an exemplary time sequence showing the management of multiple privacy groups of non-AP stations, according to some embodiments of the invention.

[0068] DESCRIPTION OF SOME EMBODIMENTS

[0069] As a development of the Randomized and Changing MAC (RCM) procedure by the IEEE 802.11 working group, the present invention regards the management of the obfuscation procedure conducted by an AP to obfuscate the values of the PE parameters of all its associated non-AP stations (e.g., OTA MAC Address, AID, Sequence Number, Packet Number, Traffic IDentifier).

[0070] The MAC address, or EUI-48 address, of a device is an Extended Unique Identifier (EUI) composed of 48 bits. It can be administered universally or locally. A universally administered address is uniquely assigned to the device by the manufacturer. On the contrary, a locally administered address is assigned to the device by a software or a network administrator, and replaces the physical burned-in address. The second-least-significant bit of the first octet of the MAC address, i.e., the seventh bit of the first octet of the address, also referred to as “U / L bit” (for “Universal / Local bit”), indicates whether it is universally (when set to 0) or locally (when set to 1) administered. The least-significant bit of the first octet of the MAC address, i.e. , the eighth bit of the first octet of the address, also referred to as “l / G bit” (for “Individual / Group bit”), indicates whether the frame is sent to only one receiving device (when set to 0, indicating unicast transmission) or to a plurality of devices (when set to 1 , indicating multicast transmission). When RCM mechanism is operated in the non-AP station, the MAC address of the non-AP station is randomly changed (for instance periodically). More specifically, the U / L bit is set to 1 , the l / G bit is set to 0, and the remaining 46 bits are randomly generated by using a pseudorandom function (PRF), or can be obtained by any other means (for instance received from AP, or taken in a predefined list of addresses).

[0071] In the RCM mechanism, both the AP and the non-AP station operate the change of MAC address of the non-AP station, from the current value to the new (obfuscated) value, at the same transition instant on their respective side. This transition instant can be dynamically determined (duration between two changes can be variable overtime), or can be based on a fixed frequency. An accurate synchronization is required to avoid discarding frames addressed with a MAC address considered as valid only by the emitter side. It has been recently proposed to rely on a transition instant defined by an absolute time (TSF), or on a transition instant that is relative to the reception of a frame (typically a beacon frame).

[0072] More generally, the obfuscation procedure does not only concern the MAC address of a non-AP station but also other privacy parameters or PE parameters including:

[0073] • the AID or AID12 which is an identifier provided by the AP to the non-AP station registering to it. The AID is used to identify the non-AP station within the BSS managed by the AP. It is shorter than the MAC address of the non-AP station,

[0074] • the sequence number (SN) which is used to manage the ordering scheduling during the data transmission and the retransmission process,

[0075] • the packet number (PN) which is used to manage the ordering scheduling during the data transmission and the retransmission process,

[0076] • the TID number which identifies the class of a transmitted packet,

[0077] • the Scrambler Seed (SS) which is used to scramble data to be transmitted.

[0078] Unfortunately, the proposed solutions based on a transition instant still suffer from a risk of frame discarding upon reception since they rely on beacon frames reception and cannot guaranty a perfect synchronization. The known solutions cannot guarantee a perfect synchronization between the non-AP station’s clock and the AP’s clock. One of the reasons is that the internal quartz that supports the 1 MHz clock of the 802.11 stations (AP or non-AP station) can suffer from a drift up to 10Oppm (as defined in the 802.1 1 standards). This 10Oppm clock drift will for instance end up with a relative clock drift difference of up to 20ps per 100ms (that is a typical interval between two beacon receptions) between an AP and a non-AP station. Although this difference is quite short, it however allows one frame to be discarded and thus a retransmission to be required. It results that the associated congestion window evolves in a way that slows down the future emission of frames.

[0079] In addition to this relatively small drift, a much bigger problem occurs when a non-AP station sleeps (goes in doze state) for a long period of time, because the clock drift may then be much higher upon station awakening. For instance, if a station sleeps for 10 minutes, the clock drifts can be up to 120ms because the station cannot receive beacon frames able to resynchronize its internal clock while asleep. In this last situation, the awakening station may use the wrong MAC address until the reception of a new beacon frame (typically up to 100ms later if the first received beacon is well received). This may result in having a large number of frames to be discarded and associated retransmissions to be performed.

[0080] To avoid synchronization issues due to a unique time instant corresponding to the transition time, a transition period has been defined during which both the current MAC address and the new (obfuscated) value are valid for communication operations by the AP and the non- AP station, and after which only the new value becomes valid. This provides time for both stations to have switched to the new value when the transition period ends.

[0081] This approach causes for each non-AP station to be temporarily allocated two values for the same privacy parameter.

[0082] To enhance the obfuscation process within the BSS managed by the AP, the change of the privacy parameters is preferably conducted at the same time for all the non-AP stations associated with the AP. It means that the temporary doubling of values for each privacy parameter is made at the same time for all the non-AP stations.

[0083] Although this has no damaging effects with privacy parameters having a huge number of values available (such as the MAC address) because each non-AP station may have a second unique value, there may be privacy parameters (such as AID and TID) where the number of available values is not sufficient to offer a second unique value to each and every non-AP station belonging to the BSS. In that case, the obfuscation procedure cannot be performed by lack of available values, which is detrimental to privacy.

[0084] The situation is getting worst and worst as the number of non-AP stations increases in the BSS and / or as the number of “ghost” values increases. A ghost value for a privacy parameter is a value no longer used in the BSS but that is still allocated to a non-AP station, usually that has left the BSS. Allocated values may become ghost when a non-AP station leaves the BSS (e.g., for roaming) without performing the necessary steps, for instance without soliciting a disassociation procedure to release the values allocated to it.

[0085] With a view to optimize the privacy in the BSS, the proposed invention introduces privacy groups of non-AP STAs such that the obfuscation procedure of the privacy parameters is performed for each privacy group independently. In that case, a transition period is associated to each privacy group of non-AP stations. The information about the execution of the obfuscation procedure related to each privacy group is exchanged during the association procedure and afterwards within management frames. Each transition period is scheduled such as the number of available values, e.g., AID12 values, is sufficient to perform the obfuscation procedure. The transition periods preferably do not overlap each other, except if the number of available values is sufficient. The groups can be split or merged depending on the evolving number of non-AP stations within the BSS.

[0086] In this context, a method of communication in a wireless network comprising an access point, AP, station managing a Basic Station Set, BSS and non-AP stations associated with the AP station, is provided.

[0087] The method comprises at the AP station: obfuscating current values of a privacy parameter for the non-AP stations into respective new values, wherein the current value and the respective new value for a non-AP station are both valid for communication operations by the non-AP station during a transition period after which the current value becomes invalid, wherein the non-AP stations are organized into two or more privacy groups, each privacy group having its own transition period.

[0088] More generally, the method may comprise obfuscating current values of a privacy parameter for the non-AP stations into respective new values, wherein the current value is switched into the respective new value for communication operations by a non-AP station at a transition time, and wherein the non-AP stations are organized into two or more privacy groups, each privacy group having its own transition time.

[0089] Using groups (whatever the transition time / instant or the transition period) helps the AP station to spread its processing load (related to obfuscation) over time.

[0090] The use of groups with the transition periods overcomes the synchronization issue while reducing the constraints on the available values required to perform the obfuscation procedure for the non-AP stations.

[0091] Figure 1 illustrates an example of a network system in which some embodiments of the invention may be implemented.

[0092] Forthe sake of illustration, Figure 1 represents an 802.11 network (i.e. , a Wi-Fi network) system 100 comprising four wireless devices: an access point station (AP) 105 and three non-AP stations (non-AP STAs) 1 10a, 110b, and 110c. Of course, the number of non-AP stations 110a, 110b, and 110c may be different from three. AP station 105 provides wireless connections between non-AP stations 1 10a, 110b, 110c and a wider network, such as the Internet (not represented). The connection of one of non-AP stations 110a, 110b, and 110c to AP station 105 may be performed by a standardized process called association, through with an AID is allocated to the non-AP station by the AP to identify the non-AP station in future communications within the network. Once a non-AP station is associated with the AP station, the non-AP station can send data to the network and receive data from the network through the AP station using its AID.

[0093] AP station 105 may comprise, be implemented as, or known as a Node B, Radio Network Controller (RNC), evolved Node B (eNB), 5G Next generation base station (gNB), Base Station Controller (BSC), Base Transceiver Station (BTS), Base Station (BS), Transceiver Function (TF), Radio Router, Radio Transceiver, Basic Service Set (BSS), Extended Service Set (ESS), Radio Base Station (RBS), or some other terminology. It can be a standalone product or it may be integrated in a device, for instance in a broadband remote access server (BRAS).

[0094] Non-AP stations 110a, 1 10b, and / or 110c may comprise, be implemented as, or known as a subscriber station, a subscriber unit, a mobile station (MS), a remote station, a remote terminal, a user terminal (UT), a user agent, a user device, a user equipment (UE), a user station (STA), or some other terminology. In some implementations, a non-AP station may be or may comprise a cellular telephone, a cordless telephone, a Session Initiation Protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device having wireless connection capability, or some other suitable processing device connected to a wireless modem. Accordingly, one or more aspects taught herein may be incorporated into a phone (e.g., a cellular phone or a smartphone), a computer (e.g., a laptop), a tablet, a portable communication device, a portable computing device (e.g., a personal data assistant), an entertainment device (e.g., a music or video device, or a satellite radio), a global positioning system (GPS) device, or any other suitable device that is configured to communicate via a wireless or wired medium. In some aspects, some of non-AP stations 110a, 110b, and 110c may be wireless nodes. Such a wireless node may provide, for example, connectivity for or to a network (e.g., a wide area network such as the Internet or a cellular network) via a wired or wireless communication link.

[0095] AP station 105 manages a set of stations that together organize their accesses to the wireless medium for communication purposes. All the stations (AP station 105 and non-AP stations 110a, 1 10b, and 1 10c) form a service set, which may be referred to as basic service set, BSS (although other terminology can be used). It is noted that AP station 105 may manage more than one BSS: each BSS is thus uniquely identified by a specific basic service set identifier (BSSID) and managed by a separate virtual AP station implemented in physical AP station 105.

[0096] Figure 2a illustrates an example of steps performed at a non-AP station or its AP station before changing privacy parameter values ofthe non-AP station, e.g., its MAC address, according to some embodiments of an obfuscation procedure.

[0097] The algorithm illustrated in Figure 2a is carried out by the non-AP station or its AP station at a RCM ready time, for example the time referenced 301 or 311 in Figure 3. RCM ready time defines the start time of a transition period during which the obfuscation procedure is conducted for the non-AP station.

[0098] For ease of explanation in the description below, the MAC address is used as an illustration of any privacy parameter. MAC address noted @MAC(i) thus illustrates any privacy parameter noted PE(i).

[0099] At step 200, a new MAC address, noted @MAC (n+1), that will be used to replace a current one noted @MAC(n), is determined and associated obfuscated parameters are also determined. The method to compute the new value of the MAC address and other privacy parameters is out of scope of the present invention. Step 200 is typically executed at RCM ready time 301 or 311 , but it is clear that step 200 may be executed in advance, i.e., at any time prior this time. The important point is that MAC(n+1) and associated PE(n+1) are determined at RCM ready time with the same result at both the AP and the non-AP sides.

[0100] To allow synchronization between the two stations to be made about these new values, step 210 adds the MAC(n+1) to be used in the future, in the list of the MAC addresses that are considered as valid in communication operations from that time point. It is to be noted that MAC(n) is already in the list of valid MAC addresses.

[0101] In some embodiments, MAC(n+1) (or PE(N+1) becomes valid only for reception operations by the non-AP station (meaning transmission operations from the AP station to the non-AP station), hence not for transmission operations by the non-AP station. The new MAC address @MAC(n+1) is thus not fully valid. This is due to the synchronization issue: it is not yet sure that the AP station has already added (through the same process of Figure 2a) MAC(n+1) in the list of valid MAC addresses forthat non-AP station. Hence, there is a risk that the AP station discards any frame sent by the non-AP station using the new values of the privacy parameters.

[0102] In the case of the non-AP station, this is the list of the MAC addresses present in the RA field of the received frames that will not be ignored by the non-AP station and will be decoded. For a non-AP station, this list typically corresponds to the unicast MAC addresses of the non-AP station, and the group MAC addresses to which the non-AP station belongs. Usually, a non-AP station has only one unicast MAC address fully valid (valid as emitting MAC address or receiving MAC address) at a time, but in some embodiments, a non-AP station may have a set of MAC addresses fully valid, and step 210 then corresponds to the change of one of the fully valid MAC addresses.

[0103] In the case of the AP station, this list corresponds to the list of MAC addresses of the non-AP stations associated with it that will be received in the TA (transmitter Address) field of the received frame. This list is used to discard frames received by the AP station that are not sent by registered stations. Of course this list is not used during the association procedure.

[0104] By adding the new address @MAC (n+1) in the list of valid addresses in received frames, the AP station or non-AP station will accept the reception and decoding of frames even if the receiving station has not yet switched the MAC address to the new value and still use @MAC(n) to address the frames it transmits.

[0105] Particular to the non-AP station, at a transition instant (not shown) within the transition period (e.g., middle of the period), the non-AP station switches its MAC address from @MAC(n) to @MAC (n+1) (the same for the other privacy parameters) for its transmission operations.

[0106] Figure 2b illustrates an example of steps performed at the non-AP station or its AP station after having changed the privacy parameter values of the non-AP station, according to some embodiments of an obfuscation procedure.

[0107] The algorithm illustrated in Figure 2b is carried out by the non-AP station or the AP station at a RCM done time, for example the time referenced 302 or 312 in Figure 3. RCM done time defines the end time of the transition period during which the obfuscation procedure is conducted for the non-AP station. Again, for ease of explanation in the description below, the MAC address is used as an illustration of any privacy parameter.

[0108] At step 220, the current MAC address @MAC(n) is removed from the list of MAC addresses that are considered valid for communication (in particular reception) operations by the non-AP station. By doing so, the AP station or non-AP station is now ready to discard any received frame that is addressed using this MAC address.

[0109] Next at step 230, since @MAC(n) is no longer valid neither in received frames, nor in transmitted frame for transmission, the @MAC(n) can be discarded (not used anymore by the station). The same applies for the other privacy parameters that are removed from the internal memory of the station. Step 230 thus allows to free the memory used for the storage of the old values of the privacy parameters.

[0110] Figure 3 illustrates, using a timeline, an exemplary time sequence showing the simultaneous obfuscating procedure for a set of non-AP stations.

[0111] A set of associated non-AP stations operate in the BSS. PE(n-2) are those privacy parameters 340 currently valid for these stations when transition period (n-1) 300 comes. The period starts at time 301 (the process of Figure 2a is performed) where new values are generated for each privacy parameter for the non-AP stations. For example, a new AID value AID(n-1) is allocated to each non-AP station in addition to the current one AID(n-2). The period ends at time 302 (the process of Figure 2b is performed), where, for example, AID(n-1) becomes the sole valid AID value. It results that PE(n-1) are now valid for the non-AP stations (341).

[0112] New stations associate with the AP station (step 330) hence increasing the number of associated stations. For instance, the number of non-AP stations may increase from 1000 to 1004.

[0113] Then comes new transition period (n) 310 that starts at time 311. As for any transition period, new AIDs have to be provided to each non-AP station. In the present case, there are no enough AID values available (2007 values according to the 802.11 standard) meaning that the obfuscation procedure cannot be conducted. PE(n-1) remain valid (342) instead of PE(n). This is detrimental to privacy.

[0114] This time sequence shows the interest to split the set of non-AP stations into multiple privacy groups for which the obfuscation procedures are conducted independently one to each other, in particular with dedicated transition periods that preferably do not overlap.

[0115] Figure 4 illustrates, using a flowchart, an exemplary sequence of steps carried out by the AP station to manage one or more privacy groups, according to some embodiments of the invention.

[0116] The AP station manages privacy groups (which may be a single one, for example when starting the BSS) of the associated non-AP stations, each privacy group having its own transition period during which the privacy parameters of the corresponding non-AP stations are changed (using the obfuscation procedure). To advertise the privacy groups to the non-AP stations, the AP station may transmit management frames as described below, in particular with reference to Figure 5.

[0117] The process is launched upon detection of a triggering event. The process seeks to update the privacy groups if appropriate.

[0118] The Figure illustrates two types of triggering events.

[0119] First exemplary triggering event 400 is based on detecting that the number NTOTAL of non-AP stations associated with the AP station evolves, i.e. , the number of non-AP STAs applying the privacy features is modified.

[0120] The tracking condition to launch the group management algorithm may be whether a new non-AP STA associates with the AP station (hence joins the BSS) or a non-AP STA dissociates from the AP station (hence leaves the BSS) or some non-AP STAs are revoked by the AP station (hence leave the BSS). In other words, the number NTOTAL evolves when one or more new non-AP stations associate with the AP station, or one or more associated non-AP stations disassociate from the AP station or are revoked by the AP station.

[0121] Second exemplary triggering event 410 is when the AP station has to define and advertise about next transition periods for change of the PE parameters in the privacy groups. The AP station may decide to modify the privacy groups for any reason (based for example on changing network conditions).

[0122] Of course, some other triggering events can lead to an update of the privacy groups.

[0123] As explained above, the AID may be a key constraint to have group-based obfuscation procedures. Hence, in the description below it is mainly made reference to the AID as an example of privacy parameter that drives the update of the privacy groups. Of course, any other privacy parameter can be used in the process of the Figure.

[0124] When the process of Figure 4 starts through step 400 or 410, an update of the privacy groups is evaluated at the date of the transition period for a given privacy group. This transition period is said to be a reference transition period, while the privacy group is a reference privacy group. It may be the privacy group concerned by step 410 or any privacy group (they can be considered successively) in case of step 400.

[0125] Although the description is focused on a single future transition period, the AP station may perform the following steps for multiple future transition periods because the AP station can announce multiple dates for future transition periods within one frame.

[0126] The goal of the evaluation is to compute the total number of allocated values for the controversial privacy parameter (AID12 in our example) during the reference transition period and to compare it to the number of available values, to determine whether or not the obfuscation procedure can be made.

[0127] At step 420, the AP station calculates the number NSTA of non-AP stations that are concerned by a change of their set of PE parameters during the reference transition period. This of course includes the non-AP stations belonging to the reference privacy group, but may also include the non-AP stations of overlapping privacy groups, i.e., other privacy groups having their transition period overlapping the reference transition period.

[0128] This step thus calculates the number NSTA of non-AP stations that have their current value and respective new value both valid for communication (e.g., reception) operations during at least a part of the reference transition period.

[0129] If the privacy groups do not overlap one each other, NSTA is the number of non-AP stations within the reference privacy group. On the other hand, if some privacy groups overlap the reference privacy group, NSTA may be the summed number of non-AP stations within all privacy groups the transition periods of which at least partially overlap the reference transition period.

[0130] Next, at step 430, the AP station calculates the number NOTHER of non-AP stations that are not concerned by a change of their set of PE parameters during the reference transition period. This includes the other non-AP stations not counted at step 420. Basically, NOTHER=NTOTAL- NSTA where NTOTAL is the total number of non-AP stations registered in the BSS (this is known by the AP station).

[0131] Next step is step 440 where the AP station determines whether a group update criterion is met. The criterion compares, for the reference transition period, on one hand twice NSTA, and NOTHE , with on the other hand the number NAVAILABLE of available values for each one of one or more privacy parameters, for instance with the number of AID values that are available. This is to be sure that enough values are available to perform the obfuscation procedure.

[0132] This defines the conditions to take a decision for adding or removing a privacy group.

[0133] As an example, if NOTHER + NSTA X 2 for the reference transition period is greater than NAVAILABLE for a controversial privacy parameter, a new privacy group may be created and a new transition period be assigned to this new privacy group. This is illustrated through step 460 where an adjusting of the privacy groups is made by splitting a privacy group into two or more new privacy groups.

[0134] A new transition period is assigned to each new privacy group. As it is sought to reduce the number of new values needed for the controversial privacy parameter, it is preferable that at least one of the new privacy groups has its transition period that does not overlap the reference transition period.

[0135] In the example above, the controversial privacy parameter is the AID12 parameter but it can be also any other privacy parameter with a limited range of available values.

[0136] Where there is no overlap between the privacy groups, the privacy group to split is the reference privacy group. A part of the non-AP stations may be kept in the reference privacy group, while the other non-AP stations initially in the reference privacy group become member of the new privacy group or groups. The resulting privacy groups may still not overlap one each other. The method to split can be multiple: to divide into similar parts of randomly selected non-AP stations, or to choose a ratio partitioning into the two or more privacy groups. Where there exist overlapping privacy group or groups, the privacy group to split may still be the reference privacy group or any “overlapping” privacy group the transition periods of which at least partially overlap the reference transition period. For instance, the most populated (i.e., with the highest number of stations) one from the overlapping privacy groups including the reference privacy group can be selected. In variants, a privacy group can be randomly selected from these overlapping privacy groups including the reference privacy group.

[0137] The resulting privacy groups may be designed not to overlap one each other. Of course, there may still exist some overlap between privacy groups, provided that the split reduces the number of new values needed for the controversial privacy parameter during the reference transition period.

[0138] Back to step 440, if on the other hand MOTHER + NSTA x 2 is less than NAVAILABLE for the controversial privacy parameter, the AP station can optionally evaluate the opportunity to merge two or more privacy groups at step 450. If the opportunity is taken, the adjusting of the privacy groups is made by merging first and second (or more) privacy groups into a new privacy group.

[0139] As an example, the opportunity may be taken when another criterion is met, for example when MOTHE + NSTA x 2 is less than NAVAILABLE / 2 meaning that they is a substantial stock of available values compared to the needs during the transition period. Of course, another weight than 1 / 2 can be used. Also another formula or criterion can be used. In some embodiments, all the transition periods may be examined to check whether they all satisfy the criterion. This is to avoid performing a merger if the privacy group under examination is an exception one compared to the others.

[0140] Multiple strategies may be contemplated for the merger, including, for illustrative purposes only, merging the two (or more) smallest privacy groups; merging the biggest privacy group with the smallest one; performing multiple mergers.

[0141] The merging step is especially useful to optimize the obfuscation procedure because the more non-AP STAs change its PE parameters at the same time, the more the obfuscation procedure is optimized and the tracking process is harder. Hence, privacy is increased.

[0142] The above description of the criterion comparing MOTHER + NSTA x 2 to NAVAILABLE is based on an estimate (NSTA) of the maximum number of values that are needed during the reference transition period. However, as some transition periods overlapping the reference transition period may not overlap one each other, the real maximum number may be less that the above estimate. Hence, in variants, the AP station may calculate the maximum number of non-AP stations that simultaneously have their both values valid for communication operations at the same time during the reference transition period. For instance, at each time instant of the reference transition period, the AP station evaluates the number of non-AP stations that are within their own transition period, and at the end the AP station keeps the maximum number as evaluated over the multiple time instants of the reference transition period. This maximum number may still be labelled NSTA as above. The AP station still determines the number of other non-AP stations at the same time instant (NOTHER=NTOTAL-NSTA) and performs the calculation MOTHER + NSTA X 2. After step 460 adding a new privacy group or step 450 merging privacy groups, the adjusted privacy groups are signaled (step 470) by the AP station in a frame addressed to the non-AP stations of its BSS. In particular, the AP station provides information related to each new privacy group and the split privacy group. Such information concerns the transition periods and the list of the non-AP STAs belonging to the groups).

[0143] To do so, the frame includes one or more group descriptions associated with one or more privacy groups, wherein a group description includes transition period indication and a list of the non-AP stations composing the associated privacy group. The group descriptions may be included in a Privacy Element 500 as described below with reference to Figure 5.

[0144] The frame may be any Management frame in the meaning of the 802.11 standard family, including a Beacon frame, an Action frame, an (unsolicited) Probe Response frame.

[0145] The criterion used above as an illustration for step 440 uses a weight equal to 1 to weight NAVAILABLE. Other lower weights may be used in variants. More generally, the criterion includes determining whether 2 x NSTA + MOTHER > a. NAVAILABLE, where a is a positive weight equal or less than 1 . The weights may be different when deciding to split a privacy group (at step 440 to go to step 460) and deciding to merge privacy groups (at step 450). In particular, the weight for deciding to split is higher (i.e., closer to 1) than the weight for deciding to merge.

[0146] Figure 5 illustrates an exemplary Element format to carry out the above group descriptions, according to some embodiments of the invention. The proposed format follows the format of an Element in the meaning of the 802.11 standard. It is used to convey the transition periods and the constitution of the associated privacy groups of non-AP STAs.

[0147] As mentioned above, this Element may be carried out in any Management frames such as a Beacon frame, an Action frame, etc.

[0148] The Privacy Element 500 contains several fields:

[0149] - Element ID field 510 (as in the 802.1 1 standard) together with optional Element ID Extension field (not shown) identifying the Privacy Element. Any value reserved in the 802.11 standards for these fields may be used to that end,

[0150] - Length field 520 indicating the length (in bytes) of the Element excluding the Element ID field 510 and the Length field 520,

[0151] - NbrGroup field 530 indicating the number of privacy groups described in the following of Element 500, and

[0152] - one or more Group Information fields 540 providing multiple group descriptions defining multiple privacy groups. Each Group Information field 540 describes or defines a privacy group by providing a list of the non-AP stations belonging to the corresponding privacy group and a transition period during which a current value of a privacy parameter and a new value obfuscating the current value for any non-AP station of the privacy group are both valid for communication operations by the non-AP station. To that end, each Group Information field 540 contains several subfields characterizing the privacy group: o Group ID subfield identifying a privacy group, o Subfield 542 conveying one or more dates of the next transition period or periods. The date can be an exact date or can be expressed in a number of TBTTs and an associated offset. The date may be the transition time. The duration of the transition period from that date or around that date may be prefixed or predetermined or conveyed in the same field after the date. In variants, the date may be the start time 401 of the transition period and the end time 402 may also be signaled, o Subfield 543 conveying the list of non-AP STAs (via their AID12 or MAC addresses) belonging to the privacy group.

[0153] Privacy Element 500 is used by the AP station to advertise over the network all non-AP STAs when at least one information related to the obfuscation procedure is updated. The Privacy Element can contain all information related to all privacy groups or to a part thereof, or only parts of information related to all or part of privacy groups, in particular only the privacy groups adjusted through steps 450 and 460 since the last advertisement.

[0154] Such advertisement is used by the non-AP stations to drive the obfuscation procedure at their side. Figure 6 illustrates, using a flowchart, general steps at such a non-AP station according to embodiments of an obfuscation procedure.

[0155] At step 600, the non-AP stations receives, from the AP station, the frame signaling multiple privacy groups, each privacy group having its own transition period. In embodiments, the non-AP station receives the above Management frame including Privacy Element 500.

[0156] Next at step 610, the non-AP station determines whether or not it is concerned by the groups newly signaled. In particular, it determines one of the multiple privacy groups to which it belongs, if any. This can be made by merely traversing the lists 543 to find whether its own AID or MAC address is present.

[0157] In the negative, the non-AP station continues to apply the group description it has received in a previous Management frame from the AP station.

[0158] In the affirmative, the non-AP station can obtain its future transition period or periods from field 542 corresponding to the determined group. Hence, at step 620, the non-AP station performs the obfuscation procedure at the next transition period: it obfuscates a current value of a privacy parameter into a new value during said transition period, wherein the current and new values are both valid for communication (e.g., reception only) operations by the non-AP station during the transition period after which the current value becomes invalid and only the new value can be used.

[0159] This is done for each privacy parameter.

[0160] Figure 7 illustrates, using a timeline, an exemplary time sequence showing the management of multiple privacy groups, according to some embodiments of the invention.

[0161] The timeline is a continuation of the beginning of the timeline of Figure 3 up to the moment when new stations associate with the AP station (step 330). In the example, the number of non-AP stations may increase from 1000 to 1004. Upon detecting this increase (step 400) or the new transition period coming (step 410), the AP station determines (step 440) that there are not enough AID values available for all the non-AP stations liable to obfuscate their privacy parameters during the next transition period 700.

[0162] The AP station thus reconsiders the privacy group allocation through step 460 by splitting the sole group G1 into two groups: still G1 and additional group G2 receiving for example half of the non-AP stations, namely 502 in our example. A (or more) new transition period is defined for group G2 that does not overlap the transition period or periods of group G1. In the example, the AP station defines two new transition periods Transition_G2(n) 705 and Transition_G2(n+1) 715 that do not overlap transition periods Transition_G1 (n) 700 and Transition_G1 (n+1) 710. It means that the obfuscation procedure is spread over the time.

[0163] During transition period Transition_G1 (n) 700, the obfuscation procedure is performed only on the group G1 of non-AP stations, hence having enough AID values available for them. Indeed, in this example of 502 stations per group, 1506 Al D12 values are used (502 x 2 for group G1 and 502 for group G2) and 501 AID12 values remain available.

[0164] Next, Transition_G2(n) 705 comes where the obfuscation procedure is performed only on the group G2 of non-AP stations, without any blocking due to an insufficient amount of AID12 values available. And so on with Transition_G1 (n+1) 710 and Transition_G2(n+1) 715, until the number NTOTAL of non-AP stations associated with the AP station evolves again.

[0165] Figure 9a illustrates, using a timeline, an exemplary time sequence illustrating the identified issues related to the AID12 management during the transition period. In this illustration, it is considered a BSS comprising one AP and 1200 STAs and a maximum number of possible AID12 values of 2007.

[0166] An EPOCH period is defined as the period during which a set of privacy parameters are valid. It is proposed to initiate the obfuscation of PE parameters at regular EPOCH periods and to introduce “margins” around the EPOCH(n) events. It is also proposed to define a short transition period between the old PE parameters and the new PE parameters so that to optimize the length of the transition period.

[0167] A set of 1200 associated non-AP stations operate in the BSS. PE(n-1) are those privacy parameters 900 currently valid for these stations when the event EPOCH (n) 910 occurs.

[0168] The transition period is a period of time around the event EPOCH (n) 910. During the transition period, each AP / STA must manage multiple sets of PE parameters. It requires CPU power and memory. As the number of available AID12 values is limited (e.g., to 2007) for associated STAs, the usage of the new PE parameters and the old PE parameters at the same time creates issues for the management of the AID12 parameter. In a dense network, the number of available AID12 values could not be enough. There is a need to manage and modify the obfuscation procedure for the AID12 parameter. These issues may also occur in other situations. For instance, from implementation point of view, an AP can allocate range of AID12 values to STAs depending on their functionalities. So, this issue can occur even if the total number of available AID12 values is not reached. During the transition period, new values are added for each privacy parameter for the non-AP stations. For example, a new AID12 value AID(n) is allocated to each non-AP station in addition to the current one AID(n-1). Due to the limited number of available AID12 values, the obfuscation procedure may fail.

[0169] At the end of the transition period, the AID(n-1) is released and the AID(n) becomes the only valid AID value. It results that PE(n) are now valid for the non-AP stations (901).

[0170] The same issue occurs during the event EPOCH(n+1) 911 and the transition period from the PE(n) privacy parameters 901 to the PE(n+1) privacy parameters 903.

[0171] This time sequence shows the benefit of splitting the set of non-AP stations into multiple privacy groups for which the obfuscation procedures are conducted independently of each other, in particular with dedicated transition periods that preferably do not overlap.

[0172] Figure 9b illustrates, using a timeline, an exemplary time sequence showing the management of multiple privacy groups of non-AP stations, according to some embodiments of the invention. In this illustration, it is considered a BSS comprising one AP and 1200 STAs, a maximum number of possible AID12 values of 2007, and 2 EPOCH Groups.

[0173] The timeline shows how an AP can manage groups of STAs separately. It means different EPOCH periodicity, different sets of PE parameters. Aim is to address the issues illustrated in Figure 9a.

[0174] The obfuscation procedure for the AID12 parameter is adapted by creating groups of STAs and to schedule obfuscation procedure only for a set of STAs instead of changing the AID12 of all STAs at the same time.

[0175] The determination of each group of STAs can be different from one AP to another depending on an obfuscation profile of a STA, some capabilities of STAs or an AP policy related to the privacy. Group management can be applied at any time or only when or if the number of available AID12 is not enough for obfuscation procedure.

[0176] The AP thus reconsiders the privacy group allocation through step 460 by splitting the sole group G1 into two groups: still G1 and additional group G2 receiving for example half of the non-AP stations (hence 2 groups of 600 STAs).

[0177] One (or more) event EPOCH with its own transition period is defined for group G2. The transition period does not overlap the transition period or periods of group G1. In the example, the AP station defines two new EPOCH events EPOCH_G2(n) 930 and Transition_G2(n+1) 931 that do not overlap EPOCH event EPOCH_G1 (n) 920 and EPOCH_G1 (n+1) 930. It means that the obfuscation procedure is spread over time.

[0178] During transition period of the EPOCH event EPOCH_G1 (n) 920, the obfuscation procedure is performed only on the group G1 of non-AP stations, hence having enough AID values available for them. Indeed, in this example of 600 stations per group, 1800 AID12 values are used (600 x 2 for group G1 and 600 for group G2) and 207 AID12 values remain available. Next, during transition period of the EPOCH event EPOCH_G2(n) 930, the obfuscation procedure is performed only on the group G2 of non-AP stations, without any blocking due to an insufficient amount of AID12 values available. And so on with EPOCH_G1 (n+1) 921 and EPOCH_G2(n+1) 931 , until the number NTOTAL of non-AP stations associated with the AP station evolves again.

[0179] Embodiments of the invention allow to manage privacy in dense environment. They are also adapted to the Vendor-specific implementation for the management of the AID12 values. More globally, this EPOCH group management allows to solve the issues related to a limited number of available values of a PE parameter. This allows an AP to manage CPE parameters in multiple groups of non-AP STAs.

[0180] Figure 8 schematically illustrates an example of a communication device, that may correspond any of the stations described by reference to Figure 1 , of a wireless network, configured to implement at least some embodiments of the present invention. The communication device, referenced 800, may preferably be a device such as a micro-computer, a workstation, or a light portable device. Communication device 800 may comprise a communication bus 813 to which may be connected:

[0181] - a central processing unit 801 , such as a processor, denoted CPU;

[0182] - a memory 803, denoted MEM, for storing an executable code of methods or steps of the methods according to embodiments of the invention as well as the registers adapted to record variables and parameters necessary for implementing the methods; and

[0183] - at least two communication interfaces 802 and 802’ connected to the wireless communication network, for example a communication network according to one of the IEEE 802.11 family of standards, via transmitting and receiving antennas 804 and 804’, respectively.

[0184] Preferably, communication bus 813 may provide communication and interoperability between the various elements included in the communication device 800 or connected to it. The representation of the bus is not limiting and in particular the central processing unit is operable to communicate instructions to any element of the communication device 800 directly or by means of another element of the communication device 800.

[0185] The executable code may be stored in a memory that may either be read only, a hard disk, or on a removable digital medium such as for example a disk. According to an optional variant, the executable code of the programs can be received by means of the communication network, via the interface 802 or 802’, in order to be stored in the memory 803 of communication device 800 before being executed.

[0186] In some embodiments, communication device 800 may be a programmable apparatus which uses software to implement embodiments of the invention. However, alternatively, some embodiments of the present invention may be implemented, totally or in partially, in hardware (for example, in the form of an Application Specific Integrated Circuit or ASIC). Embodiments) of the present invention can also be realized by a computer of a system or apparatus that reads out and executes computer executable instructions (e.g., one or more programs) recorded on a storage medium (which may also be referred to more fully as a “non- transitory computer-readable storage medium”) to perform the functions of one or more of the above-described embodiment(s) and / or that includes one or more circuits (e.g., application specific integrated circuit (ASIC)) for performing the functions of one or more of the abovedescribed embodiment(s), and by a method performed by the computer of the system or apparatus by, for example, reading out and executing the computer executable instructions from the storage medium to perform the functions of one or more of the above-described embodiment(s) and / or controlling the one or more circuits to perform the functions of one or more of the above-described embodiment(s). The computer may comprise one or more processors (e.g., central processing unit (CPU), micro processing unit (MPU)) and may include a network of separate computers or separate processors to read out and execute the computer executable instructions. The computer executable instructions may be provided to the computer, for example, from a network or the storage medium. The storage medium may include, for example, one or more of a hard-disk, a random-access memory (RAM), a read only memory (ROM), a storage of distributed computing systems, an optical disk (such as a compact disc (CD), digital versatile disc (DVD), etc.), a flash memory device, a memory card, and the like.

[0187] Expressions such as “comprise”, “include”, “incorporate”, “contain”, “is” and “have” are to be construed in a non-exclusive manner when interpreting the description and its associated claims, namely construed to allow for other items or components which are not explicitly defined also to be present. Reference to the singular is also to be construed in be a reference to the plural and vice versa.

[0188] A person skilled in the art will readily appreciate that various parameters disclosed in the description may be modified and that various embodiments disclosed may be combined without departing from the scope of the invention.

Claims

CLAIMS1. A method of communication in a wireless network comprising an access point, AP, station managing a Basic Station Set, BSS and non-AP stations associated with the AP station, the method comprising at the AP station: obfuscating current values of a privacy parameter for the non-AP stations into respective new values, wherein the current value and the respective new value for a non-AP station are both valid for communication operations by the non-AP station during a transition period after which the current value becomes invalid, wherein the non-AP stations are organized into two or more privacy groups, each privacy group having its own transition period.

2. The method of Claim 1 , wherein the transition periods of the two or more privacy groups do not overlap one each other.

3. The method of Claim 1 , wherein the transition period of one privacy group starts from a start time when the current and new values for a non-AP station of the privacy group are both valid for communication operations by the non-AP station, and ends at an end time when only the new value is valid for communication operations by the non-AP station.

4. The method of Claim 1 , further comprising, at the AP station, adjusting the privacy groups when the number NTOTAL of non-AP stations associated with the AP station evolves, wherein the adjusting is based on a criterion comparing, for a reference transition period of a reference privacy group, on one hand twice the number NSTA of non-AP stations that have their current value and respective new value both valid for communication operations during at least a part of the reference transition period, and the number MOTHER of the other associated non-AP stations, with on the other hand a number NAVAILABLE of available values for the privacy parameter.

5. The method of Claim 4, wherein NSTA is the number of non-AP stations within the reference privacy group.

6. The method of Claim 4, wherein NSTA is the summed number of non-AP stations within all privacy groups the transition periods of which at least partially overlap the reference transition period.

7. The method of Claim 4, wherein the criterion includes determining whether2 x NSTA + NOTHE S a. NAVAILABLE where a is a positive weight equal or less than 1 .

8. The method of Claim 4, wherein the adjusting includes splitting a privacy group into two or more new privacy groups.

9. The method of Claim 8, wherein at least one of the new privacy groups has itstransition period that does not overlap the reference transition period.

10. The method of Claim 8, wherein the privacy group to split includes the reference privacy group or any “overlapping” privacy group the transition periods of which at least partially overlap the reference transition period.

11. The method of Claim 10, wherein splitting a privacy group includes selecting the most populated one from the overlapping privacy groups including the reference privacy group or selecting randomly a privacy group from them, and then splitting the selected privacy group.

12. The method of Claim 4, wherein the adjusting includes merging first and second privacy groups into a new privacy group.

13. The method of Claim 4, wherein the number NTOTAL evolves when: one or more new non-AP stations associate with the AP station, or one or more associated non-AP stations disassociate from the AP station or are revoked by the AP station.

14. The method of Claim 4, further comprising sending a frame signaling the adjusted privacy groups.

15. The method of Claim 14, wherein the frame includes one or more group descriptions associated with one or more privacy groups, wherein a group description includes transition period indication and a list of the non-AP stations composing the associated privacy group.

16. A method of communication in a wireless network comprising an access point, AP, station managing a Basic Station Set, BSS and non-AP stations associated with the AP station, the method comprising, at one of the non-AP stations: receiving, from the AP station, a frame signaling multiple privacy groups, each privacy group having its own transition period; determining one of the multiple privacy groups to which the non-AP station belongs; and obfuscating a current value of a privacy parameter into a new value during the transition period of the determined privacy group, wherein the current and new values are both valid for communication operations by the non-AP station during the transition period after which the current value becomes invalid.

17. A frame to be sent by an access point, AP, station managing a Basic Station Set, BSS, of non-AP stations, the frame comprising multiple group descriptions defining multiple privacy groups, each group description including a list of the non-AP stations belonging to the corresponding privacy group and including a transition period during which a current value of a privacy parameter and a new value obfuscating the current value for any non-AP station of the privacy group are both valid for communication operations by the non-AP station.

18. The frame of Claim 17, including one Element in the meaning of the 802.11 standard that comprises the multiple group descriptions.

19. The frame of Claim 17, wherein the frame is a Management frame in the meaning of the 802.11 standard family.

20. A wireless communication device comprising at least one microprocessor configured for carrying out the steps of the method of Claim 1 .

21. A non-transitory computer-readable medium storing a program which, when executed by a microprocessor or computer system in a wireless device, causes the wireless device to perform the method of Claim 1 .

Images