Devices and methods for multi-AP coordinated transmission in a wireless network

Abstract

An access point, AP, (110) is disclosed for providing network access to one or more non-AP stations (110a-c) associated with the AP (110) and for securely negotiating a multi-access point coordination, MAPC, agreement with an overlapping basic service set, OBSS, AP (120) for implementing a MAPC transmission scheme with the OBSS AP (120) based on the MAPC agreement. The AP (110) is configured to exchange one or more frames (130) with the OBSS AP (120), wherein the one or more frames (130) comprise an MAPC element (300) and wherein the MAPC element (300) comprises information indicative of a MAPC identifier of the AP (110) and the OBSS AP (120).

Description

[0001] DEVICES AND METHODS FOR MULTI-AP COORDINATED TRANSMISSION IN A WIRELESS NETWORK

[0002] TECHNICAL FIELD

[0003] The present invention relates to wireless communications. More specifically, the present invention relates to devices and methods for multi-access point coordination, MAPC, between a group of access points, APs, in a wireless communication network, for the purpose of coordinating transmissions to associated stations, STAs, in particular a wireless local area network, WLAN, (also referred to as Wi-Fi network) in accordance with the IEEE 802.11 framework of standards.

[0004] BACKGROUND

[0005] Coordinated Beamforming, CoBF, is one of several multi-access point coordination, MAPC, schemes defined by the IEEE 802.11 framework of standards, in particular IEEE 802.1 Ibn. According to the CoBF MAPC scheme, APs transmit concurrent DL PPDUs to their associated non-AP stations while mutual interference for the OBSS non-AP stations is minimized using beamforming techniques (therefore also referred to as coordinated transmission). Once it has discovered at least one OBSS AP supporting MAPC, an initiating AP starts negotiating a MAPC agreement with an OBSS AP that supports the same MAPC coordination scheme, for instance, the CoBF scheme. After the MAPC agreement has been negotiated between the peer APs, each of the APs performs a CoBF Sounding procedure to obtain the channel information feedback between itself, the associated non-AP stations and the non-AP stations associated with the OBSS AP that are involved in the imminent CoBF transmission. Each AP computes a precoder based on the received channel information feedback that ensures minimal interference to the OBSS stations.

[0006] SUMMARY OF THE INVENTION

[0007] It is an objective of the present disclosure to provide improved devices, in particular access points, APs, and non-AP stations, as well as methods allowing for securely managing MAPC agreements between a group of access points, APs, in a wireless communication network, in particular a wireless local area network, WLAN, (also referred to as Wi-Fi network) in accordance with the IEEE 802.11 framework of standards.

[0008] The foregoing and other objectives are achieved by the subject matter of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures. In the following one or more of the following acronyms and abbreviations may be used:

[0009] AP Access Point

[0010] DHss Diffie-Hellman Shared Secret

[0011] DS Distribution System

[0012] MAPC Multi-Access Point Coordination

[0013] OBSS Overlapping Basic Service Set

[0014] PASN Pre-Association Security Negotiation

[0015] PMK Pairwise Master Key

[0016] PTK Pairwise Transient Key

[0017] SAE Simultaneous Authentication of Equals

[0018] STA Station

[0019] SME Station Management Entity

[0020] TDMA Time Division Multiple AccessUHR Ultra High Reliability

[0021] WLAN Wireless LAN

[0022] According to a first aspect an access point, AP operating a basic service set, BSS, is for providing network access to one or more non-AP stations associated with the AP according to the first aspect, and negotiating a secure, multi-access point coordination, MAPC, agreement with an AP operating an overlapping basic service set, OBSS, (herein also referred to as OBSS AP) for implementing a MAPC transmission scheme together with the OBSS AP based on the MAPC agreement. The AP according to the first aspect is configured to exchange, i.e. transmit and / or receive, one or more frames with the OBSS AP, wherein the one or more frames comprise an MAPC element and wherein the MAPC element comprises information indicative of a MAPC identifier of the AP and the OBSS AP.

[0023] In a further possible implementation form, the AP is configured to store one or more MAPC credentials, wherein the AP is configured to securely negotiate the MAP agreement based on the one or more MAPC credentials and the information indicative of the MAPC identifier of the AP and the OBSS AP.

[0024] In a further possible implementation form, the one or more MAPC credentials comprise a password or a certificate.

[0025] In a further possible implementation form, the MAPC identifier of the AP and the OBSS AP is based on a MAC address of the AP and / or a MAC address of the OBSS AP.

[0026] In a further possible implementation form, the MAPC element comprises a MAPC ID field containing the information indicative of the MAPC identifier for the AP and the OBSS AP.

[0027] In a further possible implementation form, the MAPC element comprises a MAPC Control field and the MAPC Control field comprises a MAPC ID Present field indicative of the presence of the MAPC ID field in the MAPC element.

[0028] In a further possible implementation form, the MAPC Control field further comprises an MAPC Type field indicative of one of the following purposes of the MAPC element of the one or more frames: MAPC discovery; MAPC agreement negotiation; MAPC agreement parameters update; and MAPC agreement teardown.

[0029] In a further possible implementation form, the one or more frames further comprise an Authentication Container element, wherein the MAPC Control field of the MAPC element further comprises an Authentication Container Present field indicative of the presence of the Authentication Container element in the one or more frames.

[0030] In a further possible implementation form, the Authentication Container element comprises an Authentication Algorithm Number field indicative of an authentication algorithm of a plurality of authentication algorithms for establishing authentication between the AP and the OBSS AP.

[0031] In a further possible implementation form, one value of the Authentication Algorithm Number field of the Authentication Container element is indicative of PMK caching authentication.

[0032] In a further possible implementation form, the Authentication Container element comprises an Authentication Transaction Sequence Number field indicative of a current state of progress with respect to an authentication protocol used for authentication.In a further possible implementation form, the Authentication Container element comprises a Status Code field indicative of an authentication specific status code.

[0033] In a further possible implementation form, the one or more frames comprise one or more MAPC Negotiation Request and / or Response frames, wherein the one or more MAPC Negotiation Request and / or Response frames further comprise an RSNE, an RSNXE, and / or one or more authentication elements or fields.

[0034] In a further possible implementation form, the AP and the OBSS AP are configured to perform authentication based on a Simultaneous Authentication of Equals, SAE, protocol, wherein the one or more authentication elements or fields comprise: a SAE Control field, a Scalar field, a FFE field, an Anti-Clogging Token field, a Finite Cyclic Group field, a Password Identifier element, a Rejected Groups element, an AKM Suite Selector element, a Send-Confirm field, a Confirm field, and / or a Neighbor Report element.

[0035] In a further possible implementation form, the AP and the OBSS AP are configured to perform authentication based on a Pre-Association Security Negotiation protocol and wherein the one or more authentication elements or fields comprise: a PASN Control Field; a PASN Parameters element; a Timeout Interval element; a Wrapped Data element; a Fragment element; a Tunneled PASN element; and / or a MIC element.

[0036] In a further possible implementation form, the AP is configured to derive a PTK for securely negotiating the MAPC agreement with the OBSS AP based on a PMK, a nonce of the AP, a nonce of the OBSS AP and the information indicative of the MAPC identifier of the AP and the OBSS AP.

[0037] In a further possible implementation form, the AP is configured to derive a PTK for securely negotiating the MAPC agreement with the OBSS AP based on a PMK, a Diffie-Hellman Shared Secret, DHss, and the information indicative of the MAPC identifier of the AP and the OBSS AP.

[0038] According to a second aspect a method is provided for operating an access point, AP, operating a basic service set, BSS, for providing network access to one or more non-AP stations associated with the AP and for negotiating a secure multi-access point coordination, MAPC, agreement with an AP operating an overlapping basic service set, OBSS, (herein also referred to as OBSS AP] for implementing a MAPC transmission scheme with the OBSS AP based on the MAPC agreement. The method according to the second aspect comprises:

[0039] exchanging one or more frames with the OBSS AP, wherein the one or more frames comprise an MAPC element and wherein the MAPC element comprises information indicative of a MAPC identifier of the AP and the OBSS AP.

[0040] The method according to the second aspect can be performed by the AP according to the first aspect. Thus, further features of the method according to the second aspect result directly from the functionality of the AP according to the first aspect, as well as its different implementation forms described above and below.

[0041] According to a third aspect a computer program product is provided, comprising program code which causes a computer or a processor to perform the method according to the second aspect, when the program code is executed by the computer or the processor.

[0042] Details of one or more embodiments are set forth in the accompanying drawings and the description below. Other features, objects, and advantages will be apparent from the description, drawings, and claims.BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In the following, embodiments of the present disclosure are described in more detail with reference to the attached figures and drawings, in which:

[0044] Fig. 1 shows a schematic diagram illustrating a wireless communication network, in particular a WLAN, including an AP according to an embodiment with a plurality of associated non-AP stations and an OBSS AP with a further plurality of associated non-AP stations;

[0045] Fig. 2 shows a schematic diagram illustrating a MAPC agreement state machine implemented by an AP according to an embodiment;

[0046] Fig. 3a shows a diagram illustrating the format of a MAPC element of a frame transmitted or received by an AP according to an embodiment;

[0047] Fig. 3b shows a diagram illustrating the format of a MAPC control field of the MAPC element of figure 3a;

[0048] Fig. 4 shows a diagram illustrating the format of an Authentication Container element of a frame transmitted or received by an AP according to an embodiment;

[0049] Fig. 5 shows a signalling diagram illustrating an SAE authentication exchange between an AP and an OBSS AP according to an embodiment;

[0050] Fig. 6 shows a signalling diagram illustrating an PASN authentication exchange between an AP and an OBSS AP according to an embodiment;

[0051] Fig. 7 shows a signalling diagram illustrating an PMKID authentication between an AP and an OBSS AP according to an embodiment;

[0052] Fig. 8 shows a shows a diagram illustrating the format of a MAPC Negotiation frame transmitted or received by an AP according to an embodiment;

[0053] Fig. 9 shows a signalling diagram illustrating an exchange between an AP and an OBSS AP according to an embodiment, including a Re-key notification;

[0054] Fig. 10 shows a signalling diagram illustrating an exchange between an AP and an OBSS AP according to an embodiment, including a Parameter Updated notification;

[0055] Fig. 11 shows a signalling diagram illustrating an exchange between an AP and an OBSS AP according to an embodiment, including a Teardown notification; and

[0056] Fig. 12 shows a flow diagram illustrating steps of a method according to an embodiment for operating an AP.

[0057] In the following, identical reference signs refer to identical or at least functionally equivalent features.DETAILED DESCRIPTION OF THE EMBODIMENTS

[0058] In the following description, reference is made to the accompanying figures, which form part of the disclosure, which illustrates specific aspects of embodiments of the present disclosure or specific aspects in which embodiments of the present disclosure may be used. It is understood that embodiments of the present disclosure may be used in other aspects and comprise structural or logical changes not depicted in the figures. The following detailed description, therefore, is not to be taken in a limiting sense, and the scope of the present disclosure is defined by the appended claims.

[0059] For instance, it is to be understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if one or a plurality of specific method steps are described, a corresponding device may include one or a plurality of units, e.g. functional units, to perform the described one or plurality of method steps (e.g. one unit performing the one or plurality of steps, or a plurality of units each performing one or more of the plurality of steps), even if such one or more units are not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on one or a plurality of units, e.g. functional units, a corresponding method may include one step to perform the functionality of the one or plurality of units (e.g. one step performing the functionality of the one or plurality of units, or a plurality of steps each performing the functionality of one or more of the plurality of units), even if such one or plurality of steps are not explicitly described or illustrated in the figures. Further, it is understood that the features of the various exemplary embodiments and / or aspects described herein may be combined with each other, unless specifically noted otherwise.

[0060] Figure 1 shows a wireless communication system 100, in particular a wireless local area network, WLAN, 100 in accordance with the IEEE 802.11 framework of standards (also referred to as a Wi-Fi network 100). The WLAN 100 comprises an access point, AP, 110 operating a BSS, in communication with a plurality of non-AP stations 1 lOa-c associated with the AP 110. The WLAN 100 further comprises at least one further AP 120 (which relative to the AP 110 is operating anOBSS and, therefore, also referred to as OBSS AP 120) in communication with a further plurality of non-AP stations 120a-c associated with the further AP 120. As illustrated in figure 1, by way of example, the non-AP stations HOa-c associated with the AP 110 and the further non-AP stations 120a-c, i.e. the non-AP stations 120a-c associated with the OBSS AP 120 may comprise smartphones, laptop computers, tablet computers, desktop computers or other types of wireless devices configured to be associated with an AP.

[0061] As further illustrated in figure 1, the AP 110 may comprise a processing circuitry 111 and a communication interface 113, in particular a wireless communication interface 113 enabling communication in accordance with the IEEE 802.11 framework of standards. The processing circuitry 111 may be implemented in hardware and / or software and may comprise digital circuitry, or both analog and digital circuitry. Digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The AP 110 may further comprise a memory 115 configured to store executable program code which, when executed by the processing circuitry 111, causes the AP 110 to perform the functions and methods described herein.

[0062] Likewise, the OBSS AP 120 may comprise a processing circuitry 121 and a communication interface 123, in particular a wireless communication interface 123 enabling communication in accordance with the IEEE 802.11 framework of standards. The processing circuitry 121 may be implemented in hardware and / or software and may comprise digital circuitry, or both analog and digital circuitry. Digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. The OBSS AP 120 may further comprise a memory 125 configured to store executable program code which, when executed by the processing circuitry 121, causes the further AP 120 to perform the functions and methods described herein.Likewise, each of the non-AP stations 1 lOa-c, 120a-c may comprise a processing circuitry and a communication interface (not illustrated in figure 1 ), in particular a wireless communication interface enabling a communication in accordance with the IEEE 802.11 framework of standards. The processing circuitry may be implemented in hardware and / or software and may comprise digital circuitry, or both analog and digital circuitry. Digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or general-purpose processors. Each non-AP station 1 lOa-c, 120a-c may further comprise a memory (not illustrated in figure 1 ) configured to store executable program code which, when executed by the processing circuitry of the non-AP station, causes the non-AP station to perform the functions and methods described herein.

[0063] Before describing more detailed embodiments of the AP 110 and the OBSS AP 120 in the following some technical background, in particular from the IEEE 802.11 WLAN framework of standards will be summarized that may be used for implementing or understanding certain aspects of the embodiments disclosed herein.

[0064] Authentication defined by the IEEE 802.11 framework of standards allows different authentication methods to operate using a single set of frames. Candidate authentication methods include Simultaneous Authentication of Equals, SAE, PreAssociation Security Negotiation, PASN, and Open. SAE is an authentication method using a hash of a key that is unique to each authentication. This differs from a Pairwise Master Key (PMK) which is derived from a previous successful authentication and is the same for each subsequent authentication. PASN is an authentication method that allows the secure exchange of frames between peer APs (i.e. entities that do not have an “association” relationship like an AP and a non-AP STA). It provides encryption and message integrity for the transmitted frames.

[0065] The PMK is a shared secret derived between peer APs as part of a successful authentication, which can then be used to derive a PTK that is used to encrypt and authenticate traffic between them. The Robust Security Network element, RSNE, is an element containing security information for an AP to authenticate with a peer STA. An RSN extension element, RSNE, contains further security information for an AP to authenticate with a peer STA.

[0066] In addition to providing network access to the one or more stations 1 lOa-c, 120a-c the APs 110, 120 are configured to negotiate a multi-access point coordination, MAPC, agreement and for implementing a MAPC transmission scheme (herein also referred to as MAPC operation) based on the MAPC agreement. MAPC facilitates the APs 110, 120 to coordinate their transmissions using various MAPC schemes such as: coordinated beamforming, coordinated TDMA, and coordinated spatial re-use. For MAPC discovery the APs 110, 120 supporting at least one MAPC scheme may use one or more management frames 130 to advertise their capabilities and parameters. When the APs 110, 120 discover peer APs supporting at least one common MAPC scheme (i.e. a scheme that is supported by both APs 110, 120), the APs 110, 120 are configured to start negotiating and establishing one or more MAPC agreements between these peer APs 110, 120.

[0067] In order to initiate a protected negotiation for a MAPC agreement, the APs 110, 120 are configured to discover each other and to establish a secure, stateful connection prior to coordination. As will be described in more detail in the following, embodiments disclosed herein define a process that provides provisioning of the APs 110, 120 for protected negotiation of a MAPC agreement. According to embodiments disclosed herein a MAPC identifier (MAPC ID) of each AP 110, 120 may be advertised and used to establish a protected negotiation for a MAPC agreement. In other words, the AP 110 and the OBSS AP 120 are provided with the same MAPC ID. Moreover, according to embodiments disclosed herein a credential may be provisioned in each AP 110, 120 that supports MAPC operation for authentication in establishing a MAPC agreement. According to embodiments disclosed herein, the MAPC ID may be included in discovery and / or authentication messages, i.e. frames 130 exchanged between the two APs 110, 120 supporting MAPC operation. Moreover, according to embodimentsdisclosed herein the APs 110, 120 exchange frames 130 that contain the MAPC element during the discovery phase and to assert the authentication method used for negotiating the MAPC agreement. According to an embodiment, the frames 130 exchanged between the AP 110 and the OBSS AP 120 are Action frames 130 as defined by the IEEE 802.11 framework of standards. As will be appreciated, an action frame is a management frame and each action frame has a Category and an Action field. For the IEEE 802.11 bn, the Category would be defined as UHR and the Action field would indicate the specific frame.

[0068] Figure 2 shows a MAPC agreement state machine implemented by the AP 110 and the OBSS AP 120 according to an embodiment. In an embodiment, the AP 110 may be the MAPC Initiator, i.e. the initiator of the MAPC agreement and the OBSS AP 120 may be the MAPC responder responding to the MAPC Initiator. As illustrated in figure 2, the state machine comprises two agreement states 210, 220, namely a “No MAPC Agreement” state 210 and a “MAPC Agreement Established” state 220 and three types of message exchanges used for state transitions, namely discovery, negotiation, and notification. The MAPC discovery, negotiation, and notification procedures are used to maintain the state of the MAPC agreement.

[0069] According to an embodiment, each of the APs 110, 120 supporting MAPC operation are provisioned with one or more credentials. In an embodiment, the one or more credentials may comprises a certificate and / or a password for authentication purposes. According to an embodiment, APs 110, 120 are configured with the same, locally unique MAPC identifier, i.e. MAPC ID. In an embodiment, the MAC address of either AP 110, 120 may be configured as the MAPC ID. In other words, according to an embodiment, the AP 110 and the AP 120 may be provisioned with the MAC address of the AP 110 or with the MAC address of the AP 120 as the common MAPC identifier. In addition to a MAPC ID each AP 110, 120 may be provisioned with a MAPC authentication type. The MAPC authentication type may be related to the credential being used (e.g. SAE, PASN - existing 802.11 authentication types). In the case of an AP that advertises a multi-BSSID set or a cohosted BSSID set, the MAPC ID applies for all the B SSIDs in that set.

[0070] MAPC discovery of the APs 110, 120 may be coordinated by means of broadcast or individually addressed frames. In an embodiment, the APs 110, 120 supporting MAPC operation may include a MAPC element 300 in a frame 130, in particular in a MAPC Negotiation Discovery frame 130 exchanged between the APs 110, 120. As illustrated in figure 3a, the MAPC element 300 exchanged by the APs 110, 120 may comprise a MAPC Control field 340 and a MAPC ID field 350 containing the MAPC ID. In an embodiment, the MAC address of an AP 110, 120 may be the MAPC ID of the respective AP 110, 120. In an embodiment, the MAPC Control field 340 may have a size of 1 octet and the MAPC ID field 350 may have a size of 2 octets. In addition, the MAPC element 300 may include the following standardized fields: an Element ID field 310, a Length field 320, and an Element ID Extension field 330. As will be appreciated, the MAPC ID field 350 of the MAPC element 300 may be a locally unique 2-octet field that identifies that AP peers 110, 120 can establish an MAPC agreement in a protected manner (i.e. using MAPC authentication).

[0071] Figure 3b shows the format of the MAPC control field 340 of the MAPC element 300 according to an embodiment. The purpose of the MAPC control field 340 is to indicate the use of the MAPC element 340 between the peer APs 110, 120. As illustrated in figure 3b, the MAPC control field 340 of the MAPC element 300 may comprise a MAPC Type field 341 , a MAPC ID Present field 342, an Authentication Container Present field 343, and a Reserved field 344. In an embodiment, the MAPC Type field 341 may have a size of 4 bits, the MAPC ID Present field 342 may have a size of 1 bit, the Authentication Container Present field 343 may have a size of 1 bit, and the Reserved field 344 may have a size of 2 bits. In an embodiment, the MAPC Type field 341 may encode one or more of the following four different values: when the MAPC Type field 341 is set to 1, the MAPC element 300 includes parameters required for MAPC Discovery; when the MAPC Type field 341 is set to 2, the MAPC element 300 includes parameters required for either MAPC authentication or MAPC agreement for one ormore MAPC schemes, i.e. negotiation; when the MAPC Type field 341 is set to 3, the MAPC element 300 includes updated parameters required for an existing MAPC agreement between the APs 110, 120; and / or, when the MAPC Type field 341 is set to 4, the MAPC element 300 indicates that the peer AP 110, 120 is tearing down the MAPC agreement between the APs 110, 120.

[0072] The MAPC ID Present field 342 of the MAPC control field 340 indicates whether the MAPC ID field 350 is present in the MAPC element 300. The Authentication Container Present field, e.g. bit 343 indicates that an Authentication Container element 400 shown in figure 4 as well as other authentication elements are present in the frame 130 exchanged between the APs 110, 120, in particular in MAPC Negotiation Request and Response frames 130 exchanged between the APs 110, 120, as will be described in more detail below in the context of figure 4. When the MAPC Type field 341 of the MAPC control field 340 of the MAPC element 300 is set to “Discovery”, the Authentication Container Present field 343 may be used to indicate that Authentication is required to establish the MAPC agreement between the APs 110, 120. According to an embodiment, this variant may optionally include an RSNE and / or an RSNXE to advertise the authentication protocol required for negotiating the MAPC agreement. In other words, according to an embodiment, when the MAPC Type field 341 is set to Discovery and the Authentication Container Present field 343 is set to 1 , the AP 110, 120 is required to perform authentication during MAPC negotiation for a secure, authenticated MAPC connection. When according to a further embodiment, the MAPC Type field 341 is set to Negotiation and the Authentication Container Present field 343 is set to 1, the Authentication Container element 400, the RSNE, the RSNXE, and any authentication fields / elements are conditionally present depending on the values of an Authentication Algorithm field 440 and an Authentication Transaction Sequence Number field 450, described in more detail in the following.

[0073] In an embodiment, the APs 110, 120 may exchange MAPC Negotiation Request and Response frames 130, which may comprise the Authentication Container element 400 illustrated in figure 4. In an embodiment, the frame(s) exchanged between the APs 110, 120 may include the MAPC element 300 illustrated in figure 3a and the Authentication Container element 400 illustrated in figure 4. In an embodiment, the Authentication Container element 400 contains the fields used to perform authentication between the peer APs 110, 120, if the MAPC Type field 340 of the MAPC element 300 carried in the same frame 130 is set to “Negotiation”, and authentication is required for the MAPC agreement. This may be indicated by an Authentication Container Present field 343 of the MAPC Control field 340 set to 1.

[0074] More specifically, the Authentication Container element 400 illustrated in figure 4 may comprise the following fields of a conventional authentication frame: an Element ID field 410, a Length field 420, and an Element ID Extension field 430. Moreover, the Authentication Container element 400 illustrated in figure 4 comprises an Authentication Algorithm Number field 440, an Authentication Transaction Sequence Number field 450, and / or a Status Code field 460. As illustrated in figure 4, each of the Authentication Algorithm Number field 440, the Authentication Transaction Sequence Number field 450, and the Status Code field 460 may have a size of 2 octets. The value of the Authentication Algorithm Number field 440 is indicative of an authentication algorithm, as will be described in more detail below. The value of the Authentication Transaction Sequence Number field 450 indicates the current state of progress through an authentication protocol as defined by the IEEE 802.11 framework of standards. The value of the Status Code field 460 indicates authentication specific status codes as defined by the IEEE 802.11 framework of standards.

[0075] Based on existing IEEE 802.11 authentication methods, the APs 110, 120 may be configured to exchange multiple transactions of MAPC Negotiation Request / Response frames 130 for the purpose of authenticating both the Initiating AP, for instance, the AP 110, and the Responding AP, for instance, the AP 120, prior to the MAPC negotiation initiation, as illustrated in figures 5 to 7. As will be appreciated, in that case, the authentication protocol is overlayed over MAPCNegotiation Request and Response frames 130 using the Authentication Container element 400 illustrated in figures as well as possibly other conditional authentication protocol elements and / or fields.

[0076] An example of a MAPC agreement using SAE authentication is illustrated in figure 5. In the example shown in figure 5 the MAPC Negotiation Request / Response frames 130 exchanged between the APs 110, 120 comprise the MAPC element 300 of figure 3a (indicated as MAPC [MAPC ID] in figure 5) with the MAPC Type field 341 of the MAPC Control field 340 set to “negotiation”, and the Authentication Container element 400 of figure 4. Moreover, in an embodiment the MAPC Negotiation Request / Response frames 130 exchanged between the APs 110, 120 may further comprise anRSNE and an RSNXE as well as further authentication fields and / or elements depending on the authentication protocol and the transaction sequence number (indicated by <auth> in figure 5). The RSNE and RSNXE may be used to negotiate the cipher suite used to encrypt communications and other security parameters between the APs as part of the MAPC agreement, if they are not provisioned on the APs 110, 120 prior to MAPC discovery. The authentication fields / elements <auth> may be included in the Authentication Container element 400 based on a combination of the Authentication Algorithm Number field 440 and the Authentication Transaction Sequence Number field 450. For SAE the authentication fields / elements <auth> may comprise: a SAE Control field; a Scalar field; a FFE field; an Anti-Clogging Token field; a Finite Cyclic Group field; a Password Identifier element; a Rejected Groups element; a AKM Suite Selector element; a Send-Confirm field; a Confirm field; and / or a Neighbor Report element.

[0077] An embodiment of a PASN authentication exchange of frames 130 between the APs 110, 120 is shown in figure 6. The PASN authentication is typically a three-message exchange. However, in the embodiment shown in figure 6 a fourth message is included to complete the second MAPC Negotiation Request / Response frame exchange, containing only the Authentication Container element 400, the RSNE, and the RSNXE for authentication. The authentication fields / elements <auth> may be included in the Authentication Container element 400 based on a combination of the Authentication Algorithm Number field 440 and the Authentication Transaction Sequence Number field 450. For PASN the authentication fields / elements <auth> may comprise: a PASN Control Field; a RSNE; a RSNXE; a PASN Parameters element; a Timeout Interval element; a Wrapped Data element; a Fragment element; a Tunneled PASN element; and / or a MIC element.

[0078] As will be appreciated, the exchange of frames illustrated in figures 5 and 6 for SAE and PASN ensures that the peer APs 110, 120 are provisioned with credentials and a MAPC identifier (MAPC ID) prior to a protected MAPC negotiation being established.

[0079] In an embodiment, the APs 110, 120, i.e. the MAPC AP peers are configured to derive a new PTK using a cached PMK that was derived as part of a previous MAPC agreement established between the APs 110, 120. For this type of authentication, the Authentication Algorithm Number field 440 of the Authentication Container element 400 may be set to a new value to indicate PMK Caching. The value of the Authentication Algorithm Number field 440 could be set to any unassigned value as defined in 9.4.1.1 oflEEE 802.11 REVmeD7.0 For example, the value of 255 for the Authentication Algorithm number 440 could be assigned when the authentication protocol is PMK Caching(using PMKID).

[0080] Figure 7 shows a signalling diagram illustrating an PMKID authentication between the APs 110, 120 according to an embodiment. In the embodiment shown in figure 7 the protocol includes a single request and response frame 130 transaction. As alreadv described above in the context of figures 5 and 6, <auth> denotes elements that are included in the IEEE 802.11 authentication frame, while MAPC [MAPC ID] denotes the MAPC element 300 containing other MAPC content in the frame for a given MAPC ID in the frame. In this embodiment RSNE is present and RSNXE may be optionally included. The request frame 130 includes the Authentication Container element 400 with the Authentication Algorithm Number field 440 set to the PMK Caching value, to indicate that the Initiator AP 110 is using the PMK Caching protocol. Moreover, in theMAPC Negotiation Request frame 130 the Initiator STA, e.g. the AP 110 may set the Authentication Transaction Sequence number field 450 value to 1 , include an RSNE with at least one PMKID value in the PMKID field, and a Nonce element containing a nonce of the Initiator STA, e.g. the AP 110.

[0081] The Responder STA, e.g. the AP 120 is configured to receive the MAPC Negotiation Request frame 130, validate the PMKID included in the RSNE, and store the nonce of the Initiator STA, e.g. the AP 110. If the PMKID matches the Responder STA PMK cache for the Initiator STA, e.g. the AP 110, the Responder STA, e.g. the AP 120 transmits a MAPC Negotiation Response frame 130 to the AP 110 including an Authentication Container element 400 with the Authentication Transaction Sequence Number field value set to 2, an RSNE with the validated PMKID value in the PMKID field, and a Nonce element containing the nonce of the Responder STA, e.g. the AP 120. As will be appreciated, the nonce element is defined in P802.1 Ibi 1.1 as an authentication protocol element.

[0082] Once a MAPC agreement has been established between the APs 110, 120, the Initiator STA, e.g. the AP 110 or the Responder STA, e.g. the AP 120 may re-negotiate the parameters of the MAPC agreement or teardown the MAPC agreement. To this end, according to an embodiment, the APs 110, 120 may use a MAPC Notification frame 130 for initiating this procedure. The format of the MAPC Negotiation frame 130 is illustrated in the table shown in figure 8, which comprises a Category field 810 set to either UHR or Protected UHR, a UHR Action field 820 set to MAPC Negotiation, the MAPC element 300 according to an embodiment, and a Negotiation Type field 830. The Category and Action values of the MAPC Negotiation frame 130 may be set to those allocated to P802.1 Ibn for UHR.

[0083] In the MAPC Negotiation frame 130, the MAPC Type field 341 is set to 0 and the MAPC ID Present field 342 is set to 1 in the MAPC Control field 340, and the MAPC ID field 350 is set to the MAPC ID for the MAPC agreement in the MAPC element 300, for the APs 110, 120.

[0084] The Negotiation Type field 830 may have the following possible values: a rekey value triggering a new key negotiation (this may be done using a cached PMK without tearing down the MAPC Agreement); a teardown value for terminating the MAPC agreement; or an update parameters value for updating parameters of an existing MAPC agreement between the APs 110, 120.

[0085] Figures 9, 10, and 11 show signaling diagrams illustrating exemplary message flows between the APs 110, 120 using the MAPC Notification frame 130 for each of the Notification Type values mentioned above. More specifically, figure 9 shows the message flow between the APs 110, 120 using the MAPC Notification frame 130 for re-keying, figure 10 shows the message flow between the APs 110, 120 using the MAPC Notification frame 130 for updating parameters, and figure 11 shows the message flow between the APs 110, 120 using the MAPC Notification frame 130 for a teardown of an existing MAPC agreement between the APs 110, 120. Thus, as illustrated in figures 9 to 11, the Responder STA, e.g. AP 120 may send a MAPC Notification frame 130 for re-keying, updating, re-negotiating parameters, or a teardown of an existing MAPC agreement between the APs 110, 120. The Initiator STA, e.g. the AP 110 may send the MAPC Notification frame 130 for a teardown of an existing MAPC agreement.

[0086] According to an embodiment the APs 110, 120 are configured to perform MAPC key derivation. More specifically, in an embodiment the APs 110, 120 are configured to use a PTK for encrypting traffic between the peer APs 110, 120. According to an embodiment, the APs 110, 120 are configured to as derive a new PTK (referred to as MAPC_PTK) based on the following PTK derivation function:

[0087] MAPC_PTK = KDF -Hash-Length (PMK, “MAPC Key Derivation”, MAPC ID || min(initiatorNonce, responderNonce) ||max(initiatorNonce, responderNonce) || Selected Authentication Algorithm Number || min(initiatorMAC, responderMAC) || max(initiatorMAC, responderMAC))

[0088] wherein:

[0089] PMK denotes the Pairwise Master Key;

[0090] “MAPC Key Derivation ” is a string to identify the PTK derivation function;

[0091] MAPC ID is the identifier of the MAPC associated with a group of peer APs 110, 120 that are authorized to establish a MAPC agreement;

[0092] Nonce is a random number used by the peer APs 110, 120 for the key derivation purposes; and

[0093] Selected Authentication Algorithm Number , i.e. the value of the Authentication Algorithm Number field 440 is set to the number corresponding to the Authentication Type used to generate the PMK.

[0094] The initiator is the MAPC AP 110, 120 that transmits the MAPC Negotiation Request frame 130 and receives the Response frame 130. The responder is MAPC AP 110, 120 that receives the MAPC Negotiation Request frame 130 and transmits the Response frame 130. The PMK is the result of a successful SAE or PASN Authentication, or the use of a cached PMK.

[0095] According to a further embodiment the APs may be configured to use PASN for authentication For this embodiment, the Nonce data may be replaced by a Diffie-Hellman Shared Secret (DHss), so that the resulting PTK derivation function reads as follows:

[0096] MAPC_PTK = KDF -Hash-Length (PMK, “MAPC Key Derivation”, MAPC ID || DHss || Selected Authentication Algorithm Number || min(initiatorMAC, responderMAC) || max(initiatorMAC, responderMAC))

[0097] Figure 12 shows a flow diagram illustrating a method 1200 according to an embodiment for operating an AP, such as the AP 110 shown in figure 1 , for providing network access to one or more non-AP stations 11 Oa-c associated with the AP 110 and for securely negotiating a multi-access point coordination, MAPC, agreement with the OBSS AP 120 for implementing a MAPC transmission scheme with the OBSS AP 120 based on the MAPC agreement. The method 1200 comprises a step 1201 of exchanging one or more frames 130 with the OBSS AP 120, wherein the one or more frames 130 comprise an MAPC element 300 and wherein the MAPC element 300 comprises information indicative of a MAPC identifier of the AP 110 and the OBSS AP 120.

[0098] The person skilled in the art will understand that the "blocks" ("units") of the various figures (method and apparatus) represent or describe functionalities of embodiments of the present disclosure (rather than necessarily individual "units" in hardware or software) and thus describe equally functions or features of apparatus embodiments as well as method embodiments (unit = step).

[0099] In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described embodiment of an apparatus is merely exemplary. For example, the unit division is merely logical function division and may be another division in an actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

[0100] In addition, functional units in the embodiments of the invention may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.

Claims

CLAIMS1. An access point (110) for providing network access to one or more non-AP stations (1 lOa-c) associated with the AP (110) and for securely negotiating a multi-access point coordination, MAPC, agreement with an overlapping basic service set, OBSS, AP (120) for implementing a MAPC transmission scheme with the OBSS AP (120) based on the MAPC agreement, wherein the AP (110) is configured to:exchange one or more frames (130) with the OBSS AP (120), wherein the one or more frames (130) comprise an MAPC element (300) and wherein the MAPC element (300) comprises information indicative of a MAPC identifier of the AP (110) and the OBSS AP ( 120).

2. The AP (110) of claim 1, wherein the AP (110) is configured to store one or more MAPC credentials and wherein the AP (110) is configured to securely negotiate the MAP agreement based on the one or more MAPC credentials and the information indicative of the MAPC identifier of the AP (110) and the OBSS AP (120).

3. The AP (110) of claim 2, wherein the one or more MAPC credentials comprise a password or a certificate.

4. The AP (110) of any one of the preceding claims, wherein the MAPC identifier of the AP (110) and the OBSS AP (120) is based on a MAC address of the AP (110) and / or a MAC address of the OBSS AP (120).

5. The AP (110) of any one of the preceding claims, wherein the MAPC element (300) comprises a MAPC ID field (350) containing the information indicative of the MAPC identifier of the AP (110) and the OBSS AP (120).

6. The AP (110) of claim 5, wherein the MAPC element (300) comprises a MAPC Control field (340) and wherein the MAPC Control field (340) comprises a MAPC ID Present field (342) indicative of the presence of the MAPC ID field (350) in the MAPC element (300).

7. The AP (110) of claim 6, wherein the MAPC Control field (340) further comprises an MAPC Type field (341) indicative of one of the following purposes of the MAPC element (300) of the one or more frames (130): MAPC discovery; MAPC agreement negotiation; MAPC agreement parameters update; and MAPC agreement teardown.

8. The AP (110) of claim 6 or 7, wherein the one or more frames (130) comprise an Authentication Container element (400) and wherein the MAPC Control field (340) further comprises an Authentication Container Present field (343) indicative of the presence of the Authentication Container element (400) in the one or more frames (300).

9. The AP (110) of claim 8, wherein the Authentication Container element (400) comprises an Authentication Algorithm Number field (440) indicative of an authentication algorithm of a plurality of authentication algorithms for establishing authentication between the AP (110) and the OBSS AP (120).

10. The AP (110) of claim 9, wherein one value of the Authentication Algorithm Number field (440) of the Authentication Container element (400) is indicative of PMK caching authentication.

11. The AP (110) of any one of claims 8 to 10, wherein the Authentication Container element (400) comprises an Authentication Transaction Sequence Number field (450) indicative of a current state of progress with respect to an authentication protocol used for authentication.

12. The AP (110) of any one of claims 8 to 11 , wherein the Authentication Container element (400) comprises a Status Code field (460) indicative of an authentication specific status code.

13. The AP ( 110) of any one of the preceding claims, wherein the one or more frames (130) comprise one or more MAPC Negotiation Request and / or Response frames (130) and wherein the one or more MAPC Negotiation Request and / or Response frames (130) further comprise an RSNE, an RSNXE, and / or one or more authentication elements or fields.

14. The AP (110) of claim 13, wherein the AP (110) and the OBSS AP (120) are configured to perform authentication based on a Simultaneous Authentication of Equals, SAE, protocol and wherein the one or more authentication elements or fields comprise: a SAE Control field, a Scalar field, a FFE field, an Anti-Clogging Token field, a Finite Cyclic Group field, a Password Identifier element, a Rejected Groups element, an AKM Suite Selector element, a Send-Confirm field, a Confirm field, and / or a Neighbor Report element.

15. The AP (110) of claim 13, wherein the AP (110) and the OBSS AP (120) are configured to perform authentication based on a Pre-Association Security Negotiation protocol and wherein the one or more authentication elements or fields comprise: a PASN Control Field; a PASN Parameters element; a Timeout Interval element; a Wrapped Data element; a Fragment element; a Tunneled PASN element; and / or a MIC element.

16. The AP (110) of any one of the preceding claims, wherein the AP (110) is configured to derive a PTK for securely negotiating the MAPC agreement with the OBSS AP (120) based on a PMK, a nonce of the AP (110), a nonce of the OBSS AP (120) and the information indicative of the MAPC identifier of the AP (110) and the OBSS AP (120).

17. The AP (110) of any one of claims 1 to 15, wherein the AP (110) is configured to derive aPTK for securely negotiating the MAPC agreement with the OBSS AP (120) based on a PMK, a Diffie-Hellman Shared Secret, DHss, and the information indicative of the MAPC identifier of the AP (110) and the OBSS AP (120).

18. A method (1200) for operating an access point, AP, (110) for providing network access to one or more non-AP stations (1 lOa-c) associated with the AP (110) and for securely negotiating a multi-access point coordination, MAPC, agreement with an overlapping basic service set, OBSS, AP (120) for implementing a MAPC transmission scheme with the OBSS AP (120) based on the MAPC agreement, wherein the method (1200) comprises:exchanging (1201) one or more frames (130) with the OBSS AP (120), wherein the one or more frames (130) comprise an MAPC element (300) and wherein the MAPC element (300) comprises information indicative of a MAPC identifier of the AP (110) and the OBSS AP (120).

19. A computer program product comprising a computer-readable storage medium for storing program code which causes a computer or a processor to perform the method (1200) of claim 18, when the program code is executed by the computer or the processor.

Images