PTK Derivation During Link Addition for Seamless AP Roaming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless communication systems face data loss and compromised security during seamless roaming due to break-before-make handover processes, where connections are broken before new connections are established, leading to potential data loss and security vulnerabilities.
Innovation Solution
Implementing PTK derivation during the link addition phase using enhanced security context sharing and authentication methods like Fast Initial Link Setup (FILS), Protected Authentication Service Negotiation (PASN), and Seamless Roaming Element (SRE) to establish a new temporal key before breaking the old connection, ensuring secure and seamless handovers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If break-before-make handover is used, then handover speed is improved, but data loss occurs and security is compromised
Solution Approach 1:
The patent applies preliminary action by deriving the new PTK during the link addition phase before the actual route switch occurs. The new temporal key is computed and verified in advance using security context sharing between the non-AP MLD and target AP MLD, ensuring that when the handover executes, the new connection is already secured with a fresh key, preventing both data loss and security vulnerabilities
Solution Approach 2:
The patent implements continuity of useful action by maintaining the ability to communicate with both the serving AP and target AP simultaneously during the transition. The link addition phase establishes a new secure link while the old link remains active, allowing continuous data flow without interruption. The route switch phase then seamlessly transitions traffic to the new link while maintaining connection continuity
2Reliability
If PTK is derived during link addition phase, then security is improved, but device complexity increases
Solution Approach 1:
The patent uses the serving AP MLD as an intermediary to facilitate secure key derivation with the target AP MLD. The serving AP forwards security context (including PMK-R1, ANonce, and SNonce) obtained from the non-AP MLD to the target AP MLD, enabling the target AP to compute the PTK without requiring direct complex authentication protocols between the non-AP MLD and target AP. This intermediary approach simplifies the overall process while maintaining security
Solution Approach 2:
The patent makes the security context sharing mechanism universal by using the same FILS/PASN authentication framework for both the initial association and the roaming process. The PMK-R1 derived during initial association is reused and extended with new nonces (ANonce, SNonce) for the roaming PTK derivation, eliminating the need for separate complex authentication procedures and reducing device complexity
Data Source
AI summary
Embodiments herein provide systems, methods, and apparatuses for a non-access point station (STA) to roam between access points (APs). In some embodiments, the STA may send a first management frame to a serving AP, the first management frame including an identifier for a target AP and a first container with STA security context. The STA may receive a second management frame including a second container with security context for the target AP. The STA may derive a temporal key for communication with the target AP, and establish a second link with the target AP before breaking the first link with the serving AP.