Wi-Fi Roaming Key Association Using a Shared AP MAC Address

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The security protocol for multi-link security associations in Wi-Fi 8, which involves establishing sessions/links across multiple physical APs, is incompatible with the security associations established in Wi-Fi 7 due to different MLD MAC addresses, leading to security issues during make-before-break-roaming (MBBR) across multiple APs.

Innovation Solution

A new method of key generation is developed that uses a common MAC address shared by multiple access points to derive a pairwise transient key (PTK) for secure communication, allowing seamless roaming among APs without reauthentication, using a pairwise master key (PMK) derived through a 4-way handshake protocol.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Wi-Fi 7 multi-link security association is used with MLD MAC addresses for key derivation, then security is established for single AP links, but security compatibility fails when roaming across multiple physical APs in Wi-Fi 8

Engineering Contradiction:

Improvesecurity association compatibilityVSAvoidmulti-AP roaming capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments the security association into two parts: a global PMK that remains consistent across multiple APs, and individual PTKs for each link. This allows the PMK to be shared across APs while maintaining link-specific security through separate PTK derivation, resolving the contradiction between security reliability and multi-AP adaptability

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a new key derivation mechanism that uses the PMK as an intermediary between the STA and multiple APs. Instead of deriving keys directly from MLD MAC addresses (which differ per AP), the PMK serves as a common intermediary that enables secure communication across AP boundaries while maintaining individual link security

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If make-before-break-roaming is implemented across multiple APs, then seamless roaming is achieved, but security association reestablishment is required due to different MLD MAC addresses

Engineering Contradiction:

Improveroaming efficiencyVSAvoidreauthentication time

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The patent performs preliminary action by establishing the PMK before roaming occurs. The PMK is derived in advance using a method that is compatible across multiple APs, so when roaming happens, the STA already possesses a valid PMK that can be used immediately with the new AP, eliminating the need for time-consuming reauthentication

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent ensures continuity of useful action by maintaining the PMK's validity across AP transitions. The security association doesn't need to be broken and reestablished during roaming; instead, the existing PMK continues to serve as the basis for security, allowing seamless MBBR without interruption to the security function

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS12563388B2Systems and methods for security association enabling make-before-break-roaming (MBBR)

Publication Date: 2026.02.24 CISCO TECHNOLOGY INC

AI summary

A system and method are provided for generating a pairwise transient key security association (PTKSA) by: providing a first media access control (MAC) address that is shared by multiple access points (APs), the first MAC address corresponding to an infrastructure comprising the multiple APs, and each AP of the multiple APs having a respective AP MAC address; providing a second MAC address to a station (STA); and establishing a secure link between the STA and the infrastructure using the first MAC address and the second MAC address to derive a pairwise transit key (PTK) for the secure link, wherein the secure link is between the STA and the multiple APs.