Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/50—Secure pairing of devices
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/60—Context-dependent security
  • H04W12/69—Identity-dependent
  • H04W12/73—Access point logical identity
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/105—Multiple levels of security
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

• Connection method between a first station and a second station in a wireless communication network corresponding first station, second station, and computer program.
• the field of the invention is that of telecommunications.
• the invention relates to securing access to a wireless network, for example of the WLAN (“Wireless Local Access Network”) wireless local access network type.
• WLAN Wireless Local Access Network
• the security mode makes it possible in particular to protect the data exchanged between the client terminal and the access point.
• the security mode defined by the “Wi-Fi Alliance” organization is of the WPA type, in English “Wi-Fi Protected Access”, in particular WPA2 or WPA3.
• the security mode mainly used is of the WPA2 type.
• the recommended security mode is of the WPA3 type.
• a client terminal that supports WPA2 security mode can connect to an access point that supports both WPA2 and WPA3 security modes.
• a client terminal that supports WPA2 security mode cannot connect to an access point that only supports WPA3 security mode.
• WPA3-TM Transition Mode
• the security mode to be favored at the level of the access point is the WPA3-TM security mode.
• a disadvantage of using this WPA3-TM security mode is that there are, for certain terminals (for example of the Smartphone type, printer, connected TV, etc.) interoperability problems with access points activating the WPA3-TM security mode.
• the invention proposes a solution that does not have all the drawbacks of the prior art, in the form of a connection method between a first station and a second station in a wireless communication network.
• the second station implements:
• the second station for example a client terminal, can inform the first station, for example an access point, of the security mode(s) that it supports.
• the first station can choose the appropriate security mode for the connection between the first station and the second station, the second station connecting with the set of basic services configured with this security mode.
• a set of basic services in English BSS or "Basic Service Set", is a set formed by an access point and the terminals associated with this access point, according to a particular configuration (including for example the name of the Wi-Fi network and a security mode).
• the association of the second station is only implemented with a BSS "compatible" with the security mode(s) supported by the second station, which makes it possible to avoid interoperability problems.
• the second station is associated with the BSS presenting the highest level of security among the security modes supported by the second station.
• security modes belong to the group comprising: - WPA2 security mode;
• Said at least one item of information representative of a security mode supported by said second station can in particular exhaustively list all the security modes supported by the second station.
• said at least one item of information representative of a security mode supported by said second station corresponds to the number of security modes supported by said second station.
• the first station will deduce that the security mode supported by the second station is WPA2. If two security modes are supported by the second station, the first station will deduce that the security modes supported by the second station are WPA2 and WPA3. If three security modes are supported by the second station, the first station will deduce that the security modes supported by the second station are WPA2, WPA3 and WPA4, etc.
• the second station also implements the reception of an identifier of at least one first set of basic services to which said first station belongs, said at least one first set of basic services being configured with a first security mode, and said connection comprises receiving a routing request to said selected basic service set, if the selected basic service set, said second basic service set, is configured with a second security mode supported by said second station and having a security level higher than said first security level.
• the second station receives an identifier of at least a first set of basic services.
• the first set of basic services is configured with the lowest level of security (eg WPA2) and therefore supported by all stations.
• the proposed solution makes it possible to automatically route the second station to the second set of basic services configured with this second security mode (supported by the second station).
• This second set of basic services is preferably not visible to the user of the second station, ie only an identifier of said at least one first set of basic services is displayed on an interface (for example a screen) of the second station.
• an interface for example a screen
• the user of the second station only sees a single identifier of a first BSS, and the first station can take care, if necessary, of routing the second station to a second BSS that is not broadcast, but more suitable. (for example because it is configured with a higher level of security).
• the risk is avoided that the user of the second station chooses a "bad BSS" (i.e. the one presenting a weak security mode, or one not supported by the second station), which would lead to a degradation of the customer experience with the receipt of inconsistent and varied error messages.
• a "bad BSS" i.e. the one presenting a weak security mode, or one not supported by the second station
• the proposed solution thus makes it possible to automatically route the second station to the BSS selected by the first station, taking account of the information representative of a security mode supported by the second station. This operation is therefore transparent for a user of the second station.
• the second station is a multi-band terminal, capable of transmitting or receiving signals on several frequency bands in a Wi-Fi network (for example a frequency band around 6 GHz when it is close to the point of access point, or a frequency band around 2.4 GHz when it moves away from the access point), the change of security mode inherent in the change of frequency band can thus be executed quickly and transparently to the user, i.e. without harming the user experience.
• a Wi-Fi network for example a frequency band around 6 GHz when it is close to the point of access point, or a frequency band around 2.4 GHz when it moves away from the access point
• the first station belongs to:
• a first BSS denoted BSS1, on a 2.4 GHz frequency band
• a second BSS denoted BSS2 on a 5 GHz frequency band, having the same configuration, for example a Wi-Fi network name “SSID1” and a WPA2 security mode;
• BSS3 a “second set of basic services”: a third BSS, denoted BSS3, on a 6 GHz frequency band, presenting a different configuration, for example a Wi-Fi network name “SSID2” and a WPA3 security mode .
• the BSS1 and BSS2 each associated with a distinct frequency band, form an extended service set, in English ESS for “Extended Service Set”, having a common SSID service set identifier.
• the ESS appears as a single BSS for each of the stations.
• connection further comprises the transmission, to said first station, of a response to said routing request authorizing routing to said second set of basic services and connecting said second station with said second set of basic services.
• the second station upon receipt of a routing request, can choose to associate itself, or not, with the BSS identified in the routing request, and inform the first station thereof.
• the invention also relates to a connection method between a first station and a second station in a corresponding wireless communication network, implemented by the first station.
• the first station implements:
• the first station can thus check whether the security mode or modes supported by the second station are compatible with at least one security mode of a BSS to which the first station belongs, so that the second station associates with a BSS compatible with a security mode that the second station supports, preferably the BSS presenting the highest level of protection.
• such a method also comprises, implemented by the first station:
• the proposed solution makes it possible to automatically route the second station to a BSS selected by the first station, taking account of the information representative of a security mode supported by the second station.
• the second station can choose to associate with the first BSS, or be routed to the second BSS if it supports both the first and second security modes.
• the first station implements the reception, from said second station, of a response to said routing request authorizing routing to said second set of basic services and the connection of said second station with said second set of basic services.
• the second station upon receipt of a routing request, can choose to associate itself, or not, with the BSS identified in the routing request, and inform the first station thereof.
• said at least one item of information representative of a security mode supported by said second station is transmitted in a field of the “Robust Security Network Information Element” type.
• said at least one item of information representative of a security mode supported by said second station is transmitted in a “Probe Request” type message.
• Such a message is conventionally transmitted from the second station to the first station, so that the second station can associate with a BSS to which the first station belongs.
• the proposed solution does not require the sending of an additional message.
• said at least one item of information representative of a security mode supported by said second station can be transmitted in a field of the “Robust Security Network Information Element” type inserted in a message of the “Probe Request” type.
• the invention also relates to a first station of a corresponding wireless communication network, comprising:
• such a first station is for example an access point (gateway, “set top box”, etc).
• an access point gateway, “set top box”, etc.
• a client terminal smart phone, tablet, printer, connected television, etc.
• the invention also relates to a second station of a corresponding wireless communication network, comprising:
• Such a second station is for example a client terminal (smartphone, tablet, printer, connected television, etc.).
• the invention also relates to one or more computer programs comprising instructions for implementing a connection method as described above when this or these programs are executed by at least one processor.
• the invention finally relates to one or more computer-readable recording media, on which are recorded one or more computer programs comprising program code instructions for the execution of at least one step of a connection as described above, according to any one of the embodiments.
• Such recording media can be any entity or device capable of storing a program.
• FIG. 1 illustrates an example of a Wi-Fi communication network comprising a first station STA1 and a second station STA2;
• FIG. 2 shows the main steps implemented by the first and second stations STA1 and STA2 according to a particular embodiment of the invention
• FIG. 3 illustrates an example of message exchange to connect the first and second stations STA1 and STA2 according to a particular embodiment
• FIG. 4 shows the simplified structure of a first station according to a particular embodiment
• FIG. 5 shows the simplified structure of a second station according to a particular embodiment.
• Wi-Fi communication network implementing at least two stations STA1 and STA2, as illustrated in FIG. 1.
• Such a Wi-Fi network can operate in infrastructure or ad-hoc mode.
• the general principle of the invention is based on the information, at the level of the first station, of the security mode(s) supported by the second station.
• the first station can select a basic service set to which it belongs, configured with a security mode supported by the second station, so that the second station can associate with a "good" basic service set.
• the first station selects the set of basic services configured with the security mode supported by the second station offering the highest level of security.
• the second station STA2 transmits, to the first station STA1, at least one piece of information representative of a security mode supported by the second station STA2.
• information comprises a list of the security mode(s) supported by the second station STA2, a number of security modes supported by the second station STA2, etc.
• the first station STA1 thus receives, during a step 221, said at least one item of information representative of a security mode supported by the second station STA2.
• the first station STA1 can select, during a step 222, a set of basic services to which the first station STA1 belongs, according to said at least one piece of information representing a supported security mode. by the second station STA2.
• the first station STA1 selects the set of basic services configured with this security mode.
• the first station STA1 may optionally inform the second station STA2 of the selected basic service set, but this step is optional in this case.
• the first station STA1 selects for example the set of basic services configured with the security mode having the highest security level. In this case, the first station STA1 informs the second station STA2 of the set of basic services selected.
• the second station STA2 can thus connect, during a step 212, with the set of basic services selected by the first station STA1, without going through a connection with another set of basic services which would offer a level of lower security, for example.
• the first station STA1 broadcasts beforehand in the Wi-Fi network, during a step 220, an identifier of at least a first set of basic services to which it belongs, configured with a first security mode.
• the second station STA2 receives this identifier during a step 210.
• this first security mode has the lowest security level (for example WPA2), and can therefore be supported by all the stations of the Wi-Fi network.
• the first station STA1 selects the first set of basic services, configured with this first security mode.
• the second station STA2 can thus connect with the first set of basic services selected by the first station STA1.
• the first station STA1 selects a second set of basic services, configured with a second security mode having a higher level of security than the first security mode. For example, the first station STA1 selects the second set of basic services presenting the highest level of security.
• the first station STA1 can then transmit to the second station STA2 a routing request to the second set of basic services selected, if it detects that the second security mode offers better protection than the first security mode (for example the second security mode is newer than the first security mode).
• the first station STA1 can thus decide to route the second station STA2 to a set of basic services taking into account the capabilities of the second station STA2.
• the first station STA1 offers a first set of basic services, for example the BSS1 illustrated in FIG. 1, which can be seen as a “routing” BSS, directing the second station STA2 to a BSS adapted according to the security mode or modes supported by the second station STA2, for example the BSS2 illustrated in FIG. 1.
• the BSS1 illustrated in FIG. 1 can be seen as a “routing” BSS, directing the second station STA2 to a BSS adapted according to the security mode or modes supported by the second station STA2, for example the BSS2 illustrated in FIG. 1.
• the user can select the unique BSS visible in an interface of the second station STA2.
• the second station STA2 is directed to a BSS adapted to a security mode supported by the second station STA2.
• the invention thus makes it possible to guarantee the connection of the stations which do not support the new security modes and to route the stations which support a given new security mode to the “correct” BSS. According to a particular embodiment, it makes it possible to guarantee a connection of each station with the BSS which guarantees it the best security mode supported.
• the user of the second station when discovering the visible networks, the user of the second station only sees the BSS1, and can connect his terminal to this BSS1.
• the security configuration allows all stations to be able to connect to the BSS1 without interoperability problems.
• Example of implementation An exemplary implementation of the invention is described below, in a Wi-Fi network in infrastructure mode. It is considered according to this example that the first station is an access point/router, and the second station a client terminal.
• the access point belongs to at least two BSS or ESS:
• a first BSS denoted BSS1, identified by the identifier SSID1, and configured with a first security mode having the lowest level of protection, for example of the WPA2 type.
• the BSS1 makes it possible to guarantee interoperability with a second station which would not be updated, for example a second station supporting only the first security mode.
• the BSS1 also allows the routing of a second, more recent station to a BSS configured with a second security mode having a higher level of protection than the first security mode, for example of the WPA3 type;
• BSS2 A second BSS, denoted BSS2, identified by the identifier SSID2, and configured with a second security mode having a higher level of protection than the first security mode, for example of the WPA3 type.
• the BSS2 is not visible to the user of the second station.
• a station supporting a security mode also supports security modes of lower security level.
• a station supporting the WPA3 security mode also supports earlier versions (or having a lower security level) of the WPA3 security mode, and therefore the WPA2 security mode.
• FIG. 3 illustrates an example of messages exchanged between the access point AP and the client terminal STA2 according to this example implementation.
• the access point broadcasts in the Wi-Fi network a beacon, in English “Beacon”, carrying information on the communication network.
• a beacon carries information making it possible to know the characteristics of a set of basic services offered by the access point, for example the identity of the access point, the frequency band (2.4 GHz, 5 GHz, 6 GHz ), bandwidth (20MHz, 40MHz, 80MHz, 160MHz), etc.
• the access point broadcasts a beacon 31 identifying the first set of basic services BSS1, by means of the identifier SSID1.
• the terminal STA2 When it seeks to connect to the access point AP, the terminal STA2 sends a succession of Wi-Fi frames. The terminal STA2 can thus send to the access point AP information representative of the security mode or modes that it supports, for example in a "Probe Request" message 32.
• the access point can respond to the “Probe Request” message 32 by sending a conventional “Probe Response” message 33 of the Wi-Fi standard to the terminal STA2.
• the access point AP determines that the terminal STA2 only supports the first security mode (WPA2), then it selects the set of basic services BSS1 and the terminal STA2 connects to BSS1.
• WPA2 first security mode
• the access point AP determines that the terminal STA2 supports the second security mode (WPA3), then it redirects the terminal STA2 to the set of basic services BSS2. To do this, as illustrated in FIG. 3, the access point AP sends a routing request which offers the terminal STA2 to connect to the BSS2 identified by the identifier SSID2, configured with the second security mode offering a level of higher security than the first security mode (for example the second security mode is more recent than the first security mode). For example, such a request is sent in the form of a new “Routing Request” frame 34.
• the “Routing Request” frame sent by the access point AP makes it possible to give the terminal STA2 the information necessary for it to be able to connect to the selected BSS.
• the “Routing Request” frame carries an identifier of the selected BSS (for example an SSID service set identifier), and one or more conventional fields encountered in the “probe response”/“association response” frames.
• the terminal STA2 can agree to connect to this BSS2, or decide to connect to BSS1. He can send a response to the access point AP, for example in a “Routing Response” frame 35, bearing the identifier of the BSS with which he wishes to connect (SSID2 for example) and an “RSN Information Element” field.
• the “Routing Response” frame transmitted by the terminal STA2 makes it possible to indicate to the access point AP whether it agrees to connect with the BSS selected by the AP or not.
• the “Routing Response” frame carries information of the “success” type if the terminal STA2 agrees to connect with the BSS selected by the AP, “failure” otherwise.
• the terminal STA2 can also indicate to the access point AP the reason or reasons for which it refuses to connect to the BSS selected by the access point, for example via a message of the “reason code” type taking one of the values provided by the Wi-Fi standard.
• connection continues by exchanging conventional frames as described in the Wi-Fi standard, in particular during an authentication 36, association 37 and key exchange 38 procedure.
• the authentication procedure 36 is based on the exchange of authentication messages of the “Simultaneous Authentication of Equals (SAE)” type between the access point AP and the terminal STA2.
• SAE Simultaneous Authentication of Equals
• the terminal STA2 can associate 37 (register) with the access point/router to gain full access to the network.
• the association allows the router/access point to register each station so that the frames are correctly delivered.
• the terminal STA2 sends the access point a request in association with the BSS2 in an “Association Request (SSID2)” message.
• the access point confirms the association in an “Association Response (SSID2)” response message.
• the terminal STA2 is therefore routed to the BSS2 before the association procedure, which allows it to associate with the “good” BSS, for example the one configured with the highest security mode supported by the terminal STA2.
• the terminal STA2 can then connect with the access point AP thanks to the exchange 38 of keys (“Key” 1, 2, 3, 4).
• such a first station comprises at least one memory 41 comprising a buffer memory, at least one processing unit 42, equipped for example with a programmable calculation machine or a dedicated calculation machine, for example a processor P, and controlled by the computer program 43, implementing steps of the connection method according to at least one embodiment of the invention.
• the code instructions of the computer program 43 are for example loaded into a RAM memory before being executed by the processor of the processing unit 42.
• the processor of the processing unit 42 implements the steps of the connection method described above, according to the instructions of the computer program 43, to:
• such a second station comprises at least one memory 51 comprising a buffer memory, at least one processing unit 52, equipped for example with a programmable calculation machine or a dedicated calculation machine, for example a processor P, and controlled by the computer program 53, implementing steps of the connection method according to at least one embodiment of the invention.
• the code instructions of the computer program 53 are for example loaded into a RAM memory before being executed by the processor of the processing unit 52.
• the processor of the processing unit 52 implements the steps of the connection method described above, according to the instructions of the computer program 53, to:

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Mobile Radio Communication Systems (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=78649358

Family Applications (1)

Country Status (4)

• 2021
  • 2021-07-16 FR FR2107683A patent/FR3125376A1/fr not_active Withdrawn
• 2022
  • 2022-07-13 WO PCT/FR2022/051413 patent/WO2023285768A1/fr active Application Filing
  • 2022-07-13 EP EP22755256.9A patent/EP4371326A1/de active Pending
  • 2022-07-13 CN CN202280048890.6A patent/CN117616795A/zh active Pending

Also Published As

Similar Documents

Legal Events