WO2006074591A1

WO2006074591A1 - A wireless local area network and a method for implementing a mobile terminal’s fast handover

Info

Publication number: WO2006074591A1
Application number: PCT/CN2005/002351
Authority: WO
Inventors: Zhonghui Yao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-01-13
Filing date: 2005-12-29
Publication date: 2006-07-20
Also published as: CN1805387A; CN100428715C

Abstract

A wireless LAN(WLAN) and a method for implementing a mobile terminal’s fast handover, the WLAN comprises mobile terminals and access points(Ap) which accesses mobile terminals to the network, each AP and the mobile terminals associated with it form a basic service set(BSS), between the mobile terminals and the Aps, utilizing the cryptographic material which is associated with the BSS identification to protect the air interface; wherein, a plurality of physical Aps form a logic AP and share the same basic service set identification(BBSS-ID), when the mobile terminals handover between a plurality of Aps, it uses directly the cryptographic material which was associated with the BSS identification before handover to protect the air interface. Meantime, the present invention also discloses a wireless LAN.

Description

-Wireless local area network and method for realizing fast switching of mobile station

The present invention relates to the field of communications, and in particular, to a wireless local area network and a method for implementing fast handover of a mobile station in a wireless local area network.

Background technique

At present, the IEEE 802.11 series has become the standard of wireless local area network (WLAN), which has been widely supported and applied, and has emerged demand for large-scale enterprise coverage networking, large-scale community networking, and even metropolitan networking. In such a large-scale WLAN network, a large number of WLAN access point devices (APs) need to be deployed, and different APs cover specific areas and form a large area of continuous coverage. Therefore, it is required to support the mobile terminal (MT) to switch from one AP to another while maintaining the continuity of the service while moving in the continuously covered area. The basic flow of mobile station switching is as follows:

1. The MT scans the wireless channel. The MT scans each wireless channel and performs related indicator measurements, such as field strength measurements. When the MT is to be switched from one AP to another, it will be based on these test results. For example, the MT can select the channel with the best radio channel quality as the target AP for handover.

2. Initiate a re-association request. The MT initiates a re-association request to the new AP. After receiving the re-association request, the new AP must cause the system to delete the association established with the old AP before the MT handover, and then establish a new association with the mobile station.

3. After the new association is established, the mobile station related data service flow is forwarded by the new AP. At the same time, the mobile station will continue to scan and measure other wireless channels to determine whether to switch to the new AP _0.

4. When the WLAN network is an RSN (Robust Security Network) defined by 802.11i, the mobile station and the new AP need to establish a security trust relationship and negotiate new encryption parameters. 802.11Ϊ defines a pre-authentication method, that is, a new AP is used as an 802.1X authentication point before re-association, 802.1x authentication is performed between the mobile station and the network authentication server, and the master key is negotiated, and the network authentication server The master key is delivered to the new AP. In this way, when re-associating with a new AP, the new AP and the mobile station can negotiate an air interface encryption key based on the key, thereby effectively reducing service interruption time. PT/CN2005/002351 The above pre-authentication method initiates a complete 802.1X authentication process prior to re-association. Since the authentication process also relies on the current association, the following risks exist:

1. Since the mobile station often requests re-association because the currently associated channel signal is weak, it is also dependent on the current association that the communication between the mobile station and the AP may be unreliable, and the 802.1X authentication process may not be completed correctly.

2. There is uncertainty in the time taken by the 802.1X authentication process. The mobile station may have moved outside the range covered by the current channel before the authentication is completed, resulting in the failure to complete the 802.1X authentication process.

When the pre-authentication cannot be completed, re-authentication is required after the re-association, which causes the service interruption time to increase.

Summary of the invention

The present invention provides a wireless local area network and a method for implementing fast handover of a mobile station, so as to solve the problem that the service interruption time may be prolonged when the mobile station switches in the prior art.

In order to solve the above problems, the present invention provides the following technical solutions:

A method for implementing fast handover of a mobile station in a wireless local area network, the wireless local area network includes a mobile station and an access point (AP) that connects the mobile station to the network, and each AP and its associated mobile station form a basic service set (BSS) Between the mobile station and the AP, the air interface is protected by an encryption material associated with the basic service set identifier; wherein, the plurality of physical APs form a logical AP and share the same basic service set identifier (BBSS-ID). The mobile station directly protects the air interface using the cryptographic material associated with the basic service set identifier prior to handover when switching between the plurality of physical APs.

The access controllers in the WLAN manage the mapping relationship between the logical APs and the corresponding physical APs. When the physical APs request configuration from the access controller, the same basic service identifier is configured in each physical AP.

The access controller is used as an authentication point, and the physical AP only forwards the authentication packet in the authentication process performed between the mobile station and the access controller.

After the authentication process is completed, the access controller sends the encryption key to the physical AP. A wireless local area network includes a mobile station, an access point (AP) that connects the mobile station to the network; wherein the wireless local area network further includes an access controller (AC), and multiple APs share the same basic service set identifier (BBSS- ID), the access controller configures the basic service set identifier to each of the shared identifiers In the AP.

The access controller functions as an 802.1X authentication point to complete an authentication process with the mobile station. By adopting the invention, the mobile station can re-associate to the new AP and can share the previous master key without re-authentication or pre-authentication, which speeds up the handover speed and helps to avoid the temporary service interruption caused by the handover and affects the service quality. .

DRAWINGS

1 is a schematic diagram of a physical AP corresponding to a logical AP in a wireless local area network; FIG. 2 is a schematic diagram of multiple physical APs corresponding to one logical AP in a wireless local area network according to the present invention; FIG. 3 is an access controller to an AP in the present invention. A flowchart for configuring basic service set IDs.

detailed description

In order to achieve fast switching of mobile stations, the best way is to be able to do re-association without pre-authentication or re-authentication. For the RSN (Robust Security Network) network, the best way is that the mobile station can continue to use the previous encryption material after re-association, especially the master key, so that the new AP can share the master key of the old AP. .

However, for a mobile station, when re-associating from one AP to another AP, the encryption material associated with the original AP may have been deleted, and the assumption of implementing master key sharing on the network side does not guarantee compatibility with the mobile station. The root cause is -

(1) An AP and its associated mobile station form a BSS (Basic Service Set), identified by a BSS-ID, which is an IEEE 802 MAC address.

(2) The AP generally uses the BSS-ID to identify its corresponding wireless interface. When implementing 802.1X, from the perspective of the mobile station, the AP is assumed to be an 802.1X authentication point and the BSS-ID is used as the identification of the authentication point.

(3) After the 802.1X authentication is completed and the master key is negotiated, the master key is bound to the mobile station MAC address and the AP identity (BSS-ID). Therefore, when the mobile station switches from an AP to a new AP, because the BSS-ID is different, the previous master key is only associated with the old AP and cannot be shared.

As can be seen from the above, when the BSS-ID changes, the master key sharing cannot be implemented on the mobile station side. From the perspective of the mobile station, a BSS-ID corresponds to an AP or 802.1X authentication point defined by 802.1, and this AP is referred to as a logical AP, and a logical AP is identified by a BSS-ID. For traditional networks (see Referring to Figure 1), a physical AP device corresponds to a logical AP, and its BSS-ID is set to the hardware device at the time of production. Multiple APs can be interconnected by DS (Distributed System), so that different BSSs together form an extended service set to form a local area network.

In order to enable the mobile station to share the encrypted material (mainly the master key) associated with the BSS-ID before the handover after the re-association, and realize the fast handover of the mobile station, the present invention forms a logical AP and shares by multiple physical APs. The same basic service set identifier (BSS-ID), that is, these physical APs all have the same BSS-ID, so when the mobile station switches between these physical APs, since the BSS-ID does not change, the mobile station is switched to After the new AP, the air interface can be directly protected by the cryptographic material associated with the BSS-ID before the handover.

As shown in Figure 2, physical AP1, physical AP2, and physical AP3 (not limited to three) correspond to one logical AP, that is, they share the same BSS identifier BSS-ID. A centralized access controller (AC) is introduced in the network architecture, and the AC manages the mapping of physical APs to logical APs. The BSS-ID is configured by the AC to the physical AP after the physical AP is powered on. In a centralized architecture of a wireless LAN, the AC is the upper-level switch (generally called a Wi-Fi switch) or router (generally called the access router AR) of the AP (see the IETF CAPWAP working group for the WLAN centralized architecture). Summary).

The physical AP power-on initialization process completes the negotiation of the communication mechanism between the physical AP and the AC, as shown in Figure 3. After the initialization is complete, the AP sends a configuration request message to the AC, and the AC returns a configuration response message to the AP, where the message carries the BSS-ID of the logical AP. After the AP obtains the AC configuration data, it will start running in normal mode. After the AP is running normally, the MAC frame sent by the AP to the mobile station through the air interface uses the identifier of the logical AP BSS-ID. Therefore, when the mobile station switches between the physical AP1, the physical AP2, and the physical AP3, the master key can be shared without re-authentication or pre-authentication, thereby speeding up the switching speed.

From the perspective of the mobile station, the mobile station is associated with the logical AP. When the association is completed, if it is an RSN network, the 802.1X authentication process will be started. Its authentication point is a logical AP. In the present invention, the logical AP function as an 802.1X authentication point is implemented on the AC, that is, the AC is an 802. IX authentication point. In the 802. IX authentication process, a physical AP only forwards packets and does not process packets directly.

When the MAC (Media Access Control) layer encryption is implemented on the physical AP, the AC sends the encrypted material to the AP as the logical AP. The AP can perform air interface encryption and decryption.

With the method of the present invention, when a mobile station switches from one physical AP to another physical AP, Since the logical AP has not changed, it is possible to continue using the previous cryptographic material on the new physical AP. That is, when the re-association is performed, the AC sends the previous encrypted material to the AP, thus realizing the sharing of the encrypted material by each physical AP under a logical AP, without re-authentication or pre-authentication, which speeds up the switching speed, thereby greatly reducing the switching speed. The time of business interruption. ,

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and variations of the inventions

Claims

Uncle request

A method for implementing fast handover of a mobile station in a wireless local area network, the wireless local area network comprising a mobile station and an access point (AP) for accessing the mobile station to the network, and each AP and its associated mobile station constitute a basic service set (BSS), the mobile station and the AP protect the air interface by using an encryption material associated with the basic service set identifier; and the feature is that a plurality of physical APs form a logical AP and share the same basic service set identifier (BBSS- ID), the mobile station directly protects the air interface using the cryptographic material associated with the basic service set identifier before the handover between the plurality of physical APs.

The method according to claim 1, wherein the access controller in the WLAN manages the mapping relationship between the logical APs and the corresponding physical APs, and requests the access controllers from the physical APs. Configure the same basic service identifier to be configured in each physical AP.

The method according to claim 2, wherein the access controller is used as an authentication point, and the physical AP only forwards the authentication message in an authentication process performed between the mobile station and the access controller.

The method according to claim 3, wherein after completing the authentication process, the access controller transmits the encrypted material associated with the basic service set identifier to the physical AP.

5. The method according to claim 4, wherein the authentication is 802.1X authentication.

A wireless local area network, comprising a mobile station, an access point (AP) that accesses the mobile station to the network; characterized in that it further comprises an access controller (AC), and the plurality of the APs share the same basic service set identifier (BBSS-ID), the access controller configures the basic service set identifier into each AP sharing the identifier.

The WLAN according to claim 6, wherein the access controller functions as an 802.1X authentication point to complete an authentication process with the mobile station.