WO2015144050A1 - 分配寻址标识的方法及接入点、站点和通信系统 - Google Patents
分配寻址标识的方法及接入点、站点和通信系统 Download PDFInfo
- Publication number
- WO2015144050A1 WO2015144050A1 PCT/CN2015/075002 CN2015075002W WO2015144050A1 WO 2015144050 A1 WO2015144050 A1 WO 2015144050A1 CN 2015075002 W CN2015075002 W CN 2015075002W WO 2015144050 A1 WO2015144050 A1 WO 2015144050A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- mac address
- site
- new
- access point
- sites
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
- H04L63/0414—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/30—Managing network names, e.g. use of aliases or nicknames
- H04L61/3015—Name registration, generation or assignment
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/50—Address allocation
- H04L61/5038—Address allocation for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
- H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W36/00—Hand-off or reselection arrangements
- H04W36/08—Reselecting an access point
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/26—Network addressing or numbering for mobility support
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2101/00—Indexing scheme associated with group H04L61/00
- H04L2101/60—Types of network addresses
- H04L2101/618—Details of network addresses
- H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/60—Context-dependent security
- H04W12/69—Identity-dependent
- H04W12/71—Hardware identity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/60—Context-dependent security
- H04W12/69—Identity-dependent
- H04W12/75—Temporary identity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W84/00—Network topologies
- H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
- H04W84/10—Small scale networks; Flat hierarchical networks
- H04W84/12—WLAN [Wireless Local Area Networks]
Definitions
- the present invention relates to the field of communications, and in particular, to a method for allocating addressing identifiers, and an access point, a station, and a communication system.
- a wireless local area network can provide wireless data transmission services for terminals therein within a limited range.
- IEEE 802.11-based WLAN also known as Wi-Fi, Wireless Fidelity, Wireless Fidelity
- devices such as gateways can also be used to connect terminal devices to the Internet.
- Wi-Fi has been widely used in various industries due to its rapid deployment, ease of use, and high transmission rate.
- the IEEE 802.11 specification specifies addressing in a WLAN based on a Media Access Control (MAC) address.
- MAC Media Access Control
- the eavesdropper can obtain the MAC address of the wireless message sender by receiving and analyzing the message message on the air interface.
- the privacy information of the terminal user can be obtained, such as the location and time that often occurs, and the privacy information of the end user's living habits, interests, and social relationships can be obtained through a large amount of data analysis.
- an access point allocates a temporary MAC address to a terminal in the basic service set it serves, and the eavesdropper obtains the MAC of all terminals under the basic service set.
- the address when it is found that one MAC address no longer appears, and another new MAC address appears, the new MAC address can be determined to be the changed MAC address of the original terminal, thereby continuing to track the terminal.
- the embodiment of the invention provides a method for assigning an address identifier, an access point and a site, so as to prevent the eavesdropper from tracking the terminal to obtain user privacy through the MAC address, thereby ensuring the privacy of the user.
- the present invention provides a method for allocating an addressing identifier, the addressing identifier comprising a medium access control MAC address, the addressing identification method comprising: at least two within a basic service set BSS to which an access point serves Sites notify each site of the corresponding encrypted new MAC address and indicate a predetermined change condition such that the at least two sites change the respective MAC address to the respective new MAC when the predetermined change condition is reached Addressing, when the predetermined change condition is reached, the access point updates the MAC address of the at least two sites to the new MAC address corresponding to the site, so that the subsequent receiving and forwarding from the site When the station sends a message, the new MAC address is used as the MAC address of the station.
- the addressing identifier further includes an association identifier AID; the access point notifies each of the at least two sites in the basic service set BSS When the site corresponds to the encrypted new MAC address, the site also notifies the encrypted new AID corresponding to the site; when the predetermined change condition is reached, the access point updates the MAC address of the at least two sites to correspond to the site The new MAC address updates the AID of the at least two sites to the new AID corresponding to the site.
- the access point notifies the at least two sites in the basic service set BSS served by the access point to the encryption corresponding to each site
- the method further includes: the access point confirming a new MAC address and a new AID corresponding to each of at least two sites in the basic service set BSS of the service, each of the sites Corresponding to different new MAC addresses and new AIDs.
- the access point confirms that each of the at least two sites in the basic service set BSS of the service corresponds to the new one
- the step of the MAC address and the new AID includes: the access point receiving a change request of the at least two sites within the BSS of the service, and the change request of each of the sites includes a new MAC requested by each of the sites An address; the access point uniquely verifies a new MAC address requested by each of the sites, and when the uniqueness verification passes, assigns a new AID to each of the sites, and each of the sites requests Said new MAC address and the assigned AID are the confirmed new MAC address and new AID of the site; the notifying the at least two sites of the encrypted new MAC address corresponding to each of the sites and
- the steps of the new AID include: the connection The ingress unicasts an acknowledgment message to each of the sites, the acknowledgment message indicating that the site is authorized to use the requested new MAC address
- the access point confirms that each of the at least two sites in the basic service set BSS of the service corresponds to the new one
- the step of the MAC address and the new AID includes: the access point assigns a new MAC address and a new AID to at least two sites in the BSS to which it serves, and the new MAC address and the new AID assigned to each of the sites are acknowledgements
- the step of notifying the at least two sites of the encrypted new MAC address and the new AID corresponding to each of the sites includes: separately performing the unicast mode
- the at least two stations send the encrypted new MAC address and new AID corresponding to the site.
- the indicating the predetermined change condition includes: the access point to When at least two sites in the basic service set BSS of the service notify the encrypted new MAC address corresponding to each site, carrying a predetermined time or a predetermined time point indicating the change; or the basic service to which the access point serves After the at least two sites in the set BSS notify the encrypted new MAC address corresponding to each site, respectively send a change indication message to the at least two sites in a unicast manner; or the access point serves the same After the at least two sites in the basic service set BSS notify the encrypted new MAC address corresponding to each site, the change indication message is sent to the at least two sites by broadcast.
- the step of sending an update indication message to the at least two site groups by means of a broadcast includes: broadcasting The beacon frame to which the indication bit is added sends an update indication message to the at least two sites, the indication bit including change indication information for indicating that the at least two sites perform the addressing identification change.
- the step that the access point notifies each site of the encrypted new MAC address to at least two sites in the basic service set BSS served by the access point The method further includes: performing encryption key negotiation between the access point and the at least two sites, where the access point acquires an encryption key used to encrypt a new MAC address of each of the sites,
- the encryption key is a symmetric encryption key or an asymmetric encryption key.
- an embodiment of the present invention provides a method for allocating an address identifier, where the address identifier includes a medium access control MAC address, and the method for assigning an address identifier includes: the website learns a basic service set BSS from which the station is located The encrypted new MAC address corresponding to the site notified by the access point, decrypting to obtain a new MAC address, and acquiring a predetermined change condition, the site changing the currently used MAC address to The new MAC address is such that when the message is received from the access point and sent to the access point, the new MAC address is used as the MAC address of the station.
- the addressing address further includes an association identifier AID
- the website acquires the encrypted new MAC address corresponding to the site, The encrypted new AID corresponding to the site; when the site satisfies the predetermined change condition, the site changes the currently used MAC address to the new MAC address, and changes the currently used AID to the new AID.
- the step of the site learning the encrypted new MAC address and the new AID corresponding to the site includes: receiving the site The access point is an encrypted new MAC address and a new AID assigned to the site.
- the step that the site learns the encrypted new MAC address and the new AID corresponding to the site includes: The access point sends a change request, the change request of the site includes a new MAC address requested by the site, and the site learns the encryption corresponding to the site from the confirmation message that the access point responds to the change request New MAC address, and further learn the encrypted new AID from the acknowledgment message that the access point responds to the change request or another message sent from the access point.
- the method before the step of the site obtaining the encrypted new MAC address corresponding to the site, the method further includes: performing, by the site, an encryption key negotiation with the access point. So that the station decrypts the new MAC address according to the negotiated encryption key type using a corresponding decryption method, and the encryption key is a symmetric encryption key or an asymmetric encryption key.
- an embodiment of the present invention provides an access point, where the access point includes a notification module and an update module, where: the notification module is used to provide a basic service set to the access point. At least two stations in the BSS notify each site of the encrypted new medium access control MAC address, and indicate a predetermined change condition, so that the at least two sites change their respective MAC addresses when the predetermined change condition is reached. The respective new MAC address; the update module is configured to update the MAC address of the at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, so as to enable subsequent When the message is received from the station and sent to the station, the new MAC address is used as the MAC address of the station.
- the notification module notifies at least two sites in the basic service set BSS served by the access point of the encrypted new MAC address corresponding to each site And notifying, to the at least two sites, the encrypted new association identifier AID corresponding to each site; the update module updating the MAC addresses of the at least two sites to the location when the predetermined change condition is reached The new MAC address corresponding to the site, and updating the AID of the at least two sites to the new AID corresponding to the site.
- the access point further includes a confirmation module, where: the confirmation module is specifically configured to confirm the connection
- the confirmation module is specifically configured to confirm the connection
- Each of the at least two sites in the basic service set BSS of the ingress service corresponds to a new MAC address and a new AID, and each site corresponds to a different new MAC address and a new AID.
- the determining module is specifically configured to receive the at least two in the BSS of the access point service a change request of the site, each of the change request of the site includes a new MAC address requested by each of the sites, and a unique verification of a new MAC address requested by each of the sites, when the uniqueness verification is passed Reassigning a new AID to each of the sites, and the new MAC and the assigned new AID requested by each of the sites are the new MAC address and the new AID of the confirmed site; the notification module Specifically, an acknowledgment message is replied to each of the sites by means of unicast, the acknowledgment message indicating that the new MAC address of the request is agreed to be used by the site, and each new site is notified of a new AID, where the new AID is located The confirmation message is carried in or sent by another message.
- the acknowledgment module is specifically configured to allocate a new MAC address to at least two sites in the BSS served by the access point.
- the address and the new AID, the new MAC address and the new AID assigned by each of the sites are the confirmed new MAC address and the new AID;
- the notification module is specifically The unicast mode separately sends the encrypted new MAC address and the new AID corresponding to the site to the at least two sites.
- the notification module specifically indicates the reservation by one of the following manners a change condition: the notification module carries a predetermined time or a predetermined time point indicating the change when notifying the encrypted new MAC address corresponding to each site to at least two sites in the basic service set BSS served by the access point; Or the notification module notifies the at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site, and separately, to the at least two sites in a unicast manner. Transmitting the change indication message; or the notification module notifying the at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site, and broadcasting to the at least Two site groups send change indication messages.
- the notification module sends the beacon frame with the indication bit to the at least two sites by broadcasting An update indication message, the indication bit including change indication information for indicating that the at least two sites perform an addressing identification change.
- the access point further includes a key acquisition module, wherein: the key acquisition module is configured to be used between the at least two sites Encryption key negotiation is performed to obtain an encryption key for encrypting a new MAC address of each site, which is a symmetric encryption key or an asymmetric encryption key.
- an embodiment of the present invention provides a site, where the site includes an obtaining module and a modifying module, where: the obtaining module is configured to learn, by the access point in the basic service set BSS where the site is located, The encrypted new media access control MAC address corresponding to the site, decrypting to obtain a new MAC address, and acquiring a predetermined change condition, each of the sites corresponding to a different new MAC address; the change module is configured to meet the predetermined change When the condition is changed, the MAC address currently used by the site is changed to the new MAC address corresponding to the site, so that when the subsequent access point receives and sends a message to the access point, the new The MAC address is used as the MAC address of the site.
- the obtaining module when learning the encrypted new MAC address corresponding to the site, further knows that the site corresponds to the adding
- the new association identifier AID decrypts the new MAC address and the new AID; the change module changes the MAC address and AID currently used by the site to the new MAC address and the new corresponding to the site when the predetermined change condition is met. AID.
- the obtaining module is configured to receive, by using an access point, an encrypted new MAC address that is corresponding to the site The new AID decrypts the new MAC address and the new AID.
- the obtaining module is configured to send a change request to the access point, where the change request of the site includes Determining, by the access point, the new MAC address requested by the site, from the confirmation message of the access point responding to the change request, the encrypted new MAC address corresponding to the site, and further responding to the change request from the access point
- the encrypted new AID is known in the acknowledgement message or in another message sent from the access point.
- the site further includes a key negotiation module, where: the key negotiation module is configured to perform encryption key negotiation with the access point; The obtaining module decrypts and obtains the new MAC address according to the encryption key type negotiated by the key negotiation module, and uses the corresponding decryption method to obtain the new MAC address, where the encryption key is a symmetric encryption key or an asymmetric encryption key.
- the embodiment of the present invention provides a communication system, where the communication system includes the access point in any one of the possible implementations of the third aspect or the third aspect, and any one of the fourth aspect or the fourth aspect. Sites in possible implementations.
- the invention has the beneficial effects that, different from the prior art, the present invention adjusts the MAC address transformation of multiple sites in the entire basic service set through the access point, and notifies the multiple sites of the encrypted new MAC address corresponding to each site. So that each site changes its respective MAC address to its corresponding new MAC address when the predetermined change condition is reached. When the predetermined change condition is reached, the access point also updates the MAC address of multiple sites to the site corresponding. New MAC address. In this way, the new MAC address sent by the access point to the site is encrypted, and the eavesdropper cannot steal the new MAC address. By controlling multiple sites to change the MAC address, after changing the MAC address, the eavesdropper cannot continue to track the terminal MAC address to obtain user privacy, thus ensuring the privacy of the user.
- FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present invention.
- FIG. 2 is a flowchart of a first method for allocating an addressing identifier according to an embodiment of the present invention
- FIG. 3 is a flowchart of a second method for allocating an addressing identifier according to an embodiment of the present invention
- FIG. 4 is a schematic diagram of an operation frame according to an embodiment of the present invention.
- FIG. 5 is a schematic diagram of an operation frame for allocating a new MAC address and a new AID sent by a first access point to a station according to an embodiment of the present invention
- FIG. 6 is a schematic diagram of an operation frame of a site replying access point confirmation message according to an embodiment of the present invention.
- FIG. 7 is an operation frame for allocating a new MAC address and a new AID sent by a second access point to a station according to an embodiment of the present invention
- FIG. 8 is a schematic diagram of an operation frame of an identity change message sent by an access point to each station in a broadcast manner according to an embodiment of the present invention
- FIG. 9 is a flowchart of a third method for allocating an address identifier according to an embodiment of the present invention.
- FIG. 10 is a schematic diagram of an IE format in which a station sends a change request to an access point according to an embodiment of the present invention
- FIG. 11 is a schematic diagram of a frame format in which a station 1 sends a re-association request to an access point according to an embodiment of the present invention
- FIG. 12 is a schematic diagram of a frame format in which an access point sends a re-association response to a station 1 according to an embodiment of the present invention
- FIG. 13 is a schematic diagram of a beacon frame in which an access point sends change indication information to a station according to an embodiment of the present invention
- FIG. 14 is a flowchart of a fourth method for allocating an addressing identifier according to an embodiment of the present invention.
- 15 is a flowchart of a fifth method for allocating an addressing identifier according to an embodiment of the present invention.
- 16 is a flowchart of a sixth method for allocating an addressing identifier according to an embodiment of the present invention.
- 17 is a flowchart of a seventh method for allocating an addressing identifier according to an embodiment of the present invention.
- FIG. 18 is a schematic structural diagram of a first access point according to an embodiment of the present invention.
- FIG. 19 is a schematic structural diagram of a second access point according to an embodiment of the present disclosure.
- FIG. 20 is a schematic structural diagram of a first station according to an embodiment of the present invention.
- FIG. 21 is a schematic structural diagram of a third access point according to an embodiment of the present invention.
- FIG. 22 is a schematic structural diagram of a second station according to an embodiment of the present invention.
- FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present invention.
- the communication system includes an access point AP and a site in a basic service set (BSS) of the AP service range.
- BSS basic service set
- the IEEE 802.11 specification specifies the physical layer and MAC layer protocols for wireless transmission over the 2.4 GHz, 5 GHz, and even 60 GHz spectrum.
- an AP is a site in a BSS that assumes the function of a controlling entity, and provides access to a distribution system (DS) to other sites associated with it.
- the AP can also use the Point Control Function (PCF) to coordinate data transmission at each site.
- the AP in the communication system in this embodiment associates five sites at sites 1 to 5.
- the following refers to the site mentioned in the embodiment of the present invention, which refers to a user site or a user terminal.
- FIG. 2 is a flowchart of a first method for allocating an address identifier according to an embodiment of the present invention. This embodiment is described by using an access point, and the method for allocating an address identifier in this embodiment. include:
- the access point notifies at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site, and indicates a predetermined change condition;
- the addressing identifier includes a MAC address.
- the access point notifies each of the sites of the encrypted new MAC address to at least two sites, respectively, and indicates a predetermined change condition. So that at least two sites change their respective MAC addresses to their respective new MAC addresses when the predetermined change conditions are reached.
- the change indication message is sent to the at least two sites by using a unicast manner
- the change indication message is sent to the at least two sites by broadcast.
- the predetermined change condition is indicated to be unicast or broadcast, wherein it is preferably transmitted by broadcast.
- the same notification can be made Time to send and carry the time information for the change.
- the access point may broadcast a change indication message on the working channel instructing the station to make a change in the MAC address.
- Each station configures a new MAC address to the MAC layer when it obtains its corresponding new MAC address and reaches the predetermined change condition.
- the new MAC address of the site is used as the addressing identifier.
- the access point updates the MAC address of the at least two sites to the new MAC address corresponding to the site, so that when the subsequent site receives and sends a message to the site, the new MAC address is used as the MAC address of the site. address;
- the access point Upon reaching the predetermined change condition, the access point updates the MAC address of at least two of its internal stations to the new MAC address corresponding to the station. Thus, in the next message received from the site and the message sent to the site, the new MAC address of the site is used as the MAC address of the site.
- the present invention adjusts the MAC address translation of multiple sites in the entire basic service set through the access point, and notifies the multiple sites of the encrypted new MAC address corresponding to each site.
- Each station is changed to its corresponding new MAC address when the predetermined change condition is reached.
- the access point also updates the MAC address of the multiple sites to the new corresponding to the site. MAC address.
- the new MAC address sent by the access point to the site is encrypted, and the eavesdropper cannot steal the new MAC address.
- the eavesdropper cannot continue to track the terminal MAC address to obtain user privacy, thus ensuring the privacy of the user.
- FIG. 3 is a flowchart of a method for allocating an address identifier according to an embodiment of the present invention. This embodiment is described by using an access point, and the method for allocating an address identifier in this embodiment. include:
- S201 Perform an encryption key negotiation between the access point and at least two sites, where the access point acquires an encryption key used to encrypt a new MAC address of each site.
- the access point negotiates with each of the at least two sites for shared encryption key, and the access point obtains an encryption key Ekey for encrypting the new MAC address of the site.
- the encryption key in the embodiment of the present invention may be a symmetric encryption key or an asymmetric encryption key.
- the access point and the site 1 perform encryption key negotiation as an example.
- the access point performs the shared encryption key negotiation with the site 1, and the access point obtains the Ekey1, the access point.
- the new MAC address of Site 1 is encrypted by using Ekey1 as the encryption key of the symmetric encryption algorithm.
- the association ID (AID) of the site needs to be updated at the same time, the new AID is also encrypted with the encryption key.
- Site 1 decrypts with Ekey1 to get the new MAC address and the new AID.
- the access point and the station 1 generate a Pairwise Transient Key (PTK) by a Pairwise Master Key (PMK) in the four-step handshake phase of the authentication phase, and then generate a temporary key by the PTK. (Temporal Key, TK).
- PTK Pairwise Transient Key
- PMK Pairwise Master Key
- the TK obtained by 128 bits can be directly intercepted by the PTK as Ekey1; or the KCK (Key Confirmation Key) and the KEK (Key Encryption Key) can be intercepted by the PTK.
- the 128-bit key is used as the Ekey1 in the remaining bits after the TK; or the access point and the site 1 perform the random number (Nonce) exchange, and the Ekey1 is derived by the random number and the TK of both parties; more, After the entry point and site 1 perform the random number (Nonce) exchange, Ekey1 is derived by the random number, timestamp and TK of both parties.
- the key negotiation process is a four-step handshake and a random number exchange process.
- the encryption key is an asymmetric encryption key, it is usually a public key.
- the encryption key negotiation between the access point and the site 1 is taken as an example.
- Ekey1 is an RSA public key that Site 1 sends to the access point.
- the access point encrypts the new MAC address and the new AID of the site 1 by Ekey1, and the site 1 receives the corresponding RSA private key for decryption.
- the corresponding key negotiation process is mainly for the public key transmission and reception process.
- the access point encrypts the new MAC address and the new AID of the site with an encryption key negotiated with the site.
- the encryption of the new MAC address and the new AID can be encrypted together, or separately.
- Ekey1 encrypts the new MAC address (MAC1-1) and the new AID (AID1-1) of Site 1.
- Ekey1 may be a symmetric encryption key or an asymmetric encryption key. In the embodiment of the present invention, a symmetric encryption key is preferred.
- Ekey1 is a symmetric encryption key
- the encryption mode of encrypting MAC1-1 and AID1-1 can be AES-CCM mode
- Ekey1 is a 128-bit key.
- the encryption type can be expressed as:
- Encrypted MAC1-1 and AID1-1 AES-CCM-128 Ekey1 (MAC1-1 and AID1-1)
- MAC1-1 and AID1-1 can be separately encrypted, such as
- Encrypted MAC1-1 AES-CCM-128 Ekey1 (MAC1-1)
- the above is only an example of the encryption key negotiation between the access point and the site 1.
- the process of negotiating the encryption key of the access point with other sites and encrypting the new MAC address and the new AID are basically the same as above. This is not repeated.
- the access point confirms a new MAC address corresponding to each of at least two sites in the basic service set BSS of the service;
- the site's AID can be updated simultaneously.
- the access point confirms the new MAC address of each of the at least two sites in the basic service set BSS of the service, the new AID corresponding to each site is also confirmed.
- Each site corresponds to a different new MAC address and a new AID.
- the first way the access point receives the change request of at least two sites in the BSS of its service, and the change request of each site includes the new MAC address requested by each site.
- the site will carry the new MAC address that it prefers to use in the request.
- the new MAC address requested by each site is uniquely verified, and each site is assigned a new AID when the uniqueness verification is passed.
- the new MAC address and the assigned new AID requested by each site are used as the new MAC address and the new AID corresponding to the determined site.
- a possible implementation manner for uniquely verifying a new MAC address requested by a site may be: a new MAC address requested by the site and all sites in the basic service set BSS of the access point service. The MAC address is compared. If the new MAC address requested by the site is not currently used by any site in the BSS of the access point service, the unique MAC address uniqueness requested by the site is verified.
- the second mode the access point allocates a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site are the new MAC address and the new AID corresponding to the confirmed site. .
- S203 The access point notifies at least two sites to the encrypted new MAC address corresponding to each site, and indicates a predetermined change condition.
- the access point notifies each of the sites of the encrypted new MAC address to at least two sites, respectively, and indicates a predetermined change condition. So that at least two sites change their respective MAC addresses to their respective new MAC addresses when the predetermined change conditions are reached.
- the AID of the site is also changed together while updating the MAC address of the site. Therefore, in a preferred embodiment, when the access point notifies at least two sites of the encrypted new MAC address corresponding to each site, the encrypted new AID corresponding to each site may also be notified. So that at least two sites change their respective MAC address and new AID to their respective new MAC address and new AID when the predetermined change condition is reached.
- the access point When the access point confirms that the new MAC address and the new AID corresponding to at least two sites in the BSS of the service are implemented by the foregoing first manner, the access point replies to the acknowledgment message to each site in a unicast manner, and confirms The message indicates that the site agrees to use the new MAC address it requested and notifies each site of the new AID.
- the acknowledgment message of the reply carries a new MAC address that is unique.
- the new AID may be carried in the acknowledgement message or sent through another message.
- the access point may separately send the site to the at least two sites by using the unicast mode. Corresponding encrypted new MAC address and new AID.
- an information element or a new management frame (Management Frame) can be defined to complete the related message interaction of the MAC address and the AID change; in addition, a definition is also defined in IEEE802.11.
- a management frame called an Action Frame defines the management frame required for a single business activity by defining a new Action Category. This embodiment is described by taking an operation frame as an example, but is not limited thereto.
- FIG. 4 is a schematic diagram of an operation frame according to the embodiment.
- RA is the Receiver Address, which is the receiving address of the message
- TA is the Transmitter Address, which is the sending address of the message
- a new operation category identifier is defined in the frame body of the operation frame, indicating that the ID (Identity) is changing the service.
- the operation is represented by Change ID, which is simplified as CID and has a length of 1 byte.
- the CID message mode bit indicates whether the operation frame is used to identify a change schedule indication or to identify a change confirmation.
- the identifier change schedule indication is used to indicate that the frame is sent by the access point to the station, and is used to indicate that the address identifier is changed, and the identifier change confirmation indicates that the frame is sent by the station to the access point, and the access point is sent to the access point. Change the confirmation of the addressing ID indication.
- the access point when the access point sends information such as a new MAC address and AID to the site 1, the CID message mode ID is set to 1, and the encrypted MAC and AID are carried in the content of the subsequent CID element and Identify change time information.
- RA is the current address of station 1 MAC1-0, that is, the MAC address before the change.
- the station 1 After receiving the message sent by the access point, the station 1 decrypts the MAC1-1 and the AID1-1, and replies to the AP with an acknowledgement message indicating that the MAC1-1 and the AID1-1 are accepted. As shown in Figure 6.
- the access point when the access point sends the MAC address and the AID to the station, the access point may send the MAC1-1 and the AID1-1 to the station 1 as an example, and the operation frame of the access point is as shown in FIG. 7.
- the access point can broadcast a change indication message to each station to make changes to each station.
- the broadcast message can also be implemented by an operation frame. As shown in Figure 8.
- the change indication message may also be indicated to each station by adding an indication bit (such as Indication shown in FIG. 8) to a broadcast message such as a beacon frame, for example, when the indication bit is set, the station receives the beacon.
- MAC address and AID update after frame, when the indicator bit is set to 0 When the station receives the beacon frame, it does not update the MAC address and AID.
- the above is an example of the interaction between the access point and the site 1.
- the interaction process between the access point and other sites is basically the same, and will not be repeated.
- the access point updates the MAC address of the at least two sites to the new MAC address corresponding to the site, so that when the subsequent site receives and sends a message to the site, the new MAC address is used as the MAC of the site. address.
- the access point updates the MAC address and AID of at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached.
- the time information received by each station can ensure that each station and the access point change after the same time, such as
- the time information is a timing
- the time of the TSF (Timing Synchronization Function) of each station is synchronized with the access point.
- each station The new MAC and the new AID assigned by the access point are configured to the MAC layer, and the access point also updates the MAC address and the AID of each site, so that when the site message of the new MAC address is received, the access is received.
- the point can determine the information of the site and the shared information of the site, such as a shared data encryption key.
- at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
- the AP assigns a 16-bit AID to the site during the association phase.
- the PS-Poll (Power Saving Poll) message sent by the terminal will carry the AID in plain text. Therefore, if the terminal only changes the MAC address, the eavesdropper can also find the new and old MAC of the terminal by analyzing the AID. The correspondence of the addresses, thereby relocking the terminal. Therefore, in the method for allocating the addressing identifier provided in this embodiment, the MAC address of each station is updated, and the AID is also changed at the same time. On the one hand, the new MAC address and the new AID sent by the access point to the site are encrypted, and the eavesdropper cannot steal the new MAC address and the new AID. On the other hand, by controlling multiple sites to change the MAC address and AID, after the change, the eavesdropper cannot continue to track the terminal MAC address and AID to obtain user privacy, thereby ensuring the privacy of the user.
- the PS-Poll Power Saving Poll
- FIG. 9 is a flowchart of a method for allocating an address identifier according to an embodiment of the present invention.
- the method for assigning an address identifier in this embodiment includes the following steps. :
- S301 The station learns the encrypted new MAC address corresponding to the site notified by the access point in the basic service set BSS, decrypts the new MAC address, and obtains a predetermined change condition, and each site corresponds to a different new MAC address. ;
- the AP assigns a 16-bit AID to the site during the association phase.
- the PS-Poll (Power Saving Poll) message sent by the terminal will carry the AID in plain text. Therefore, if the terminal only changes the MAC address, the eavesdropper can also find the new and old MAC of the terminal by analyzing the AID. The correspondence of the addresses, thereby relocking the terminal.
- the site's MAC address and AID can be changed at the same time to prevent the eavesdropper from tracking the user's private information by tracking the site's AID.
- the access point notifies the site of the new MAC address, it also notifies the site of the new AID corresponding to the site. Therefore, in the preferred embodiment of the present invention, when the site learns the encrypted new MAC address corresponding to the site, it also knows the encrypted new AID corresponding to the site, decrypts and obtains the new MAC address and the new AID, and each site corresponds to a different new MAC. Address and new AID.
- the site further includes: performing encryption key negotiation between the site and the access point, so that the site uses the corresponding decryption method according to the negotiated encryption key type. Decrypt to get the new MAC address and the new AID.
- the encryption key can be a symmetric encryption key or an asymmetric encryption key.
- the site decrypts with the corresponding key
- the encryption key is an asymmetric encryption key
- the site decrypts with the private key corresponding to the key.
- An implementation manner in which the site learns the encrypted new MAC address and the new AID corresponding to the site is that the site receives the encrypted new MAC address and the new AID allocated by the access point, so as to know the corresponding encrypted new MAC address and the new one. AID.
- the station requests a MAC address change from the access point, that is, sends a change request to the access point, and the change request of the site may include a new MAC address requested by the site, where it needs to be stated that the request carries
- the new MAC address is also encrypted.
- the access point receives the change of the site, please Find and decrypt the requested new MAC address, perform a uniqueness check, and then give a confirmation message as a response to the change request.
- the station learns the encrypted new MAC address corresponding to the site from the confirmation message of the access point responding to the change request, and can further learn the new AID.
- the new MAC address corresponding to the site is the new MAC address requested by the site, and when the new MAC address requested by the site does not pass the uniqueness verification, the new MAC address corresponding to the site is The access point assigns a unique new MAC address to the site, and the new AID corresponding to the site is allocated by the access point for the site.
- the new AID can be carried in the acknowledgment message or can be sent separately through another message.
- the site sends a change request to the access point.
- the site may also be implemented by defining an operation frame or a new management frame or a new information element (IE).
- the method for defining the operation frame is in the second embodiment and the embodiment. The third has been explained.
- a new IE is defined as an example, but is not limited thereto.
- the newly defined information elements can be carried in various management frames, such as Probe Request/Response, Reassociation Request/Response, and Beacon frames.
- FIG. 10 is a schematic diagram of an IE format in which a station sends a change request to an access point according to an embodiment of the present invention.
- RA is the receiving address and TA is the sending address.
- the CID information elements mainly include:
- Information element ID 1 byte, when redefining a new information element for a certain service, a new information element ID needs to be registered, and when the receiving party receives the message, the service type is identified according to the information element ID;
- Information element length defines the length of the information element
- CID message mode and CID element content carry different content according to different message modes, such as requesting the request mode (1 in the corresponding table) carrying the priority MAC address, and responding to the response mode (2 in the corresponding table) carrying the confirmation indication and
- the AID indicates that the bit Indication mode (4 in the corresponding table) carries empty content, as shown in Table 2.
- Site 1 determines a priority MAC address MAC1-1 and encrypts it, as described above.
- Site 1 sends a re-association request to the access point, carrying the CID IE, and its frame format is as shown in FIG.
- the access point obtains the CID IE therein after receiving the reassociation request, and then decrypts the encrypted MAC1-1 therein to obtain MAC1-1.
- the access point then performs MAC 1-1 uniqueness verification in the BSS.
- the verification method may be to compare the MAC 1-1 with the MAC address of all stations in the BSS. When the MAC 1-1 is not currently used by any STA, the MAC 1- 1 is unique within the BSS.
- the access point encrypts the newly assigned AID 1-1 for Site 1.
- the access point sends a re-association response to the station 1, carrying the CID IE, and its frame format is as shown in FIG.
- the access point may broadcast a message carrying the indication information.
- an access point can broadcast a beacon frame.
- the location identifier in this embodiment, the MAC address, or the MAC address and the AID
- the CID IE is carried in the Beacon frame, and the message format is as shown in FIG. Show.
- the access point also carries the change time T in the confirmation message to the station.
- At least two stations in the BSS where the access point is located can support the change of the addressing identifier (in this embodiment, the MAC address, or the MAC address and the AID).
- the identification change trigger condition is met, at least two sites will send a MAC address change request to the access point within a certain time period t after the identification change trigger condition is met. Therefore, when the access point receives the change request of the first station, if the time is T0, the time T specified by the access point meets the following conditions, and it can be guaranteed that at least two sites will be changed before the T time arrives.
- Request ie T>T0+t.
- the site When the site meets the predetermined change condition, the site changes the currently used MAC address to a new MAC address corresponding to the site, so that when the subsequent access point receives and sends a message to the access point, Use the new MAC address as the MAC address of the site;
- the site updates the currently used MAC address and AID to its corresponding new MAC address when the predetermined change condition is met. New AID.
- the site i represents any site other than the site 1.
- MAC1-1 and AID1-1 are the new MAC address and new AID of Site 1, respectively, and MAC1-0 is the MAC address before Site 1 is changed.
- MACi-1 and AIDi-1 are the new MAC address and new AID of site i, respectively, and MACi-0 is the MAC address before site i is changed.
- FIG. 14 is a flowchart of a fourth method for allocating an address identifier according to an embodiment of the present invention.
- the embodiment is applicable to the access point mentioned above to actively allocate a new MAC address and a new AID to a station.
- the method of this embodiment includes the following steps:
- the access point performs shared encryption key negotiation with site 1 (Ekey1);
- the access point and the site 1 perform a shared encryption key negotiation to determine a key Ekey1 for encrypting the new MAC and the new AID of the site 1.
- the access point performs shared encryption key negotiation with the site i (Ekeyi);
- a shared encryption key negotiation is performed between the access point and the site i to determine a key Ekeyi for encrypting the new MAC and the new AID of the site i.
- the access point encrypts MAC1-1 and AID1-1;
- the access point sends an operation frame (MAC1-1, AID1-1, T) to the station 1.
- the access point sends an operation frame to the station 1, the operation frame carries the encrypted MAC1-1 and AID1-1, and the identification change time T, and the corresponding reception address is MAC1-0.
- Site 1 decrypts to obtain MAC1-1 and AID1-1;
- Site 1 sends an operation frame (confirm) to the access point;
- Site 1 sends an operation frame to the access point to confirm that MAC1-1 and AID1-1 have been received, and the corresponding sending address is MAC1-0.
- the access point sends an operation frame (MACi-1, AIDi-1, T) to the station i.
- the access point sends an operation frame to the station i, the operation frame carries the encrypted MACi-1 and AIDi-1, and the identification change time T, and the corresponding reception address is MACi-0.
- Site i decrypts to obtain MACi-1 and AIDi-1;
- Site i sends an operation frame (confirm) to the access point
- Site i sends an operation frame to the access point to confirm that MACi-1 and AIDi-1 have been received, and the corresponding transmission address is MACi-0.
- the access point updates the MAC address and the AID of each site.
- Site 1 is updated to MAC1-1 and AID1-1;
- Site i is updated to MACi-1 and AIDi-1;
- both the access point and the station's timer After both the access point and the station's timer are clocked to T, both the access point and the site update the MAC address and AID.
- FIG. 15 is a fifth type of address addressing address provided by the embodiment of the present invention.
- the flow chart of the method, the difference between the embodiment shown in FIG. 15 and the embodiment shown in FIG. 14 is:
- step 404 and step 407 the operation frame sent by the access point to the station does not carry the indication change time T, and the step 410 becomes: the access point sends an operation frame (identification change indication) to the station, and the corresponding receiving address is Broadcast address.
- the specific implementation of the remaining steps is consistent with the embodiment shown in Figure 14, please refer to the previous detailed description.
- the access point when the access point notifies the new MAC address and the new AID of the station, it does not indicate the change time, but after transmitting the new MAC and the new AID, by broadcasting an operation frame for indicating the change, the site After receiving the indication, the MAC and AID are updated, and the access point also updates the MAC and AID of each station after issuing an instruction.
- FIG. 16 is a flowchart of a sixth method for allocating an address identifier according to an embodiment of the present invention.
- the embodiment is applicable to the above mentioned site by requesting an access point to obtain a new MAC address and a new one.
- the method of this embodiment includes the following steps:
- the access point performs shared encryption key negotiation with site 1 (Ekey1);
- the access point and the site 1 perform a shared encryption key negotiation to determine a key Ekey1 for encrypting the new MAC and the new AID of the site 1.
- the access point performs shared encryption key negotiation with the site i (Ekeyi);
- a shared encryption key negotiation is performed between the access point and the site i to determine a key Ekey1 for encrypting the new MAC and the new AID of the site i.
- Site 1 encrypts the new MAC address MAC1-1 that it prefers to use.
- Site 1 sends a re-association request (MAC1-1) to the access point;
- the station 1 sends a re-association request to the access point, where the request includes the encrypted MAC1-1 that the station 1 preferentially uses, and the corresponding sending address is MAC1-0.
- the access point decrypts MAC1-1 to verify uniqueness
- the access point decrypts to obtain MAC1-1, and uniquely verifies the MAC1-1.
- a possible implementation manner for the access point to perform unique authentication on the MAC 1-1 may be: comparing the MAC 1-1 with the MAC addresses of all sites in the basic service set BSS of the access point service, if MAC1 If the -1 address is not currently used by any site in the BSS served by the access point, the MAC1-1 unique check is considered to pass.
- the access point encrypts AID1-1;
- the access point When MAC1-1 passes the uniqueness verification, the access point assigns the new association identifier AID1-1 to the site 1, and encrypts the AID1-1.
- the access point sends a re-association response (AID1-1) to the station 1;
- the access point sends a re-association response to the station 1, instructing it to use the MAC1-1, and carrying the AID1-1 in the response, and the corresponding receiving address is MAC1-0.
- Site 1 decrypts AID1-1
- Site 1 decrypts to obtain AID1-1.
- Site i encrypts the new MAC address MACi-1 that it prefers to use.
- Site i sends a re-association request (MACi-1) to the access point.
- the station i sends a re-association request to the access point, where the request includes the encrypted MACi-1 that the station i preferentially uses, and the corresponding sending address is MACi-0.
- the access point sends a re-association response (AIDi-0) to the station i.
- the access point decrypts the MACi-1 and performs uniqueness verification.
- the site i is assigned a new association identifier AIDi-1.
- the access point sends a reassociation response to the station i, instructing it to use the MACi-1, and carrying the AIDi-1 in the response, the receiving address being MAC1-0.
- Site i obtains AIDi-1 by decryption.
- the access point broadcasts a beacon frame (identification change indication);
- the access point broadcasts a beacon frame to each station, instructing each station to make changes to the MAC address and AID.
- the access point updates the MAC address and the AID of each site.
- Site 1 is updated to MAC1-1 and AID1-1;
- Site i is updated to MACi-1 and AIDi-1;
- the station When the station receives the beacon frame, it updates the respective MAC address and AID. After the broadcast beacon frame is broadcast, the access point also updates the MAC address and AID of each station.
- FIG. 17 is a seventh type of addressing addressing identifier provided by the embodiment of the present invention.
- the flow chart of the method, the difference between the embodiment shown in FIG. 17 and the embodiment shown in FIG. 16 is:
- step 507 and 511 the re-association response sent by the access point to the station carries the indication change time T;
- step 513 becomes:
- the access point when the access point makes a re-association response to the station, the access point indicates the time T of the change, and the access point and the station both update the MAC address and the AID after timing to T.
- the access point and the site 1 perform a shared key negotiation, or the site 1 sends a re-association request to the access point, the site i to the access point, etc., which may be in actual operation. It is not strictly different, and it is even possible to execute simultaneously. Therefore, those skilled in the art should understand that the numbers of the above steps are not the order of execution in the actual sense.
- FIG. 18 is a schematic structural diagram of a first access point according to an embodiment of the present invention.
- the access point 100 of this embodiment includes a notification module 11 and an update module 12, where:
- the notification module 11 is configured to notify at least two sites in the basic service set BSS served by the access point of the encrypted new MAC address corresponding to each site, and indicate a predetermined change condition, so that at least two sites reach the predetermined change condition. , changing their respective MAC addresses to their respective new MAC addresses;
- the notification module 11 notifies each of the sites of the encrypted new MAC address to at least two sites, respectively, and indicates a predetermined change condition. So that at least two sites change their respective MAC addresses to their respective new MAC addresses when the predetermined change conditions are reached.
- the notification module 11 indicates that the predetermined change condition may have the following possible implementation manners:
- the change indication message is sent to at least two sites by broadcast.
- the notification module 11 indicates that the predetermined change condition can be transmitted in a unicast or broadcast manner, wherein it is preferably transmitted by broadcast.
- the notification module 11 can transmit and carry the time information for making the change at the same time when the notification is made.
- the notification module 11 can broadcast a change indication message on the working channel instructing the station to make a change in the MAC address.
- Each station configures a new MAC address to the MAC layer when it obtains its corresponding new MAC address and reaches the predetermined change condition.
- the new MAC address of the site is used as the addressing identifier.
- the update module 12 is configured to update the MAC address of the at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, so that the new MAC address is used as the MAC address of the site when the subsequent site receives and sends a message to the site. address.
- the update module 12 updates the MAC address of at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, and addresses the new MAC address of the site in the next message sent to the site and the message received from the site. logo.
- the present invention adjusts the MAC address translation of multiple sites in the entire basic service set through the access point, and notifies the multiple sites of the encrypted corresponding to each site.
- the new MAC address so that each site changes its respective MAC address to its corresponding new MAC address when the predetermined change condition is reached.
- the access point also updates the MAC address of multiple sites.
- the new MAC address corresponding to the site In this way, the new MAC address sent by the access point to the site is encrypted, and the eavesdropper cannot steal the new MAC address.
- the eavesdropper cannot continue to track the MAC address to obtain the privacy of the end user, thus ensuring the privacy of the user.
- FIG. 19 is a schematic structural diagram of a second access point according to an embodiment of the present invention.
- the access point 200 of this embodiment includes a notification module 21, an update module 22, a confirmation module 23, and a key acquisition module. 24, where:
- the notification module 21 is configured to notify at least two sites of the encrypted new MAC address corresponding to each site, and indicate a predetermined change condition, so that at least two sites change their respective MAC addresses to their respective ones when the predetermined change condition is reached. New MAC address.
- the site's AID can be updated simultaneously to prevent the eavesdropper from tracking user privacy by tracking the AID.
- the notification module 21 notifies the at least two sites of the encrypted new MAC address corresponding to each site, and also notifies the at least two sites of the encrypted new AID corresponding to each site.
- the update module 22 is configured to update the MAC address of the at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, so that the new MAC address is used as the MAC address of the site when receiving and sending the message from the site. address.
- the update module 22 updates the MAC address and the AID of at least two sites to the station when the predetermined change condition is reached. Point the new MAC address and the new AID.
- the subsequent reception from the site and the sending of the message to the site at least one of the new MAC address of the site and the new AID is used as the addressing address.
- the confirmation module 23 is configured to confirm a new MAC address and a new AID corresponding to each of at least two sites in the basic service set BSS of the access point service, and each site corresponds to a different new MAC address and a new AID.
- the confirmation module 23 is configured to receive a change request of at least two sites in the BSS of the access point service, where the change request of each site includes a new MAC address requested by each site, and the new MAC address requested by each site is unique. Sexual verification, when the unique verification is passed, each station is assigned a new AID, and the new MAC and the assigned new AID requested by each site are the new MAC address and the new AID of the confirmed site.
- the notification module 21 replies to each site with a confirmation message in a unicast manner, the confirmation message instructs the site to use the requested new MAC address, and notifies each site of the new AID.
- the new AID is carried in the acknowledgement message or sent through another message.
- the confirmation module 23 is configured to allocate a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site are the new MAC address and the new AID corresponding to the confirmed site.
- the notification module 21 sends the encrypted new MAC address and the new AID corresponding to the site to the at least two sites by unicast.
- Each site corresponds to a different new MAC address and a new AID.
- the confirmation module 23 is provided to confirm two possible implementation manners of the new MAC address and the new AID corresponding to at least two sites in the BSS of the access point service, and of course, the object of the present invention can be achieved. On the basis of it, it can also be implemented in other possible ways.
- the first way the access point receives the change request of at least two sites in the BSS of its service, and the change request of each site includes the new MAC address requested by each site.
- the site will carry the new MAC address that it prefers to use in the request.
- the new MAC address requested by each site is uniquely verified, and each site is assigned a new AID when the uniqueness verification is passed.
- the new MAC address and the assigned new AID requested by each site are used as the new MAC address and the new AID corresponding to the determined site.
- the second mode the access point allocates a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site correspond to the confirmed site. New MAC address and new AID.
- the notification module 21 replies with a confirmation message to each site in a unicast manner, and confirms The message indicates that the site agrees to use the new MAC address it requested and notifies each site of the new AID.
- the acknowledgment message of the reply carries a new MAC address that is unique.
- the new AID may be carried in the acknowledgement message or sent through another message.
- the notification module 21 separately sends the site correspondence to the at least two sites by using the unicast mode. Encrypted new MAC address and new AID.
- an information element or a new management frame (Management Frame) can be defined to complete the related message interaction of the MAC address and the AID change; in addition, a definition is also defined in IEEE802.11.
- a management frame called an Action Frame defines the management frame required for a single business activity by defining a new Action Category. This embodiment is described by taking an operation frame as an example, but is not limited thereto.
- the key obtaining module 24 is configured to perform encryption key negotiation with at least two sites to obtain an encryption key for encrypting a new MAC address of each site, and the encryption key is a symmetric encryption key or asymmetric encryption. Key.
- the access point performs shared encryption key negotiation with each of the at least two sites through the key obtaining module 24 to obtain an encryption key Ekey for encrypting the new MAC address of the site.
- the encryption key in the embodiment of the present invention may be a symmetric encryption key or an asymmetric encryption key.
- the access point negotiates with the site 1 for the encryption key.
- the access point negotiates with the site 1 for the shared encryption key.
- the access point obtains Ekey1 and the access point uses Ekey1.
- the new MAC address of Site 1 is encrypted for the encryption key of the symmetric encryption algorithm.
- the AID of the site needs to be updated simultaneously, the new AID is also encrypted with the encryption key.
- Site 1 decrypts with Ekey1 to get the new MAC address and the new AID.
- the access point and the station 1 generate a Pairwise Transient Key (PTK) by a Pairwise Master Key (PMK) in the four-step handshake phase of the authentication phase, and then generate a temporary key by the PTK. (Temporal Key, TK).
- PTK Pairwise Transient Key
- PMK Pairwise Master Key
- the TK of 128 bits can be directly intercepted by the PTK as Ekey1; or the key of 128 bits is taken as the Ekey1 by the PTK in the remaining bits after intercepting KCK, KEK, and TK; or, the access point and After the site 1 performs the random number (Nonce) exchange, the Ekey1 is derived by the random number and the TK of the two parties; moreover, the access point and the station 1 perform the random number (Nonce) exchange, and the two parties have a random number and a time stamp ( Timestamp) and TK to derive Ekey1.
- the key negotiation process is a four-step handshake and a random number exchange process.
- the encryption key is an asymmetric encryption key, it is usually a public key.
- the encryption key negotiation between the access point and the site 1 is taken as an example.
- Ekey1 is an RSA public key that Site 1 sends to the access point.
- the access point encrypts the new MAC address and the new AID of the site 1 by Ekey1, and the site 1 receives the corresponding RSA private key for decryption.
- the corresponding key negotiation process is mainly for the public key transmission and reception process.
- the access point encrypts the new MAC address and the new AID of the site with an encryption key negotiated with the site.
- the encryption of the new MAC address and the new AID can be encrypted together, or separately.
- Ekey1 encrypts the new MAC address (MAC1-1) of Site 1 and the new association identifier (AID1-1).
- Ekey1 may be a symmetric encryption key or an asymmetric encryption key. In the embodiment of the present invention, a symmetric encryption key is preferred.
- Ekey1 is a symmetric encryption key
- the encryption mode of encrypting MAC1-1 and AID1-1 can be AES-CCM mode
- Ekey1 is a 128-bit key.
- the encryption type can be expressed as:
- Encrypted MAC1-1 and AID1-1 AES-CCM-128 Ekey1 (MAC1-1 and AID1-1)
- MAC1-1 and AID1-1 can be separately encrypted, such as
- Encrypted MAC1-1 AES-CCM-128 Ekey1 (MAC1-1)
- the key acquisition module 24 notifies the confirmation module 23 of the acquired encryption key, and the confirmation module 23 encrypts the new MAC address and the new AID of the site with the encryption key, and then notifies the site through the notification module 21.
- the update module 22 Upon reaching the predetermined change condition notified by the notification module 21, the update module 22 will internalize it.
- the MAC address of at least two sites is updated to the new MAC address corresponding to the site, and the AID of at least two sites is changed to the new AID corresponding to the site.
- the time information received by each station can ensure that each station and the access point change after the same time. For example, when the time information is a timing moment, the TSF time of each station is synchronized with the access point. When the timers of each station and the access point are timed to the moment, each station will allocate a new MAC to the access point.
- the new AID is configured to the MAC layer, and the access point also updates the MAC address and the AID of each site, so that when receiving the site message with the sending address as the new MAC address, the access point can determine the information of the site and Shared information for the site, such as shared data encryption keys.
- the access point In the subsequent message interaction, at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
- the access points in the embodiments shown in FIG. 18 and FIG. 19 can implement the steps of the method in the embodiment shown in FIG. 2 and FIG. 3 of the present invention.
- the division of each module is only one.
- the division of each module in the access point may also be other manners, for example, several modules are integrated into one module to implement.
- FIG. 20 is a schematic structural diagram of a first site according to an embodiment of the present invention.
- the site 300 of this embodiment includes an obtaining module 31 and a changing module 32, where:
- the obtaining module 31 is configured to learn the encrypted new MAC address corresponding to the site, decrypt the obtained new MAC address, and obtain a predetermined change condition, where each site corresponds to a different new MAC address;
- the access point in order to prevent the eavesdropper from tracking the user's private information by tracking the AID of the site, the access point notifies the site of the new MAC address, but also notifies the site of the new AID corresponding to the site. Therefore, in the preferred embodiment of the present invention, the obtaining module 31 can also obtain the encrypted new AID corresponding to the site when decrypting the encrypted new MAC address corresponding to the site, and decrypt the obtained new MAC address and the new AID.
- the obtaining module 31 decrypts and obtains the new MAC address and the new AID by receiving the encrypted new MAC address and the new AID allocated by the access point for the site correspondence.
- the obtaining module 31 sends a change request to the access point, and the change request of the site includes the new MAC address requested by the site, and the encrypted new MAC address corresponding to the site is obtained from the confirmation message of the access point responding to the change request, and Further knowledge of the new AID.
- the obtaining module 31 learns the new AID from the confirmation message of the access point responding to the change request; or The new AID is known from another message sent by the ingress.
- An implementation manner of the obtaining module 31 for obtaining the encrypted new MAC address and the new AID corresponding to the site is to receive the encrypted new MAC address and the new AID allocated by the access point, so as to obtain the encrypted new MAC address corresponding to the site and New AID.
- the obtaining module 31 requests a MAC address change from the access point, that is, sends a change request to the access point, where the change request includes a new MAC address requested by the site, where it is required to be described in the request.
- the new MAC address is also encrypted.
- the access point receives the request from the site and decrypts the requested new MAC address for uniqueness verification, and then presents a confirmation message as a response to the request.
- the station learns the encrypted new MAC address corresponding to the site from the confirmation message of the access point responding to the change request, and further learns the new AID.
- the new MAC address corresponding to the site is the new MAC address requested by the site, and when the new MAC address requested by the site does not pass the uniqueness verification, the new MAC address corresponding to the site is The access point assigns a unique new MAC address to the site, and the new AID corresponding to the site is allocated by the access point for the site.
- the new AID can be carried in the acknowledgment message or can be sent separately through another message.
- the access point also carries the change time T in the confirmation message to the station.
- At least two stations in the BSS where the access point is located can support the addressing identifier (in this embodiment, a MAC address, or a MAC address and an AID).
- the change trigger condition is met, at least two sites will send a MAC address change request to the access point within a certain time period t after the change trigger condition is met. Therefore, when the access point receives the change request of the first station, if the time is T0, the time T specified by the access point meets the following conditions, and it can be guaranteed that at least two sites will be changed before the T time arrives.
- Request ie T>T0+t.
- the site sends a change request to the access point.
- the site may also be implemented by defining an operation frame or a new management frame or a new information element (IE).
- the method for defining the operation frame is in the second embodiment and the embodiment. The third has been explained.
- a new IE is defined as an example, but is not limited thereto.
- the newly defined information elements can be carried in various management frames, such as Probe Request/Response, Reassociation Request/Response, and Beacon frames.
- the change module 32 is configured to change the site's MAC address to when the predetermined change condition is met.
- the new MAC address corresponding to the site so that when the subsequent access from the access point receives and sends a message to the access point, the new MAC address is used as the MAC address of the site.
- the change module 32 updates the MAC address currently used by the station to the new MAC address corresponding to the station, under the predetermined change condition.
- the change module 32 updates the current MAC address and AID of the site to the new corresponding to the site when the predetermined condition is met.
- the MAC address and the new AID at the next reception of the message, use at least one of the new MAC address and the new AID as the addressing identifier.
- the site 300 further includes a key agreement module 33, where:
- the key agreement module 33 is configured to perform encryption key negotiation with the access point.
- the obtaining module 31 decrypts and obtains the new MAC address and the new AID according to the encryption key type negotiated by the key agreement module 33, and uses the corresponding decryption method to obtain the new MAC address and the new AID.
- the encryption key is a symmetric encryption key or an asymmetric encryption key.
- the obtaining module 31 further includes: the key negotiation module 33 performs encryption key negotiation with the access point, so that the obtaining module 31 is based on the negotiated encryption key type. , decrypt the new MAC address and the new AID using the corresponding decryption method.
- the encryption key can be a symmetric encryption key or an asymmetric encryption key.
- the site decrypts with the corresponding key
- the encryption key is the army called the encryption key
- the site decrypts with the private key corresponding to the key.
- the station provided in the embodiment shown in FIG. 20 can implement the steps in the method embodiment shown in FIG. 9.
- the division of each module in the site is only an example, and is not specifically limited. The scope of the invention.
- the functional modules of the site may also be other division manners, such as several modules integrated on one module implementation.
- FIG. 21 is a schematic structural diagram of a third access point according to an embodiment of the present invention.
- the access point 400 of this embodiment includes a processor 41 (may be one or more, in various embodiments of the present invention. Taking one as an example), a memory 42, a receiver 43, a transmitter 44, and a bus system 45, wherein:
- the processor 41 controls the operation of the access point 400, which may also be referred to as a CPU (Central Processing Unit).
- Processor 41 may be an integrated circuit chip with signal processing capabilities.
- the processor 41 can also be a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuit (ASIC), a Field-Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
- the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
- Memory 42 may include read only memory and random access memory and provides instructions and data to processor 41. A portion of the memory 42 may also include non-volatile random access memory (NVRAM).
- NVRAM non-volatile random access memory
- the various components of the access point 400 are coupled together by a bus system 45, which may include, in addition to the data bus, a power bus, a control bus, a status signal bus, and the like.
- the bus system may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus.
- the bus may be one or more physical lines, and when it is a plurality of physical lines, it may be divided into an address bus, a data bus, a control bus, and the like.
- the processor 41, the memory 42, and the receiver 43, the transmitter 44 may also be directly connected through a communication line.
- various buses are labeled as bus system 45 in the figure.
- the memory 42 stores the following elements, executable modules or data structures, or subsets thereof, or their extended sets:
- Operation instructions include various operation instructions for implementing various operations.
- Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
- the processor 41 performs the following operations by calling an operation instruction stored in the memory 42 (the operation instruction can be stored in the operating system):
- the processor 41 notifies the at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site through the transmitter 44, and indicates a predetermined change condition, so that at least two sites are reaching the predetermined change. When conditions are met, change their respective MAC addresses to their respective New MAC address.
- the processor 41 when the processor 41 notifies the at least two sites of the encrypted new MAC address corresponding to each site by the transmitter 44, the at least two sites may also be notified of the encrypted new AID corresponding to each site. .
- the processor 41 indicates that the predetermined change condition by the transmitter 44 can have the following possible implementation manners:
- the change indication message is sent to at least two sites by broadcast.
- the processor 41 indicates that the predetermined change condition can be transmitted in a unicast or broadcast manner, wherein it is preferably transmitted by broadcast.
- the processor 41 can transmit and carry the time information for the change at the same time when the notification is made by the transmitter 44.
- the processor 41 can broadcast a change indication message on the working channel through the transmitter 44, instructing the station to make a change in the MAC address and the AID.
- Each station configures a new MAC address and a new AID to the MAC layer when obtaining respective new MAC addresses and new AIDs and reaching a predetermined change condition.
- at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
- the processor 41 further updates the MAC address of the at least two sites of the access point to the new MAC address corresponding to the site when the predetermined change condition is reached, so that when the message is received and sent to the site from the site, the new MAC address is used as the new MAC address.
- the MAC address of the site is updated.
- the processor 41 When the processor 41 notifies the site of the new AID corresponding to the site, when the predetermined change condition is reached, the MAC addresses of the at least two sites are updated to the new MAC address corresponding to the site, and the AIDs of the at least two sites are updated to correspond to the site.
- the new AID when subsequently sent to or received from the site, uses at least one of the new MAC address of the site and the new AID as the addressing identifier.
- the processor 41 is further configured to confirm a new MAC address and a new AID corresponding to each of at least two sites in the basic service set BSS of the access point service, where each site corresponds to a different new MAC address and a new AID.
- the processor 41 receives the change request of at least two sites in the BSS of the access point service through the receiver 43.
- the change request of each site includes a new MAC address requested by each site, and a new MAC address requested for each site.
- each site is assigned a new AID when the uniqueness verification is passed, and the new MAC and the assigned new AID requested by each site are the new MAC address and the new AID of the confirmed site.
- the processor 41 replies to the acknowledgment message to each of the stations in a unicast manner by the transmitter 44, the acknowledgment message instructing the site to use the requested new MAC address, and notifying each station of the new AID.
- the new AID is carried in the acknowledgement message or sent through another message.
- the processor 41 is further configured to allocate a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID allocated by each site are the new MAC address corresponding to the confirmed site and the new AID.
- the processor 41 transmits the encrypted new MAC address and the new AID corresponding to the station to the at least two sites by the transmitter 44 in a unicast manner.
- Each site corresponds to a different new MAC address and a new AID.
- the processor 41 confirms two possible implementation manners of a new MAC address and a new AID corresponding to at least two sites in the BSS of the access point service, and of course, can achieve the object of the present invention. On the basis of this, other possible ways can also be implemented.
- the processor 41 receives the change request of at least two sites in the BSS of the access point service through the receiver 43, and the change request of each site includes the new MAC address requested by each site. In other words, the site will carry the new MAC address that it prefers to use in the request.
- the processor 41 receives the change request of at least two sites through the receiver 43, the new MAC address requested by each site is uniquely verified, and each site is assigned a new AID when the uniqueness verification is passed.
- the new MAC address and the assigned new AID requested by each site are used as the new MAC address and the new AID corresponding to the determined site.
- the second mode the processor 41 allocates a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site are the new MAC addresses corresponding to the confirmed site and New AID.
- the processor 41 When the processor 41 confirms that the new MAC address and the new AID corresponding to at least two sites in the BSS of the service are respectively implemented by the first mode, the processor 41 replies to each site by the transmitter 44 in a unicast manner. A confirmation message indicating that the site is permitted to use its request New MAC address and notify each site of the new AID. When the new MAC address requested by the site fails to pass the uniqueness verification, the acknowledgment message of the reply carries a new MAC address that is unique. The new AID may be carried in the acknowledgement message or sent through another message.
- the processor 41 When the processor 41 confirms that the new MAC address and the new AID corresponding to each of the at least two sites in the BSS of the access point service are implemented by the foregoing second manner, the processor 41 unicasts to at least the transmitter 44.
- the two sites send the encrypted new MAC address and the new AID corresponding to the site.
- an Information Element or a new Management Frame is defined to complete the related message interaction of the MAC address and the AID change; in addition, a definition called IEEE802.11 is also defined.
- the management frame of the Action Frame defines the management frame required for a single business activity by defining a new Action Category.
- the processor 41 is further configured to obtain an encryption key for encrypting a new MAC address of each site by using the sender 44 and the receiver 43 to perform encryption key negotiation with at least two sites, and encrypt the key. Is a symmetric encryption key or an asymmetric encryption key.
- the processor 41 performs shared encryption key negotiation with each of the at least two sites to obtain an encryption key Ekey for encrypting the new MAC address and the new AID of the site.
- the encryption key in the embodiment of the present invention may be a symmetric encryption key or an asymmetric encryption key.
- the access point negotiates with the site 1 for encryption key
- the processor 41 performs shared encryption key negotiation with the site 1
- the processor 41 obtains Ekey1
- the processor 41 uses Ekey1.
- the new MAC address of Site 1 is encrypted for the encryption key of the symmetric encryption algorithm.
- the AID needs to be updated simultaneously, the new AID is also encrypted with the encryption key.
- Site 1 decrypts with Ekey1 to get the new MAC address and the new AID.
- the access point and the station 1 generate a Pairwise Transient Key (PTK) by a Pairwise Master Key (PMK) in the four-step handshake phase of the authentication phase, and then generate a temporary key by the PTK. (Temporal Key, TK).
- PTK Pairwise Transient Key
- PMK Pairwise Master Key
- the TK obtained by 128 bits can be directly intercepted by the PTK as Ekey1; or the 128-bit key is taken as the Ekey1 by the PTK in the remaining bits after intercepting KCK, KEK, and TK; or, the access point After random number exchange (Nonce) with station 1, randomize both sides Ekey1 is derived from the number and TK; moreover, the access point and the site 1 derive the Ekey1 by the random number, the timestamp and the TK after performing the random number exchange (Nonce).
- the key negotiation process is a four-step handshake and a random number exchange process.
- the encryption key is an asymmetric encryption key, it is usually a public key.
- the encryption key negotiation between the access point and the site 1 is taken as an example.
- Ekey1 is an RSA public key that Site 1 sends to the access point.
- the access point encrypts the new MAC address and the new AID of the site 1 by Ekey1, and the site 1 receives the corresponding RSA private key for decryption.
- the corresponding key negotiation process is mainly for the public key transmission and reception process.
- the processor 41 encrypts the new MAC address and the new AID of the site with an encryption key negotiated with the site.
- the encryption of the new MAC address and the new AID can be encrypted together, or separately.
- Ekey1 encrypts the new MAC address (MAC1-1) and the new AID (AID1-1) of Site 1.
- Ekey1 may be a symmetric encryption key or an asymmetric encryption key. In the embodiment of the present invention, a symmetric encryption key is preferred.
- the above is only an example of the encryption key negotiation between the access point and the site 1.
- the process of negotiating the encryption key of the access point with other sites and encrypting the new MAC address and the new AID are basically the same as above. This is not repeated.
- the processor 41 notifies the station of the new MAC address and the new AID by the transmitter 44, when the predetermined time or the predetermined time point indicating the change is carried, the time information received by each station can ensure that the stations and the access points after the unified time Make changes. For example, when the time information is a timing moment, the TSF time of each station is synchronized with the access point. When the timers of each station and the access point are timed to the moment, each station will allocate a new MAC to the access point.
- the new AID is configured to the MAC layer, and the access point also updates the MAC address and the AID of each site, so that when receiving the site message with the sending address as the new MAC address, the access point can determine the information of the site and Shared information for the site, such as shared data encryption keys.
- the access point In the subsequent message interaction, at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
- each step of the above method may be completed by an integrated logic circuit of hardware in the processor 41 or an instruction in a form of software.
- Embodiments of the invention may be implemented or implemented The various methods, steps, and logic blocks disclosed.
- the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
- the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
- the storage medium is located in the memory 42, and the processor 41 reads the information in the memory 42 and performs the steps of the above method in combination with its hardware.
- FIG. 22 is a schematic structural diagram of a second site according to an embodiment of the present invention.
- the site 500 of the embodiment includes a processor 51 (may be one or more, and one embodiment of the present invention takes one as an example). ), memory 52, receiver 53, transmitter 54, and bus system 55, wherein:
- the processor 51 controls the operation of the station 500, which may also be referred to as a CPU (Central Processing Unit).
- Processor 51 may be an integrated circuit chip with signal processing capabilities.
- the processor 51 can also be a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuit (ASIC), a Field-Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
- the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
- Memory 52 can include read only memory and random access memory and provides instructions and data to processor 51. A portion of memory 52 may also include non-volatile random access memory (NVRAM).
- NVRAM non-volatile random access memory
- the various components of the station 500 are coupled together by a bus system 55, which may include, in addition to the data bus, a power bus, a control bus, a status signal bus, and the like.
- the bus system may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus.
- the bus may be one or more physical lines, and when it is a plurality of physical lines, it may be divided into an address bus, a data bus, a control bus, and the like.
- the processor 51, the memory 52, and the receiver 53, the transmitter 54 may also be directly connected through a communication line.
- various buses are labeled as bus system 55 in the figure.
- the memory 52 stores the following elements, executable modules or data structures, or their Subsets, or their extension sets:
- Operation instructions include various operation instructions for implementing various operations.
- Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
- the processor 51 performs the following operations by calling an operation instruction stored in the memory 52 (the operation instruction can be stored in the operating system):
- the processor 51 learns the encrypted new MAC address corresponding to the site, decrypts and obtains a new MAC address, and acquires a predetermined change condition, and each site corresponds to a different new MAC address.
- the access point in order to prevent the eavesdropper from tracking the user's private information by tracking the AID of the site, the access point notifies the site of the new MAC address, but also notifies the site of the new AID corresponding to the site. Therefore, in the preferred embodiment of the present invention, when the processor 51 learns the encrypted new MAC address corresponding to the site, the processor 51 can also learn the encrypted new AID corresponding to the site, and decrypt the obtained new MAC address and the new AID.
- the processor 51 can receive the encrypted new MAC address and the new AID allocated by the access point for the site correspondingly through the receiver 53, and decrypt the obtained new MAC address and the new AID.
- the processor 51 sends a change request to the access point through the transmitter 54, and the change request of the site includes the new MAC address requested by the site, and the encrypted new MAC address corresponding to the site is obtained from the confirmation message of the access point responding to the change request. Address and further learn about the new AID.
- the processor 51 learns the new AID from the confirmation message of the access point responding to the change request; or learns the new AID from another message sent by the access point.
- the processor 51 learns that the encrypted new MAC address and the new AID corresponding to the site are obtained by receiving the encrypted new MAC address and the new AID allocated by the access point, so as to obtain the encrypted corresponding to the site.
- New MAC address and new AID are obtained by receiving the encrypted new MAC address and the new AID allocated by the access point, so as to obtain the encrypted corresponding to the site.
- the processor 51 requests the access point to send a MAC address change to the access point, that is, sends a change request to the access point, where the change request includes a new MAC address of the site request, where it should be noted that
- the new MAC address carried in the request is also encrypted.
- the access point receives the request from the site and decrypts the requested new MAC address for uniqueness verification, and then presents a confirmation message as a response to the request.
- the station learns the encrypted new MAC address corresponding to the site from the confirmation message of the access point responding to the change request, and further learns the new AID.
- a possible implementation manner for the access point to perform unique authentication on the new MAC address requested by the site may be: all the new MAC addresses requested by the site and all the basic service sets in the BSS of the access point service. The MAC address of the site is compared. If the new MAC address requested by the site is not currently used by any site in the BSS of the access point service, the unique MAC address uniqueness requested by the site is verified.
- the new MAC address corresponding to the site is the new MAC address requested by the site, and when the new MAC address requested by the site does not pass the uniqueness verification, the new MAC address corresponding to the site is The access point assigns a unique new MAC address to the site, and the new AID corresponding to the site is allocated by the access point for the site.
- the new AID can be carried in the acknowledgment message or can be sent separately through another message.
- the access point also carries the change time T in the confirmation message to the station.
- At least two stations in the BSS where the access point is located can support the addressing identifier (in this embodiment, a MAC address, or a MAC address and an AID).
- the change trigger condition is met, at least two sites will send a MAC address change request to the access point within a certain time period t after the change trigger condition is met. Therefore, when the access point receives the change request of the first station, if the time is T0, the time T specified by the access point meets the following conditions, and it can be guaranteed that at least two sites will be changed before the T time arrives.
- Request ie T>T0+t.
- the site sends a change request to the access point.
- the site may also be implemented by defining an operation frame or a new management frame or a new information element (IE).
- the method for defining the operation frame is in the second embodiment and the embodiment.
- the third has been explained.
- a new IE is defined as an example, but is not limited thereto.
- the newly defined information elements can be carried in various management frames, such as Probe Request/Response, Reassociation Request/Response, and Beacon frames.
- the processor 51 is further configured to change the MAC address of the site to a new MAC address corresponding to the site when the predetermined change condition is met, so that when the subsequent access point receives and sends a message to the access point, the new MAC address is used as the site. MAC address.
- the processor 51 When the processor 51 obtains the new MAC address corresponding to the site and simultaneously learns the encrypted new AID corresponding to the site, the processor 51 updates the MAC address and the AID of the site to the new MAC address corresponding to the site when the predetermined condition is met. And the new AID, the next time the message is received, At least one of a new MAC address and a new AID is used as an addressing identifier.
- the processor 51 is further configured to perform encryption key negotiation with the access point to decrypt the obtained new MAC address and the new AID by using a corresponding decryption method according to the negotiated encryption key type, where the encryption key is a symmetric encryption key or Asymmetric encryption key.
- the processor 51 decrypts with the corresponding key
- the processor 51 decrypts with the private key corresponding to the key.
- the embodiment of the present invention further provides a communication system, where the communication system includes the access point provided by any of the foregoing embodiments, and the site provided by any of the foregoing embodiments.
- the communication system includes the access point provided by any of the foregoing embodiments, and the site provided by any of the foregoing embodiments.
- each step of the above method may be completed by an integrated logic circuit of hardware in the processor 51 or an instruction in a form of software.
- the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
- the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
- the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
- the storage medium is located in the memory 52, and the processor 51 reads the information in the memory 52 and performs the steps of the above method in combination with its hardware.
- the method for allocating the addressing identifier and the access point, the station, and the communication system provided by the embodiment of the present invention can be understood that the present invention adjusts the MAC address transformation of multiple sites in the entire basic service set through the access point to multiple sites. Notifying each site of the encrypted new MAC address and the new AID, so that each site changes its respective MAC address and AID to its corresponding new MAC address and new AID when the predetermined change condition is reached, when the reservation is reached. When the condition is changed, the access point also updates the MAC address of multiple sites to the new MAC address corresponding to the site, and updates the AID of the site to the new AID corresponding to the site.
- the new MAC address and the new AID sent by the access point to the site are encrypted, and the eavesdropper cannot steal the new MAC address and the new AID.
- the eavesdropper cannot continue after the change Track the MAC address and AID to obtain the privacy of the end user, and protect the privacy of the user.
- the disclosed system, apparatus, and method may be implemented in other manners.
- the device embodiments described above are merely illustrative.
- the division of the modules or units is only a logical function division.
- there may be another division manner for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
- the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
- the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
- each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
- the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
- the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
- the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
- a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present invention.
- the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Databases & Information Systems (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Description
Claims (27)
- 一种分配寻址标识的方法,其特征在于,所述寻址标识包括介质访问控制MAC地址,所述方法包括:接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址,并指示预定更改条件,以使得所述至少两个站点在达到所述预定更改条件时,将各自的MAC地址更改为各自的所述新MAC地址;在达到所述预定更改条件时,所述接入点将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址,以使得后续自所述站点接收和向所述站点发送消息时,以所述新MAC地址作为所述站点的MAC地址。
- 根据权利要求1所述的方法,其特征在于,所述寻址标识还包括关联标识AID;所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址时,还通知站点对应的加密的新AID;在达到预定更改条件时,所述接入点将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址,将所述至少两个站点的AID更新为所述站点对应的所述新AID。
- 根据权利要求2所述的方法,其特征在于,接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的所述新MAC地址和新AID的步骤之前,还包括:所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID,每个所述站点分别对应不同的新MAC地址和新AID。
- 根据权利要求3所述的方法,其特征在于,所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID的步骤包括:所述接入点接收其服务的BSS内的所述至少两个站点的更改请求,每个所述站点的更改请求中包括每个所述站点请求的新MAC地址;所述接入点对每个所述站点请求的新MAC地址进行唯一性查证,在所述唯一性查证通过时,为每个所述站点分配新AID,每个所述站点请求的所述新MAC地址和分配的所述AID即为确认的所述站点的新MAC地址和 新AID;所述向所述至少两个站点通知每个所述站点对应的加密的所述新MAC地址和新AID的步骤包括:所述接入点以单播方式向每个所述站点回复确认消息,所述确认消息指示同意所述站点使用请求的所述新MAC地址,并向每个所述站点通知新AID;所述新AID在所述确认消息中携带或通过从所述接入点发送的另一消息发送。
- 根据权利要求3所述的方法,其特征在于,所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID的步骤包括:所述接入点为其服务的BSS内的至少两个站点分配新MAC地址和新AID,每个所述站点分配的所述新MAC地址和新AID为确认的所述站点对应的新MAC地址和新AID;所述向所述至少两个站点通知每个所述站点对应的加密的所述新MAC地址和新AID的步骤包括:通过单播方式分别向所述至少两个站点发送所述站点对应的加密的所述新MAC地址和新AID。
- 根据权利要求1-5任一所述的方法,其特征在于,所述指示预定更改条件包括:所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址时,携带指示更改的预定时间或预定时间点;或所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后,通过单播的方式分别向所述至少两个站点发送更改指示消息;或所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后,通过广播的方式向所述至少两个站点群发更改指示消息。
- 根据权利要求6所述的方法,其特征在于,所述通过广播的方式向所述至少两个站点群发更新指示消息的步骤包括:通过广播添加了指示位的信标帧向所述至少两个站点群发更新指示消息,所述指示位包含用于指示所述至少两个站点进行寻址标识更改的更改指示信息。
- 根据权利要求1所述的方法,其特征在于,所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址的步骤之前,还包括:所述接入点与所述至少两个站点之间进行加密密钥协商,所述接入点获取用于对每个所述站点的新MAC地址进行加密的加密密钥,所述加密密钥为对称加密密钥或非对称加密密钥。
- 一种分配寻址标识的方法,其特征在于,所述寻址标识包括介质访问控制MAC地址,所述分配寻址标识方法包括:站点获知由其所在的基本服务集BSS内的接入点通知的所述站点对应的加密的新MAC地址,解密获得新MAC地址,并获取预定更改条件,所述站点在满足所述预定更改条件时,将当前使用的MAC地址更改为所述新MAC地址,以使得后续自所述接入点接收和向所述接入点发送消息时,以所述新MAC地址作为所述站点的MAC地址。
- 根据权利要求9所述的方法,其特征在于,所述寻址地址还包括关联标识AID,所述站点获知所述站点对应的加密的新MAC地址的同时,还获取所述站点对应的加密的新AID;所述站点在满足所述预定更改条件时,将当前使用的MAC地址更改为所述新MAC地址,并将当前使用的AID更改为所述新AID。
- 根据权利要求10所述的方法,其特征在于,站点获知所述站点对应的加密的新MAC地址和新AID的步骤包括:所述站点接收接入点为所述站点对应分配的加密的新MAC地址和新AID。
- 根据权利要求10所述的方法,其特征在于,站点获知所述站点对应的加密的新MAC地址和新AID的步骤包括:所述站点向接入点发送更改请求,所述站点的更改请求中包括所述站点请求的新MAC地址,所述站点从所述接入点响应所述更改请求的确认消息中,获知所述站点对应的加密的新MAC地址,并进一步从所述接入点响 应所述更改请求的所述确认消息中或从所述接入点发送的另一消息中获知加密的新AID。
- 根据权利要求9所述的方法,其特征在于,站点获知所述站点对应的加密的新MAC地址的步骤之前,还包括:所述站点与接入点进行加密密钥协商,以使所述站点根据协商的加密密钥类型,使用对应的解密方法解密获得所述新MAC地址,所述加密密钥为对称加密密钥或非对称加密密钥。
- 一种接入点,其特征在于,所述接入点包括通知模块以及更新模块,其中:所述通知模块用于向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新介质访问控制MAC地址,并指示预定更改条件,以使得所述至少两个站点在达到所述预定更改条件时,将各自的MAC地址更改为各自的所述新MAC地址;所述更新模块用于在达到所述预定更改条件时,将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址,以使得后续自所述站点接收和向所述站点发送消息时,以所述新MAC地址作为所述站点的MAC地址。
- 根据权利要求14所述的接入点,其特征在于,所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址时,还向所述至少两个站点通知每个站点对应的加密的新关联标识AID;所述更新模块在达到所述预定更改条件时,将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址,并将所述至少两个站点的AID更新为所述站点对应的所述新AID。
- 根据权利要求15所述的接入点,其特征在于,所述接入点还包括确认模块,其中:所述确认模块用于确认所述接入点服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID,每个站点分别对应不同的新MAC地址和新AID。
- 根据权利要求16所述的接入点,其特征在于,所述确认模块具体用 于接收所述接入点服务的BSS内的所述至少两个站点的更改请求,每个所述站点的更改请求中包括每个所述站点请求的新MAC地址,对每个所述站点请求的新MAC地址进行唯一性查证,在所述唯一性查证通过时,为每个所述站点分配新AID,每个所述站点请求的所述新MAC和分配的所述新AID即为所述确认的所述站点的新MAC地址和新AID;所述通知模块具体通过单播方式向每个所述站点回复确认消息,所述确认消息指示同意所述站点使用请求的所述新MAC地址,并向每个所述站点通知新AID,所述新AID在所述确认消息中携带或通过另一消息发送。
- 根据权利要求16所述的接入点,其特征在于,所述确认模块具体用于为接入点服务的BSS内的至少两个站点分配新MAC地址和新AID,每个所述站点分配的所述新MAC地址和新AID为确认的所述站点对应的新MAC地址和新AID;所述通知模块具体通过单播方式分别向所述至少两个站点发送所述站点对应的加密的所述新MAC地址和新AID。
- 根据权利要求14-18任一项所述的接入点,其特征在于,所述通知模块具体通过以下方式之一指示预定更改条件:所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址时,携带指示更改的预定时间或预定时间点;或所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后,通过单播的方式分别向所述至少两个站点发送更改指示消息;或所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后,通过广播的方式向所述至少两个站点群发更改指示消息。
- 根据权利要求19所述的接入点,其特征在于,所述通知模块具体通过广播添加了指示位的信标帧向所述至少两个站点群发更新指示消息,所述指示位包含用于指示所述至少两个站点进行寻址标识更改的更改指示信息。
- 根据权利要求14所述的接入点,其特征在于,所述接入点还包括密 钥获取模块,其中:所述密钥获取模块用于与所述至少两个站点之间进行加密密钥协商,获取用于对每个站点的新MAC地址进行加密的加密密钥,所述加密密钥为对称加密密钥或非对称加密密钥。
- 一种站点,其特征在于,所述站点包括获得模块和更改模块,其中:所述获得模块用于获知由所述站点所在的基本服务集BSS内的接入点通知的所述站点对应的加密的新介质访问控制MAC地址,解密获得新MAC地址,并获取预定更改条件,每个所述站点分别对应不同的所述新MAC地址;所述更改模块用于在满足预定更改条件时,将所述站点当前使用的MAC地址更改为所述站点对应的所述新MAC地址,以使得后续自所述接入点接收和向所述接入点发送消息时,以所述新MAC地址作为所述站点的MAC地址。
- 根据权利要求22所述的站点,其特征在于,所述获得模块在获知所述站点对应的加密的新MAC地址时,还获知所述站点对应的加密的新关联标识AID,解密获得新MAC地址和新AID;所述更改模块在满足预定更改条件时,将所述站点当前使用的MAC地址和AID更改为所述站点对应的新MAC地址和新AID。
- 根据权利要求23所述的站点,其特征在于,所述获得模块具体通过接收接入点为所述站点对应分配的加密的新MAC地址和新AID,解密获得所述新MAC地址和新AID。
- 根据权利要求23所述的站点,其特征在于,所述获得模块具体通过向接入点发送更改请求,所述站点的更改请求中包括所述站点请求的新MAC地址,从所述接入点响应所述更改请求的确认消息中,获知所述站点对应的加密的新MAC地址,并进一步从所述接入点响应所述更改请求的所述确认消息中或从所述接入点发送的另一消息中获知加密的新AID。
- 根据权利要求22所述的站点,其特征在于,所述站点还包括密钥协商模块,其中:所述密钥协商模块用于与接入点进行加密密钥协商;所述获得模块根据所述密钥协商模块协商的加密密钥类型,使用对应 的解密方法解密获得所述新MAC地址,所述加密密钥为对称加密密钥或非对称加密密钥。
- 一种通信系统,其特征在于,所述通信系统包括权利要求14-21任一项所述的接入点以及权利要求22-26任一项所述的站点。
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2016559311A JP2017515353A (ja) | 2014-03-25 | 2015-03-25 | アドレス指定識別子の割り当て方法、アクセスポイント、ステーション、および通信システム |
EP15768040.6A EP3116252B1 (en) | 2014-03-25 | 2015-03-25 | Method for allocating addressing identifier, access point, station and communication system |
KR1020167029538A KR101826936B1 (ko) | 2014-03-25 | 2015-03-25 | 주소지정 식별자를 할당하는 방법, 액세스 포인트, 스테이션 및 통신 시스템 |
US15/274,751 US10382435B2 (en) | 2014-03-25 | 2016-09-23 | Method for allocating addressing identifier, access point, station, and communications system |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201410114893.2A CN104955038B (zh) | 2014-03-25 | 2014-03-25 | 分配寻址标识的方法及接入点、站点和通信系统 |
CN201410114893.2 | 2014-03-25 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/274,751 Continuation US10382435B2 (en) | 2014-03-25 | 2016-09-23 | Method for allocating addressing identifier, access point, station, and communications system |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2015144050A1 true WO2015144050A1 (zh) | 2015-10-01 |
Family
ID=54169313
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2015/075002 WO2015144050A1 (zh) | 2014-03-25 | 2015-03-25 | 分配寻址标识的方法及接入点、站点和通信系统 |
Country Status (6)
Country | Link |
---|---|
US (1) | US10382435B2 (zh) |
EP (1) | EP3116252B1 (zh) |
JP (1) | JP2017515353A (zh) |
KR (1) | KR101826936B1 (zh) |
CN (1) | CN104955038B (zh) |
WO (1) | WO2015144050A1 (zh) |
Families Citing this family (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10524289B2 (en) * | 2015-12-25 | 2019-12-31 | Kabushiki Kaisha Toshiba | Wireless communication device |
CN107786972B (zh) | 2016-08-31 | 2020-07-24 | 华为技术有限公司 | 无线局域网中建立关联的方法、终端和接入点 |
CN107979864B (zh) * | 2016-10-25 | 2021-11-19 | 中兴通讯股份有限公司 | 接入点的接入方法、装置及系统 |
WO2018120247A1 (zh) * | 2016-12-31 | 2018-07-05 | 华为技术有限公司 | 一种终端匹配方法、装置 |
US10993110B2 (en) * | 2018-07-13 | 2021-04-27 | Nvidia Corp. | Connectionless fast method for configuring Wi-Fi on displayless Wi-Fi IoT device |
US11582230B2 (en) * | 2019-05-03 | 2023-02-14 | Zte Corporation | Dynamic MAC address change mechanism for wireless communications |
US11765577B2 (en) * | 2019-07-12 | 2023-09-19 | Apple Inc. | Identity obscuration for a wireless station |
US11412073B2 (en) | 2019-10-16 | 2022-08-09 | Raytheon Company | Alternate control channel for network protocol stack |
US11438300B2 (en) | 2019-10-16 | 2022-09-06 | Raytheon Company | Alternate control channel for network protocol stack |
WO2021247693A1 (en) * | 2020-06-03 | 2021-12-09 | Raytheon Company | Alternate control channel for network protocol stack |
KR20230001000A (ko) | 2021-06-25 | 2023-01-03 | (주)휴온스 | 약물방출 특성이 개선된 엠파글리플로진 및 메트포르민 복합제제 |
CN118044240A (zh) * | 2021-11-12 | 2024-05-14 | Oppo广东移动通信有限公司 | 通信方法和站点 |
GB2614562A (en) * | 2022-01-07 | 2023-07-12 | Canon Kk | Method for changing a value of an extended unique identifier of a non-AP station associated with an AP station |
GB2614584A (en) * | 2022-01-07 | 2023-07-12 | Canon Kk | Method for changing the value of one or more privacy parameters of stations within a basic service set |
GB2615576B (en) * | 2022-02-11 | 2024-04-24 | Canon Kk | Method for seamlessly changing a value of an extended unique identifier of a non-AP station associated with an AP station |
GB2616033A (en) * | 2022-02-24 | 2023-08-30 | Canon Kk | Method for changing the MAC address of a non-AP station for a next association with an AP station |
WO2023164949A1 (zh) * | 2022-03-04 | 2023-09-07 | Oppo广东移动通信有限公司 | 无线通信的方法和设备 |
EP4290902A1 (en) * | 2022-06-10 | 2023-12-13 | Apple Inc. | Association identifier change and obfuscation in wlan communication |
WO2024082302A1 (zh) * | 2022-10-21 | 2024-04-25 | Oppo广东移动通信有限公司 | 信息更新方法、装置、设备、存储介质 |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7330456B2 (en) * | 2003-12-19 | 2008-02-12 | Mediatek, Inc. | Method and apparatus for wireless relay within a network environment |
CN102027767A (zh) * | 2008-05-16 | 2011-04-20 | 日本电气株式会社 | 通信装置、通信方法以及通信控制程序 |
Family Cites Families (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7330472B2 (en) * | 2001-10-26 | 2008-02-12 | Sharp Laboratories Of America, Inc. | System and method for hybrid coordination in a wireless LAN |
FI113515B (fi) * | 2002-01-18 | 2004-04-30 | Nokia Corp | Osoitteistus langattomissa lähiverkoissa |
KR100878764B1 (ko) * | 2002-07-06 | 2009-01-14 | 삼성전자주식회사 | 사용자의 익명성보장을 위한 무선 랜 시스템 및 사용자의익명성 보장방법 |
KR100694105B1 (ko) * | 2005-04-25 | 2007-03-12 | 삼성전자주식회사 | 무선 메시 망에서 이동 스테이션 정보를 배포하는 방법 및장치 |
US8126145B1 (en) * | 2005-05-04 | 2012-02-28 | Marvell International Ltd. | Enhanced association for access points |
WO2007096884A2 (en) * | 2006-02-22 | 2007-08-30 | Elad Barkan | Wireless internet system and method |
JP4347335B2 (ja) * | 2006-12-18 | 2009-10-21 | 富士通株式会社 | ネットワーク中継プログラム、ネットワーク中継装置、通信システム、ネットワーク中継方法 |
EP2810478B1 (en) * | 2012-01-31 | 2016-11-16 | Marvell World Trade Ltd. | Mac header compression in long-range wireless local area networks |
KR101514966B1 (ko) | 2012-06-28 | 2015-04-24 | 주식회사 케이티 | 무선랜 시스템에서 aid 재할당 방법 |
US9736871B2 (en) * | 2012-12-12 | 2017-08-15 | Lg Electronics Inc. | Method for transmitting/receiving information related to association identifier in wireless communication system and device therefor |
CN104754560B (zh) * | 2013-12-30 | 2018-11-30 | 华为终端(东莞)有限公司 | 一种位置隐私保护方法、装置及系统 |
-
2014
- 2014-03-25 CN CN201410114893.2A patent/CN104955038B/zh active Active
-
2015
- 2015-03-25 WO PCT/CN2015/075002 patent/WO2015144050A1/zh active Application Filing
- 2015-03-25 KR KR1020167029538A patent/KR101826936B1/ko active IP Right Grant
- 2015-03-25 JP JP2016559311A patent/JP2017515353A/ja not_active Withdrawn
- 2015-03-25 EP EP15768040.6A patent/EP3116252B1/en active Active
-
2016
- 2016-09-23 US US15/274,751 patent/US10382435B2/en active Active
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7330456B2 (en) * | 2003-12-19 | 2008-02-12 | Mediatek, Inc. | Method and apparatus for wireless relay within a network environment |
CN102027767A (zh) * | 2008-05-16 | 2011-04-20 | 日本电气株式会社 | 通信装置、通信方法以及通信控制程序 |
Non-Patent Citations (1)
Title |
---|
HARJUBS, D.: "IEEE 802.11-14/0367r2", PRIVACY ENHANCED WIRELESS, 16 March 2013 (2013-03-16), XP068069039 * |
Also Published As
Publication number | Publication date |
---|---|
KR101826936B1 (ko) | 2018-02-07 |
EP3116252A4 (en) | 2017-02-22 |
US20170012977A1 (en) | 2017-01-12 |
CN104955038A (zh) | 2015-09-30 |
CN104955038B (zh) | 2019-06-11 |
JP2017515353A (ja) | 2017-06-08 |
EP3116252B1 (en) | 2018-12-05 |
US10382435B2 (en) | 2019-08-13 |
KR20160136419A (ko) | 2016-11-29 |
EP3116252A1 (en) | 2017-01-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2015144050A1 (zh) | 分配寻址标识的方法及接入点、站点和通信系统 | |
KR102312670B1 (ko) | 사용자 단말 간 장치 대 장치 통신을 수행하는 방법 | |
EP3609121B1 (en) | Method and device for managing digital certificate | |
US11765577B2 (en) | Identity obscuration for a wireless station | |
US10631162B2 (en) | Method and apparatus to perform device to device communication in wireless communication network | |
CN108886685B (zh) | 一种终端匹配方法、装置 | |
KR102094216B1 (ko) | 이동 통신 시스템 환경에서 프락시미티 기반 서비스 단말 간 발견 및 통신을 지원하기 위한 보안 방안 및 시스템 | |
TW201703556A (zh) | 網路安全架構 | |
JP7292263B2 (ja) | デジタル証明書を管理するための方法および装置 | |
KR20140041226A (ko) | 이동 통신 시스템에서 그룹 통신을 위한 보안 관리 방법 및 장치 | |
GB2499247A (en) | Method, apparatus and computer program for facilitating secureD2D discovery information | |
WO2018219181A1 (zh) | 确定终端设备的标识的方法和装置 | |
CN104065765A (zh) | Wifi数据传输方法、系统及其相关方法 | |
CN113545115B (zh) | 一种通信方法及装置 | |
WO2012092418A1 (en) | Methods for establishing a secure point-to-point call on a trunked network | |
WO2018188841A1 (en) | Encrypting data in a pre-associated state | |
KR101789264B1 (ko) | 경량화된 사물인터넷 디바이스 인증 시스템 및 방법 | |
WO2022083448A1 (zh) | 加密方法、解密方法、装置及设备 | |
WO2014194818A1 (zh) | 一种用于发现设备的用户的方法和用户设备 | |
WO2015192665A1 (zh) | 基于临时mac地址的接入方法、装置及系统 | |
IL254758B2 (en) | Method, equipment and computer software product for code encryption | |
CN115885496B (zh) | 一种通信方法及相关装置 | |
WO2023044792A1 (zh) | 无线通信的方法、站点设备和接入点设备 | |
WO2017118269A1 (zh) | 一种空口标识的保护方法及装置 | |
US20090080660A1 (en) | Processorless media access control architecture for wireless communication |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 15768040 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 2016559311 Country of ref document: JP Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
REEP | Request for entry into the european phase |
Ref document number: 2015768040 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2015768040 Country of ref document: EP |
|
ENP | Entry into the national phase |
Ref document number: 20167029538 Country of ref document: KR Kind code of ref document: A |