WO2019035859A1

WO2019035859A1 - Neighbor aware networking data path security provisioning using opportunistic wireless encryption

Info

Publication number: WO2019035859A1
Application number: PCT/US2017/068557
Authority: WO
Inventors: Emily Qi; Ilan Peer
Original assignee: Intel IP Corporation
Priority date: 2017-08-18
Filing date: 2017-12-27
Publication date: 2019-02-21

Abstract

This disclosure describes systems, methods, and devices related to neighbor awareness networking (NAN) multicast. A first NAN device may cause to send a NAN service discovery frame to a second NAN device during a discovery window, wherein the NAN service discovery frame includes an indication for support for opportunistic wireless encryption (OWE). A secure association (SA) NAN data path (NDP) request may be received from the second NAN device. The SA NDP request may include one or more parameters. A shared secret and a pairwise master key (PMK) may be determined by the first NAN device. The shared secret may be associated with the first NAN device and the second NAN device. The SA NDP may be established based at least in part on the PMK.

Description

NEIGHBOR AWARE NETWORKING DATA PATH SECURITY PROVISIONING USING OPPORTUNISTIC WIRELESS ENCRYPTION

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of U.S. Provisional Application No. 62/547,599, filed August 18, 2017, the disclosure of which is incorporated herein by reference as if set forth in full.

TECHNICAL FIELD

[0002] This disclosure generally relates to systems, methods, and devices for wireless communications and, more particularly, to neighbor aware networking (NAN) data path security provisioning using opportunistic wireless encryption (OWE).

BACKGROUND

[0003] Wireless devices are becoming widely prevalent. Recently, there has been a shift in technology to support direct wireless communications between wireless devices. NAN may refer to a specification for Wi-Fi for device and/or service discovery and peer-to-peer communication. NAN may describe the formation of a cluster of devices (referred to as a NAN cluster) for devices in physical proximity to one another.

BRIEF DESCRIPTION OF THE DRAWINGS

[0004] FIG. 1 depicts a diagram illustrating an example network environment of a NAN data path security provisioning using OWE, in accordance with one or more example embodiments of the present disclosure.

[0005] FIG. 2 depicts an illustrative schematic diagram for a NAN data path security provisioning using OWE system, in accordance with one or more embodiments of the disclosure.

[0006] FIG. 3 depicts a flow diagram of an illustrative process for a NAN data path security provisioning using OWE system, in accordance with one or more embodiments of the disclosure.

[0007] FIGs. 4A-4B depict illustrative schematic diagrams for a NAN data path security provisioning using OWE system, in accordance with one or more example embodiments of the present disclosure.

[0008] FIG. 5 depicts a functional diagram of an example communication station that may be suitable for use as a user device, in accordance with one or more example embodiments of the present disclosure.

[0009] FIG. 6 depicts a block diagram of an example machine upon which any of one or more techniques (e.g., methods) may be performed, in accordance with one or more example embodiments of the present disclosure.

DETAILED DESCRIPTION

[0010] The following description and the drawings sufficiently illustrate specific embodiments to enable those skilled in the art to practice them. Other embodiments may incorporate structural, logical, electrical, process, and other changes. Portions and features of some embodiments may be included in, or substituted for, those of other embodiments. Embodiments set forth in the claims encompass all available equivalents of those claims.

[0011] The Neighbor Aware Networking (NAN) (which may be known as Wi-Fi Aware) specification addresses privacy and security aspects of peer-to-peer communication by defining the means to establish a secure data path between peers. The specification assumes that the base of the security establishment is Pairwise Master Key (PMK) known to the peers. However, the specification states that the establishment or derivation of such a key is out of the scope of the specification. This disclosure describes a method to establish a PMK based, for example, on techniques defined in the Opportunistic Wireless Encryption (OWE) specification. There are no previous solutions for provisioning a PMK for NAN use cases.

[0012] Example embodiments of the present disclosure relate to systems, methods, and devices for NAN data path security provisioning using OWE.

[0013] In one embodiment, a NAN data path security provisioning using OWE system may allow provisioning of a PMK to NAN device peers.

[0014] In one embodiment, a NAN data path security provisioning using OWE system may facilitate a public key advertisement, where a NAN device publishing a service, which requires security, includes its public key as part of the service attributes. [0015] In one embodiment, a NAN data path security provisioning using OWE system may facilitate secure NAN Data Path (NDP) establishment. For example, a NAN device that wishes to establish a secure NDP with the publisher may compute a local public/private key pair, and use it to generate a shared secret and corresponding PMK based, for example, on the Diffie-Hellman scheme. The NAN device may include its public key in the NDP request together with the other NAN attributes. Upon receiving an NDP request with public key information, the publishing NAN device may use it to compute a shared secret and corresponding PMK based, for example, on the Diffie-Hellman scheme. The NDP establishment may continue as defined in the NAN specification, using the derived PMK. NAN devices may attempt PMKSA caching in conjunction with the OWE PMK derivation. If a PMKID is included in the Security Context Information attribute along with Diffie-Hellman parameter in the Service Discovery frame, the receiving NAN Device that has a PMKSA with a matching PMKID should not include Diffie-Hellman parameter in the NDP Request frame. In this case, the cached PMKSA will be used.

[0016] Currently the NAN specification does not address the means to provision a PMK between peers. This disclosure suggests an in-bound method of provisioning such a PMK.

[0017] Example embodiments of the present disclosure relate to systems, methods, and devices for neighbor aware networking (NAN) data path security provisioning using opportunistic wireless encryption (OWE). In some embodiments, a NAN device may advertise or otherwise communicate to nearby devices by publishing, broadcasting, or otherwise communicating information about a network. The NAN device may generate public/private key. The NAN device may generate a service discovery frame that includes information about the network. The NAN device may include an indication that it supports OWE and its public key as part of the service attributes of the service discovery frame. For example, the public key may be included as a service attribute of the service discovery frame.

[0018] A NAN device that wishes to establish a secure NAN data path (NDP) with the publishing NAN device that published the service discovery frame. The NAN device may compute its local public/private key pair. The NAN device may use its local public key and the public key received from the publishing NAN device to generate a shared secret and corresponding pairwise master key (PMK). In some embodiments, the shared secret and corresponding PMK may be computed based on the Diffie-Hellman scheme. The NAN device may include its public key in the NDP request together with the other NAN attributes.

[0019] Upon receiving an NDP request with public key information from the NAN device, the publishing NAN device may use the public key to compute a shared secret and corresponding PMK based on the Diffie-Hellman scheme. Thus, the publishing NAN device and the NAN device may each have the shared secret and corresponding PMK without having to communicate them to each other.

[0020] The NDP between the publishing NAN device and the NAN device may be established, for example, as defined in the NAN specification, using the derived PMK of each of the devices. In some embodiments, the device may enact pairwise master key security association (PMKSA) caching in conjunction with the OWE PMK derivation. If a PMK identifier (PMKID) is included in the security context information attribute along with the Diffie-Hellman parameter in the service discovery frame, the receiving NAN device that has a PMKSA with a matching PMKID should not include the Diffie-Hellman parameter in the NDP request frame, as the cashed PMKSA will be used in establishing the NDP between the devices.

[0021] In some embodiments, the derived PMK on each of the devices may be associated with an expiration date. Upon expiration of the PMK, the devices will need to derive a new PMK for future use.

[0022] Similarly, the peer-to-peer (P2P) specification (known as Wi-Fi Direct Certification) may use the wireless simple configuration technology (WSC) specification to authenticate and provision the P2P peers during P2P group establishment. While the provisioning process allows to authenticate the peers (to some extent) it is a somewhat complex flow that requires temporary establishment of the P2P group for the provisioning process, the provisioning process itself, teardown of the group and re-establishment of the group.

[0023] P2P specification defines the group provisioning flow, which uses WSC to authenticate and provision the P2P peers. However, the relatively long flow requires instantiation of a group to be used for the WSC provisioning process, actual WSC provisioning, disconnection of the P2P client from the P2P GO and reconnection using the newly established keys. Additionally, the P2P specification requires knowledge of PIN or physical/virtual button, which may not be efficient.

[0024] In some embodiments, the P2P provisioning using OWE may use, for example, Diffie- Hellman (DH) key exchange. Using OWE may simplify and shorten the provisioning process, as the provisioning in done as part of the association flow. Provisioning using OWE may be done as part of the association flow, using information elements (IE) in the association request and association response frames. This may make connection flow faster and less error prone by eliminating the need to connect-disconnect-reconnect flow by the P2P client and eliminating the long WSC provisioning flow that requires exchange of about 10 data frames.

[0025] During P2P Group Ownership Negotiation (GON), OWE provisioning method may be negotiated. If both parties agreed on a provisioning method different then OWE, then that provision method is used. In some embodiments, the P2P GO may start beaconing, using Open Authentication System, advertising support for OWE Authentication and Key Management (AKM). The P2P client may start scanning, searching for the P2P GO. The P2P client validates that the P2P GO indicates support for OWE AKM in its robust security network (RSN) IE. The P2P client may perform open system authentication with the P2P GO. The P2P client may generate its DH public and private key pair, and may add an OWE IE including its public key to the association request. The P2P client may send the association request to the P2P GO.

[0026] Upon reception of the association request frame from the P2P client, the P2P GO may create its own DH public and private key pair, and add to the association response an OWE IE including its public key. The P2P GO may generate the PMK based on the shared secret, based on the DH scheme.

[0027] Upon reception of a successful association response, the P2P client may generate the PMK based on the shared secret, based on the DH scheme. Both peers may proceed to the 4-way handshake for authentication and generation of Pairwise Transient Keys (PTK). The PMK may be stored for further group invocations.

[0028] The above descriptions are for purposes of illustration and are not meant to be limiting. Numerous other examples, configurations, processes, etc., may exist, some of which are described in detail below. Example embodiments will now be described with reference to the accompanying figures.

[0029] FIG. 1 is a network diagram illustrating an example wireless network 100 of a NAN data path security provisioning using OWE system, according to some example embodiments of the present disclosure. Wireless network 100 can include one or more user devices 120 (e.g., 122, 124, 126, or 128), which may communicate in accordance with wireless standards, such as the IEEE 802.11 communication standards. For example, two or more wireless devices may perform connectivity procedures with one another in order to set up Wi-Fi data sessions, according to some example embodiments of the present disclosure. In the example of FIG. 1, a wireless communication channel may be established between two or more wireless devices (e.g., user device(s) 120), where a first user device 120 may correspond to a service seeker, and a second user device 120 may correspond to a service advertiser. A service advertiser may be a wireless device that may advertise and provide one or more of these services over a wireless communication channel. The user device(s) 120 may be wireless devices that are non-stationary and do not have fixed locations. A service seeker may be a wireless device that is seeking certain services, such as printing, playing content, sending, docking, etc.

[0030] In some embodiments, the user devices 120 can include one or more computer systems similar to that of the functional diagram of FIG. 5 and/or the example machine/system of FIG. 6.

[0031] One or more illustrative user device(s) 120 may be operable by one or more user(s) 110. The user device(s) 120 (e.g., 122, 124, 126, or 128) may include any suitable processor- driven user device including, but not limited to, a desktop user device, a laptop user device, a server, a router, a switch, an access point, a smartphone, a tablet, a wearable wireless device (e.g., a bracelet, a watch, glasses, a ring, etc.), and so forth.

[0032] Any of the user devices 120 (e.g., 122, 124, 126, or 128) may be configured to communicate with each other and any other component of the wireless network 100 directly and/or via one or more communications networks 130, wirelessly or wired. Any of the communications networks 130 may include, but not be limited to, any one of a combination of different types of suitable communications networks such as, for example, broadcasting networks, cable networks, public networks (e.g., the Internet), private networks, wireless networks, cellular networks, or any other suitable private and/or public networks. Further, any of the communications networks 130 may have any suitable communication range associated therewith and may include, for example, global networks (e.g., the Internet), metropolitan area networks (MANs), wide area networks (WANs), local area networks (LANs), or personal area networks (PANs). In addition, any of the communications networks 130 may include any type of medium over which network traffic may be carried including, but not limited to, coaxial cable, twisted-pair wire, optical fiber, a hybrid fiber coaxial (HFC) medium, microwave terrestrial transceivers, radio frequency communication mediums, white space communication mediums, ultra-high frequency communication mediums, satellite communication mediums, or any combination thereof.

[0033] Any of the user devices 120 (e.g., 122, 124, 126, or 128) may include one or more communications antennas. Communications antennas may be any suitable type of antenna corresponding to the communications protocols used by the user device(s) 120. Some non-limiting examples of suitable communications antennas include Wi-Fi antennas, IEEE 802.11 family of standards compatible antennas, directional antennas, non-directional antennas, dipole antennas, folded dipole antennas, patch antennas, MIMO antennas, or the like. The communications antenna may be communicatively coupled to a radio component to transmit and/or receive signals, such as communications signals, to and/or from the user devices 120 (e.g., 122, 124, 126, or 128).

[0034] Any of the user devices 120 (e.g., 122, 124, 126, or 128) may include any suitable radio and/or transceiver for transmitting and/or receiving radio frequency (RF) signals in the bandwidth and/or channels corresponding to the communications protocols utilized by any of the user device(s) 120 to communicate with each other. The radio components may include hardware and/or software to modulate and/or demodulate communications signals according to pre- established transmission protocols. The radio components may further have hardware and/or software instructions to communicate via one or more Wi-Fi and/or Wi-Fi Direct protocols, as standardized by the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards.

[0035] Some embodiments may be used in conjunction with devices and/or networks operating in accordance with existing. Wireless Fidelity (Wi-Fi) Alliance (WFA) Specifications, including Wi-Fi Neighbor Awareness Networking (NAN) Technical Specification (e.g., NAN and NAN2) and/or future versions and/or derivatives thereof, devices and/or networks operating in accordance with existing WFA Peer-to-Peer (P2P) specifications and/or future versions and/or derivatives thereof, devices and/or networks operating in accordance with existing Wireless- Gigabit-Alliance (WGA) specifications (Wireless Gigabit Alliance, Inc. WiGig MAC and PHY Specification) and/or future versions and/or derivatives thereof, devices and/or networks operating in accordance with existing IEEE 802.11 standards and/or amendments (e.g., 802.11b, 802. l lg, 802.11η, 802.1 lac, 802.1 lax, 802. Had, 802.1 lay, 802.1 laz, etc.).

[0036] In certain example embodiments, the radio component, in cooperation with the communications antennas, may be configured to communicate via 2.4 GHz channels (e.g., 802.11b, 802. l lg, 802.11n), 5 GHz channels (e.g., 802.11n, 802.1 lac), or 60 GHz channels (e.g., 802.11ad, 802.11ay). In some embodiments, non-Wi-Fi protocols may be used for communications between devices, such as Bluetooth, dedicated short-range communication (DSRC), ultra-high frequency (UHF) (e.g., IEEE 802.1 laf, IEEE 802.22), white band frequency (e.g., white spaces), or other packetized radio communications. The radio component may include any known receiver and baseband suitable for communicating via the communications protocols. The radio component may further include a low noise amplifier (LNA), additional signal amplifiers, an analog-to-digital (AID) converter, one or more buffers, and a digital baseband.

[0037] One or more illustrative user device(s) 120 may be operable by one or more user(s) 110. It should be noted that any addressable unit may be a station (STA). An STA may take on multiple distinct characteristics, each of which shape its function. For example, a single addressable unit might simultaneously be a portable STA, a quality-of-service (QoS) STA, a dependent STA, and a hidden STA. The one or more illustrative user device(s) 120 may be ST As. The one or more illustrative user device(s) 120 may operate as a personal basic service set (PBSS) control point/access point (PCP/AP). The user device(s) 120 (e.g., 122, 124, 126, or 128) may include any suitable processor-driven device including, but not limited to, a mobile device or a non-mobile, e.g., a static, device. For example, user device(s) 120 may include, a user equipment (UE), a station (STA), an access point (AP), a software enabled AP (SoftAP), a personal computer (PC), a wearable wireless device (e.g., bracelet, watch, glasses, ring, etc.), a desktop computer, a mobile computer, a laptop computer, an ultrabook™ computer, a notebook computer, a tablet computer, a server computer, a handheld computer, a handheld device, an internet of things (IoT) device, a sensor device, a PDA device, a handheld PDA device, an on-board device, an off-board device, a hybrid device (e.g., combining cellular phone functionalities with PDA device functionalities), a consumer device, a vehicular device, a non-vehicular device, a mobile or portable device, a non-mobile or non-portable device, a mobile phone, a cellular telephone, a PCS device, a PDA device which incorporates a wireless communication device, a mobile or portable GPS device, a DVB device, a relatively small computing device, a non-desktop computer, a "carry small live large" (CSLL) device, an ultra-mobile device (UMD), an ultra-mobile PC (UMPC), a mobile internet device (MID), an "origami" device or computing device, a device that supports dynamically composable computing (DCC), a context-aware device, a video device, an audio device, an A/V device, a set-top-box (STB), a Blu-ray disc (BD) player, a BD recorder, a digital video disc (DVD) player, a high definition (HD) DVD player, a DVD recorder, a HD DVD recorder, a personal video recorder (PVR), a broadcast HD receiver, a video source, an audio source, a video sink, an audio sink, a stereo tuner, a broadcast radio receiver, a flat panel display, a personal media player (PMP), a digital video camera (DVC), a digital audio player, a speaker, an audio receiver, an audio amplifier, a gaming device, a data source, a data sink, a digital still camera (DSC), a media player, a smartphone, a television, a music player, or the like. Other devices, including smart devices such as lamps, climate control, car components, household components, appliances, etc. may also be included in this list.

[0038] As used herein, the term "Internet of Things (IoT) device" is used to refer to any object (e.g., an appliance, a sensor, etc.) that has an addressable interface (e.g., an Internet protocol (IP) address, a Bluetooth identifier (ID), a near-field communication (NFC) ID, etc.) and can transmit information to one or more other devices over a wired or wireless connection. An IoT device may have a passive communication interface, such as a quick response (QR) code, a radio-frequency identification (RFID) tag, an NFC tag, or the like, or an active communication interface, such as a modem, a transceiver, a transmitter-receiver, or the like. An IoT device can have a particular set of attributes (e.g., a device state or status, such as whether the IoT device is on or off, open or closed, idle or active, available for task execution or busy, and so on, a cooling or heating function, an environmental monitoring or recording function, a light-emitting function, a sound-emitting function, etc.) that can be embedded in and/or controlled/monitored by a central processing unit (CPU), microprocessor, ASIC, or the like, and configured for connection to an IoT network such as a local ad-hoc network or the Internet. For example, IoT devices may include, but are not limited to, refrigerators, toasters, ovens, microwaves, freezers, dishwashers, dishes, hand tools, clothes washers, clothes dryers, furnaces, air conditioners, thermostats, televisions, light fixtures, vacuum cleaners, sprinklers, electricity meters, gas meters, etc., so long as the devices are equipped with an addressable communications interface for communicating with the IoT network. IoT devices may also include cell phones, desktop computers, laptop computers, tablet computers, personal digital assistants (PDAs), etc. Accordingly, the IoT network may be comprised of a combination of "legacy" Internet-accessible devices (e.g., laptop or desktop computers, cell phones, etc.) in addition to devices that do not typically have Internet-connectivity (e.g., dishwashers, etc.).

[0039] The user device(s) 120 may also include mesh stations in, for example, a mesh network, in accordance with one or more IEEE 802.11 standards and/or 3GPP standards.

[0040] Any of the user devices 120 (e.g., 122, 124, 126, or 128) may be configured to communicate with each other and any other component of the wireless network 100 directly and/or via one or more communications networks 130, wirelessly or wired. Any of the communications networks 130 may include, but not be limited to, any one of a combination of different types of suitable communications networks such as, for example, broadcasting networks, cable networks, public networks (e.g., the Internet), private networks, wireless networks, cellular networks, or any other suitable private and/or public networks. Further, any of the communications networks 130 may have any suitable communication range associated therewith and may include, for example, global networks (e.g., the Internet), metropolitan area networks (MANs), wide area networks (WANs), local area networks (LANs), or personal area networks (PANs). In addition, any of the communications networks 130 may include any type of medium over which network traffic may be carried including, but not limited to, coaxial cable, twisted-pair wire, optical fiber, a hybrid fiber coaxial (HFC) medium, microwave terrestrial transceivers, radio frequency communication mediums, white space communication mediums, ultra-high frequency communication mediums, satellite communication mediums, or any combination thereof.

[0041] Any of the user devices 120 (e.g., 122, 124, 126, or 128) may include one or more communications antennas. Communications antennas may be any suitable type of antenna corresponding to the communications protocols used by the user device(s) 120. Some non-limiting examples of suitable communications antennas include Wi-Fi antennas, IEEE 802.11 family of standards compatible antennas, directional antennas, non-directional antennas, dipole antennas, folded dipole antennas, patch antennas, MIMO antennas, or the like. The communications antenna may be communicatively coupled to a radio component to transmit and/or receive signals, such as communications signals, to and/or from the user devices 120 (e.g., 122, 124, 126, or 128).

[0042] Any of the user devices 120 (e.g., 122, 124, 126, or 128) may include any suitable radio and/or transceiver for transmitting and/or receiving radio frequency (RE) signals in the bandwidth and/or channels corresponding to the communications protocols utilized by any of the user device(s) 120 to communicate with each other. The radio components may include hardware and/or software to modulate and/or demodulate communications signals according to pre- established transmission protocols. The radio components may further have hardware and/or software instructions to communicate via one or more Wi-Fi and/or Wi-Fi Direct protocols, as standardized by the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards.

[0043] Some embodiments may be used in conjunction with devices and/or networks operating in accordance with existing. Wireless Fidelity (Wi-Fi) Alliance (WFA) Specifications, including Wi-Fi Neighbor Awareness Networking (NAN) Technical Specification (e.g., NAN and NAN2) and/or future versions and/or derivatives thereof, devices and/or networks operating in accordance with existing WFA Peer-to-Peer (P2P) specifications and/or future versions and/or derivatives thereof, devices and/or networks operating in accordance with existing Wireless- Gigabit-Alliance (WGA) specifications (Wireless Gigabit Alliance, Inc. WiGig MAC and PHY Specification) and/or future versions and/or derivatives thereof, devices and/or networks operating in accordance with existing IEEE 802.11 standards and/or amendments (e.g., 802.11b, 802. l lg, 802.11η, 802.1 lac, 802.1 lax, 802. Had, 802.1 lay, 802.1 laz, etc.).

[0044] In certain example embodiments, the radio component, in cooperation with the communications antennas, may be configured to communicate via 2.4 GHz channels (e.g., 802.11b, 802. l lg, 802.11η), 5 GHz channels (e.g., 802.11η, 802.1 lac), or 60 GHz channels (e.g., 802. Had, 802. Hay). In some embodiments, non-Wi-Fi protocols may be used for communications between devices, such as Bluetooth, dedicated short-range communication (DSRC), ultra-high frequency (UHF) (e.g., IEEE 802.1 laf, IEEE 802.22), white band frequency (e.g., white spaces), or other packetized radio communications. The radio component may include any known receiver and baseband suitable for communicating via the communications protocols. The radio component may further include a low noise amplifier (LNA), additional signal amplifiers, an analog-to-digital (AID) converter, one or more buffers, and a digital baseband.

[0045] FIG. 2 depicts an illustrative schematic diagram 200 for NAN data path security provisioning using OWE, in accordance with one or more example embodiments of the present disclosure. Referring to FIG. 2, there is shown a NAN device A 202 communicating with a NAN device B 204.

[0046] At operation 205, NAN device A 202 that wishes to publish a service that requires security generates a public and private key pair. At operation 210, NAN device A 202 may generate a service discovery frame and includes a NAN OWE attribute, providing information associated with the desired group and the public key generated at operation 205.

[0047] At operation 215, NAN device A 202 may publish, broadcast, advertise, or otherwise communicate the service discovery frame to one or more user devices 120. At operation 220, NAN device B 204 may receive the service discovery frame from NAN device A 202. NAN device B 204 may determine to establish a secure association (SA) NDP with a peer NAN device (e.g., NAN device A 202) that publishes support for OWE provisioning. At operation 225, NAN device B 204 may generate it public and private key pair. At operation 230, NAN device B may compute a shared secret and derive a PMK. At operation 235, NAN device B 204 may generate and send an NDP request which includes a NAN OWE attribute, including the public key generated at operation 225, and the corresponding NAN security attributes (with information based on the derived PMK).

[0048] In some embodiments, if a PMKID is included in the Security Context Information attribute along with NAN OWE attribute in the service discovery frame, the receiving NAN device (e.g., NAN device B 204) that has a PMKSA with a matching PMKID for the same service instance should not include a NAN OWE attribute in the NDP Request frame. In this case, a cached PMKSA will be used.

[0049] At operation 240, NAN device A 202 may receive an NDP request with a NAN OWE attribute. In some embodiments, the NAN device A 202 may validate the received parameters to ensure they conform to the parameters defined in the NAN specification. In case of invalid parameters, the NAN device A 202 should respond with an NDP response setting the NDP attribute status set to rejected. In some embodiments, the NAN device that receives the NDP response (e.g., NAN device B 204) may resend an NDP request with updated parameters. Upon validation of the parameters of the NDP request by NAN device A 202, NAN device A 202 may generate the shared secret using the public key associated with NAN device B 204 obtained from the NDP request. NAN device A 202 may then derive the PMK from the shared secret. At block 245, the shared secret and derived PMK may be known to both NAN device A 202 and NAN device B 204, at which point the SA NDP establishment may commence.

[0050] At operation 250, NAN device A 202 may continue to process the NDP request, and continue the NDP establishment as defined in the NAN specification. For example, NAN device A 202 may generate and send an NDP response. At operation 255, NAN device B 204 may generate and send an NDP confirmation for an SA NDP. At operation 260, NAN device A 202 may initiate the establishment of the NDP between NAN device A 202 and NAN device B 204. At operation 265, NAN device A 202 and NAN device B 204 may store their respectively derived PMKs for future use. At operation 270, if the service discovery frame from NAN device A 202 includes a PMKTD that matches a PMKSA known to NAN device B 204, the corresponding PMK may be used and the SA NDP establishment may continue as defined in the NAN specification without PMK derivation, as exemplified in operations 205 to 240.

[0051] Table 1 shows the NAN OWE attribute definition, which may be used in communications between NAN device A 202 and NAN device B 204.

Table 1 : NAN OWE Attribute definition:

[0052] The attribute ID field is indicative of the type of NAN attribute. The length field indicates the length of the following fields in the attribute. The publish ID field identifies a Publish Service Instance. The group field indicates a domain parameter set. The public key field is the encoding of the public key that is included in the attribute.

[0053] It is understood that the above descriptions are for purposes of illustration and are not meant to be limiting.

[0054] FIG. 3 illustrates a flow diagram of illustrative process 300 for an illustrative NAN data path security provisioning using OWE system, in accordance with one or more example embodiments of the present disclosure.

[0055] At block 302, a device (e.g., the user device(s) 120 of FIG. 1) may cause to publish a service with support for opportunistic wireless encryption (OWE). In some embodiments, the device 120 may generate a Service Discovery frame. A Service Discovery frame may be a type of management frame that are exchanged between devices to join a wireless network. Service discovery frames may be transmitted by a device 120 and may contain information that nearby user devices 120 need prior to initiating a request to join a network.

[0056] At block 304, the device may identify a neighbor awareness network (NAN) data path (NDP) request received from a NAN device, the NDP request comprising one or more parameters. Examples of the parameters may include an OWE attribute, device capabilities, and the like.

[0057] At block 306, the device may determine a shared secret with a NAN device and derive a pairwise master key (PMK), further discussed in FIGs. 4A-4B. The shared secret and derived PMK may be used by the NAN devices to establish a secure association NDP.

[0058] It is understood that the above descriptions are for purposes of illustration and are not meant to be limiting.

[0059] FIG. 4A illustrates a flow diagram of an illustrative process 400 for NAN data path security provisioning using OWE system, in accordance with one or more example embodiments of the present disclosure. At block 402, a NAN device (e.g., NAN device A 202) may generate a private/public key pair. At block 404, NAN device A 202 may cause to publish a service indicating support for OWE. In some embodiments, NAN device A 202 may generate a service discovery frame which includes an indication that it supports OWE. For example, NAN device A 202 may advertise support for OWE using an authentication and key management (AKM) suite selector for OWE, which may be added to the robust security network (RSN) network element in all frames issued or sent by the user device. The public key of the user device may be encoded in the service discovery frame. In some embodiments, the public key may be encoded using the integer-to-octet string conversion technique.

[0060] At block 406, NAN device A 202 may receive an NDP request from NAN device B 204 that includes a public key associated with NAN device B 204. In some embodiments, the NDP request may be responsive to receiving the service discovery frame. OWE association may be indicated in information added to requests and responses between devices in elements. Each element may have an element identifier, a length, and a value field that is element specific. For instance, OWE may add a Diffie-Hellman parameter element. The publishing NAN device may add their public key while the NAN device requesting to establish an SA NDP may add their respective public key. NAN device B 204 may indicate in the NDP request the OWE AKM in the RSM element portion of the request and may include a Diffie-Hellman parameter element.

[0061] At block 408, NAN device A 202 may determine a shared secret and may derive a pairwise master key (PMK) based on the shared secret. In some embodiments, the shared secret using the Diffie-Hellman algorithm and create a PMK and its associated identifier (PMKID). For example, given a private key (of NAN device A 202) and the peer's (NAN device B 204) public key, a shared secret may be generated and a PMK may be derived. At block 410, NAN device A 202 may cause to transmit an NDP response. In some embodiments, NAN device A 202 may initiate a 4-way handshake with NAN device B 204 using the PMK generated. The 4-way handshake may generate a Key-Encrypting Key (KEK), a Key-Confirmation Key (KCK), and a message integrity code (MIC) to use for protection of the frames that define the 4-way handshake.

[0062] At block 412, NAN device A 202 may receive an NDP confirm from NAN device B 204 to proceed with the 4-way handshake initiated by NAN device A 202.

[0063] At block 414, NAN device A 202 may initiate an SA NDP with NAN device B 204 in response to receiving the NDP confirmation. The result of the 4-way handshake is encryption keys to protect bulk unicast data and broadcast data.

[0064] At block 416, NAN device A 202 may optionally store the derived PMK for later use for the instance of the service for PMK caching. If PMK caching is enabled, NAN device A 202 and NAN device B may cache their respectively derived PMK for a certain period of time. NAN device B 204 may indicate to enable PMK caching by including the identifying PMKID in the NDP request (e.g., NDP request of block 406). If NAN device A 202 has cached the PMK identified by the PMKID, it includes the PMKID in the response to the NDP request at block 410. Otherwise, the PMKID may be ignored and the authentication process may proceed.

[0065] FIG. 4B illustrates a flow diagram of an illustrative process 450 for NAN data path security provisioning using OWE system, in accordance with one or more example embodiments of the present disclosure. [0066] At block 452, a NAN device (e.g., NAN device B 204) may detect a published service. In some embodiments, NAN device B 204 may receive a service discovery frame issued or transmitted by a NAN device (e.g., NAN device A 202). At block 454, NAN device B 204 may obtain a public key from the publishing NAN device (e.g., NAN device A 202). For example, NAN device B 204 may obtain the public key associated with the publishing NAN device from the service discovery frame received at block 452.

[0067] At block 456, NAN device B 204 may generate a local public/private key pair. At block 458, NAN device B 204 may determine a shared secrete with the publishing NAN device (e.g., NAN device A 202) and derive a pairwise master key. In some embodiments, NAN device B 204 may use its own private key and the public key from the publishing NAN device to generate a shared secret. In some embodiments, the shared secret may be generated based on the Diffie- Hellman algorithm. NAN device B 204 may create a PMK based on the shared secret and generate its associated identifier (PMKID). For example, given a local private key (e.g., of NAN device B 204) and the public key of publishing NAN device (e.g., NAN device A 202), a shared secret may be generated and a PMK may be derived.

[0068] At block 460, NAN device B 204 may cause to transmit an NDP request to establish an SA NDP. The request may include an OWE attribute.

[0069] At block 462, NAN device B 204 may receive an NDP response from the publishing NAN device indicating that an SA NDP may be established. At block 464, NAN device B 204 may cause to transmit an NDP confirmation to the publishing NAN device, confirming that the SA NDP to be established. At block 466, NAN device A 202 may initiate a 4-way handshake to the NAN device B 204 using the PMK generated by NAN device A 202. Optionally, NAN device B 204 may store the PMK generated at block 458 for later use if PMKSA caching is enabled.

[0070] FIG. 5 shows a functional diagram of an exemplary communication station 500 in accordance with some embodiments. In one embodiment, FIG. 5 illustrates a functional block diagram of a communication station that may be suitable for use as a user device 120 (FIG. 1) in accordance with some embodiments. The communication station 500 may also be suitable for use as a handheld device, a mobile device, a cellular telephone, a smartphone, a tablet, a netbook, a wireless terminal, a laptop computer, a wearable computer device, a femtocell, a high data rate (HDR) subscriber station, an access point, an access terminal, or other personal communication system (PCS) device.

[0071] The communication station 500 may include communications circuitry 502 and a transceiver 510 for transmitting and receiving signals to and from other communication stations using one or more antennas 501. The communications circuitry 502 may include circuitry that can operate the physical layer (PHY) communications and/or media access control (MAC) communications for controlling access to the wireless medium, and/or any other communications layers for transmitting and receiving signals. The communication station 500 may also include processing circuitry 506 and memory 508 arranged to perform the operations described herein. In some embodiments, the communications circuitry 502 and the processing circuitry 506 may be configured to perform operations detailed in FIGs. 2, 3, 4A and a4B.

[0072] In accordance with some embodiments, the communications circuitry 502 may be arranged to contend for a wireless medium and configure frames or packets for communicating over the wireless medium. The communications circuitry 502 may be arranged to transmit and receive signals. The communications circuitry 502 may also include circuitry for modulation/demodulation, upconversion/downconversion, filtering, amplification, etc. In some embodiments, the processing circuitry 506 of the communication station 500 may include one or more processors. In other embodiments, two or more antennas 501 may be coupled to the communications circuitry 502 arranged for sending and receiving signals. The memory 508 may store information for configuring the processing circuitry 506 to perform operations for configuring and transmitting message frames and performing the various operations described herein. The memory 508 may include any type of memory, including non-transitory memory, for storing information in a form readable by a machine (e.g., a computer). For example, the memory 508 may include a computer-readable storage device, read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices and other storage devices and media.

[0073] In some embodiments, the communication station 500 may be part of a portable wireless communication device, such as a personal digital assistant (PDA), a laptop or portable computer with wireless communication capability, a web tablet, a wireless telephone, a smartphone, a wireless headset, a pager, an instant messaging device, a digital camera, an access point, a television, a medical device (e.g., a heart rate monitor, a blood pressure monitor, etc.), a wearable computer device, or another device that may receive and/or transmit information wirelessly.

[0074] In some embodiments, the communication station 500 may include one or more antennas 501. The antennas 501 may include one or more directional or omnidirectional antennas, including, for example, dipole antennas, monopole antennas, patch antennas, loop antennas, microstrip antennas, or other types of antennas suitable for transmission of RF signals. In some embodiments, instead of two or more antennas, a single antenna with multiple apertures may be used. In these embodiments, each aperture may be considered a separate antenna. In some multiple-input multiple-output (MIMO) embodiments, the antennas may be effectively separated for spatial diversity and the different channel characteristics that may result between each of the antennas and the antennas of a transmitting station.

[0075] In some embodiments, the communication station 500 may include one or more of a keyboard, a display, a non-volatile memory port, multiple antennas, a graphics processor, an application processor, speakers, and other mobile device elements. The display may be an LCD screen including a touch screen.

[0076] Although the communication station 500 is illustrated as having several separate functional elements, two or more of the functional elements may be combined and may be implemented by combinations of software-configured elements, such as processing elements including digital signal processors (DSPs), and/or other hardware elements. For example, some elements may include one or more microprocessors, DSPs, field-programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), radio-frequency integrated circuits (RFICs) and combinations of various hardware and logic circuitry for performing at least the functions described herein. In some embodiments, the functional elements of the communication station 500 may refer to one or more processes operating on one or more processing elements.

[0077] Certain embodiments may be implemented in one or a combination of hardware, firmware, and software. Other embodiments may also be implemented as instructions stored on a computer-readable storage device, which may be read and executed by at least one processor to perform the operations described herein. A computer-readable storage device may include any non-transitory memory mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a computer-readable storage device may include read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices, and other storage devices and media. In some embodiments, the communication station 500 may include one or more processors and may be configured with instructions stored on a computer-readable storage device memory.

[0078] FIG. 6 illustrates a block diagram of an example of a machine 600 or system upon which any one or more of the techniques (e.g., methodologies) discussed herein may be performed. In other embodiments, the machine 600 may operate as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the machine 600 may operate in the capacity of a server machine, a client machine, or both in server-client network environments. In an example, the machine 600 may act as a peer machine in peer-to- peer (P2P) (or other distributed) network environments. The machine 600 may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile telephone, a wearable computer device, a web appliance, a network router, a switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine, such as a base station. Further, while only a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein, such as cloud computing, software as a service (SaaS), or other computer cluster configurations.

[0079] Examples, as described herein, may include or may operate on logic or a number of components, modules, or mechanisms. Modules are tangible entities (e.g., hardware) capable of performing specified operations when operating. A module includes hardware. In an example, the hardware may be specifically configured to carry out a specific operation (e.g., hardwired). In another example, the hardware may include configurable execution units (e.g., transistors, circuits, etc.) and a computer-readable medium containing instructions where the instructions configure the execution units to carry out a specific operation when in operation. The configuring may occur under the direction of the executions units or a loading mechanism. Accordingly, the execution units are communicatively coupled to the computer-readable medium when the device is operating. In this example, the execution units may be a member of more than one module. For example, under operation, the execution units may be configured by a first set of instructions to implement a first module at one point in time and reconfigured by a second set of instructions to implement a second module at a second point in time.

[0080] The machine (e.g., computer system) 600 may include a hardware processor 602 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory 604 and a static memory 606, some or all of which may communicate with each other via an interlink (e.g., bus) 608. The machine 600 may further include a power management device 632, a graphics display device 610, an alphanumeric input device 612 (e.g., a keyboard), and a user interface (UI) navigation device 614 (e.g., a mouse). In an example, the graphics display device 610, alphanumeric input device 612, and UI navigation device 614 may be a touch screen display. The machine 600 may additionally include a storage device (i.e., drive unit) 616, a signal generation device 618 (e.g., a speaker), a NAN data path security provisioning using OWE device 619, a network interface device/transceiver 620 coupled to antenna(s) 630, and one or more sensors 628, such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensor. The machine 600 may include an output controller 634, such as a serial (e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate with or control one or more peripheral devices (e.g., a printer, a card reader, etc.)).

[0081] The storage device 616 may include a machine- readable medium 622 on which is stored one or more sets of data structures or instructions 624 (e.g., software) embodying or utilized by any one or more of the techniques or functions described herein. The instructions 624 may also reside, completely or at least partially, within the main memory 604, within the static memory 606, or within the hardware processor 602 during execution thereof by the machine 600. In an example, one or any combination of the hardware processor 602, the main memory 604, the static memory 606, or the storage device 616 may constitute machine-readable media.

[0082] The NAN data path security provisioning using OWE device 619 may carry out or perform any of the operations and processes (e.g., process 300, 400, 450) described and shown above.

[0083] In some embodiments, the NAN data path security provisioning using OWE device

619 may advertise or otherwise communicate to nearby devices by publishing, broadcasting, or otherwise communicating information about a network. The NAN data path security provisioning using OWE device 619 may generate public/private key. The NAN data path security provisioning using OWE device 619 may generate a service discovery frame that includes information about the network. The NAN data path security provisioning using OWE device 619 may include an indication that it supports OWE and its public key as part of the service attributes of the service discovery frame.

[0084] Upon receiving an NDP request with public key information from the NAN device, the NAN data path security provisioning using OWE device 619 may use the public key to compute a shared secret and corresponding PMK based on the Diffie-Hellman scheme. Thus, the publishing NAN data path security provisioning using OWE device 619 and the NAN device may each have the shared secret and corresponding PMK without having to communicate them to each other.

[0085] The NDP between the NAN data path security provisioning using OWE device 619 and the NAN device may be established, for example, as defined in the NAN specification, using the derived PMK of each of the devices. In some embodiments, the NAN data path security provisioning using OWE device 619 may enact pairwise master key security association (PMKSA) caching in conjunction with the OWE PMK derivation. If a PMK identifier (PMKID) is included in the security context information attribute along with the Diffie-Hellman parameter in the service discovery frame, the receiving NAN device that has a PMKSA with a matching PMKID should not include the Diffie-Hellman parameter in the NDP request frame, as the cashed PMKSA will be used in establishing the NDP between the devices.

[0086] In some embodiments, the derived PMK on each of the devices may be associated with an expiration date. Upon expiration of the PMK, the devices will need to derive a new PMK for future use.

[0087] The NAN data path security provisioning using OWE device 619 may also perform the functionality of the NAN device that determines to establish an SA NDP with a publishing NAN device.

[0088] It is understood that the above are only a subset of what the NAN data path security provisioning using OWE device 619 may be configured to perform and that other functions included throughout this disclosure may also be performed by the NAN data path security provisioning using OWE device 619.

[0089] While the machine-readable medium 622 is illustrated as a single medium, the term "machine-readable medium" may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) configured to store the one or more instructions 624.

[0090] Example 1 may include a first neighbor awareness networking (NAN) device, the device comprising memory and processing circuitry configured to: cause, by the first NAN device, to send a NAN service discovery frame to a second NAN device, wherein the NAN service discovery frame includes an indication for support for opportunistic wireless encryption (OWE); receive, from the second NAN device, a secure association (SA) NAN data path (NDP) request, the SA NDP request comprising one or more parameters; determine, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; establish the SA NDP based at least in part on the PMK.

[0091] Example 2 may include the first NAN device of example 1 and/or some other example herein, wherein the memory and the processing circuitry are further configured to validate the one or more parameters, wherein the one or more parameters comprise a NAN OWE attribute, a public key, or a corresponding NAN security attributes.

[0092] Example 3 may include the first NAN device of example 1 and/or some other example herein, wherein the memory and the processing circuitry is further configured to: determine the one or more parameters are invalid parameters; and determine to respond with an SA NDP response including an NDP attribute status indicting a rejection of the SA NDP request.

[0093] Example 4 may include the first NAN device of example 1 and/or some other example herein, wherein to determine the shared secret and the PMK, comprises the memory and the processing circuitry being further configured to: cause to transmit a first public key associated with the first NAN device to the second NAN device; receive, from the second NAN device, a second public key associated with the second NAN device; and determine the shared secret based on a private key associated with the first public key and the second public key.

[0094] Example 5 may include the first NAN device of example 4 and/or some other example herein, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

[0095] Example 6 may include the first NAN device of example 4 and/or some other example herein, wherein the first public key is included a service attribute of the service discovery frame.

[0096] Example 7 may include the first NAN device of example 1 and/or some other example herein, wherein the memory and the processing circuitry are further configured to store the shared secret and the PMK.

[0097] Example 8 may include the first NAN device of example 1 and/or some other example herein, wherein the shared secret and the PMK are associated with an expiration date.

[0098] Example 9 may include the first NAN device of example 1 and/or some other example herein, further comprising a transceiver configured to transmit and receive wireless signals.

[0099] Example 10 may include the first NAN device of example 9 and/or some other example herein, further comprising one or more antennas coupled to a transceiver.

[00100] Example 11 may include a non-transitory computer-readable medium storing computer-executable instructions which when executed by one or more processors result in performing operations comprising: receiving, by a first neighbor awareness networking (NAN) device, a NAN service discovery frame with support for opportunistic wireless encryption (OWE) associated with a second NAN device; determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; causing, by the first NAN device, to transmit a request for a secure association (SA) NAN data path (NDP) request to the second NAN device, the SA NDP request comprising one or more parameters that includes an OWE attribute; and causing to establish the SA NDP based at least in part on the PMK.

[00101] Example 12 may include the non-transitory computer-readable medium of example 11 and/or some other claim herein, wherein the indication includes a first public key associated with the second NAN device.

[00102] Example 13 may include the non-transitory computer-readable medium of example 12 and/or some other claim herein, wherein the operations for determining the shared secret and the PMK further comprise: obtaining the first public key associated with the first NAN device; generating a second public key and a private key corresponding to the second public key; and determining the shared secret based on the first public key and the private key.

[00103] Example 14 may include the non-transitory computer-readable medium of example 12 and/or some other claim herein, wherein the one or more parameters of the SA NDP request include the second public key associated with the first NAN device.

[00104] Example 15 may include the non-transitory computer-readable medium of example 12 and/or some other claim herein, wherein the shared secret and the PMK are based on a Diffie- Hellman algorithm.

[00105] Example 16 may include the non-transitory computer-readable medium of example 12 and/or some other claim herein, wherein the first public key is included as a service attribute of the service discovery frame.

[00106] Example 17 may include the non-transitory computer-readable medium of example 11 and/or some other claim herein, wherein the operations further comprise: storing the shared secret and the PMK.

[00107] Example 18 may include the non-transitory computer-readable medium of example 11 and/or some other claim herein, wherein the shared secret and the PMK are associated with an expiration date.

[00108] Example 19 may include a method comprising: causing, by a first neighbor awareness networking (NAN) device, to send a NAN service discovery frame to a second NAN device during a discovery window, wherein the NAN service discovery frame includes an indication for support for opportunistic wireless encryption (OWE); receiving, from the second NAN device, a secure association (SA) NAN data path (NDP) request, the SA NDP request comprising one or more parameters; determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; establishing the SA NDP based at least in part on the PMK.

[00109] Example 20 may include the method of example 19 and/or some other example herein, further comprising: validating the one or more parameters, wherein the one or more parameters comprise a NAN OWE attribute, a public key, or a corresponding NAN security attributes.

[00110] Example 21 may include the method of example 19 and/or some other example herein, further comprising: determining the one or more parameters are invalid parameters; and determining to respond with an SA NDP response including an NDP attribute status indicting a rejection of the SA NDP request.

[00111] Example 22 may include the method of example 19 and/or some other example herein, wherein determining the shared secret and the PMK further comprise: causing to transmit a first public key associated with the first NAN device to the second NAN device; receiving, from the second NAN device, a second public key associated with the second NAN device; and determining the shared secret based on the first public key and the second public key.

[00112] Example 23 may include the method of example 22 and/or some other example herein, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

[00113] Example 24 may include the method of example 22 and/or some other example herein, wherein the first public key is included as a service attribute of the service discovery frame.

[00114] Example 25 may include the method of example 19 and/or some other example herein, further comprising: storing the shared secret and the PMK.

[00115] Example 26 may include the method of example 19 and/or some other example herein, wherein the shared secret and the PMK are associated with an expiration date.

[00116] Example 27 may include the apparatus comprising means for performing a method as claimed in any one of examples 19-26.

[00117] Example 28 may include the system, comprising at least one memory device having programmed instruction that, in response to execution cause at least one processor to perform the method of any one of examples 19-26.

[00118] Example 29 may include the system, comprising at least one memory device having programmed instruction that, in response to execution cause at least one processor to perform the method of any one of examples 19-26.

[00119] Example 30 may include a non-transitory computer-readable medium storing computer-executable instructions which when executed by one or more processors result in performing operations comprising: causing, by the first NAN device, to send a NAN service discovery frame to a second NAN device, wherein the NAN service discovery frame includes an indication for support for opportunistic wireless encryption (OWE); receiving, from the second NAN device, a secure association (SA) NAN data path (NDP) request, the SA NDP request comprising one or more parameters; determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; establishing the SA NDP based at least in part on the PMK.

[00120] Example 31 may include the non-transitory computer-readable medium of example 30 and/or some other example herein, wherein the operations further comprise validating the one or more parameters, wherein the one or more parameters comprise a NAN OWE attribute, a public key, or a corresponding NAN security attributes. [00121] Example 32 may include the non-transitory computer-readable medium of example 30 and/or some other example herein, wherein the operations further comprise: determining the one or more parameters are invalid parameters; and determining to respond with an SA NDP response including an NDP attribute status indicting a rejection of the SA NDP request.

[00122] Example 33 may include the non-transitory computer-readable medium of example 30 and/or some other example herein, wherein to determine the shared secret and the PMK, comprises operations further comprising: causing to transmit a first public key associated with the first NAN device to the second NAN device; receiving, from the second NAN device, a second public key associated with the second NAN device; and determining the shared secret based on a private key associated with the first public key and the second public key.

[00123] Example 34 may include the non-transitory computer-readable medium of example 33 and/or some other example herein, wherein the shared secret and the PMK are based on a Diffie- Hellman algorithm.

[00124] Example 35 may include the non-transitory computer-readable medium of example 33 and/or some other example herein, wherein the first public key is included a service attribute of the service discovery frame.

[00125] Example 36 may include the non-transitory computer-readable medium of example 33 and/or some other example herein, wherein the operations further comprise: storing the shared secret and the PMK.

[00126] Example 37 may include the non-transitory computer-readable medium of example 30 and/or some other example herein, wherein the shared secret and the PMK are associated with an expiration date.

[00127] Example 38 may include an apparatus comprising: means for causing, by the first NAN device, to send a NAN service discovery frame to a second NAN device, wherein the NAN service discovery frame includes an indication for support for opportunistic wireless encryption (OWE); means for receiving, from the second NAN device, a secure association (SA) NAN data path (NDP) request, the SA NDP request comprising one or more parameters; means for determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; means for establishing the SA NDP based at least in part on the PMK. [00128] Example 39 may include the apparatus of example 38 and/or some other example herein, further comprising means for validating the one or more parameters, wherein the one or more parameters comprise a NAN OWE attribute, a public key, or a corresponding NAN security attributes.

[00129] Example 40 may include the apparatus of example 38 and/or some other example herein, further comprising: means for determining the one or more parameters are invalid parameters; and means for determining to respond with an SA NDP response including an NDP attribute status indicting a rejection of the SA NDP request.

[00130] Example 41 may include the apparatus of example 38 and/or some other example herein, wherein to determine the shared secret and the PMK, further comprises: means for causing to transmit a first public key associated with the first NAN device to the second NAN device; means for receiving, from the second NAN device, a second public key associated with the second NAN device; and means for determining the shared secret based on a private key associated with the first public key and the second public key.

[00131] Example 42 may include the apparatus of example 41 and/or some other example herein, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

[00132] Example 43 may include the apparatus of example 41 and/or some other example herein, wherein the first public key is included a service attribute of the service discovery frame.

[00133] Example 44 may include the apparatus of example 38 and/or some other example herein, further comprising: means for storing the shared secret and the PMK.

[00134] Example 45 may include the apparatus of example 38 and/or some other example herein, wherein the shared secret and the PMK are associated with an expiration date.

[00135] Example 46 may include a device, the device comprising memory and processing circuitry configured to: receive, by a first neighbor awareness networking (NAN) device, a NAN service discovery frame with support for opportunistic wireless encryption (OWE) associated with a second NAN device; determine, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; cause, by the first NAN device, to transmit a request for a secure association (SA) NAN data path (NDP) request to the second NAN device, the S A NDP request comprising one or more parameters that includes an OWE attribute; and cause to establish the SA NDP based at least in part on the PMK.

[00136] Example 47 may include the device of example 46 and/or some other example herein, wherein the indication includes a first public key associated with the second NAN device.

[00137] Example 48 may include the device of example 47 and/or some other example herein, wherein determining the shared secret and the PMK the memory and processing circuitry configured to: obtain the first public key associated with the first NAN device; generate a second public key and a private key corresponding to the second public key; and determine the shared secret based on the first public key and the private key.

[00138] Example 49 may include the device of example 47 and/or some other example herein, wherein the one or more parameters of the SA NDP request include the second public key associated with the first NAN device.

[00139] Example 50 may include the device of example 47 and/or some other example herein, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

[00140] Example 51 may include the device of example 47 and/or some other example herein, wherein the first public key is included as a service attribute of the service discovery frame.

[00141] Example 52 may include the device of example 46 and/or some other example herein, wherein the memory and processing circuitry configured to: store the shared secret and the PMK.

[00142] Example 53 may include the device of example 46 and/or some other example herein, wherein the shared secret and the PMK are associated with an expiration date.

[00143] Example 54 may include the device of example 47 and/or some other example herein, further comprising a transceiver configured to transmit and receive wireless signals.

[00144] Example 55 may include the device of example 54 and/or some other example herein, further comprising one or more antennas coupled to a transceiver.

[00145] Example 56 may include a method comprising: receiving, by a first neighbor awareness networking (NAN) device, a NAN service discovery frame with support for opportunistic wireless encryption (OWE) associated with a second NAN device; determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; causing, by the first NAN device, to transmit a request for a secure association (SA) NAN data path (NDP) request to the second NAN device, the SA NDP request comprising one or more parameters that includes an OWE attribute; and causing to establish the SA NDP based at least in part on the PMK.

[00146] Example 57 may include the method of example 56 and/or some other example herein, wherein the indication includes a first public key associated with the second NAN device.

[00147] Example 58 may include the method of example 57 and/or some other example herein, wherein determining the shared secret and the PMK further comprises: obtaining the first public key associated with the first NAN device; generating a second public key and a private key corresponding to the second public key; and determining the shared secret based on the first public key and the private key.

[00148] Example 59 may include the method of example 57 and/or some other example herein, wherein the one or more parameters of the SA NDP request include the second public key associated with the first NAN device.

[00149] Example 60 may include the method of example 57 and/or some other example herein, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

[00150] Example 61 may include the method of example 57 and/or some other example herein, wherein the first public key is included as a service attribute of the service discovery frame.

[00151] Example 62 may include the method of example 56 and/or some other example herein, further comprising: storing the shared secret and the PMK.

[00152] Example 63 may include the method of example 56 and/or some other example herein, wherein the shared secret and the PMK are associated with an expiration date.

[00153] Example 64 may include an apparatus comprising means for performing a method as claimed in any one of examples 56-63.

[00154] Example 65 may include a system, comprising at least one memory device having programmed instruction that, in response to execution cause at least one processor to perform the method of any one of claims 56-63.

[00155] Example 66 may include a system, comprising at least one memory device having programmed instruction that, in response to execution cause at least one processor to perform the method of any one of examples 56-63.

[00156] Example 67 may include an apparatus comprising: means for receiving, by a first neighbor awareness networking (NAN) device, a NAN service discovery frame with support for opportunistic wireless encryption (OWE) associated with a second NAN device; means for determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; means for causing, by the first NAN device, to transmit a request for a secure association (SA) NAN data path (NDP) request to the second NAN device, the SA NDP request comprising one or more parameters that includes an OWE attribute; and means for causing to establish the SA NDP based at least in part on the PMK.

[00157] Example 68 may include the apparatus of example 67 and/or some other example herein, wherein the indication includes a first public key associated with the second NAN device.

[00158] Example 69 may include the apparatus of example 68 and/or some other example herein, wherein determining the shared secret and the PMK further comprises: means for obtaining the first public key associated with the first NAN device; means for generating a second public key and a private key corresponding to the second public key; and means for determining the shared secret based on the first public key and the private key.

[00159] Example 70 may include the apparatus of example 68 and/or some other example herein, wherein the one or more parameters of the SA NDP request include the second public key associated with the first NAN device.

[00160] Example 71 may include the apparatus of example 68 and/or some other example herein, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

[00161] Example 72 may include the apparatus of example 68 and/or some other example herein, wherein the first public key is included as a service attribute of the service discovery frame.

[00162] Example 73 may include the apparatus of example 67 and/or some other example herein, further comprising: means for storing the shared secret and the PMK.

[00163] Example 74 may include the apparatus of example 67 and/or some other example herein, wherein the shared secret and the PMK are associated with an expiration date.

[00164] Example 75 may include an apparatus comprising means for performing a method as claimed in any of the preceding examples.

[00165] Example 76 may include a machine-readable storage including machine-readable instructions, when executed, to implement a method as claimed in any preceding example.

[00166] Example 77 may include a machine-readable storage including machine-readable instructions, when executed, to implement a method or realize an apparatus as claimed in any preceding example.

[00167] Example 78 may include one or more non-transitory computer-readable media comprising instructions to cause an electronic device, upon execution of the instructions by one or more processors of the electronic device, to perform one or more elements of a method described in or related to any of examples 1-77, or any other method or process described herein

[00168] Example 79 may include an apparatus comprising logic, modules, and/or circuitry to perform one or more elements of a method described in or related to any of examples 1-77, or any other method or process described herein.

[00169] Example 80 may include a method, technique, or process as described in or related to any of examples 1-77, or portions or parts thereof.

[00170] Example 81 may include an apparatus comprising: one or more processors and one or more computer readable media comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform the method, techniques, or process as described in or related to any of examples 1-77, or portions thereof.

[00171] Example 82 may include a method of communicating in a wireless network as shown and described herein.

[00172] Example 83 may include a system for providing wireless communication as shown and described herein.

[00173] Example 84 may include a device for providing wireless communication as shown and described herein.

[00174] Embodiments according to the disclosure are in particular disclosed in the attached claims directed to a method, a storage medium, a device and a computer program product, wherein any feature mentioned in one example category, e.g., method, can be claimed in another claim category, e.g., system, as well. The dependencies or references back in the attached claims are chosen for formal reasons only. However, any subject matter resulting from a deliberate reference back to any previous claims (in particular multiple dependencies) can be claimed as well, so that any combination of claims and the features thereof are disclosed and can be claimed regardless of the dependencies chosen in the attached claims. The subj ect-matter which can be claimed comprises not only the combinations of features as set out in the attached claims but also any other combination of features in the claims, wherein each feature mentioned in the claims can be combined with any other feature or combination of other features in the claims. Furthermore, any of the embodiments and features described or depicted herein can be claimed in a separate claims and/or in any combination with any embodiment or feature described or depicted herein or with any of the features of the attached claims.

[00175] The foregoing description of one or more implementations provides illustration and description, but is not intended to be exhaustive or to limit the scope of embodiments to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of various embodiments.

[00176] Various embodiments may be implemented fully or partially in software and/or firmware. This software and/or firmware may take the form of instructions contained in or on a non-transitory computer-readable storage medium. Those instructions may then be read and executed by one or more processors to enable performance of the operations described herein. The instructions may be in any suitable form, such as but not limited to source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. Such a computer- readable medium may include any tangible non-transitory medium for storing information in a form readable by one or more computers, such as but not limited to read-only memory (ROM); random-access memory (RAM); magnetic disk storage media; optical storage media; a flash memory, etc.

[00177] The term "machine-readable medium" may include any medium that is capable of storing, encoding, or carrying instructions for execution by the machine 600 and that cause the machine 600 to perform any one or more of the techniques of the present disclosure, or that is capable of storing, encoding, or carrying data structures used by or associated with such instructions. Non-limiting machine-readable medium examples may include solid-state memories and optical and magnetic media. In an example, a massed machine-readable medium includes a machine-readable medium with a plurality of particles having resting mass. Specific examples of massed machine-readable media may include non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), or electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD- ROM disks. [00178] The instructions 624 may further be transmitted or received over a communications network 626 using a transmission medium via the network interface device/transceiver 620 utilizing any one of a number of transfer protocols (e.g., frame relay, internet protocol (IP), transmission control protocol (TCP), user datagram protocol (HDP), hypertext transfer protocol (HTTP), etc.). Example communications networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), mobile telephone networks (e.g., cellular networks), plain old telephone (POTS) networks, wireless data networks (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards known as Wi- Fi®, IEEE 802.16 family of standards known as WiMax®), IEEE 802.15.4 family of standards, and peer-to-peer (P2P) networks, among others. In an example, the network interface device/transceiver 620 may include one or more physical jacks (e.g., Ethernet, coaxial, or phone jacks) or one or more antennas to connect to the communications network 626. In an example, the network interface device/transceiver 620 may include a plurality of antennas to wirelessly communicate using at least one of single-input multiple-output (SIMO), multiple-input multiple- output (MIMO), or multiple-input single-output (MISO) techniques. The term "transmission medium" shall be taken to include any intangible medium that is capable of storing, encoding, or carrying instructions for execution by the machine 600 and includes digital or analog communications signals or other intangible media to facilitate communication of such software. The operations and processes described and shown above may be carried out or performed in any suitable order as desired in various implementations. Additionally, in certain implementations, at least a portion of the operations may be carried out in parallel. Furthermore, in certain implementations, less than or more than the operations described may be performed.

[00179] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments. The terms "computing device," "user device," "communication station," "station," "handheld device," "mobile device," "wireless device" and "user equipment" (UE) as used herein refers to a wireless communication device such as a cellular telephone, a smartphone, a tablet, a netbook, a wireless terminal, a laptop computer, a femtocell, a high data rate (HDR) subscriber station, an access point, a printer, a point of sale device, an access terminal, or other personal communication system (PCS) device. The device may be either mobile or stationary.

[00180] As used within this document, the term "communicate" is intended to include transmitting, or receiving, or both transmitting and receiving. This may be particularly useful in claims when describing the organization of data that is being transmitted by one device and received by another, but only the functionality of one of those devices is required to infringe the claim. Similarly, the bidirectional exchange of data between two devices (both devices transmit and receive during the exchange) may be described as "communicating," when only the functionality of one of those devices is being claimed. The term "communicating" as used herein with respect to a wireless communication signal includes transmitting the wireless communication signal and/or receiving the wireless communication signal. For example, a wireless communication unit, which is capable of communicating a wireless communication signal, may include a wireless transmitter to transmit the wireless communication signal to at least one other wireless communication unit, and/or a wireless communication receiver to receive the wireless communication signal from at least one other wireless communication unit.

[00181] As used herein, unless otherwise specified, the use of the ordinal adjectives "first," "second," "third," etc., to describe a common object, merely indicates that different instances of like objects are being referred to and are not intended to imply that the objects so described must be in a given sequence, either temporally, spatially, in ranking, or in any other manner.

[00182] Some embodiments may be used in conjunction with various devices and systems, for example, a personal computer (PC), a desktop computer, a mobile computer, a laptop computer, a notebook computer, a tablet computer, a server computer, a handheld computer, a handheld device, a personal digital assistant (PDA) device, a handheld PDA device, an on-board device, an off- board device, a hybrid device, a vehicular device, a non-vehicular device, a mobile or portable device, a consumer device, a non-mobile or non-portable device, a wireless communication station, a wireless communication device, a wireless access point (AP), a wired or wireless router, a wired or wireless modem, a video device, an audio device, an audio-video (A/V) device, a wired or wireless network, a wireless area network, a wireless video area network (WVAN), a local area network (LAN), a wireless LAN (WLAN), a personal area network (PAN), a wireless PAN (WPAN), and the like. [00183] Some embodiments may be used in conjunction with one way and/or two-way radio communication systems, cellular radio-telephone communication systems, a mobile phone, a cellular telephone, a wireless telephone, a personal communication system (PCS) device, a PDA device which incorporates a wireless communication device, a mobile or portable global positioning system (GPS) device, a device which incorporates a GPS receiver or transceiver or chip, a device which incorporates an RFID element or chip, a multiple input multiple output (MIMO) transceiver or device, a single input multiple output (SEVIO) transceiver or device, a multiple input single output (MISO) transceiver or device, a device having one or more internal antennas and/or external antennas, digital video broadcast (DVB) devices or systems, multi- standard radio devices or systems, a wired or wireless handheld device, e.g., a smartphone, a wireless application protocol (WAP) device, or the like.

[00184] Some embodiments may be used in conjunction with one or more types of wireless communication signals and/or systems following one or more wireless communication protocols, for example, radio frequency (RF), infrared (IR), frequency-division multiplexing (FDM), orthogonal FDM (OFDM), time-division multiplexing (TDM), time-division multiple access (TDMA), extended TDMA (E-TDMA), general packet radio service (GPRS), extended GPRS, code-division multiple access (CDMA), wideband CDMA (WCDMA), CDMA 2000, single- carrier CDMA, multi-carrier CDMA, multi-carrier modulation (MDM), discrete multi-tone (DMT), Bluetooth®, global positioning system (GPS), Wi-Fi, Wi-Max, ZigBee, ultra-wideband (UWB), global system for mobile communications (GSM), 2G, 2.5G, 3G, 3.5G, 4G, fifth generation (5G) mobile networks, 3GPP, long term evolution (LTE), LTE advanced, enhanced data rates for GSM Evolution (EDGE), or the like. Other embodiments may be used in various other devices, systems, and/or networks.

[00185] Certain aspects of the disclosure are described above with reference to block and flow diagrams of systems, methods, apparatuses, and/or computer program products according to various implementations. It will be understood that one or more blocks of the block diagrams and flow diagrams, and combinations of blocks in the block diagrams and the flow diagrams, respectively, may be implemented by computer-executable program instructions. Likewise, some blocks of the block diagrams and flow diagrams may not necessarily need to be performed in the order presented, or may not necessarily need to be performed at all, according to some implementations.

[00186] These computer-executable program instructions may be loaded onto a special-purpose computer or other particular machine, a processor, or other programmable data processing apparatus to produce a particular machine, such that the instructions that execute on the computer, processor, or other programmable data processing apparatus create means for implementing one or more functions specified in the flow diagram block or blocks. These computer program instructions may also be stored in a computer-readable storage media or memory that may direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable storage media produce an article of manufacture including instruction means that implement one or more functions specified in the flow diagram block or blocks. As an example, certain implementations may provide for a computer program product, comprising a computer-readable storage medium having a computer- readable program code or program instructions implemented therein, said computer-readable program code adapted to be executed to implement one or more functions specified in the flow diagram block or blocks. The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational elements or steps to be performed on the computer or other programmable apparatus to produce a computer- implemented process such that the instructions that execute on the computer or other programmable apparatus provide elements or steps for implementing the functions specified in the flow diagram block or blocks.

[00187] Accordingly, blocks of the block diagrams and flow diagrams support combinations of means for performing the specified functions, combinations of elements or steps for performing the specified functions and program instruction means for performing the specified functions. It will also be understood that each block of the block diagrams and flow diagrams, and combinations of blocks in the block diagrams and flow diagrams, may be implemented by special-purpose, hardware-based computer systems that perform the specified functions, elements or steps, or combinations of special-purpose hardware and computer instructions.

[00188] Conditional language, such as, among others, "can," "could," "might," or "may," unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain implementations could include, while other implementations do not include, certain features, elements, and/or operations. Thus, such conditional language is not generally intended to imply that features, elements, and/or operations are in any way required for one or more implementations or that one or more implementations necessarily include logic for deciding, with or without user input or prompting, whether these features, elements, and/or operations are included or are to be performed in any particular implementation.

[00189] Many modifications and other implementations of the disclosure set forth herein will be apparent having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the disclosure is not to be limited to the specific implementations disclosed and that modifications and other implementations are intended to be included within the scope of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

Claims

CLAIMS What is claimed is:

1. A first neighbor awareness networking (NAN) device, the device comprising memory and processing circuitry configured to:

cause, by the first NAN device, to send a NAN service discovery frame to a second NAN device, wherein the NAN service discovery frame includes an indication for support for opportunistic wireless encryption (OWE);

receive, from the second NAN device, a secure association (SA) NAN data path (NDP) request, the SA NDP request comprising one or more parameters;

determine, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device;

establish the SA NDP based at least in part on the PMK.

2. The first NAN device of claim 1, wherein the memory and the processing circuitry are further configured to validate the one or more parameters, wherein the one or more parameters comprise a NAN OWE attribute, a public key, or a corresponding NAN security attributes.

3. The first NAN device of claim 1, wherein the memory and the processing circuitry is further configured to:

determine the one or more parameters are invalid parameters; and

determine to respond with an SA NDP response including an NDP attribute status indicting a rejection of the SA NDP request.

4. The first NAN device of claim 1, wherein to determine the shared secret and the PMK, comprises the memory and the processing circuitry being further configured to:

cause to transmit a first public key associated with the first NAN device to the second NAN device;

receive, from the second NAN device, a second public key associated with the second NAN device; and determine the shared secret based on a private key associated with the first public key and the second public key.

5. The first NAN device of claim 4, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

6. The first NAN device of claim 4, wherein the first public key is included in a service attribute of the service discovery frame.

7. The first NAN device of claim 1, wherein the memory and the processing circuitry are further configured to:

store the shared secret and the PMK.

8. The first NAN device of claim 1, wherein the shared secret and the PMK are associated with an expiration date.

9. The first NAN device of claim 1, further comprising a transceiver configured to transmit and receive wireless signals.

10. The first NAN device of claim 9, further comprising one or more antennas coupled to a transceiver.

11. A non-transitory computer-readable medium storing computer-executable instructions which when executed by one or more processors result in performing operations comprising: receiving, by a first neighbor awareness networking (NAN) device, a NAN service discovery frame with support for opportunistic wireless encryption (OWE) associated with a second NAN device;

determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device;

causing, by the first NAN device, to transmit a request for a secure association (SA) NAN data path (NDP) request to the second NAN device, the SA NDP request comprising one or more parameters that includes an OWE attribute; and

causing to establish the S A NDP based at least in part on the PMK.

12. The non-transitory computer-readable medium of claim \ 1, wherein the indication includes a first public key associated with the second NAN device.

13. The non-transitory computer-readable medium of claim 12, wherein the operations for determining the shared secret and the PMK further comprise:

obtaining the first public key associated with the first NAN device;

generating a second public key and a private key corresponding to the second public key; and

determining the shared secret based on the first public key and the private key.

14. The non-transitory computer*readable medium of claim 12, wherein the one or more parameters of the SA NDP request include the second public key associated with the first NAN device.

15. The non-transitory computer-readable medium of claim 12, wherein the shared secret and the PMK are based on a Diffie-Hellman algorithm.

16. The non-transitory computer-readable medium of claim 12, wherein the first public key is included as a service attribute of the service discovery frame.

17. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise;

storing the shared secret and the PMK.

18. The non-transitory computer-readable medium of claim 11 , wherein the shared secret and the PMK are associated with an expiration date.

19. A method comprising:

causing, by a first neighbor awareness networking (NAN) device, to send a NAN service discovery frame to a second NAN device during a discovery window, wherein the NAN service discovery frame includes an indication for support for opportunistic wireless encryption (OWE);

receiving, from the second NAN device, a secure association (SA) NAN data path (NDP) request, the SA NDP request comprising one or more parameters;

determining, by the first NAN device, a shared secret and a pairwise master key (PMK), the shared secret associated with the first NAN device and the second NAN device; establishing the SA NDP based at least in part on the PMK.

20. The method of claim 19, further comprising:

validating the one or more parameters, wherein the one or more parameters comprise a NAN OWE attribute, a public key, or a corresponding NAN security attributes.

21. The method of claim 19, further comprising:

determining the one or more parameters are invalid parameters; and

determining to respond with an S A NDP response including an NDP attribute status indicting a rejection of the SA NDP request.

22. The method of claim 19, wherein determining the shared secret and the PMK further comprise:

causing to transmit a first public key associated with the first NAN device to the second NAN device;

receiving, from the second NAN device, a second public key associated with the second NAN device; and

determining the shared secret based on the first public key and the second public key.

23. The method of claim 22, wherein the shared secret and the PMK are based on a Diffie- Hellman algorithm.

24. The method of claim 22, wherein the first public key is included as a service attribute of the service discovery frame.

25. The method of claim 19, further comprising:

storing the shared secret and the PMK.