WO2022144007A1 - 控制帧处理及生成方法、站点、接入点及存储介质 - Google Patents

控制帧处理及生成方法、站点、接入点及存储介质 Download PDF

Info

Publication number
WO2022144007A1
WO2022144007A1 PCT/CN2021/143958 CN2021143958W WO2022144007A1 WO 2022144007 A1 WO2022144007 A1 WO 2022144007A1 CN 2021143958 W CN2021143958 W CN 2021143958W WO 2022144007 A1 WO2022144007 A1 WO 2022144007A1
Authority
WO
WIPO (PCT)
Prior art keywords
control frame
mic
value
random value
check value
Prior art date
Application number
PCT/CN2021/143958
Other languages
English (en)
French (fr)
Inventor
张园园
顾胜东
张军一
Original Assignee
乐鑫信息科技（上海）股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 乐鑫信息科技（上海）股份有限公司 filed Critical 乐鑫信息科技（上海）股份有限公司
Priority to US18/260,211 priority Critical patent/US20240107313A1/en
Publication of WO2022144007A1 publication Critical patent/WO2022144007A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to a control frame processing method, a station, a control frame generation method, an access point, and a computer-readable storage medium.
  • Wi-Fi Alliance proposed a new generation of Wi-Fi protocol IEEE 802.11ax, whose primary purpose is to solve the problem of network capacity and improve network efficiency.
  • OFDMA Orthogonal Frequency Division Multiple Access
  • RU Resource Unit
  • AP Access Point
  • Communication improves the transmission efficiency of wireless networks.
  • the trigger frame can enable devices in the network that support the 802.11ax protocol to perform efficient OFDMA communication and improve network efficiency.
  • its powerful control capability and lack of effective protection make trigger frames or similar control frames easy to become a breakthrough for hackers to damage the network. Therefore, how to effectively protect the trigger frame or control frame so as to ensure the security of the network is the focus and difficulty of research in the field of wireless communication.
  • control frame processing method which is applied to a wireless communication site, including:
  • control frame sent by the access point
  • the control frame includes a check field
  • the check field includes a random value and a message integrity check (Message Integrity Check, MIC) check value
  • the method further includes:
  • control frame is discarded.
  • the method before parsing the received control frame and extracting the random value and the MIC check value, the method further includes:
  • the method before parsing the received control frame and extracting the random value and the MIC check value, the method further includes:
  • the method further includes:
  • control frame is a trigger frame used for resource allocation for uplink OFDMA transmission.
  • the MIC key is a MIC key multicast sent from the access point to the station.
  • the present application also provides a site, the site includes a processor and a memory; wherein, the memory is used to store program instructions;
  • the processor is configured to execute any one of the control frame processing methods described above according to the program instructions.
  • the present application also provides a computer-readable storage medium, where the computer-readable storage medium stores program instructions, and when the program instructions are executed, the operations of any one of the control frame processing methods described above are implemented.
  • the present application also provides a method for generating a control frame, which is applied to an access point of wireless communication, including:
  • the ciphertext of the random value and the ciphertext of the MIC check value are added to the control frame as check fields;
  • the control frame is sent to the station.
  • the check field includes: a control frame check field identifier, data type, data length and numerical information; wherein, the control frame check field identifier is used to identify whether the current field is a check field; the The data type is used to identify the type of the numerical information as a random value type or a MIC check value type; the data length is used to identify the length of the numerical information; the numerical information is used to identify the data type as random.
  • the value type indicates a corresponding random value, or when the data type is identified as a MIC check value, it indicates a corresponding MIC check value.
  • the random value is generated in a monotonically increasing or monotonically decreasing manner.
  • the present application also provides an access point, the access point includes a processor and a memory; wherein the memory is used to store program instructions;
  • the processor is configured to execute the operations of any one of the control frame generation methods described above according to the program instructions.
  • the present application also provides a computer-readable storage medium, where the computer-readable storage medium stores program instructions, and when the program instructions are executed, the operations of any one of the foregoing control frame generation methods are implemented.
  • the control frame processing method provided by the present application is applied to a wireless communication site, by receiving a control frame sent by an access point, the control frame includes a check field, and the check field includes a random value and a MIC check value;
  • the control frame is parsed, and the random value and the MIC check value are extracted; the random value and the MIC check value are decrypted using the data key from the access point, and the original random value is obtained.
  • Plaintext and the original plaintext of the MIC check value use the MIC key from the access point, the non-check field in the control frame and the random value to calculate the local MIC check value; determine the MIC check value Check whether the original plaintext of the value is consistent with the local MIC check value, and if so, perform a corresponding control operation according to the control frame.
  • the control frame processing method provided by the present application can effectively protect the control frame, prevent hackers from using the control frame to carry out wireless network attacks, and ensure the security of the network.
  • the present application uses the reserved field in the control frame to perform the encryption operation, and only encrypts the verification information, rather than encrypting the part of the frame body data.
  • the normal communication between the two parties will not be affected, and the compatibility is also taken into consideration while improving the security, and the scalability is stronger.
  • the part of the frame body data in this application is not encrypted, and the MIC check value is obtained from the frame body data and the MIC key, if the random number is not added, the attacker may pass the frame body data and the MIC key. The check value obtains the MIC check value. Therefore, the method of adding random numbers is adopted in this scheme to further improve the security of the network.
  • the present application also provides a station, a control frame generation method, an access point, and a computer-readable storage medium having at least the above technical advantages.
  • FIG. 1 schematically shows a schematic diagram of uplink OFDMA transmission based on trigger frame
  • FIG. 2 schematically shows a flow chart of a specific implementation manner of the control frame processing method provided by the present application
  • FIG. 3 schematically shows a schematic diagram of the format of a trigger frame
  • FIG. 4 schematically shows a flowchart of another specific implementation manner of the control frame processing method provided by the present application.
  • FIG. 5 schematically shows a structural block diagram of a specific implementation manner of a control frame processing apparatus provided by the present application
  • FIG. 6 schematically shows a structural block diagram of a specific implementation manner of a site provided by the present application
  • FIG. 7 schematically shows a flow chart of a specific implementation manner of the control frame generation method provided by the present application.
  • FIG. 8 schematically shows a structural block diagram of a specific implementation manner of the control frame generating apparatus provided by the present application.
  • FIG. 9 schematically shows a structural block diagram of the access point provided by the present application.
  • the access point informs all stations (STA) that the association ID (Association ID, AID), RU position, transmission time, and transmission power of the packet sending station are required by sending the trigger frame. and other information.
  • the station that receives the trigger frame compares its own AID with the AID in the trigger frame. If it recognizes that its own AID is the same as the AID in the trigger frame, it will perform the TB PPDU according to the specified parameters after the SIFS time after receiving the trigger frame. send.
  • the access point uses the MU-STA BA frame to reply to all stations.
  • the trigger frame is the key to the efficient transmission of the 802.11ax protocol.
  • the trigger frame As a control frame, the trigger frame is not protected by security measures.
  • the 802.11ax protocol stipulates that the trigger frame can be sent in any physical frame format except 802.11b, so the use of the trigger frame for denial of service (DoS) attacks such as Implementation costs are very low.
  • DoS denial of service
  • Hackers who use trigger frames to attack can make any one or more stations send packets at a specified RU with specified power, so that the attacked device cannot send and receive packets normally. For example, a hacker can send a trigger frame every 10ms, so that the attacker can send a 5ms TB PPDU packet on a 26tone RU with a very low transmit power. This kind of attack will almost not affect the normal communication of other devices in the network while paralyzing the victim.
  • the present application aims to solve the problem that the newly introduced trigger frame lacks an effective protection mechanism, so as to prevent hackers from using the trigger frame to conduct wireless network attacks, so as to ensure the security of the 802.11ax network.
  • FIG. 2 shows a flowchart of a specific implementation manner of the control frame processing method provided by the present application.
  • the method is applied to a wireless communication site, which specifically includes:
  • S201 Receive a control frame sent by an access point, where the control frame includes a check field, and the check field includes a random value and a MIC check value;
  • a check field is added to the control frame, and the check field includes a random value R and a MIC check value (Message Integrity Code).
  • the check field may include: a control frame check field identifier (AID), a data type (info_type), a data length (info_len), and numerical information (info_data); wherein, the control frame check field
  • the identification (AID) is used to identify whether the current field is a check field
  • the data type (info_type) is used to identify that the type of the numerical information is a random value type or a MIC check value type
  • the data length (info_len) is used is used to identify the length of the numerical information
  • the numerical information (info_data) is used to indicate a corresponding random value when the data type is identified as a random value type, or to indicate a corresponding random value when the data type is identified as a MIC check value MIC check value.
  • the trigger frame includes a MAC header, a common info field, and multiple user info fields.
  • the basic length of the user information (user info) field is 40 bits, and there will be some additional trigger frame information according to the different types of trigger frame subdivisions.
  • Each user information (user info) field consists of a 12-bit AID and a series of control information.
  • user information (user info) fields of several AIDs are added after the last valid user information (user info) field of the trigger frame for transmitting the check field.
  • the structure of the newly added user information (user info) check field is shown in Table 1.
  • info_type When info_type is 0, it indicates that the type of subsequent info_data is a random value R, and when info_type is 1, it indicates that the type of subsequent info_data is a MIC check value.
  • info_len indicates the length of valid data in info_data, in bytes.
  • info_data is a specific random value or MIC check value carried.
  • the access point (AP) can transmit a random value or MIC check value of any length by carrying a plurality of user information (user info) as described above in the transmitted control frame.
  • S203 Decrypt the random value and the MIC check value by using the data key from the access point to obtain the original plaintext of the random value and the original plaintext of the MIC check value;
  • the random value R rx_encry and the MIC check value MIC rx_encry are decrypted using the local data key from the access point to obtain the original plaintext R rx of the random value and the original plaintext MIC rx of the MIC check value.
  • the decryption method may adopt a symmetric algorithm such as the AES algorithm or an asymmetric algorithm, which is not limited here.
  • S204 Calculate the local MIC check value using the MIC key from the access point, the non-check field in the control frame, and the random value;
  • the local MIC check value MIC local is calculated using the MIC key from the access point, the non-check field in the control frame and the random value.
  • the MIC key is used to calculate the MIC check value, which can be the MIC key multicast sent from the access point to the station.
  • the control frame in this application is a variable-length control frame, which can support storing the check field. Control frames can be divided into check fields and non-check fields. As a specific implementation manner, the control frame may be a trigger frame.
  • S205 Determine whether the original plaintext of the MIC check value is consistent with the local MIC check value, and if so, perform a corresponding control operation according to the control frame.
  • control frame processing method provided by the present application may further include: after judging whether the original plaintext of the MIC check value is consistent with the local MIC check value, further comprising: if If the original plaintext of the MIC check value is inconsistent with the local MIC check value, the control frame is discarded. That is, when comparing the MIC local and the MIC rx , the control frame is discarded.
  • the control frame processing method provided by the present application can effectively protect the control frame, prevent hackers from using the control frame to carry out wireless network attacks, and ensure the security of the network.
  • the present application uses the reserved field in the control frame to perform the encryption operation, and only encrypts the verification information, rather than encrypting the part of the frame body data. Therefore, even if one of the two communication parties does not support the encryption method of the present application, the normal communication between the two parties will not be affected, and the compatibility is also taken into consideration while improving the security, and the scalability is stronger.
  • the part of the frame body data in this application is not encrypted, and the MIC check value is obtained from the frame body data and the MIC key, if the random number is not added, the attacker may pass the frame body data and the MIC key.
  • the check value obtains the MIC check value. Therefore, the method of adding random numbers is adopted in this scheme to further improve the security of the network.
  • the random value R rx obtained this time may also be recorded for the next verification process. Specifically, after obtaining the original plaintext of the random value and the original plaintext of the MIC check value, it can be judged whether the original plaintext of the decoded random value satisfies the condition of monotonically increasing or decreasing Under the condition of decreasing, the subsequent verification operation is performed. If the monotonically increasing or decreasing condition is not satisfied, the control frame is discarded. By setting the check condition, the security of the network is further ensured.
  • FIG. 4 A flowchart of another specific implementation of the control frame processing method provided by the present application is shown in FIG. 4 .
  • the control frame is taken as an example of a trigger frame, and a check field for determining whether the control frame is valid is added.
  • the operation process of judging whether the station and the access point have been associated, and judging whether the original plaintext of the random value satisfies the condition of monotonically increasing or decreasing. 4 the method specifically includes:
  • S401 Receive a trigger frame sent by an access point, where the trigger frame includes a check field, and the check field includes a random value and a MIC check value;
  • S402 Determine whether the trigger frame contains a valid check field; if so, enter S403; if not, enter S409;
  • S403 Determine whether the station is associated with the access point; if so, go to S404; if not, go to S408;
  • S405 Decrypt the random value and the MIC check value by using the data key from the access point to obtain the original plaintext of the random value and the original plaintext of the MIC check value;
  • S406 Determine whether the decoded original plaintext of the random value satisfies the condition of monotonically increasing or decreasing monotonically; if so, go to S407; if not, go to S409;
  • S407 Calculate a local MIC check value by using the MIC key from the access point, the non-check field in the trigger frame, and the random value, and determine that the original plaintext of the MIC check value is the same as the local MIC check value. Check whether the test values are consistent, if yes, go to S408; if not, go to S409;
  • the trigger frame is not checked and transmitted according to the 802.11ax protocol.
  • the station receives the data key and the MIC key from the access point when the station is associated with or has established a connection with the access point.
  • the site does not respond to the trigger frame. Otherwise, use the local MIC key from the receipt of the MAC header of the trigger frame to the last valid user info, that is, the user info that does not contain AID 4094, together with the decrypted R rx , use the decryption algorithm to calculate the MIC local . Finally, compare the MIC local with the MIC rx , and discard the trigger frame if the MIC local and the MIC rx are inconsistent. Otherwise, respond to the trigger frame according to the 802.11ax protocol, and record the random value R rx obtained this time for the next verification.
  • the decryption method may be AES-CBC.
  • This embodiment provides a trigger frame protection scheme that takes both compatibility and security into consideration.
  • the encryption operation is performed by using the reserved field in the trigger frame, and only the verification information is encrypted, not the part of the frame body data. Therefore, even if one of the two communication parties does not support the encryption method of the present application, it will not affect the normal communication of the two parties, and the compatibility is also taken into account while improving the security, and the scalability is stronger.
  • the part of the frame body data in this application is not encrypted, and the MIC check value is obtained from the frame body data and the MIC key, if the random number is not added, the attacker may pass the frame body data and the MIC key. The check value obtains the MIC check value. Therefore, the method of adding random numbers to determine its monotonous increase or decrease in this scheme further improves the security of the network.
  • the present application also provides a control frame processing apparatus, and the control frame processing apparatus is applied to a station of wireless communication.
  • a structural block diagram of a specific implementation manner of a control frame processing apparatus 500 provided by the present application the apparatus specifically includes:
  • the receiving module 501 is configured to receive a control frame sent by an access point, where the control frame includes a check field, and the check field includes a random value and a MIC check value;
  • the parsing module 502 is configured to parse the received control frame, and extract the random value and the MIC check value therein;
  • the decryption module 503 is configured to use the data key from the access point to decrypt the random value and the MIC check value to obtain the original plaintext of the random value and the original plaintext of the MIC check value;
  • the first calculation module 504 is configured to use the MIC key from the access point, the non-check field in the control frame and the random value to calculate the local MIC check value;
  • the judgment module 505 is configured to judge whether the original plaintext of the MIC check value is consistent with the local MIC check value, and if so, perform a corresponding control operation according to the control frame.
  • the present application also provides a site 600 , as shown in the structural block diagram of a specific implementation manner of the site in FIG. 6 , the site 600 includes a processor 601 and a memory 602 .
  • the memory is used for storing program instructions; the processor is used for executing the operation of any one of the above control frame processing methods according to the program instructions.
  • the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores program instructions, and when the program instructions are executed, realizes the operation of any one of the control frame processing methods described above.
  • control frame processing apparatus, site and computer-readable storage medium correspond to the above-mentioned control frame processing method, and the specific implementation can refer to the content of the above-mentioned method section, which will not be repeated here.
  • the present application also provides a method for generating a control frame, which is applied to an access point of wireless communication. As shown in the flowchart of a specific implementation manner of the method for generating a control frame provided by the present application in FIG. 7 , the method includes: :
  • the access point generates a random value R, for example, a 128-bit random value R may be generated.
  • the random value R generated by the access point can satisfy the condition of monotonically increasing or decreasing.
  • the station After receiving the control frame, the station obtains a random value by parsing it, and can judge whether it satisfies the conditions of monotonically increasing or decreasing monotonically compared with the previously parsed data, and discards the control frame if it does not satisfy the condition of monotonically increasing or decreasing. , so as to avoid replay attacks.
  • S702 Calculate the MIC check value using the non-check field of the control frame, the random value, and the MIC key sent to the site;
  • the MIC key may be the MIC key obtained when the station connects with the access point.
  • AES-CBC can be used to calculate the MIC check value to ensure the integrity of the control frame.
  • S703 Encrypt the random value and the calculated MIC check value with a data key to obtain a ciphertext of the random value and a ciphertext of the MIC check value;
  • the generated random value R and the calculated MIC check value are encrypted using an encryption algorithm based on the multicast frame data key, and the ciphertext R* of the random value and the ciphertext MIC* of the MIC check value are obtained.
  • the encryption algorithm can use a symmetric algorithm such as the AES algorithm, and of course, an asymmetric algorithm can also be used.
  • the check field may include: a control frame check field identifier, data type, data length and numerical information; wherein, the control frame check field identifier is used to identify whether the current field is a check field;
  • the data type is used to identify the type of the numerical information as a random value type or a MIC check value type;
  • the data length is used to identify the length of the numerical information;
  • the numerical information is used to identify in the data type When it is a random value type, it represents a corresponding random value, or when the data type identifier is a MIC check value, it represents a corresponding MIC check value.
  • FIG. 7 a schematic diagram of the generation process of the check field of the control frame is shown in FIG. 7 .
  • the original control frame and the random number are used for MIC check value operation to obtain the integrity check information MIC of the control frame.
  • the random number and the MIC check value are encrypted, and then the ciphertext R* of the random value and the ciphertext MIC* of the MIC check value are split and added to the control frame according to the above method of adding a check field.
  • the splitting process may be to transmit the lower bits first and then the higher bits, or of course, the higher bits may be transmitted first and then the lower bits, which does not affect the implementation of the present application.
  • S705 Send the control frame to the station.
  • the access point sends the control frame to the station, and after receiving the control frame, the station executes the operations of the method for processing the control frame.
  • control frame generating apparatus which is applied to an access point of wireless communication. Specifically include:
  • a generating module 801, configured to generate random values
  • the second calculation module 802 is configured to calculate the MIC check value according to the non-check field of the control frame, the random value and the MIC key sent to the station;
  • the encryption module 803 is configured to encrypt the random value and the calculated MIC check value by using a data key to obtain the ciphertext of the random value and the ciphertext of the MIC check value;
  • the adding module 804 is configured to add the ciphertext of the random value and the ciphertext of the MIC check value as check fields to the control frame;
  • the sending module 805 is configured to send the control frame to the station.
  • the present application also provides an access point 900.
  • the access point 900 includes a processor 901 and a memory 902; wherein the memory 902 is used to store program instructions ; the processor 901 is configured to execute the operation of any one of the control frame generation methods described above according to the program instructions.
  • the present application also provides a computer-readable storage medium, where program instructions are stored in the computer-readable storage medium, and when the program instructions are executed, the operations of any one of the foregoing control frame generation methods are implemented.
  • control frame generation device correspond to the above-mentioned control frame generation method, and the specific implementation can refer to the content of the above-mentioned method section, which is not repeated here. Repeat.
  • the technical solution of the present application can be applied to an IEEE 802.11ax wireless local area network, where the network includes one or more access points (access points, AP) and one or more stations (station, STA).
  • access points access points, AP
  • stations station, STA
  • the site may be a device with wireless communication functions, such as user equipment, access terminals, remote terminals, user terminals, mobile devices, and may also be cellular phones, handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, etc. , which is not limited in the embodiments of the present application.
  • the access point can be any device with wireless transceiver function that communicates with the station.
  • the device includes but is not limited to: evolved node B, radio network controller, node B, base station controller, etc., and can also be one or a group of antenna panels of a base station in 5G and 5G systems, or can also be a baseband unit or Distributed units, etc., are not limited here.
  • the present application can effectively protect the control frame, prevent hackers from using the control frame to attack the wireless network, and ensure the security of the network.
  • the present application uses the reserved field in the control frame to perform the encryption operation, and only encrypts the verification information, rather than encrypting the part of the frame body data. Therefore, even if one of the two communication parties does not support the encryption method of the present application, the normal communication between the two parties will not be affected, and the compatibility is also taken into consideration while improving the security, and the scalability is stronger.
  • the part of the frame body data in this application is not encrypted, and the MIC check value is obtained from the frame body data and the MIC key, if the random number is not added, the attacker may pass the frame body data and the MIC key. The check value obtains the MIC check value. Therefore, the method of adding random numbers is adopted in this scheme to further improve the security of the network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种控制帧处理方法、站点、控制帧生成方法、接入点以及计算机可读存储介质，控制帧处理方法通过接收接入点发送的控制帧，对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值；采用来自接入点的数据密钥对随机值以及MIC校验值进行解密，得到随机值的原始明文以及MIC校验值的原始明文；采用来自接入点的MIC密钥、控制帧中的非校验字段及随机值计算本地MIC校验值；判断MIC校验值的原始明文与本地MIC校验值是否一致，如果是，则根据控制帧执行相应控制操作。本申请提供的控制帧处理方法，能够对控制帧进行有效保护，防止黑客利用控制帧来进行无线网络攻击，保证了网络的安全性。

Description

控制帧处理及生成方法、站点、接入点及存储介质 技术领域
本申请涉及无线通信技术领域，尤其涉及一种控制帧处理方法、站点、控制帧生成方法、接入点以及计算机可读存储介质。
背景技术
随着手机、PAD等个人电子设备的不断普及，以及物联网技术的深入发展，具有Wi-Fi通信需求的设备数量呈爆发式增长。在高密度部署场景下，Wi-Fi的传输效率成为影响用户体验的关键之一。基于此现状，Wi-Fi联盟提出了新一代Wi-Fi协议IEEE 802.11ax，其首要目的是解决网络容量问题，提升网络效率。
802.11ax提升效率最重要的举措之一就是采用正交频分多址(Orthogonal Frequency Division Multiple Access，OFDMA)技术。OFDMA技术将信道进一步划分为更小的资源单元(Resource Units，RU)，接入点(Access Point，AP)将与不同终端间的数据传输分配在不同的RU，从而实现AP与多个设备同时通信，提升了无线网络的传输效率。触发(trigger)帧作为802.11ax中引入的一种新的控制帧，能够使得网络中支持802.11ax协议的设备进行高效的OFDMA通信，提升网络的效率。但是其强大的控制能力以及缺乏有效的保护，使得触发帧或类似的控制帧很容易成为黑客进行网络破坏的突破口。因此，如何对触发帧或控制帧进行有效的保护从而保证网络的安全，是无线通信领域研究的重点和难点。
发明内容
为解决上述问题，本申请提供了一种控制帧处理方法，应用于无线通信的站点，包括：
接收接入点发送的控制帧，所述控制帧中包括校验字段，所述校验字段包括随机值以及信息完整性校验(Message Integrity Check，MIC)校验值；
对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值；
采用来自接入点的数据密钥对所述随机值以及所述MIC校验值进行解密，得到所述随机值的原始明文以及所述MIC校验值的原始明文；
采用来自接入点的MIC密钥、所述控制帧中的非校验字段及所述随机值计算本地MIC校验值；
判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致，如果是，则根据所述控制帧执行相应控制操作。
可选地，在所述判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致之后还包括：
若所述MIC校验值的原始明文与所述本地MIC校验值不一致，则丢弃所述控制帧。
可选地，在所述对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值之前还包括：
判断所述控制帧中是否包含有效的校验字段；
如果是，则执行后续对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值的操作；如果否，则丢弃所述控制帧。
可选地，在所述对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值之前还包括：
判断所述站点与所述接入点是否已关联；
如果是，则执行后续对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值的操作；如果否，则根据所述控制帧执行相应控制操作。
可选地，在所述得到所述随机值的原始明文以及所述MIC校验值的原始明文之后还包括：
判断解码到的所述随机值的原始明文是否满足单调递增或单调递减的条件；
如果是，则执行后续使用接收到的所述控制帧计算本地MIC校验值的操作；如果否，则丢弃所述控制帧。
可选地，所述控制帧是用于对上行OFDMA传输进行资源分配的触发帧。
可选地，所述MIC密钥是从接入点组播发送到站点的MIC密钥。
本申请还提供了一种站点，所述站点包括处理器以及存储器；其中，所述存储器用于存储程序指令；
所述处理器用于根据所述程序指令执行上述任一种所述的控制帧处理方法的操作。
本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有程序指令，所述程序指令被执行时实现上述任一种所述的控制帧处理方法的操作。
本申请还提供了一种控制帧生成方法，应用于无线通信的接入点，包括：
生成随机值；
采用控制帧的非校验字段、所述随机值以及发送至站点的MIC密钥计算MIC校验值；
采用数据密钥对所述随机值以及计算得到的所述MIC校验值进行加密，得到所述随机值的密文以及所述MIC校验值的密文；
将所述随机值的密文以及所述MIC校验值的密文作为校验字段，添加至控制帧中；
将所述控制帧发送至站点。
可选地，所述校验字段包括：控制帧校验字段标识、数据类型、数据长度以及数值信息；其中，所述控制帧校验字段标识用于标识当前字段是否为校验字段；所述数据类型用于标识所述数值信息的类型为随机值类型或MIC校验值类型；所述数据长度用于标识所述数值信息的长度；所述数 值信息用于在所述数据类型标识为随机值类型时表示对应的随机值，或在所述数据类型标识为MIC校验值时表示对应的MIC校验值。
可选地，所述随机值按照单调递增或单调递减进行生成。
本申请还提供了一种接入点，所述接入点包括处理器以及存储器；其中，所述存储器用于存储程序指令；
所述处理器用于根据所述程序指令执行上述任一种所述的控制帧生成方法的操作。
本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有程序指令，所述程序指令被执行时实现上述任一种所述的控制帧生成方法的操作。
本申请提供的控制帧处理方法，应用于无线通信的站点，通过接收接入点发送的控制帧，该控制帧中包括校验字段，校验字段包括随机值以及MIC校验值；对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值；采用来自接入点的数据密钥对所述随机值以及所述MIC校验值进行解密，得到所述随机值的原始明文以及所述MIC校验值的原始明文；采用来自接入点的MIC密钥、所述控制帧中的非校验字段及所述随机值计算本地MIC校验值；判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致，如果是，则根据所述控制帧执行相应控制操作。本申请提供的控制帧处理方法，能够对控制帧进行有效保护，防止黑客利用控制帧来进行无线网络攻击，保证了网络的安全性。本申请利用控制帧中的保留字段进行加密操作，且仅针对校验信息进行加密，而不是对帧体数据的部分进行加密。因此，即使通信双方中有一方不支持本申请的加密方法，也不会影响双方的正常通信，在提升安全性的同时也兼顾了兼容性，可扩展性更强。此外，本申请中由于帧体数据的部分是不加密的，且MIC校验值是根据帧体数据与MIC密钥得出的，如果不加入随机数的话，攻击者可能通过帧体数据以及MIC校验值得到MIC校验值，因此，本方案中采用添加随机数的方式进一步提升了网络的安全性。
此外，本申请还提供了一种至少具有上述技术优点的站点、控制帧生成方法、接入点以及计算机可读存储介质。
附图说明
在下文中，将基于实施例参考附图进一步解释本申请。
图1示意性地示出基于触发帧的上行OFDMA传输示意图；
图2示意性地示出本申请所提供的控制帧处理方法的一种具体实施方式的流程图；
图3示意性地示出触发帧的格式示意图；
图4示意性地示出本申请所提供的控制帧处理方法的另一种具体实施方式的流程图；
图5示意性地示出本申请所提供的控制帧处理装置的一种具体实施方式的结构框图；
图6示意性地示出本申请所提供的站点的一种具体实施方式的结构框图；
图7示意性地示出本申请所提供的控制帧生成方法的一种具体实施方式的流程图；
图8示意性地示出本申请所提供的控制帧生成装置的一种具体实施方式的结构框图；
图9示意性地示出本申请所提供的接入点的结构框图。
具体实施方式
以下将结合附图和具体的实施方式，对本申请的方法及设备进行详细说明。应理解，附图所示以及下文所述的实施例仅仅是说明性的，而不作为对本申请的限制。
参照图1基于触发帧的上行OFDMA传输示意图，接入点(AP)通过发送触发帧，告知所有站点(STA)需要发包站点的关联ID(Association ID，AID)、RU位置、发送时间、发射功率等信息。收到触发帧的站点将自 身的AID与触发帧中的AID进行比较，若识别出自身的AID与触发帧中的AID相同，则在收到触发帧后SIFS时间后按照规定参数进行TB PPDU的发送。接入点收到触发帧后使用MU-STA BA帧向所有站点进行回复。
触发帧是802.11ax协议实现高效率传输的关键。作为一种控制帧，触发帧没有采用安全措施进行保护，同时，802.11ax协议规定触发帧可以按照除802.11b以外的任何物理帧格式进行发送，所以利用触发帧进行拒绝服务(DoS)等攻击的实施成本非常低。利用触发帧进行攻击的黑客可以让任意一个或多个站点在规定RU按规定功率发包，从而让被攻击设备无法进行正常的收发包。如：黑客可以每隔10ms发送一个触发帧，让被攻击者在某个26tone的RU上以极小的发射功率发5ms的TB PPDU包。这种攻击方式在瘫痪被攻击者的同时，几乎不会影响网络中其他设备的正常通信。
作为802.11ax协议中新引入的控制帧，由于协议规定统一的安全措施进行保护，因此直接采用管理帧中的加密方式会导致设备之间不兼容的问题。鉴于此，本申请旨在解决新引入的触发帧缺乏有效保护机制的问题，防止黑客利用触发帧进行无线网络攻击，以保证802.11ax网络的安全。
图2示出了本申请所提供的控制帧处理方法的一种具体实施方式的流程图。本实施例中，该方法应用于无线通信的站点，其具体包括：
S201：接收接入点发送的控制帧，所述控制帧中包括校验字段，所述校验字段包括随机值以及MIC校验值；
本申请实施例在控制帧中添加校验字段，校验字段包括有随机值R和MIC校验值(Message Integrity Code)。作为一种具体实施方式，校验字段可以包括：控制帧校验字段标识(AID)、数据类型(info_type)、数据长度(info_len)以及数值信息(info_data)；其中，所述控制帧校验字段标识(AID)用于标识当前字段是否为校验字段；所述数据类型(info_type)用于标识所述数值信息的类型为随机值类型或MIC校验值类型；所述数据长度(info_len)用于标识所述数值信息的长度；所述数值信息(info_data)用于在所述数据类型标识为随机值类型时表示对应的随机值，或在所述数据类型标识为MIC校验值时表示对应的MIC校验值。
下面介绍添加校验字段的一种具体表现形式。以控制帧为触发帧为例，参照图3触发帧的格式示意图。触发帧包含MAC头、公共信息(common info)字段以及多个用户信息(user info)字段。其中用户信息(user info)字段的基础长度为40比特，根据触发(trigger)帧细分类型的不同会有若干触发帧附加信息。每个用户信息(user info)字段由一个12位的AID以及一系列控制信息构成。本申请实施例在触发帧最后一个有效的用户信息(user info)字段后添加若干个AID的用户信息(user info)域，用于传输校验字段。新添加的用户信息(user info)校验字段结构如表1所示。
表1
位置 Bit 0:Bit 11 Bit 12:Bit13 Bit 14:Bit 15 Bit 15:Bit 39 其他
内容 4094 info_type info_len info_data 0
本实施例中，AID＝4094为触发帧校验字段标识，可以理解的是，其仅为一种具体示例，在实际中可以利用任何触发帧保留的AID，并不限于该具体形式。info_type为0时表示后续info_data的类型为随机值R，info_type为1表示后续info_data的类型为MIC校验值。info_len表示info_data中有效数据的长度，单位为字节。info_data为具体携带的随机值或MIC校验值。接入点(AP)通过在传输的控制帧中携带多个如上所述的用户信息(user info)，即可以传输任意长度的随机值或者MIC校验值。
S202：对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值；
站点在接收到接入点发送的控制帧之后，对控制帧进行解析，可以从控制帧中提取出携带的随机值R rx_encry和MIC校验值MIC rx_encry。作为一种具体实施方式，站点在识别到AID＝4094标记之后，可以从中提取到随机值R rx_encry和MIC校验值MIC rx_encry。
S203：采用来自接入点的数据密钥对所述随机值以及所述MIC校验值进行解密，得到所述随机值的原始明文以及所述MIC校验值的原始明文；
采用站点本地来自接入点的数据密钥对随机值R rx_encry和MIC校验值MIC rx_encry进行解密，得到随机值的原始明文R rx和MIC校验值的原始明文MIC rx。可以理解的是，解密的方法可以采用AES算法等对称算法或非对称算法，在此不做限定。
S204：采用来自接入点的MIC密钥、所述控制帧中的非校验字段及所述随机值计算本地MIC校验值；
采用来自接入点的MIC密钥、控制帧中的非校验字段及随机值计算本地MIC校验值MIC local。MIC密钥用于计算MIC校验值，其可以是从接入点组播发送到站点的MIC密钥。本申请中控制帧为可变长的控制帧，其可支持存放校验字段。控制帧可以分为校验字段以及非校验字段。作为一种具体实施方式，控制帧可以为触发帧。
S205：判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致，如果是，则根据所述控制帧执行相应控制操作。
比较MIC local与MIC rx，若MIC local与MIC rx一致，则按照802.11ax协议响应该控制帧，执行相应控制操作。
在上述实施例的基础上，本申请所提供的控制帧处理方法还可以进一步包括：在所述判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致之后还包括：若所述MIC校验值的原始明文与所述本地MIC校验值不一致，则丢弃所述控制帧。即，在比较MIC local与MIC rx不一致时，则丢弃该控制帧。
本申请提供的控制帧处理方法，能够对控制帧进行有效保护，防止黑客利用控制帧来进行无线网络攻击，保证了网络的安全性。本申请利用控制帧中的保留字段进行加密操作，且仅针对校验信息进行加密，而不是对帧体数据的部分进行加密。因此，即使通信双方中有一方不支持本申请的加密方法，也不会影响双方的正常通信，在提升安全性的同时也兼顾了兼容性，可扩展性更强。此外，本申请中由于帧体数据的部分是不加密的，且MIC校验值是根据帧体数据与MIC密钥得出的，如果不加入随机数的 话，攻击者可能通过帧体数据以及MIC校验值得到MIC校验值，因此，本方案中采用添加随机数的方式进一步提升了网络的安全性。
进一步地，还可以记录本次获取的随机值R rx用于下次的校验过程。具体地，可以在得到所述随机值的原始明文以及所述MIC校验值的原始明文之后，判断解码到的随机值的原始明文是否满足单调递增或单调递减的条件，在满足单调递增或单调递减的条件下，才进行后续校验的操作。在不满足单调递增或单调递减的情况下，则丢弃该控制帧。通过设置该校验条件，进一步保证了网络的安全。
本申请所提供的控制帧处理方法的另一种具体实施方式的流程图如图4所示，本实施例以控制帧为触发帧为例，并增加了判断控制帧是否包含有效的校验字段、判断站点与接入点是否已关联、以及判断随机值的原始明文是否满足单调递增或单调递减的条件的操作过程。参照图4，该方法具体包括：
S401：接收接入点发送的触发帧，所述触发帧中包括校验字段，所述校验字段包括随机值以及MIC校验值；
S402：判断所述触发帧中是否包含有效的校验字段；如果是，则进入S403；如果否，则进入S409；
S403：判断所述站点与所述接入点是否已关联；如果是，则进入S404；如果否，则进入S408；
S404：对接收到的所述触发帧进行解析，提取其中的随机值以及MIC校验值；
S405：采用来自接入点的数据密钥对所述随机值以及所述MIC校验值进行解密，得到所述随机值的原始明文以及所述MIC校验值的原始明文；
S406：判断解码到的所述随机值的原始明文是否满足单调递增或单调递减的条件；如果是，则进入S407；如果否，则进入S409；
S407：采用来自接入点的MIC密钥、所述触发帧中的非校验字段及所述随机值计算本地MIC校验值，判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致，如果是，则进入S408；如果否，则进入S409；
S408：根据所述触发帧执行相应控制操作；
S409：丢弃所述触发帧。
由802.11ax协议规定，站点未连接至接入点时也可使用AID＝2046的user field中的信息进行TB PPDU的发送。这种场景下由于站点尚未分配到组播密钥，则对该触发帧不进行任何校验，按照802.11ax协议规定进行传输。
通过判断站点与接入点是否已关联，即判断站点与接入点是否已建立连接。在站点与接入点已关联或已建立连接的情况下，站点接收到来自接入点的数据密钥和MIC密钥。
若收到触发帧的站点已经获取到组播密钥，则根据AID＝4094标记，在收到触发帧后提取出R rx_encry和MIC rx_encry。接着使用本地的组播数据密钥对这两部分进行解密，得到原始明文R rx和MIC rx。若设置解码到的随机值的原始明文应满足单调递增的条件，则如果本次收到的随机数R rx比上次解析到的小，则认为本触发帧不应当信任，站点不响应该触发帧。若设置解码到的随机值的原始明文应满足单调递减的条件，则如果本次收到的随机数R rx比上次解析到的大，则认为本触发帧不应当信任，站点不响应该触发帧。否则，使用本地MIC密钥从收到触发帧MAC头开始，到最后一个有效的user info，即不包含AID为4094的user info，连同解密得到的R rx使用解密算法计算出MIC local。最后，比较MIC local与MIC rx，若MIC local与MIC rx不一致，则丢弃该触发帧。否则，按照802.11ax协议响应该触发帧，并记录本次获取的随机值R rx用于下次的校验。
作为一种具体实施方式，解密方法可以为AES-CBC。
本实施例提供了一种兼顾兼容性以及安全性的触发帧保护方案。利用触发帧中的保留字段进行加密操作，且仅针对校验信息进行加密，而不是对帧体数据的部分进行加密。因此，即使通信双方中有一方不支持本申请 的加密方法，也不会影响双方的正常通信，在提升安全性的同时也兼顾了兼容性，可扩展性更强。此外，本申请中由于帧体数据的部分是不加密的，且MIC校验值是根据帧体数据与MIC密钥得出的，如果不加入随机数的话，攻击者可能通过帧体数据以及MIC校验值得到MIC校验值，因此，本方案中采用添加随机数判断其单调递增或递减的方式也进一步提升了网络的安全性。
此外，本申请还提供了一种控制帧处理装置，所述控制帧处理装置应用于无线通信的站点。如图5本申请所提供的控制帧处理装置500的一种具体实施方式的结构框图所示，该装置具体包括：
接收模块501，被配置为接收接入点发送的控制帧，所述控制帧中包括校验字段，所述校验字段包括随机值以及MIC校验值；
解析模块502，被配置为对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值；
解密模块503，被配置为采用来自接入点的数据密钥对所述随机值以及所述MIC校验值进行解密，得到所述随机值的原始明文以及所述MIC校验值的原始明文；
第一计算模块504，被配置为采用来自接入点的MIC密钥、所述控制帧中的非校验字段及所述随机值计算本地MIC校验值；
判断模块505，被配置为判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致，如果是，则根据所述控制帧执行相应控制操作。
此外，本申请还提供了一种站点600，如图6站点的一种具体实施方式的结构框图所示，该站点600包括处理器601以及存储器602。其中，存储器用于存储程序指令；所述处理器用于根据所述程序指令执行如上述任一种所述的控制帧处理方法的操作。
此外，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质存储有程序指令，所述程序指令被执行时实现上述任一种所述的控制帧处理方法的操作。
可以理解的是，本申请所提供的控制帧处理装置、站点以及计算机可读存储介质与上述的控制帧处理方法相对应，其具体实施方式可以参照上述方法部分的内容，在此不再赘述。
此外，本申请还提供了一种控制帧生成方法，应用于无线通信的接入点，如图7本申请所提供的控制帧生成方法的一种具体实施方式的流程图所示，该方法包括：
S701：生成随机值；
接入点生成随机值R，例如可以生成一个128比特的随机值R。当然，此处的128比特仅为具体示例，并不构成限定。接入点生成的随机值R可以满足单调递增或单调递减的条件。站点在接收到控制帧之后，从中解析得到随机值，可以判断与之前解析的数据相比是否满足单调递增或单调递减的条件，在不满足单调递增或单调递减的情况下，则丢弃该控制帧，从而起到避免重放攻击的作用。
S702：采用控制帧的非校验字段、所述随机值以及发送至站点的MIC密钥计算MIC校验值；
将控制帧中从MAC头开始到最后一个有效user info中的所有数据以及随机值R，根据控制帧的非校验字段、随机值以及发送至站点的MIC密钥计算得到MIC校验值。MIC密钥可以为站点与接入点连接时获取得到的MIC密钥。具体可以使用AES-CBC计算MIC校验值，以保证控制帧的完整性。
S703：采用数据密钥对所述随机值以及计算得到的所述MIC校验值进行加密，得到所述随机值的密文以及所述MIC校验值的密文；
对产生的随机值R以及计算得到的MIC校验值，基于组播帧数据密钥使用加密算法进行加密，得到随机值的密文R*以及MIC校验值的密文MIC*。加密算法可以采用AES算法等对称算法，当然也可以采用非对称算法等。
S704：将所述随机值的密文以及所述MIC校验值的密文作为校验字段，添加至控制帧中；
作为一种具体实施方式，校验字段可以包括：控制帧校验字段标识、数据类型、数据长度以及数值信息；其中，所述控制帧校验字段标识用于标识当前字段是否为校验字段；所述数据类型用于标识所述数值信息的类型为随机值类型或MIC校验值类型；所述数据长度用于标识所述数值信息的长度；所述数值信息用于在所述数据类型标识为随机值类型时表示对应的随机值，或在所述数据类型标识为MIC校验值时表示对应的MIC校验值。
以触发帧为例，控制帧校验字段生成过程的示意图如图7所示。将原始的控制帧同随机数进行MIC校验值运算，得到控制帧的完整性校验信息MIC。随后将随机数和MIC校验值进行加密，然后将随机值的密文R*以及MIC校验值的密文MIC*按照上述添加校验字段的方法拆分后添加至控制帧中。拆分过程可以为先传输低位后传输高位，当然也可以先传输高位再传输低位，这均不影响本申请的实现。
S705：将所述控制帧发送至站点。
接入点将该控制帧发送至站点，站点接收到该控制帧之后，执行上述控制帧处理的方法的操作。
此外，本申请还提供了一种控制帧生成装置，应用于无线通信的接入点，如图8本申请所提供的控制帧生成装置800的一种具体实施方式的结构框图所示，该装置具体包括：
生成模块801，被配置为生成随机值；
第二计算模块802，被配置为采用根据控制帧的非校验字段、所述随机值以及发送至站点的MIC密钥计算MIC校验值；
加密模块803，被配置为采用数据密钥对所述随机值以及计算得到的所述MIC校验值进行加密，得到所述随机值的密文以及所述MIC校验值的密文；
添加模块804，被配置为将所述随机值的密文以及所述MIC校验值的密文作为校验字段，添加至控制帧中；
发送模块805，被配置为将所述控制帧发送至站点。
此外，本申请还提供了一种接入点900，如图9接入点的结构框图所示，该接入点900包括处理器901以及存储器902；其中，所述存储器902用于存储程序指令；所述处理器901用于根据所述程序指令执行上述任一种所述的控制帧生成方法的操作。
此外，本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质存储有程序指令，所述程序指令被执行时实现上述任一种所述的控制帧生成方法的操作。
可以理解的是，本申请所提供的控制帧生成装置、接入点以及计算机可读存储介质与上述的控制帧生成方法相对应，其具体实施方式可以参照上述方法部分的内容，在此不再赘述。
本申请的技术方案可以应用于IEEE 802.11ax无线局域网络中，该网络中包括一个或多个接入点(access point，AP)和一个或多个站点(station，STA)。
其中，站点可以为具有无线通信功能的装置，如用户设备、接入终端、远程终端、用户终端、移动设备，还可以为蜂窝电话、具有无线通信功能的手持设备、车载设备、可穿戴设备等，本申请实施例对此并不限定。
接入点可以是任意一种具有无线收发功能的、与站点进行通信的设备。该设备包括但不限于：演进型节点B、无线网络控制器、节点B、基站控制器等，还可以为5G、5G系统中的基站的一个或一组天线面板，或者还可以为基带单元或分布式单元等，在此不做限定。
本申请能够对控制帧进行有效保护，防止黑客利用控制帧来进行无线网络攻击，保证了网络的安全性。本申请利用控制帧中的保留字段进行加密操作，且仅针对校验信息进行加密，而不是对帧体数据的部分进行加密。因此，即使通信双方中有一方不支持本申请的加密方法，也不会影响双方的正常通信，在提升安全性的同时也兼顾了兼容性，可扩展性更强。此外，本申请中由于帧体数据的部分是不加密的，且MIC校验值是根据帧 体数据与MIC密钥得出的，如果不加入随机数的话，攻击者可能通过帧体数据以及MIC校验值得到MIC校验值，因此，本方案中采用添加随机数的方式进一步提升了网络的安全性。
虽然出于本公开的目的已经描述了本申请各方面的各种实施例，但是不应理解为将本公开的教导限制于这些实施例。在一个具体实施例中公开的特征并不限于该实施例，而是可以和不同实施例中公开的特征进行组合。例如，在一个实施例中描述的根据本申请的方法的一个或多个特征和/或操作，亦可单独地、组合地或整体地应用在另一实施例中。本领域技术人员应理解，还存在可能的更多可选实施方式和变型，可以对上述系统进行各种改变和修改，而不脱离由本申请权利要求所限定的范围。

Claims (14)

  1. 一种控制帧处理方法，应用于无线通信的站点，其特征在于，包括：
    接收接入点发送的控制帧，所述控制帧中包括校验字段，所述校验字段包括随机值以及MIC校验值；
    对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值；
    采用来自接入点的数据密钥对所述随机值以及所述MIC校验值进行解密，得到所述随机值的原始明文以及所述MIC校验值的原始明文；
    采用来自接入点的MIC密钥、所述控制帧中的非校验字段及所述随机值计算本地MIC校验值；
    判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致，如果是，则根据所述控制帧执行相应控制操作。
  2. 如权利要求1所述的控制帧处理方法，其特征在于，在所述判断所述MIC校验值的原始明文与所述本地MIC校验值是否一致之后还包括：
    若所述MIC校验值的原始明文与所述本地MIC校验值不一致，则丢弃所述控制帧。
  3. 如权利要求1所述的控制帧处理方法，其特征在于，在所述对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值之前还包括：
    判断所述控制帧中是否包含有效的校验字段；
    如果是，则执行后续对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值的操作；如果否，则丢弃所述控制帧。
  4. 如权利要求1所述的控制帧处理方法，其特征在于，在所述对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值之前还包括：
    判断所述站点与所述接入点是否已关联；
    如果是，则执行后续对接收到的所述控制帧进行解析，提取其中的随机值以及MIC校验值的操作；如果否，则根据所述控制帧执行相应控制操作。
  5. 如权利要求1至4任一项所述的控制帧处理方法，其特征在于，在所述得到所述随机值的原始明文以及所述MIC校验值的原始明文之后还包括：
    判断解码到的所述随机值的原始明文是否满足单调递增或单调递减的条件；
    如果是，则执行后续使用接收到的所述控制帧计算本地MIC校验值的操作；如果否，则丢弃所述控制帧。
  6. 如权利要求5所述的控制帧处理方法，其特征在于，所述控制帧是用于对上行OFDMA传输进行资源分配的触发帧。
  7. 如权利要求5所述的控制帧处理方法，其特征在于，所述MIC密钥是从接入点组播发送到站点的MIC密钥。
  8. 一种站点，其特征在于，所述站点包括处理器以及存储器；其中，所述存储器用于存储程序指令；
    所述处理器用于根据所述程序指令执行如权利要求1至7任一项所述的控制帧处理方法的操作。
  9. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有程序指令，所述程序指令被执行时实现如权利要求1至7任一项所述的控制帧处理方法的操作。
  10. 一种控制帧生成方法，应用于无线通信的接入点，其特征在于，包括：
    生成随机值；
    采用控制帧的非校验字段、所述随机值以及发送至站点的MIC密钥计算MIC校验值；
    采用数据密钥对所述随机值以及计算得到的所述MIC校验值进行加密，得到所述随机值的密文以及所述MIC校验值的密文；
    将所述随机值的密文以及所述MIC校验值的密文作为校验字段，添加至控制帧中；
    将所述控制帧发送至站点。
  11. 如权利要求10所述的控制帧生成方法，其特征在于，所述校验字段包括：控制帧校验字段标识、数据类型、数据长度以及数值信息；其中，所述控制帧校验字段标识用于标识当前字段是否为校验字段；所述数据类型用于标识所述数值信息的类型为随机值类型或MIC校验值类型；所述数据长度用于标识所述数值信息的长度；所述数值信息用于在所述数据类型标识为随机值类型时表示对应的随机值，或在所述数据类型标识为MIC校验值时表示对应的MIC校验值。
  12. 如权利要求10或11所述的控制帧生成方法，其特征在于，所述随机值按照单调递增或单调递减进行生成。
  13. 一种接入点，其特征在于，所述接入点包括处理器以及存储器；其中，所述存储器用于存储程序指令；
    所述处理器用于根据所述程序指令执行如权利要求10至12任一项所述的控制帧生成方法的操作。
  14. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有程序指令，所述程序指令被执行时实现如权利要求10至12任一项所述的控制帧生成方法的操作。
PCT/CN2021/143958 2020-12-31 2021-12-31 控制帧处理及生成方法、站点、接入点及存储介质 WO2022144007A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/260,211 US20240107313A1 (en) 2020-12-31 2021-12-31 Control frame processing method, control frame generating method, station, access point, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011643629.XA CN112867005A (zh) 2020-12-31 2020-12-31 控制帧处理及生成方法、站点、接入点及存储介质
CN202011643629.X 2020-12-31

Publications (1)

Publication Number Publication Date
WO2022144007A1 true WO2022144007A1 (zh) 2022-07-07

Family

ID=76000904

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/143958 WO2022144007A1 (zh) 2020-12-31 2021-12-31 控制帧处理及生成方法、站点、接入点及存储介质

Country Status (3)

Country Link
US (1) US20240107313A1 (zh)
CN (1) CN112867005A (zh)
WO (1) WO2022144007A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112867005A (zh) * 2020-12-31 2021-05-28 乐鑫信息科技（上海）股份有限公司 控制帧处理及生成方法、站点、接入点及存储介质
WO2023082209A1 (zh) * 2021-11-12 2023-05-19 Oppo广东移动通信有限公司 通信方法和站点
WO2023082208A1 (zh) * 2021-11-12 2023-05-19 Oppo广东移动通信有限公司 通信方法和站点

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101394412A (zh) * 2008-09-28 2009-03-25 西安西电捷通无线网络通信有限公司 一种防止安全协议第一条消息被伪造的方法
CN101442531A (zh) * 2008-12-18 2009-05-27 西安西电捷通无线网络通信有限公司 一种安全协议第一条消息的保护方法
CN109842880A (zh) * 2018-08-23 2019-06-04 华为技术有限公司 路由方法、装置及系统
CN112867005A (zh) * 2020-12-31 2021-05-28 乐鑫信息科技（上海）股份有限公司 控制帧处理及生成方法、站点、接入点及存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101986726B (zh) * 2010-10-25 2012-11-07 西安西电捷通无线网络通信股份有限公司 一种基于wapi的管理帧保护方法
CN102014342B (zh) * 2010-12-31 2012-07-18 西安西电捷通无线网络通信股份有限公司 混合组网的网络系统及方法
US9614935B2 (en) * 2013-03-15 2017-04-04 Qualcomm Incorporated Protected control frames
CN104486759B (zh) * 2014-12-15 2018-11-23 北京极科极客科技有限公司 一种无障碍接入无线网络的方法
EP3697137A4 (en) * 2017-11-02 2021-06-30 LG Electronics Inc. METHOD OF SENDING OR RECEIVING A FRAME IN WLAN AND DEVICE FOR THEREFORE

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101394412A (zh) * 2008-09-28 2009-03-25 西安西电捷通无线网络通信有限公司 一种防止安全协议第一条消息被伪造的方法
CN101442531A (zh) * 2008-12-18 2009-05-27 西安西电捷通无线网络通信有限公司 一种安全协议第一条消息的保护方法
CN109842880A (zh) * 2018-08-23 2019-06-04 华为技术有限公司 路由方法、装置及系统
CN112867005A (zh) * 2020-12-31 2021-05-28 乐鑫信息科技（上海）股份有限公司 控制帧处理及生成方法、站点、接入点及存储介质

Also Published As

Publication number Publication date
US20240107313A1 (en) 2024-03-28
CN112867005A (zh) 2021-05-28

Similar Documents

Publication Publication Date Title
US11122428B2 (en) Transmission data protection system, method, and apparatus
WO2022144007A1 (zh) 控制帧处理及生成方法、站点、接入点及存储介质
US9071416B2 (en) Galois/counter mode encryption in a wireless network
CN103945376B (zh) 用于高吞吐量无线通信的在减少分组丢失情况下进行密钥重置的无线设备和方法
US8627092B2 (en) Asymmetric cryptography for wireless systems
US20180278625A1 (en) Exchanging message authentication codes for additional security in a communication system
CN109874139B (zh) 锚密钥生成方法、设备以及系统
KR101916034B1 (ko) 무선통신 시스템에서 단문 데이터의 암호화 방법 및 장치
CN102752102B (zh) 数据包分段加密传输处理方法和装置
US11082843B2 (en) Communication method and communications apparatus
US11924911B2 (en) Extreme-high-throughput fast initial link setup support in multi-link operation in wireless communications
US9872175B2 (en) Packet processing method, apparatus, and system
US20230089319A1 (en) Address randomization schemes
JP2015122764A (ja) 無線通信装置および無線通信装置の動作方法
Chakrabarty et al. Black networks for Bluetooth low energy
US20170272405A1 (en) Security Improvements in a Wireless Data Exchange Protocol
Grgić et al. An overview of security aspects of iot communication technologies for smart agriculture
CN110830421B (zh) 数据传输方法和设备
WO2013152632A1 (zh) 一种安全身份发现及通信方法
US20120039185A1 (en) System and Method for Providing Security in a Wireless Communications System
Junaid et al. Per packet authentication for IEEE 802.11 wireless LAN
Narang et al. Survey of Mobile WiMAX and its threats
EP2984783B1 (en) Secure radio information transfer over mobile radio bearer
US20230085657A1 (en) Address randomization schemes for multi-link devices
JP2013090046A (ja) 通信システム及び通信方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21914735

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21914735

Country of ref document: EP

Kind code of ref document: A1