Enhanced security for multi-link wireless operations

Patent metadata

Field	Value
Publication number	US-12200121-B2
Application number	US-202318477341-A
Country	US
Kind code	B2
Filing date	Sep 28, 2023
Priority date	Aug 27, 2019
Publication date	Jan 14, 2025
Grant date	Jan 14, 2025

Abstract

This disclosure describes systems, methods, and devices related to security for multi-link operations. A multi-link device (MLD) may establish a first communication link between a first device of the MLD and a first device of a second MLD, and a second communication link between a second device of the MLD and a second device of the second MLD. The MLD may generate a group-addressed message. The MLD may protect the group-addressed message using a first key or a first integrity key. The MLD may protect the group-addressed message using a second key or a second integrity key. The MLD may send, using the first communication link, the group-addressed message protected using the first key or the first integrity key, and may send, using the second communication link, the group-addressed message protected using the second key or the second integrity key.

First claim

What is claimed is:

1. A multi-link device (MLD) comprising processing circuitry coupled to storage, the processing circuitry configured to:
generate, using a cipher-block chaining message authentication protocol (CCMP), a first packet number and first additional authentication data (AAD) of a first medium access control (MAC) protocol data unit (MPDU);
set a first address of the first AAD to a first MLD MAC address of a first logical station device (STA) of a second MLD to receive the first MPDU;
set a second address of the first AAD to a second MLD MAC address of a first logical access point (AP) of the MLD;
generate, using the CCMP, a second packet number and second AAD of a second MPDU;
set a third address of the second AAD to a third MLD MAC address of a second logical STA of the second MLD to receive the second MPDU;
set a fourth address of the second AAD to a fifth MLD MAC address of a second logical AP of the MLD;
transmit, using the first logical AP of the MLD and a first communication link between the first logical AP and the first logical STA of the second MLD, the first MPDU; and
transmit, using the second logical AP of the MLD and a second communication link between the second logical AP and the second logical STA of the second MLD, the second MPDU.

2. The MLD of claim 1 , wherein at least one of the first MPDU or the second MPDU is a group-addressed MPDU.

3. The MLD of claim 1 , wherein the first MPDU uses a first group temporal key (GTK) for the first communication link, and wherein the second MPDU uses a second GTK for the second communication link.

4. The MLD of claim 1 , wherein the first MPDU uses a first integrity GTK (IGTK) for the first communication link, and wherein the second MPDU uses a second IGTK for the second communication link.

5. The MLD of claim 1 , wherein the first MPDU uses a first beacon IGTK (BIGTK) for the first communication link, and wherein the second MPDU uses a second beacon IGTK (BIGTK) for the second communication link.

6. The device of claim 1 , wherein a temporal key used for the first MPDU is included in a multi-link key data encapsulation (KDE), and wherein the multi-link KDE further comprises the second address.

7. The device of claim 1 , further comprising a transceiver configured to transmit and receive wireless signals comprising the first MPDU and the second MPDU.

8. The device of claim 7 , further comprising an antenna coupled to the transceiver to send the first MPDU and the second MPDU.

9. A non-transitory computer-readable medium storing computer-executable instructions which when executed by one or more processors result in performing operations comprising:
generating, using a cipher-block chaining message authentication protocol (CCMP), a first packet number and first additional authentication data (AAD) of a first medium access control (MAC) protocol data unit (MPDU);
setting a first address of the first AAD to a first MLD MAC address of a first logical station device (STA) of a second MLD to receive the first MPDU;
setting a second address of the first AAD to a second MLD MAC address of a first logical access point (AP) of the MLD;
generating, using the CCMP, a second packet number and second AAD of a second MPDU;
setting a third address of the second AAD to a third MLD MAC address of a second logical STA of the second MLD to receive the second MPDU;
setting a fourth address of the second AAD to a fifth MLD MAC address of a second logical AP of the MLD;
transmitting, using the first logical AP of the MLD and a first communication link between the first logical AP and the first logical STA of the second MLD, the first MPDU; and
transmitting, using the second logical AP of the MLD and a second communication link between the second logical AP and the second logical STA of the second MLD, the second MPDU.

10. The non-transitory computer-readable medium of claim 9 , wherein at least one of the first MPDU or the second MPDU is a group-addressed MPDU.

11. The non-transitory computer-readable medium of claim 9 , wherein the first MPDU uses a first group temporal key (GTK) for the first communication link, and wherein the second MPDU uses a second GTK for the second communication link.

12. The non-transitory computer-readable medium of claim 9 , wherein the first MPDU uses a first integrity GTK (IGTK) for the first communication link, and wherein the second MPDU uses a second IGTK for the second communication link.

13. The non-transitory computer-readable medium of claim 9 , wherein the first MPDU uses a first beacon IGTK (BIGTK) for the first communication link, and wherein the second MPDU uses a second beacon IGTK (BIGTK) for the second communication link.

14. The non-transitory computer-readable medium of claim 9 , wherein a temporal key used for the first MPDU is included in a multi-link key data encapsulation (KDE), and wherein the multi-link KDE further comprises the second address.

15. A method comprising:
generating, by processing circuitry of a multi-link device (MLD), using a cipher-block chaining message authentication protocol (CCMP), a first packet number and first additional authentication data (AAD) of a first medium access control (MAC) protocol data unit (MPDU);
setting, by the processing circuitry, a first address of the first AAD to a first MLD MAC address of a first logical station device (STA) of a second MLD to receive the first MPDU;
setting, by the processing circuitry, a second address of the first AAD to a second MLD MAC address of a first logical access point (AP) of the MLD;
generating, by the processing circuitry, using the CCMP, a second packet number and second AAD of a second MPDU;
setting, by the processing circuitry, a third address of the second AAD to a third MLD MAC address of a second logical STA of the second MLD to receive the second MPDU;
setting, by the processing circuitry, a fourth address of the second AAD to a fifth MLD MAC address of a second logical AP of the MLD;
transmitting, by the processing circuitry, using the first logical AP of the MLD and a first communication link between the first logical AP and the first logical STA of the second MLD, the first MPDU; and
transmitting, by the processing circuitry, using the second logical AP of the MLD and a second communication link between the second logical AP and the second logical STA of the second MLD, the second MPDU.

16. The method of claim 15 , wherein at least one of the first MPDU or the second MPDU is a group-addressed MPDU.

17. The method of claim 15 , wherein the first MPDU uses a first group temporal key (GTK) for the first communication link, and wherein the second MPDU uses a second GTK for the second communication link.

18. The method of claim 15 , wherein the first MPDU uses a first integrity GTK (IGTK) for the first communication link, and wherein the second MPDU uses a second IGTK for the second communication link.

19. The method of claim 15 , wherein the first MPDU uses a first beacon IGTK (BIGTK) for the first communication link, and wherein the second MPDU uses a second beacon IGTK (BIGTK) for the second communication link.

20. The method of claim 15 , wherein a temporal key used for the first MPDU is included in a multi-link key data encapsulation (KDE), and wherein the multi-link KDE further comprises the second address.

Assignees

• Intel Corp

Inventors

• Huang Po-Kai
• Chen Cheng
• Ouzieli Ido
• Epstein Avner
• Alexander Danny
• Schreiber Ofer
• Klein Arik
• Bravo Daniel
• Cariou Laurent
• Hareuveni Ofer
• Reshef Ehud
• Balaban Nir

Classifications

• H04L2101/622

  Layer-2 addresses, e.g. medium access control [MAC] addresses · CPC title

• H04L61/5069

  for group communication, multicast communication or broadcast communication · CPC title

• H04W76/15

  Setup of multiple wireless link connections · CPC title

• H04W12/041

  Key generation or derivation · CPC title

• H04L63/104

  Grouping of entities · CPC title