Frame Transfer Method, Related Apparatus, and Communications System

Patent metadata

Field	Value
Publication number	US-2016192187-A1
Application number	US-201514983206-A
Country	US
Kind code	A1
Filing date	Dec 29, 2015
Priority date	Dec 31, 2014
Publication date	Jun 30, 2016
Grant date	—

Abstract

A frame transfer method includes sending, by an access point to a wireless terminal associated with the access point, a group key of a virtual local area network to which the wireless terminal belongs; receiving, by the access point, a frame, where the frame is a broadcast frame of the virtual local area network or a multicast frame of the virtual local area network; encrypting, by the access point, the frame using the group key of the virtual local area network, to obtain an encrypted frame; and sending, by the access point and in a wireless local area network of the access point, the encrypted frame. The method reduces complexity of implementing virtual local area network (VLAN) isolation between wireless terminals in a wireless local area network (WLAN) and reduces frame forwarding load of an access point (AP).

First claim

What is claimed is:

1 . A frame transfer method, comprising:
sending, by an access point to a first wireless terminal associated with the access point, a first group key of a first virtual local area network to which the wireless terminal belongs; receiving, by the access point, a first frame, wherein the first frame is a first group addressed frame of the first virtual local area network; encrypting, by the access point, the first frame using the first group key of the virtual local area network to obtain a first encrypted frame; and sending, by the access point, the first encrypted frame in a wireless local area network of the access point.

2 . The method according to claim 1 , wherein the first group addressed frame is a broadcast frame of the first virtual local area network.

3 . The method according to claim 1 , wherein the first group addressed frame is a multicast frame of the first virtual local area network.

4 . The method according to claim 1 , wherein the first frame comprises a first virtual local area network identifier of the first virtual local area network, and wherein the method further comprises removing the first virtual local area network identifier from the first frame before the encrypting the first frame.

5 . The method according to claim 1 , wherein sending, to the first wireless terminal associated with the access point, the first group key of the first virtual local area network to which the first wireless terminal belongs comprises sending, to the first wireless terminal and using a group key handshake message, the first group key of the first virtual local area network to which the first wireless terminal belongs.

6 . The method according to claim 1 , further comprising:
sending, by the access point to a second wireless terminal associated with the access point, a second group key of a second virtual local area network to which the second wireless terminal belongs, wherein the first virtual local area network and the second virtual local area network are different; receiving, by the access point, a second frame, wherein the second frame is a second group addressed frame of the second virtual local area network to which the another wireless terminal belongs or a multicast frame of the virtual local area network to which the another wireless terminal belongs; encrypting, by the access point, the second frame using the second group key of the second virtual local area network to obtain a second encrypted frame; and sending, by the access point, the second encrypted frame and in the wireless local area network of the access point.

7 . The method according to claim 6 , wherein the second group addressed frame is a broadcast frame of the second virtual local area network.

8 . The method according to claim 6 , wherein the second group addressed frame is a multicast frame of the second virtual local area network.

9 . An access point, comprising:
a transceiver configured to:
send, to a first wireless terminal associated with the access point, a first group key of a first virtual local area network to which the first wireless terminal belongs;
receive a first frame, wherein the first frame is a first group addressed frame of the first virtual local area network; and
send a first encrypted frame in a wireless local area network of the access point; and
an encryption chip coupled to the transceiver and configured to encrypt the first frame using the first group key of the first virtual local area network to obtain the first encrypted frame.

10 . The access point according to claim 9 , wherein the first group addressed frame is a broadcast frame of the first virtual local area network.

11 . The access point according to claim 9 , wherein the first group addressed frame is a multicast frame of the first virtual local area network.

12 . The access point according to claim 9 , wherein the first frame comprises a virtual local area network identifier of the first virtual local area network, and wherein the encryption chip is further configured to remove the virtual local area network identifier from the first frame before encrypting the first frame.

13 . The access point according to claim 9 , wherein the transceiver is further configured to send, to the first wireless terminal using a group key handshake message, the first group key of the first virtual local area network to which the first wireless terminal belongs.

14 . The access point according to claim 9 , wherein the transceiver is further configured to:
send, to a second wireless terminal associated with the access point, a second group key of a second virtual local area network to which the second wireless terminal belongs, wherein the first virtual local area network and the second virtual local area network are different; receive a second frame, wherein the second frame is a second group addressed frame of the second virtual local area network; and send a second encrypted frame in the wireless local area network, and wherein the encryption chip is further configured to encrypt the second frame using the second group key of the second virtual local area network to obtain the second encrypted frame.

15 . The access point according to claim 14 , wherein the second group addressed frame is a broadcast frame of the second virtual local area network.

16 . The access point according to claim 14 , wherein the second group addressed frame is a multicast frame of the second virtual local area network.

17 . A communications system, comprising:
a first wireless terminal; and an access point associated with the first wireless terminal and configured to:
send, to the first wireless terminal, a first group key of a first virtual local area network to which the first wireless terminal belongs;
receive a first frame, wherein the first frame is a broadcast frame of the first virtual local area network or a multicast frame of the first virtual local area network;
encrypt the first frame using the first group key of the first virtual local area network to obtain a first encrypted frame; and
send the first encrypted frame in a wireless local area network of the access point, wherein the first wireless terminal is configured to:
receive the first group key from the access point;
receive the first encrypted frame from the access point; and
decrypt the first encrypted frame using the first group key of the first virtual local area network.

18 . The communications system according to claim 17 , further comprising a second wireless terminal associated with the access point, wherein the access point is further configured to:
send, to the second wireless terminal, a second group key of a second virtual local area network to which the second wireless terminal belongs, wherein the first virtual local area network and the second virtual local area network are different; receive a second frame, wherein the second frame is a broadcast frame of the second virtual local area network or a multicast frame of the second virtual local area network; encrypt the second frame using the second group key of the second virtual local area network to obtain a second encrypted frame; and send the second encrypted frame in the wireless local area network, and wherein the second wireless terminal is configured to:
receive the second group key from the access point;
receive the second encrypted frame from the access point; and
decrypt the second encrypted frame using the second group key.

Assignees

• Huawei Tech Co Ltd

Inventors

• Tao Chengyi

Classifications

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04L12/18

  for broadcast or conference {, e.g. multicast} · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04W12/04 Primary

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title