Access point device and system for wireless local area network, and related methods

Patent metadata

Field	Value
Publication number	US-9642004-B2
Application number	US-201214130821-A
Country	US
Kind code	B2
Filing date	Jun 18, 2012
Priority date	Jul 5, 2011
Publication date	May 2, 2017
Grant date	May 2, 2017

Abstract

The present invention provides an access point device and system for a wireless local area network, and related methods thereof. On the access point device, a same ESS is divided into a plurality of VLANs, wherein the access point device comprises a broadcast key management module which is used for managing broadcast keys encrypting broadcast information and a broadcast key storage device which is used for storing the broadcast keys. The broadcast keys are stored in the broadcast key storage device in a way of corresponding to VLAN IDs of the VLANs, and the broadcast key management module can obtain the corresponding broadcast keys through the VLAN IDs.

First claim

The invention claimed is:

1. An access point device for a wireless local area network the network comprising a plurality of wireless devices and the access point device, wherein on the access point device:
a same extended service set (ESS) is divided into a plurality of virtual local area networks (VLANs), wherein broadcast keys are stored in a broadcast key storage device of the access point device so as to correspond to virtual local area network identifiers (VLAN IDs) of the VLANs by being indexed through the VLAN IDs so as to realize information isolation among the VLANs, and the access point device comprises memory and a processor, the processor executing the following steps:
issuing a corresponding broadcast key, which includes the following sub-steps:
acquiring a wireless device ID of a wireless device accessing the wireless local area network;
acquiring a VLAN ID of a VLAN to which the wireless device belongs through the acquired wireless device ID,
acquiring the corresponding broadcast key through the acquired VLAN ID, and issuing the acquired corresponding broadcast key to the wireless device;

encrypting information, in which the broadcast key corresponding to the VLAN ID of the VLAN is utilized to encrypt information broadcast to the VLAN; and
broadcasting the encrypted information, wherein when the wireless device accessing the ESS leaves the ESS, the processor executes the following steps for the VLAN to which the wireless device belongs:
acquiring the VLAN ID of the VLAN whose broadcast keys needs to be updated;
acquiring the corresponding to-be-updated broadcast key through the acquired VLAN ID, and
updating the acquired corresponding to-be-updated broadcast key, and
issuing an updated broadcast key to all wireless devices accessing the VLAN and then broadcasting encrypted information utilizing the updated broadcast key.

2. The access point device according to claim 1 , the processor further executes the following step:
managing wireless devices accessing the ESS.

3. The access point device according to claim 2 , the processor further executes the following step:
managing the wireless devices by enabling wireless device identifiers (IDs) of the wireless devices to correspond to VLAN IDs of VLANs to which the wireless devices belong.

4. The access point device according to claim 3 , wherein the wireless device IDs of the wireless devices are media access control addresses of the wireless devices.

5. The access point device according to claim 1 , wherein the access point device communicates with an authentication system, and information about which VLANs the wireless devices accessing the ESS belong to is acquired from the authentication system.

6. The access point device according to claim 1 , the processor further executes the following step:
periodically updating the broadcast keys and storing the updated broadcast keys in the broadcast key storage device so as to correspond to the VLAN IDs of the VLANs.

7. The access point device according to claim 1 , wherein after a wireless device accessing the ESS is switched between VLANs divided corresponding to the ESS, the processor further executes the following step:
updating a broadcast key of a VLAN to which the wireless device originally belongs, and storing the updated broadcast key in the broadcast key storage device so as to correspond to VLAN ID of the VLAN.

8. A method for broadcasting encrypted information in a wireless local area network, the network comprising a plurality of wireless devices and an access point device, wherein
on the access point device of the wireless local area network, a same extended service set (ESS) is divided into a plurality of virtual local area networks (VLANs}, wherein broadcast keys are stored in a broadcast key storage device of the access point device so as to correspond to virtual local area network identifiers (VLAN IDs) of the VLANs by being indexed through the VLAN IDs so as to realize information isolation among the VLANs, and the method includes the following steps:
issuing a corresponding broadcast key, which includes the following sub-steps:
acquiring a wireless device identifier (ID) of a wireless device accessing the wireless local area network;
acquiring a virtual local area network identifier (VLAN ID) of a virtual local area network (VLAN) to which the wireless device belongs through the acquired wireless device ID;
acquiring the corresponding broadcast key through the acquired VLAN ID; and
issuing the acquired corresponding broadcast key to the wireless device;
encrypting information, in which the broadcast key corresponding to the VLAN ID of the VLAN is utilized to encrypt information broadcast to the VLAN; and

wherein when the wireless device accessing the ESS leaves the ESS, the access point device executes the following steps for the VLAN to which the wireless device belongs:
acquiring the VLAN ID of a VLAN whose broadcast keys need to be updated;
acquiring the corresponding to-be-updated broadcast key through the acquired VLAN ID; and
updating the acquired corresponding to-be-updated broadcast key and
issuing an updated broadcast key to all wireless devices accessing the VLAN and then broadcasting encrypted information utilizing the updated broadcast key.

9. A method for updating broadcast keys in a wireless local area network, the network comprising a plurality of wireless devices and an access point device, wherein
on the access point device of the wireless local area network, a same extended service set (ESS) is divided into a plurality of virtual local area networks (VLANs), wherein broadcast keys are stored in a broadcast key storage device of the access point device so as to correspond to virtual local area network identifiers (VLAN IDs) of the VLANs by being indexed through the VLAN IDs so as to realize information isolation among the VLANs, and wherein the access point device periodically executes the following steps for the VLANs:
acquiring a VLAN ID of a virtual local area network (VLAN) whose broadcast keys need to be updated;
acquiring a corresponding to-be-updated broadcast key through the acquired VLAN ID; and
updating the acquired corresponding to-be-updated broadcast key and issuing an updated broadcast key to all wireless devices accessing the VLAN and then broadcasting encrypted information utilizing the updated broadcast key,
wherein when a wireless device accessing the ESS leaves the ESS, the access point device executes the following steps for a VLAN to which the wireless device originally belongs:
acquiring a VLAN ID of the VLAN to which the wireless device originally belongs;
acquiring the corresponding to-be-updated broadcast key through the acquired VLAN ID; and

updating the acquired corresponding to-be-updated broadcast key acquired through the acquired VLAN ID and issuing an updated broadcast key to all wireless devices accessing the VLAN and then broadcasting encrypted information utilizing the updated broadcast key.

10. The method for updating broadcast keys in a wireless local area network of claim 9 , after a wireless device accessing the ESS is switched between the VLANs divided from the ESS the access point device further executes the following steps for a VLAN to which the wireless device originally belongs:
acquiring a VLAN ID of the VLAN to which the wireless device originally belongs;
acquiring a corresponding to-be-updated broadcast key through the acquired VLAN ID; and
updating the acquired corresponding to-be-updated broadcast key and issuing an updated broadcast key to all wireless devices accessing the VLAN and then broadcasting encrypted information utilizing the updated broadcast key.

Assignees

• Wang Yue
• Li Hao
• Wang Dong
• Miyata Hiroshi
• Yokogawa Electric Corp

Inventors

• Wang Yue
• Li Hao
• Wang Dong
• Miyata Hiroshi

Classifications

• H04L2209/601

  Broadcast encryption · CPC title

• H04L63/065

  for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833) · CPC title

• H04L12/4641

  Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272) · CPC title

• H04W12/04 Primary

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L9/083 Primary

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title