WO2023020164A1 - 管理通信信道的方法和装置 - Google Patents

管理通信信道的方法和装置 Download PDF

Info

Publication number
WO2023020164A1
WO2023020164A1 PCT/CN2022/105248 CN2022105248W WO2023020164A1 WO 2023020164 A1 WO2023020164 A1 WO 2023020164A1 CN 2022105248 W CN2022105248 W CN 2022105248W WO 2023020164 A1 WO2023020164 A1 WO 2023020164A1
Authority
WO
WIPO (PCT)
Prior art keywords
client
management frame
target information
encrypted
information element
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/105248
Other languages
English (en)
French (fr)
Inventor
曹鸿健
张婉桥
黄琳
简云定
伏伟
刘宇佳
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Priority to EP22857477.8A priority Critical patent/EP4319229A4/en
Publication of WO2023020164A1 publication Critical patent/WO2023020164A1/zh
Priority to US18/520,123 priority patent/US20240098488A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the embodiments of this specification relate to the field of computer technologies, and in particular, to a method and device for managing communication channels.
  • WiFi Wireless Fidelity
  • the network connection may be interrupted or the system may crash due to data parsing errors.
  • the client receives forged communication channel-related information in the Beacon frame and executes wrong instructions to switch channels, resulting in connection interruption or man-in-the-middle attacks.
  • the embodiment of this specification describes a method and device for managing a communication channel.
  • An original management frame carrying target information elements is constructed on the wireless access point AP device side.
  • the target information elements include information elements related to communication channel management.
  • For each client connected to the AP device set the target address of the constructed original management frame as the MAC address of the client, and use the key corresponding to the client to encrypt the information in the target information element to obtain an encrypted management frame .
  • encrypted management frames are sent. In this way, the encrypted transmission of communication channel management related information between the AP device and the client is realized, preventing attackers from falsifying and replaying the communication channel management related information carried in the management frame, and improving the security of WiFi communication.
  • a method for managing a communication channel which is executed by a wireless access point AP device, including: constructing an original management frame carrying target information elements, where the target information elements include information elements related to communication channel management;
  • the destination address of the above-mentioned original management frame is set to the MAC address of the client;
  • the corresponding key encrypts the information in the above-mentioned target information element to obtain an encrypted management frame;
  • the above-mentioned encrypted management frame is sent in the WiFi network, so that the connected client in the WiFi network can determine whether to receive the message according to the destination address.
  • the management frame is processed.
  • the above method further includes: broadcasting the above original management frame in the WIFI network when it is determined that no client has established a connection with the above AP device.
  • the encryption of the information in the above-mentioned target information element by using the key corresponding to the client includes: obtaining the exclusive key between the two generated during the handshake process when establishing a connection with the client;
  • the information in the above-mentioned target information element is encrypted by using the above-mentioned exclusive key.
  • the above-mentioned target information element is stored in a tag-length-value data format; and the above-mentioned encryption of the information in the above-mentioned target information element using the key corresponding to the client includes: using the client The corresponding key encrypts the value in the above target information element.
  • the above-mentioned original management frame includes a beacon frame and a probe response frame.
  • the above-mentioned target information element includes one of the following: channel switch statement element, channel switch package element, broadband channel switch element, mesh network channel switch parameter element, channel switch time element, maximum channel switch time element and future Channel bootstrap element.
  • the above-mentioned method further includes: in response to determining that the channel switching is completed, sending the destination address in the above-mentioned WiFi network to be a broadcast address , and beacon frames that do not carry a Channel Switch Announcement element.
  • a method for managing a communication channel executed by a client, including: receiving an encrypted management frame sent by a wireless access point AP device, which carries an encrypted target information element, and the target information element includes the same as Information elements related to communication channel management; according to the destination address of the above-mentioned encrypted management frame, determine whether to process the encrypted management frame; in response to determining to process the encrypted management frame, use the pre-stored key to process the above-mentioned target information element Decryption; manage the communication channel according to the decryption result.
  • determining whether to process the encrypted management frame according to the destination address of the encrypted management frame includes: determining whether to process the encrypted management frame when the destination address of the encrypted management frame is the MAC address of the client to process.
  • the above-mentioned decryption of the above-mentioned target information element by using the pre-stored key includes: using the exclusive key generated between the two during the handshake process when establishing a connection with the above-mentioned wireless access point AP device, to The above target information elements are decrypted.
  • the above-mentioned encrypted management frame is an encrypted beacon frame
  • the above-mentioned target information element is a channel switching statement element
  • the above-mentioned management of the communication channel according to the decryption result includes: performing channel switching according to the decrypted channel switching statement element. switch.
  • an apparatus for managing a communication channel which is set on a wireless access point AP device, including: a construction unit configured to construct an original management frame carrying a target information element, and the target information element includes a communication channel management Relevant information elements; an execution unit, configured to execute preset steps for each client in the connected clients when it is determined that there is a client connected to the AP device, wherein the execution unit includes: a setting module , configured to set the destination address of the original management frame as the MAC address of the client; the encryption module is configured to encrypt the information in the above target information element by using the key corresponding to the client to obtain an encrypted management frame; the sending module , configured to send the encrypted management frame in the WiFi network, so that the connected client in the WiFi network can determine whether to process the received management frame according to the destination address.
  • an apparatus for managing a communication channel which is set on a client, and includes: a receiving unit configured to receive an encrypted management frame sent by a wireless access point AP device, which carries an encrypted target information element, and the above target
  • the information elements include information elements related to communication channel management; the determining unit is configured to determine whether to process the encrypted management frame according to the destination address of the encrypted management frame; the decryption unit is configured to respond to determining whether to process the encrypted management frame Processing, using a pre-stored key to decrypt the above target information element; a management unit configured to manage the communication channel according to the decryption result.
  • a computer-readable storage medium on which a computer program is stored, and when the above-mentioned computer program is executed by a processor, the above-mentioned method according to any one of the first aspect is realized.
  • a wireless access point AP device including a memory and a processor, wherein executable codes are stored in the memory, and when the processor executes the executable codes, the first aspect any of the above methods.
  • a computer-readable storage medium on which a computer program is stored, and when the above-mentioned computer program is executed in a computer, it causes the computer to execute the above-mentioned method according to any one of the second aspect.
  • a terminal device including a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, any one of the second aspects can be implemented. the above method.
  • the wireless access point AP device side first construct an original management frame carrying target information elements, and the target information elements include information elements related to communication channel management. For each client connected to the AP device, set the target address of the constructed original management frame as the MAC address of the client, and use the key corresponding to the client to encrypt the information in the target information element to obtain an encrypted management frame . Afterwards, encrypted management frames are sent. Since the AP device uses different keys for different clients during the encryption process, the client can only decrypt the information of the target information element in the management frame whose destination address is the same as its own MAC address, but cannot decrypt the target information element in other management frames. Information about the information element. In this way, the encrypted transmission of communication channel management related information between the AP device and the client is realized, preventing attackers from falsifying and replaying the communication channel management related information carried in the management frame, and improving the security of WiFi communication.
  • FIG. 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification
  • Fig. 2 shows a schematic flowchart of a method for managing a communication channel according to an embodiment
  • Fig. 3 shows a schematic diagram of the main structure of a Beacon frame
  • Figure 4 shows a schematic diagram of the format of the CSA
  • FIG. 5 shows a schematic flow chart of the four-way handshake process
  • Fig. 6 shows the schematic diagram of TLV data format
  • Fig. 7 shows a schematic flowchart of a method for managing a communication channel according to yet another embodiment
  • Fig. 8 shows a schematic block diagram of an apparatus for managing a communication channel according to an embodiment
  • Fig. 9 shows a schematic block diagram of an apparatus for managing a communication channel according to yet another embodiment.
  • Fig. 1 is a schematic diagram of an implementation scene of an embodiment disclosed in this specification.
  • the implementation scenario in FIG. 1 includes a wireless AP device 101 and multiple clients 102 .
  • the wireless AP device 101 needs to manage the communication channel (for example, switch channels), in order to notify the connected client 102, it will construct the original management frame carrying the target information element, the target information element includes information related to communication channel management information elements.
  • the destination address of the original management frame constructed is set as the MAC address of the client 102, and the key corresponding to the client 102 is used to correspond to the target information element
  • the information is encrypted to obtain an encrypted management frame.
  • the wireless AP device 101 sends the set address and the encrypted encrypted management frame within the WiFi network.
  • the client 102 in the WiFi network will determine whether the destination address of the encrypted management frame is the same as its own MAC address. If they are the same, then use the pre-stored key to decrypt and analyze the target information elements of the encrypted management frame, and finally obtain communication channel management related information, and manage the communication channel according to the obtained communication channel management related information.
  • the encrypted transmission of communication channel management-related information between the AP device 101 and the client 102 is realized, preventing attackers from falsifying and replaying the communication channel management-related information carried in the management frame, and improving the security of WiFi communication sex.
  • the specific implementation manner of the above process is described below.
  • Figure 2 illustrates a method of managing communication channels according to one embodiment.
  • the method can be executed by a wireless access point AP device.
  • AP devices may include wireless routers.
  • the method for managing a communication channel may include the following steps:
  • Step 201 constructing an original management frame carrying target information elements.
  • the AP device may construct a management frame carrying target information elements as an original management frame.
  • the target information elements may include information elements related to communication channel management.
  • the above-mentioned original management frame may include a beacon frame (Beacon frame) and a probe response frame.
  • Beacon frame Beacon frame
  • probe response frame a beacon frame (Beacon frame)
  • a wireless client can acquire surrounding wireless network information through passive scanning and active scanning.
  • Passive scanning means that the client obtains wireless network information by listening to the Beacon frames periodically sent by the AP device.
  • Active scanning means that the client actively sends a probe request frame (Probe Request frame), and obtains network signals through the probe response frame (Probe Response) sent back by the AP device for the probe request frame.
  • the Beacon frame is one of the management frames in the wireless local area network based on IEEE 802.11, which contains the description information of the network. Beacon frames are periodically transmitted by wireless access point (AP) devices in the infrastructure Basic Service Set (BSS). The Beacon frame is used to announce the existence of the wireless local area network and to synchronize the members of the basic service set.
  • FIG. 3 shows a schematic diagram of the main structure of a Beacon frame. It can be understood that the numbers above the boxes in the figure can represent the space occupied by the information, and the unit is octet, and octets is the plural form of octet.
  • the Beacon beacon frame includes 802.11 MAC Header (MAC Header), variable length frame body (Frame Body) and frame check sequence (FCS).
  • the MAC header can include the following: Frame Control (Frame Control), duration/ID (Duration/ID), address information (Address), sequence control (Sequence Control), quality of service control (QoS Control), HT ( High-throughput, high throughput) control (HT Control) and so on.
  • the frame body of the Beacon frame may include fixed-length fields and multiple information elements. Wherein, the fixed-length field may include a timestamp (Timestamp), a beacon interval (Beacon interval), performance information (Capability information), and the like.
  • the frame body of the Probe Response frame may also include a fixed-length field and multiple information elements.
  • the above-mentioned target information element may include one of the following: a Channel Switch Announcement (CSA) element, a Channel Switch Wrapper element, a Wide Bandwith Channel Switch element, Mesh Channel Switch Parameters element, Channel Switch Timing element, Max Channel Switch Time element and Future Channel Guidance element.
  • the target information elements described above may relate to communication channel management. For example, in order to warn the client in the WiFi network that the channel is about to change, the AP can add a corresponding CSA field in the management frame (for example, Beacon frame, probe response frame, etc.) to notify the client of the channel to which the client is about to switch, so that Let the client switch to the new channel in time.
  • Figure 4 shows a schematic diagram of the format of the CSA.
  • the CSA includes Element ID, Length, Channel Switch Mode, New Channel Number, and Channel Switch Timing (Channel Switch Count). It can be understood that the functions and formats of the above target information elements are described and recorded in detail in the WiFi wireless network 802.11 technical standard, and will not be repeated here. According to actual needs, the above-mentioned target information elements can all appear in the Beacon frame and the probe response frame.
  • constructing the management frame carrying the target information element may refer to writing the target information element in the frame body of the management frame, so as to obtain the management frame carrying the target information element.
  • Step 202 when it is determined that there are clients connected to the AP device, the following steps 2021-2023 are performed for each client among the connected clients. specifically:
  • Step 2021 set the destination address of the original management frame as the MAC address of the client.
  • the AP device may set the destination address of the original management frame carrying the target information element as the MAC address of the client.
  • Step 2022 Use the key corresponding to the client to encrypt the information in the target information element to obtain an encrypted management frame.
  • each client connected to the AP device can exchange or negotiate a set of keys in advance with the AP device.
  • the key can be a symmetric key or an asymmetric key.
  • different clients have different keys.
  • step 2022 can also be specifically implemented as follows: First, determine the exclusive key between the two generated during the handshake process when establishing a connection with the client as the key corresponding to the client. The information in the target information element is then encrypted using the unique key.
  • FIG. 5 shows a schematic flow chart of the four-way handshake process, as shown in Figure 5, the specific process includes:
  • the AP device For the first handshake, the AP device generates a random number ANonce, and sends information such as ANonce, Service Set Identifier (SSID) and its own MAC address to the client. After the client receives it, it can calculate the PTK (pairwise transient key, pairwise temporary key). Among them, PTK can be calculated by the following formula (1):
  • HMAC represents the HMAC algorithm
  • SNonce is a random number generated by the client
  • MAC A represents the MAC address of the AP device
  • MAC s represents the MAC address of the client.
  • PMK is related to the authentication method. If it is PSK (pre-shared key, pre-shared key mode) authentication method, PMK is calculated by the following formula (2):
  • PBKDF2 represents the PBKDF2 algorithm
  • Passphrase represents the login password input by the user.
  • the client sends information such as SNonce, its own MAC address, and MIC (Message Integrity code) to the AP device.
  • the AP device After the AP device receives it, it also uses the formula (1) to calculate the value of the PTK.
  • the AP device sends a message carrying GTK (Group Transient Key) and MIC to the client.
  • GTK is encrypted with KEK (key encryption key, key encryption key), and KEK is used to encrypt the key to generate messages.
  • MIC is encrypted with KCK (key confirmation key, key confirmation key), and MIC is used to calculate the integrity of the key generation message.
  • the client After receiving the above message, the client will verify the MIC. If the verification is successful, the client will obtain GTK.
  • the client sends a confirmation message to the AP device, and the AP device successfully authenticates the message, and both parties install PTK and GTK. It can be understood that this specification is only a brief description of the four-way handshake process, and the calculations in the actual handshake process are more complicated, and will not be repeated here.
  • the AP device may determine the PTK generated during the four-way handshake with the client as the key corresponding to the client, and use the PTK to encrypt information in the target information element.
  • the PTK is an exclusive key negotiated between the AP device and a single client, and each client negotiates a different exclusive key with the AP.
  • the exclusive key generated during the handshake process can be reused to encrypt information without additional exchange or negotiation of keys, thereby simplifying the steps of key determination and improving efficiency.
  • the above target information element may be stored in a tag-length-value, ie, TLV (Tag, Length, Value) data format.
  • Fig. 6 shows a schematic diagram of the TLV data format.
  • the target information elements expressed in the TLV data format include element identification (Element ID), length (Length) and information (Information).
  • element ID element identification
  • Length length
  • Information information
  • the element identifier, length and information respectively correspond to the label, length and value in the TLV data format.
  • step 2022 can also be specifically implemented as follows: the value in the target information element is encrypted using the key corresponding to the client. Taking the target information element as CSA as an example, it is only necessary to encrypt the channel switching mode, new channel number, and channel switching timing. In this implementation, only the value in the target information element is encrypted, without encrypting all the information in the target information element, thereby reducing the data in the process of encryption and decryption while ensuring that the value is not leaked The amount of calculation is improved, and the efficiency is improved.
  • Step 2023 sending the encrypted management frame obtained after setting the address and encryption processing in the WiFi network, so that the connected client in the WiFi network can determine whether to process the received management frame according to the destination address.
  • the AP device can send the encrypted management frame obtained after setting the address and encryption processing within the WiFi network. Due to the openness of the WiFi network, all clients in the WiFi network can receive the encrypted management frame.
  • the connected client in the WiFi network can determine whether to process the received encrypted management frame according to the destination address of the encrypted management frame. Specifically, the client can determine whether the destination address of the encrypted management frame is the same as its own MAC address, and if so, perform operations such as decryption and analysis on the management frame, and perform operations on the channel according to the information related to communication channel management obtained through decryption and analysis. manage. For example, when the target information element is a channel switching declaration element, the channel switching may be performed according to the decrypted and parsed channel switching declaration.
  • the above-mentioned method for managing a communication channel may further include the following step not shown in FIG. 2 : when it is determined that no client establishes a connection with the AP device, broadcast the original management frame in the WIFI network.
  • the AP device can set the destination address of the constructed original management frame (for example, a beacon frame) as the broadcast address, and broadcast the original management frame in the WiFi network , the original management frame carries the original unencrypted target information element.
  • the constructed original management frame for example, a beacon frame
  • the sent beacon frame may be an unencrypted beacon frame.
  • the above-mentioned method for managing a communication channel may further include the following steps shown in FIG. 2: responding to determining the channel After the switching is completed, a beacon frame whose destination address is the broadcast address and does not carry the channel switching statement element is sent in the WiFi network.
  • the AP device will continue to send the beacon frame whose destination address is the broadcast address and does not carry the channel switching declaration element in the WiFi network. , to announce the existence of the WLAN.
  • Fig. 7 shows a schematic flowchart of a method for managing a communication channel according to an embodiment.
  • This method can be executed by the client.
  • the client may refer to various devices capable of establishing a connection with the WiFi network, including but not limited to smart phones, platform computers, e-book readers, notebook computers, and the like.
  • the method for managing a communication channel may include the following steps:
  • Step 701 receiving an encrypted management frame sent by a wireless access point AP device, which carries an encrypted target information element.
  • the client may receive the management frame that carries the encrypted target information element and is sent by the connected wireless access point AP device.
  • the management frame may include a beacon frame (Beacon frame) and a probe response frame.
  • the above target information elements may include information elements related to communication channel management.
  • the target information element may include one of the following: a channel switch statement (Channel Switch Announcement, CSA) element, a channel switch statement (Channel Switch Announcement, CSA) element, a channel switch package (Channel Switch Wrapper) element, a broadband channel switch element ( Wide Bandwith Channel Switch) element, Mesh Channel Switch Parameters element, Channel Switch Timing element, Max Channel Switch Time element and Future Channel Guidance )element.
  • the above target information element is located in the frame body part of the management frame.
  • Step 702 Determine whether to process the encrypted management frame according to the destination address of the received encrypted management frame.
  • the AP device may set the destination address of the encrypted management frame carrying the encrypted target information element as the MAC address of the client.
  • the client in the WiFi network can determine whether the received encrypted management frame is sent by the AP device for itself according to the destination address of the received encrypted management frame, and if so, process the encrypted management frame.
  • the client may determine whether the destination address of the received encrypted management frame is the same as its own MAC address, and if so, determine that the management frame is sent by the AP device for itself, thereby determining to process the encrypted management frame.
  • Step 703 Decrypt the target information element by using the pre-stored key in response to determining to process the encrypted management frame.
  • each client connected to the AP device can exchange or negotiate a set of keys in advance with the AP device.
  • the key can be a symmetric key or an asymmetric key.
  • different clients have different keys.
  • the client determines to process the received management frame, the target information element is decrypted by using a pre-stored key exchanged or negotiated with the AP device. It can be understood that, after decrypting the target information element, the client can also parse the management frame in the current conventional way of parsing the management frame.
  • the above-mentioned decryption of the target information element using the pre-stored key may be specifically performed as follows: using the exclusive key generated during the handshake process when establishing a connection with the wireless access point AP device, Decrypt the target information element.
  • a key will be exchanged through a handshake process. After the process is successful, a key for communication between the AP device and the client will be generated to encrypt communication data.
  • a PTK pressure transient key
  • the client may use the PTK generated during the four-way handshake process when establishing a connection with the AP device to decrypt the target information element.
  • the key generated during the handshake process can be reused to encrypt information without additional key exchange or negotiation, thereby simplifying the key determination steps and improving efficiency.
  • Step 704 manage the communication channel according to the decryption result.
  • the client manages the channel information according to the decryption result of the target information element and the analysis result of the management frame.
  • the encrypted management frame is an encrypted beacon frame and the target information element is a channel switching statement element
  • channel switching may be performed according to the channel switching statement obtained through decryption and parsing.
  • the method for managing communication channels realized by the above-mentioned embodiments of the present application realizes encrypted transmission of communication channel management-related information between the AP device and the client, and prevents attackers from falsifying and distorting the communication channel management-related information carried in the management frame. Replay, improving the security of WiFi communication.
  • an apparatus for managing a communication channel is provided.
  • the above-mentioned apparatus for managing communication channels may be set in a wireless access point AP device.
  • the device 800 for managing communication channels includes: a construction unit 801 configured to construct an original management frame carrying target information elements, where the target information elements include information elements related to communication channel management; an execution unit 802 configured to In order to perform preset steps for each client in the connected client when it is determined that there is a client connected to the above-mentioned AP device, wherein the above-mentioned execution unit 802 includes: a setting module 8021 configured to set the above-mentioned original management The destination address of the frame is set to the MAC address of the client; the encryption module 8022 is configured to encrypt the information in the above-mentioned target information element using the key corresponding to the client to obtain an encrypted management frame; the sending module 8023 is configured to encrypt The management frame is sent in the WiFi network for the connected client in the WiFi network to determine whether to process the received management frame according to the destination address.
  • the apparatus 800 further includes: a broadcast unit (not shown in the figure), configured to broadcast in the WIFI network when it is determined that no client has established a connection with the AP device Raw management frame above.
  • a broadcast unit (not shown in the figure), configured to broadcast in the WIFI network when it is determined that no client has established a connection with the AP device Raw management frame above.
  • the above-mentioned encryption module 8022 is further configured to: obtain the exclusive key between the two generated during the handshake process when establishing a connection with the client; The information in the target information element is encrypted.
  • the above-mentioned target information elements are stored in a tag-length-value data format; and the above-mentioned encryption module 8022 is further configured to: use the key corresponding to the client to encrypt the above-mentioned target The value in the information element is encrypted.
  • the foregoing original management frame includes a beacon frame and a probe response frame.
  • the above-mentioned target information element includes one of the following: a channel switching statement element, a channel switching packaging element, a broadband channel switching element, a mesh network channel switching parameter element, a channel switching time element, Maximum Channel Switching Time element and Future Channel Steering element.
  • the above-mentioned device 800 further includes: a beacon frame sending unit (not shown in the figure), configured to, in response to determining that the channel switching is completed, send the destination address in the above-mentioned WiFi network to broadcast address, and beacon frames that do not carry a channel switch announcement element.
  • a beacon frame sending unit (not shown in the figure), configured to, in response to determining that the channel switching is completed, send the destination address in the above-mentioned WiFi network to broadcast address, and beacon frames that do not carry a channel switch announcement element.
  • an apparatus for managing a communication channel is provided.
  • the above-mentioned device for managing the communication channel may be set on the client terminal.
  • the apparatus 900 for managing a communication channel includes: a receiving unit 901 configured to receive an encrypted management frame sent by a wireless access point AP device, which carries an encrypted target information element, and the target information element includes a Information elements related to channel management; the determining unit 902 is configured to determine whether to process the encrypted management frame according to the destination address of the encrypted management frame; the decryption unit 903 is configured to respond to determining that the encrypted management frame is processed, using The pre-stored key decrypts the above target information element; the management unit 904 is configured to manage the communication channel according to the decryption result.
  • the determining unit 902 is further configured to: determine to process the encrypted management frame when the destination address of the encrypted management frame is the MAC address of the client.
  • the above-mentioned decryption unit 903 is further configured to: use the exclusive key between the two generated during the handshake process when establishing a connection with the above-mentioned wireless access point AP, and decrypt the above-mentioned target information elements to decrypt.
  • the management unit 904 is further configured to: perform channel switching according to the decrypted channel switching declaration element.
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the method as described in FIG. 2 is realized.
  • a wireless access point AP device including a memory and a processor, wherein executable codes are stored in the memory, and when the processor executes the executable codes, the The method described in Figure 2.
  • a computer-readable storage medium on which a computer program is stored, and when the above-mentioned computer program is executed in a computer, it causes the computer to execute the method as described in FIG. 7 .
  • a terminal device including a memory and a processor, wherein executable codes are stored in the memory, and when the processor executes the executable codes, the implementation as shown in FIG. 7 is implemented. described method.
  • RAM random access memory
  • ROM read-only memory
  • EEPROM electrically programmable ROM
  • EEPROM electrically erasable programmable ROM
  • registers hard disks, removable disks, CD-ROMs, or all Any other known storage medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本说明书实施例提供了一种管理通信信道的方法和装置，所述方法的一具体实施例通过无线接入点AP设备执行，包括，在无线接入点AP设备端构建携带目标信息元素的原始管理帧，目标信息元素包括与通信信道管理相关的信息元素。在确定存在客户端已连接到AP设备的情况下，针对连接到AP设备的各个客户端，将构建的管理帧的目标地址设置为该客户端的MAC地址，并采用该客户端对应的密钥对目标信息元素中的信息进行加密。之后，将设置地址和加密后的管理帧在WiFi网络内进行发送。

Description

管理通信信道的方法和装置
本申请要求于2021年8月19日提交中国国家知识产权局、申请号为202110957050.9、申请名称为“管理通信信道的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本说明书实施例涉及计算机技术领域，尤其涉及一种管理通信信道的方法和装置。
背景技术
随着无线通信的发展，越来越多的设备通过WiFi联入网络，实现智能化功能。WiFi通信的开放性特点，为终端设备联入无线网络提供了便利，同时也为攻击者提供了可乘之机。攻击者可以伪造和重放无线网络上的任意帧，给用户信息安全带来极大的威胁。举例来说，Beacon帧作为无线AP(Wireless Access Point，无线接入点)的信标帧，通常是明文传输的，任何人都可以监听和伪造。当攻击者伪造Beacon帧中与通信信道相关的信息并重放时，会造成对已连接WiFi网络的客户端的攻击。例如，客户端接收到Beacon帧中畸形的通信信道相关信息后，可能因数据解析错误而导致网络连接中断或系统崩溃。又例如，客户端接收Beacon帧中伪造的通信信道相关信息，会执行错误的指令去切换信道，从而导致连接中断或者中间人攻击。
因此，希望能有改进的方案，能够提高WiFi通信的安全性。
发明内容
本说明书实施例描述了一种管理通信信道的方法和装置，在无线接入点AP设备端构建携带目标信息元素的原始管理帧，目标信息元素包括与通信信道管理相关的信息元素。针对连接到AP设备的各个客户端，将构建的原始管理帧的目标地址设置为该客户端的MAC地址，并采用该客户端对应的密钥对目标信息元素中的信息进行加密，得到加密管理帧。之后，将加密管理帧进行发送。从而实现了AP设备和客户端之间通信信道管理相关信息的加密传输，防止了攻击者对管理帧中携带的通信信道管理相关信息的伪造和重放，提高了WiFi通信的安全性。
根据第一方面，提供了一种管理通信信道的方法，通过无线接入点AP设备执行，包 括：构建携带目标信息元素的原始管理帧，上述目标信息元素包括与通信信道管理相关的信息元素；在确定存在客户端已连接到上述AP设备的情况下，针对已连接客户端中的各个客户端，执行以下步骤：将上述原始管理帧的目的地址设置为该客户端的MAC地址；采用该客户端对应的密钥对上述目标信息元素中的信息进行加密，得到加密管理帧；将上述加密管理帧在WiFi网络内进行发送，以供WiFi网络内的已连接客户端根据目的地址确定是否对接收到的管理帧进行处理。
在一个实施例中，上述方法还包括：在确定没有客户端与上述AP设备建立连接的情况下，在WIFI网络中广播上述原始管理帧。
在一个实施例中，上述采用该客户端对应的密钥对上述目标信息元素中的信息进行加密，包括：获取与该客户端建立连接时握手过程中生成的二者之间的专属密钥；使用上述专属密钥对上述目标信息元素中的信息进行加密。
在一个实施例中，上述目标信息元素采用标签－长度－取值的数据格式进行存储；以及上述采用该客户端对应的密钥对上述目标信息元素中的信息进行加密，包括：采用该客户端对应的密钥对上述目标信息元素中的取值进行加密。
在一个实施例中，上述原始管理帧包括信标帧和探测响应帧。
在一个实施例中，上述目标信息元素包括以下之一：信道切换声明元素、信道切换封装元素、宽频信道切换元素、网状网络信道切换参数元素、信道切换时间元素、最大信道切换时间元素和未来信道引导元素。
在一个实施例中，当上述原始管理帧为信标帧，上述目标信息元素为信道切换声明元素时，上述方法还包括：响应于确定信道切换完成，在上述WiFi网络中发送目的地址为广播地址，以及不携带信道切换声明元素的信标帧。
根据第二方面，提供了一种管理通信信道的方法，通过客户端执行，包括：接收无线接入点AP设备发送的加密管理帧，其中携带加密后的目标信息元素，上述目标信息元素包括与通信信道管理相关的信息元素；根据上述加密管理帧的目的地址，确定是否对该加密管理帧进行处理；响应于确定对该加密管理帧进行处理，使用预先存储的密钥对上述目标信息元素进行解密；根据解密结果对通信信道进行管理。
在一个实施例中，上述根据上述加密管理帧的目的地址，确定是否对该加密管理帧进行处理，包括：在上述加密管理帧的目的地址为上述客户端的MAC地址时，确定对该加密管理帧进行处理。
在一个实施例中，上述使用预先存储的密钥对上述目标信息元素进行解密，包括： 使用与上述无线接入点AP设备建立连接时握手过程中生成的二者之间的专属密钥，对上述目标信息元素进行解密。
在一个实施例中，上述加密管理帧为加密的信标帧，上述目标信息元素为信道切换声明元素；上述根据解密结果对通信信道进行管理，包括：根据解密后的信道切换声明元素，进行信道切换。
根据第三方面，提供了一种管理通信信道的装置，设置于无线接入点AP设备，包括：构建单元，配置为构建携带目标信息元素的原始管理帧，上述目标信息元素包括与通信信道管理相关的信息元素；执行单元，配置为在确定存在客户端已连接到上述AP设备的情况下，针对已连接客户端中的各个客户端，执行预设步骤，其中，上述执行单元包括：设置模块，配置为将上述原始管理帧的目的地址设置为该客户端的MAC地址；加密模块，配置为采用该客户端对应的密钥对上述目标信息元素中的信息进行加密，得到加密管理帧；发送模块，配置为将上述加密管理帧在WiFi网络内进行发送，以供WiFi网络内的已连接客户端根据目的地址确定是否对接收到的管理帧进行处理。
根据第四方面，提供了一种管理通信信道的装置，设置于客户端，包括：接收单元，配置为接收无线接入点AP设备发送的加密管理帧，其中携带加密后目标信息元素，上述目标信息元素包括与通信信道管理相关的信息元素；确定单元，配置为根据上述加密管理帧的目的地址，确定是否对该加密管理帧进行处理；解密单元，配置为响应于确定对该加密管理帧进行处理，使用预先存储的密钥对上述目标信息元素进行解密；管理单元，配置为根据解密结果对通信信道进行管理。
根据第五方面，提供了一种计算机可读存储介质，其上存储有计算机程序，当上述计算机程序被处理器执行时，实现如第一方面中任一项的上述的方法。
根据第六方面，提供了一种无线接入点AP设备，包括存储器和处理器，其特征在于，上述存储器中存储有可执行代码，上述处理器执行上述可执行代码时，实现如第一方面中任一项上述的方法。
根据第七方面，提供了一种计算机可读存储介质，其上存储有计算机程序，当上述计算机程序在计算机中执行时，令计算机执行如第二方面中任一项的上述的方法。
根据第八方面，提供了一种终端设备，包括存储器和处理器，其特征在于，上述存储器中存储有可执行代码，上述处理器执行上述可执行代码时，实现如第二方面中任一项上述的方法。
根据本说明书实施例提供的管理通信信道的方法和装置，在无线接入点AP设备端， 首先构建携带目标信息元素的原始管理帧，目标信息元素包括与通信信道管理相关的信息元素。针对连接到AP设备的各个客户端，将构建的原始管理帧的目标地址设置为该客户端的MAC地址，并采用该客户端对应的密钥对目标信息元素中的信息进行加密，得到加密管理帧。之后，将加密管理帧进行发送。由于AP设备加密过程中针对不同客户端采用的密钥不同，因此，客户端只能解密目的地址与自身MAC地址相同的管理帧中的目标信息元素的信息，而不能解密其它管理帧中的目标信息元素的信息。从而实现了AP设备和客户端之间通信信道管理相关信息的加密传输，防止了攻击者对管理帧中携带的通信信道管理相关信息的伪造和重放，提高了WiFi通信的安全性。
附图说明
图1为本说明书披露的一个实施例的实施场景示意图；
图2示出了根据一个实施例的管理通信信道的方法的流程示意图；
图3示出了Beacon帧的主要结构的示意图；
图4示出了CSA的格式示意图；
图5示出了四次握手过程的流程示意图；
图6示出了TLV数据格式的示意图；
图7示出了根据又一个实施例的管理通信信道的方法的流程示意图；
图8示出了根据一个实施例的管理通信信道的装置的示意性框图；
图9示出了根据又一个实施例的管理通信信道的装置的示意性框图。
具体实施方式
下面通过附图和实施例，对本说明书提供的技术方案做进一步的详细描述。可以理解的是，此处所描述的具体实施例仅仅用于解释相关发明，而非对该发明的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与有关发明相关的部分。需要说明的是，在不冲突的情况下，本说明书的实施例及实施例中的特征可以相互组合。
图1为本说明书披露的一个实施例的实施场景示意图。如图1所示，在图1的实施场景中，包括无线AP设备101和多个客户端102。当无线AP设备101需要对通信信道进行管理(例如，切换信道)的时候，为了通知所连接的客户端102，会构建携带目标信息元素的原始管理帧，该目标信息元素包括与通信信道管理相关的信息元素。针对已连接客户端102中的每一个客户端102，将所构建的原始管理帧的目的地址设置为该客户端102的 MAC地址，并采用该客户端102对应的密钥对应目标信息元素中的信息进行加密，得到加密管理帧。由于WiFi网络的开放性，WiFi网络中传输的数据帧会被网络中的所有客户端102接收，因此，为了防止管理帧中加密的信息被其他客户端破解，加密时不同的客户端采用不同的密钥。最后，无线AP设备101将设置地址和加密后的加密管理帧在WiFi网络内进行发送。WiFi网络内的客户端102接收到该加密管理帧之后，会判断该加密管理帧的目的地址是否与自身的MAC地址相同。如果相同，则使用预存的密钥对该加密管理帧的目标信息元素进行解密、解析等处理，最终得到通信信道管理相关信息，并根据得到的通信信道管理相关信息对通信信道进行管理。由此，实现了AP设备101和客户端102之间通信信道管理相关信息的加密传输，防止了攻击者对管理帧中携带的通信信道管理相关信息的伪造和重放，提高了WiFi通信的安全性。下面描述以上过程的具体执行方式。
图2示出了根据一个实施例的管理通信信道的方法。该方法可以通过无线接入点AP设备执行。举例来说，AP设备可以包括无线路由器。如图2所示，管理通信信道的方法可以包括以下步骤：
步骤201，构建携带目标信息元素的原始管理帧。
在本实施例中，AP设备可以构建携带目标信息元素的管理帧，作为原始管理帧。这里，目标信息元素可以包括与通信信道管理相关的信息元素。
在一个实施例中，上述原始管理帧可以包括信标帧(Beacon帧)和探测响应帧。
通常，无线客户端可以通过被动扫描和主动扫描的方式获取周围的无线网络信息。被动扫描是指客户端通过监听AP设备定期发送的Beacon帧获取无线网络信息。主动扫描是指客户端主动发送探测请求帧(Probe Request帧)，通过AP设备针对探测请求帧发回的探测响应帧(Probe Response)获取网络信号。
Beacon帧是基于IEEE 802.11的无线局域网中的管理帧之一，它包含了网络的描述信息。Beacon帧由基础设施基本服务集(Basic Service Set，BSS)中的无线接入点(AP)设备周期性地传送。Beacon帧用于宣布无线局域网的存在，并使基本服务集的成员同步。图3示出了Beacon帧的主要结构的示意图。可以理解，图中方框上面的数字可以表示信息所占的空间，单位为八位组(octet)，octets为octet的复数形式。如图3所示，Beacon信标帧包括802.11 MAC Header(MAC头)、可变(variable)长的帧主体(Frame Body)和帧检验序列(FCS)。作为示例，MAC头可以包括以下内容：帧控制(Frame Control)、持续时间/ID(Duration/ID)、地址信息(Address)、顺序控制(Sequence Control)、服务质量控制(QoS Control)、HT(High－throughput，高吞吐量)控制(HT Control) 等等。Beacon帧的帧主体部分可以包括固定长度字段和多个信息元素。其中，固定长度字段可以包括时间戳(Timestamp)、信标间隔(Beacon interval)、性能信息(Capability information)等。
与Beacon帧的结构相似，探测响应帧的帧主体部分也可以包括固定长度字段和多个信息元素。
在一个实施例中，上述目标信息元素可以包括以下之一：信道切换声明(Channel Switch Announcement，CSA)元素、信道切换封装(Channel Switch Wrapper)元素、宽频信道切换元素(Wide Bandwith Channel Switch)元素、网状网络信道切换参数(Mesh Channel Switch Parameters)元素、信道切换时间(Channel Switch Timing)元素、最大信道切换时间(Max Channel Switch Time)元素和未来信道引导(Future Channel Guidance)元素。上述目标信息元素可以与通信信道管理相关。举例来说，AP为了警告WiFi网络中的客户端即将变换信道，可以在管理帧(例如，Beacon帧、探测响应帧等)中加入对应的CSA字段，来通知客户端即将切往的信道，以便让客户端及时切换到新的信道。图4示出了CSA的格式示意图，如图4所示CSA包括元素标识(Element ID)、长度(Length)、信道切换模式(Channel Switch Mode)、新信道编号(New Channel Number)、信道切换计时(Channel Switch Count)。可以理解，上述目标信息元素的功能和格式在WiFi无线网络802.11技术标准中有详细的描述和记载，此处不再赘述。根据实际需要，上述目标信息元素都可以在Beacon帧和探测响应帧中出现。
作为示例，构建携带目标信息元素的管理帧，可以是指在管理帧的帧主体中写入目标信息元素，从而得到携带目标信息元素的管理帧。
步骤202，在确定存在客户端已连接到AP设备的情况下，针对已连接客户端中的各个客户端，执行以下步骤2021－2023。具体地：
步骤2021，将原始管理帧的目的地址设置为该客户端的MAC地址。
在本实施例中，针对已经连接到AP设备的每一个客户端，AP设备可以将上述携带目标信息元素的原始管理帧的目的地址设置为该客户端的MAC地址。
步骤2022，采用该客户端对应的密钥对目标信息元素中的信息进行加密，得到加密管理帧。
在本实施例中，与AP设备连接的每一个客户端与AP设备之间都可以预先交换或协商一组密钥。举例来说，该密钥可以是对称密钥，也可以是非对称密钥。为了防止管理帧中加密的信息被破解，不同的客户端所对应的密钥不同。
在一个实施例中，步骤2022还可以具体如下实现：首先，将与该客户端建立连接时握手过程中生成的二者之间的专属密钥确定为该客户端对应的密钥。然后，使用该专属密钥对目标信息元素中的信息进行加密。
一般，AP设备与客户端建立连接时，会通过握手过程交换密钥，该过程成功后会产生一个AP设备和客户端之间通信的密钥，用于加密通信数据。以四次握手过程为例，图5示出了四次握手过程的流程示意图，如图5所示，具体过程包括：
第一次握手，AP设备生成随机数ANonce，并将ANonce、服务集标识(Service Set Identifier，SSID)和自身的MAC地址等信息，发送给客户端。客户端接收到后，可以计算出PTK(pairwise transient key，成对临时秘钥)。其中，PTK可以通过以下公式(1)计算：
PTK＝HMAC(PMK+ANonce+SNonce+MAC A+MAC s)       (1)
其中，HMAC表示HMAC算法，SNonce是客户端生成的随机数，MAC A表示AP设备的MAC地址，MAC s表示客户端的MAC地址。这里，PMK跟认证方式有关，如果是PSK(pre－shared key，预共享密钥模式)认证方式，则PMK通过以下公式(2)计算：
PMK＝PBKDF2(Passphrase，SSID)       (2)
其中，PBKDF2表示PBKDF2算法，Passphrase表示用户输入的登录密码。
第二次握手，客户端将SNonce、自身的MAC地址、MIC(Message Integrity code，消息完整性代码)等信息发送给AP设备。AP设备接收之后，同样利用公式(1)计算PTK的值。
第三次握手，AP设备将携带GTK(Group Transient Key，组临时秘钥)和MIC的消息发送给客户端。其中，GTK使用KEK(key Encryption key，密钥加密密钥)加密，KEK用来加密密钥生成消息。MIC使用KCK(key confirmation key，密钥确认密钥)加密，MIC用来计算密钥生成消息的完整性。客户端接收到上述消息后，会进行MIC的校验，如果校验成功，客户端就获取到了GTK。
第四次握手，客户端向AP设备发送用于确认的消息，AP设备对该消息认证成功，双方安装PTK、GTK。可以理解，本说明书仅仅是对四次握手过程的简要描述，实际握手过程中的计算更加复杂，此处不再赘述。
在本实施例中，AP设备可以将与该客户端四次握手过程中生成的PTK确定为该客户端对应的密钥，并使用PTK对目标信息元素中的信息进行加密。相对于多个客户端共享的GTK，PTK是AP设备与单个客户端之间协商出来的专属秘钥，各个客户端与AP协商出不同的专 属秘钥。本实现方式，可以复用握手过程中生成的专属密钥对信息进行加密，而不需要再额外交换或协商密钥，从而简化了密钥确定步骤，提高了效率。
在一个实施例中，上述目标信息元素可以采用标签－长度－取值，即，TLV(Tag、Length、Value)，的数据格式进行存储。图6示出了TLV数据格式的示意图，如图6所示，以TLV数据格式表示的目标信息元素包括元素标识(Element ID)、长度(Length)和信息(Information)。其中，元素标识、长度和信息分别对应TLV数据格式中的标签、长度和取值。
基于目标信息元素的这种数据格式，步骤2022还可以具体如下实现：采用该客户端对应的密钥对目标信息元素中的取值进行加密。以目标信息元素为CSA为例，只需对信道切换模式、新信道编号、信道切换计时进行加密。本实现方式，只对目标信息元素中的取值进行加密，而不需要对目标信息元素中的所有信息都进行加密，从而在保证取值不泄露的同时，减少了加密、解密过程中的数据计算量，提高了效率。
步骤2023，将设置地址和加密处理后得到的加密管理帧在WiFi网络内进行发送，以供WiFi网络内的已连接客户端根据目的地址确定是否对接收到的管理帧进行处理。
在本实施例中，AP设备可以将设置地址和加密处理后得到的加密管理帧在WiFi网络内进行发送。由于WiFi网络的开放性，WiFi网络内的客户端都可以接收到该加密管理帧。WiFi网络内的已连接客户端可以根据加密管理帧的目的地址判断是否对接收到的加密管理帧进行处理。具体的，客户端可以判断加密管理帧的目的地址是否和自身的MAC地址相同，如果相同，则对管理帧执行解密、解析等操作，并根据解密、解析得到的通信信道管理相关信息对信道进行管理。例如，当目标信息元素为信道切换声明元素时，可以根据解密、解析得到的信道切换声明进行信道切换。
在一个实施例中，上述管理通信信道的方法，还可以包括图2中未示出的以下步骤：在确定没有客户端与AP设备建立连接的情况下，在WIFI网络中广播原始管理帧。
在本实施例中，如果没有客户端与AP设备建立连接，则AP设备可以将构建的原始管理帧(例如，信标帧)的目的地址设置为广播地址，在WiFi网络中广播该原始管理帧，该原始管理帧携带原始的不加密的目标信息元素。以信标帧为例，在没有客户端与AP设备连接的情况下，发送的信标帧可以是不加密的信标帧。
在一个实施例中，当上述原始管理帧为信标帧，上述目标信息元素为信道切换声明元素时，上述管理通信信道的方法，还可以包括图2中示出的以下步骤：响应于确定信道切换完成，在WiFi网络中发送目的地址为广播地址，以及不携带信道切换声明元素的信标 帧。
在本实施例中，根据信道切换声明元素中信息，AP设备和客户端的信道切换完成后，AP设备将继续在WiFi网络中发送目的地址为广播地址，且不携带信道切换声明元素的信标帧，以宣布无线局域网的存在。
图7示出了根据一个实施例的管理通信信道的方法的流程示意图。该方法可以通过客户端执行。这里，客户端可以是指能够与WiFi网络建立连接的各种设备，包括但不限于智能手机、平台电脑、电子书阅读器、笔记本电脑等等。如图7所示，该管理通信信道的方法可以包括以下步骤：
步骤701，接收无线接入点AP设备发送的加密管理帧，其中携带加密后的目标信息元素。
在本实施例中，客户端可以接收所连接的无线接入点AP设备发送的、携带加密后目标信息元素的管理帧。这里，管理帧可以包括信标帧(Beacon帧)和探测响应帧。上述目标信息元素可以包括与通信信道管理相关的信息元素。例如，目标信息元素可以包括以下之一：信道切换声明(Channel Switch Announcement，CSA)元素、信道切换声明(Channel Switch Announcement，CSA)元素、信道切换封装(Channel Switch Wrapper)元素、宽频信道切换元素(Wide Bandwith Channel Switch)元素、网状网络信道切换参数(Mesh Channel Switch Parameters)元素、信道切换时间(Channel Switch Timing)元素、最大信道切换时间(Max Channel Switch Time)元素和未来信道引导(Future Channel Guidance)元素。上述目标信息元素位于管理帧的帧主体部分。
步骤702，根据所接收的加密管理帧的目的地址，确定是否对该加密管理帧进行处理。
在本实施例中，针对已经连接到AP设备的每一个客户端，AP设备可以将携带加密后目标信息元素的加密管理帧的目的地址设置为该客户端的MAC地址。这样，WiFi网络内的客户端可以根据所接收的加密管理帧的目的地址，确定接收到的加密管理帧是否是AP设备针对自己发送的，如果是，则对该加密管理帧进行处理。具体的，客户端可以判断接收的加密管理帧的目的地址是否与自己的MAC地址相同，如果相同，则确定该管理帧是AP设备针对自己发送的，从而确定对该加密管理帧进行处理。
步骤703，响应于确定对上述加密管理帧进行处理，使用预先存储的密钥对目标信息元素进行解密。
在本实施例中，与AP设备连接的每一个客户端与AP设备之间都可以预先交换或协商一组密钥。举例来说，该密钥可以是对称密钥，也可以是非对称密钥。为了防止管理帧中 加密的信息被破解，不同的客户端所对应的密钥不同。这样，如果客户端确定对接收的管理帧进行处理，则使用预先存储的、与AP设备交换或协商的密钥对目标信息元素进行解密。可以理解，对目标信息元素进行解密之后，客户端还可以按照目前常规的解析管理帧的方式对管理帧进行解析。
在一个实施例中，上述使用预先存储的密钥对目标信息元素进行解密，可以具体如下进行：使用与无线接入点AP设备建立连接时握手过程中生成的二者之间的专属密钥，对目标信息元素进行解密。
一般，AP设备与客户端建立连接时，会通过握手过程交换密钥，该过程成功后会产生一个AP设备和客户端之间通信的密钥，用于加密通信数据。以四次握手过程为例，由结合图5的描述可知，四次握手过程中会产生PTK(pairwise transient key，成对临时秘钥)，作为AP设备与单个客户端之间的专属秘钥。
在本实施例中，客户端可以使用与AP设备建立连接时四次握手过程中生成的PTK，对目标信息元素进行解密。本实现方式，可以复用握手过程中生成的密钥对信息进行加密，而不需要再额外交换或协商密钥，从而简化了密钥确定步骤，提高了效率。
步骤704，根据解密结果对通信信道进行管理。
在本实施例中，客户端根据对目标信息元素的解密结果，以及对管理帧的解析结果，对信道信息进行管理。例如，当加密管理帧为加密的信标帧，目标信息元素为信道切换声明元素时，可以根据解密、解析得到的信道切换声明进行信道切换。
本申请的上述实施例提供的管理通信信道的方法，实现了AP设备和客户端之间通信信道管理相关信息的加密传输，防止了攻击者对管理帧中携带的通信信道管理相关信息的伪造和重放，提高了WiFi通信的安全性。
根据另一方面的实施例，提供了一种管理通信信道的装置。上述管理通信信道的装置可以设置于无线接入点AP设备中。
图8示出了根据一个实施例的管理通信信道的装置的示意性框图。如图8所示，该管理通信信道的装置800包括：构建单元801，配置为构建携带目标信息元素的原始管理帧，上述目标信息元素包括与通信信道管理相关的信息元素；执行单元802，配置为在确定存在客户端已连接到上述AP设备的情况下，针对已连接客户端中的各个客户端，执行预设步骤，其中，上述执行单元802包括：设置模块8021，配置为将上述原始管理帧的目的地址设置为该客户端的MAC地址；加密模块8022，配置为采用该客户端对应的密钥对上述目标信息元素中的信息进行加密，得到加密管理帧；发送模块8023，配置为将加密管理 帧在WiFi网络内进行发送，以供WiFi网络内的已连接客户端根据目的地址确定是否对接收到的管理帧进行处理。
在本实施例的一些可选的实现方式中，装置800还包括：广播单元(图中未示出)，配置为在确定没有客户端与上述AP设备建立连接的情况下，在WIFI网络中广播上述原始管理帧。
在本实施例的一些可选的实现方式中，上述加密模块8022进一步配置为：获取与该客户端建立连接时握手过程中生成的二者之间的专属密钥；使用上述专属密钥对上述目标信息元素中的信息进行加密。
在本实施例的一些可选的实现方式中，上述目标信息元素采用标签－长度－取值的数据格式进行存储；以及上述加密模块8022进一步配置为：采用该客户端对应的密钥对上述目标信息元素中的取值进行加密。
在本实施例的一些可选的实现方式中，上述原始管理帧包括信标帧和探测响应帧。
在本实施例的一些可选的实现方式中，上述目标信息元素包括以下之一：信道切换声明元素、信道切换封装元素、宽频信道切换元素、网状网络信道切换参数元素、信道切换时间元素、最大信道切换时间元素和未来信道引导元素。
在本实施例的一些可选的实现方式中，上述装置800还包括：信标帧发送单元(图中未示出)，配置为响应于确定信道切换完成，在上述WiFi网络中发送目的地址为广播地址，以及不携带信道切换声明元素的信标帧。
根据另一方面的实施例，提供了一种管理通信信道的装置。上述管理通信信道的装置可以设置于客户端。
图9示出了根据又一个实施例的管理通信信道的装置的示意性框图。如图9所示，该管理通信信道的装置900包括：接收单元901，配置为接收无线接入点AP设备发送的加密管理帧，其中携带加密后的目标信息元素，上述目标信息元素包括与通信信道管理相关的信息元素；确定单元902，配置为根据上述加密管理帧的目的地址，确定是否对该加密管理帧进行处理；解密单元903，配置为响应于确定对该加密管理帧进行处理，使用预先存储的密钥对上述目标信息元素进行解密；管理单元904，配置为根据解密结果对通信信道进行管理。
在本实施例的一些可选的实现方式中，上述确定单元902进一步配置为：在上述加密管理帧的目的地址为上述客户端的MAC地址时，确定对该加密管理帧进行处理。
在本实施例的一些可选的实现方式中，上述解密单元903进一步配置为：使用与上 述无线接入点AP建立连接时握手过程中生成的二者之间的专属密钥，对上述目标信息元素进行解密。
在本实施例的一些可选的实现方式中，上述管理单元904进一步配置为：根据解密后的信道切换声明元素，进行信道切换。
根据另一方面的实施例，还提供了一种计算机可读存储介质，其上存储有计算机程序，当上述计算机程序被处理器执行时，实现如图2所描述的方法。
根据再一方面的实施例，还提供了一种无线接入点AP设备，包括存储器和处理器，其特征在于，上述存储器中存储有可执行代码，上述处理器执行上述可执行代码时，实现如图2所描述的方法。
根据另一方面的实施例，还提供了一种计算机可读存储介质，其上存储有计算机程序，当上述计算机程序在计算机中执行时，令计算机执行如图7所描述的方法。
根据再一方面的实施例，还提供了一种终端设备，包括存储器和处理器，其特征在于，上述存储器中存储有可执行代码，上述处理器执行上述可执行代码时，实现如图7所描述的方法。
本领域普通技术人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执轨道，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
结合本文中所公开的实施例描述的方法或算法的步骤可以用硬件、处理器执轨道的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD－ROM、或技术领域内所公知的任意其它形式的存储介质中。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (17)

  1. 一种管理通信信道的方法，通过无线接入点AP设备执行，包括：
    构建携带目标信息元素的原始管理帧，所述目标信息元素包括与通信信道管理相关的信息元素；
    在确定存在客户端已连接到所述AP设备的情况下，针对已连接客户端中的各个客户端，执行以下步骤：
    将所述原始管理帧的目的地址设置为该客户端的MAC地址；
    采用该客户端对应的密钥对所述目标信息元素中的信息进行加密，得到加密管理帧；
    将所述加密管理帧在WiFi网络内进行发送，以供WiFi网络内的已连接客户端根据目的地址确定是否对接收到的管理帧进行处理。
  2. 根据权利要求1所述的方法，其中，所述方法还包括：
    在确定没有客户端与所述AP设备建立连接的情况下，在WIFI网络中广播所述原始管理帧。
  3. 根据权利要求1所述的方法，其中，所述采用该客户端对应的密钥对所述目标信息元素中的信息进行加密，包括：
    获取与该客户端建立连接时握手过程中生成的二者之间的专属密钥；
    使用所述专属密钥对所述目标信息元素中的信息进行加密。
  4. 根据权利要求1所述的方法，其中，所述目标信息元素采用标签－长度－取值的数据格式进行存储；以及
    所述采用该客户端对应的密钥对所述目标信息元素中的信息进行加密，包括：
    采用该客户端对应的密钥对所述目标信息元素中的取值进行加密。
  5. 根据权利要求1所述的方法，其中，所述原始管理帧包括信标帧和探测响应帧。
  6. 根据权利要求5所述的方法，其中，所述目标信息元素包括以下之一：信道切换声明元素、信道切换封装元素、宽频信道切换元素、网状网络信道切换参数元素、信道切换时间元素、最大信道切换时间元素和未来信道引导元素。
  7. 根据权利要求6所述的方法，其中，当所述原始管理帧为信标帧，所述目标信息元素为信道切换声明元素时，所述方法还包括：
    响应于确定信道切换完成，在所述WiFi网络中发送目的地址为广播地址，以及不携带信道切换声明元素的信标帧。
  8. 一种管理通信信道的方法，通过客户端执行，包括：
    接收无线接入点AP设备发送的加密管理帧，其中携带加密后的目标信息元素，所述目标信息元素包括与通信信道管理相关的信息元素；
    根据所述加密管理帧的目的地址，确定是否对该加密管理帧进行处理；
    响应于确定对该加密管理帧进行处理，使用预先存储的密钥对所述目标信息元素进行解密；
    根据解密结果对通信信道进行管理。
  9. 根据权利要求8所述的方法，其中，所述根据所述加密管理帧的目的地址，确定是否对该加密管理帧进行处理，包括：
    在所述加密管理帧的目的地址为所述客户端的MAC地址时，确定对该加密管理帧进行处理。
  10. 根据权利要求8所述的方法，其中，所述使用预先存储的密钥对所述目标信息元素进行解密，包括：
    使用与所述无线接入点AP设备建立连接时握手过程中生成的二者之间的专属密钥，对所述目标信息元素进行解密。
  11. 根据权利要求8所述的方法，其中，所述加密管理帧为加密的信标帧，所述目标信息元素为信道切换声明元素；
    所述根据解密结果对通信信道进行管理，包括：
    根据解密后的信道切换声明元素，进行信道切换。
  12. 一种管理通信信道的装置，设置于无线接入点AP设备，包括：
    构建单元，配置为构建携带目标信息元素的原始管理帧，所述目标信息元素包括与通信信道管理相关的信息元素；
    执行单元，配置为在确定存在客户端已连接到所述AP设备的情况下，针对已连接客户端中的各个客户端，执行预设步骤，其中，所述执行单元包括：
    设置模块，配置为将所述原始管理帧的目的地址设置为该客户端的MAC地址；
    加密模块，配置为采用该客户端对应的密钥对所述目标信息元素中的信息进行加密，得到加密管理帧；
    发送模块，配置为将所述加密管理帧在WiFi网络内进行发送，以供WiFi网络内的已连接客户端根据目的地址确定是否对接收到的管理帧进行处理。
  13. 一种管理通信信道的装置，设置于客户端，包括：
    接收单元，配置为接收无线接入点AP设备发送的加密管理帧，其中携带加密后目标信息元素，所述目标信息元素包括与通信信道管理相关的信息元素；
    确定单元，配置为根据所述加密管理帧的目的地址，确定是否对该加密管理帧进行处理；
    解密单元，配置为响应于确定对该加密管理帧进行处理，使用预先存储的密钥对所述目标信息元素进行解密；
    管理单元，配置为根据解密结果对通信信道进行管理。
  14. 一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序被处理器执行时，实现如权利要求1－7中任一项的所述的方法。
  15. 一种无线接入点AP设备，包括存储器和处理器，其特征在于，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1－7中任一项所述的方法。
  16. 一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行权利要求8－11中任一项的所述的方法。
  17. 一种终端设备，包括存储器和处理器，其特征在于，所述存储器中存储有可执行 代码，所述处理器执行所述可执行代码时，实现权利要求8－11中任一项所述的方法。
PCT/CN2022/105248 2021-08-19 2022-07-12 管理通信信道的方法和装置 Ceased WO2023020164A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22857477.8A EP4319229A4 (en) 2021-08-19 2022-07-12 METHOD AND DEVICE FOR MANAGING A COMMUNICATION CHANNEL
US18/520,123 US20240098488A1 (en) 2021-08-19 2023-11-27 Communication channel management methods and apparatuses

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110957050.9A CN113613245B (zh) 2021-08-19 2021-08-19 管理通信信道的方法和装置
CN202110957050.9 2021-08-19

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/520,123 Continuation US20240098488A1 (en) 2021-08-19 2023-11-27 Communication channel management methods and apparatuses

Publications (1)

Publication Number Publication Date
WO2023020164A1 true WO2023020164A1 (zh) 2023-02-23

Family

ID=78341377

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/105248 Ceased WO2023020164A1 (zh) 2021-08-19 2022-07-12 管理通信信道的方法和装置

Country Status (4)

Country Link
US (1) US20240098488A1 (zh)
EP (1) EP4319229A4 (zh)
CN (1) CN113613245B (zh)
WO (1) WO2023020164A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113613245B (zh) * 2021-08-19 2025-07-25 支付宝(杭州)信息技术有限公司 管理通信信道的方法和装置
CN115174388B (zh) * 2022-07-01 2024-03-26 杭州涂鸦信息技术有限公司 一种联网智能设备网络更新方法、装置、设备及存储介质
GB2620416B (en) * 2022-07-07 2025-06-04 Canon Kk Obfuscation of IES in management frames using container IES with encrypted information section
CN120017293A (zh) * 2023-11-16 2025-05-16 中兴通讯股份有限公司 信息处理方法、网络设备及计算机可读存储介质
CN117479111B (zh) * 2023-12-25 2024-03-22 广州鲁邦通物联网科技股份有限公司 一种基于Wi-Fi技术的离线自动付费方法、系统及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030063593A1 (en) * 2001-09-29 2003-04-03 Kabushiki Kaisha Toshiba Wireless communication system and wireless LAN access point
WO2006120316A1 (fr) * 2005-05-13 2006-11-16 France Telecom Procede de communication pour reseaux sans fil par trames de gestion comportant une signature electronique
CN107846685A (zh) * 2017-11-16 2018-03-27 北京小米移动软件有限公司 配置信息的传输方法、装置及系统、存储介质
WO2020011276A1 (zh) * 2018-07-11 2020-01-16 杭州博联智能科技股份有限公司 利用wifi管理帧的数据发送、接收和通信方法、设备、存储介质
CN113613245A (zh) * 2021-08-19 2021-11-05 支付宝(杭州)信息技术有限公司 管理通信信道的方法和装置

Family Cites Families (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7120138B2 (en) * 2001-07-02 2006-10-10 Koninklijke Philips Electronics N.V. Dynamic frequency selection with recovery for a basic service set network
US20050086465A1 (en) * 2003-10-16 2005-04-21 Cisco Technology, Inc. System and method for protecting network management frames
CN1968261B (zh) * 2005-11-14 2011-05-25 联想(北京)有限公司 一种在无线局域网中共享资源的方法
KR100737527B1 (ko) * 2005-12-08 2007-07-10 한국전자통신연구원 이더넷 폰에서 보안 채널 제어 방법 및 장치
CN101395835A (zh) * 2006-02-28 2009-03-25 诺基亚公司 无线网络中用于省电传送的使用mac报头的多播组地址信令
CN101137139A (zh) * 2006-09-01 2008-03-05 鸿富锦精密工业（深圳）有限公司 无线局域网络装置通信参数设定系统及方法
CN101272379A (zh) * 2008-05-13 2008-09-24 武汉理工大学 基于IEEE802.1x安全认证协议的改进方法
CN101959188B (zh) * 2009-07-16 2012-11-14 北京中电华大电子设计有限责任公司 一种无线局域网卡芯片密钥管理方法
CN101616412A (zh) * 2009-08-07 2009-12-30 杭州华三通信技术有限公司 无线局域网中管理帧的校验方法和设备
CN101848463A (zh) * 2010-03-16 2010-09-29 苏州汉明科技有限公司 无线接入点保护合法用户接入的方法
CN102404720B (zh) * 2010-09-19 2014-10-08 华为技术有限公司 无线局域网中密钥的发送方法及装置
CN101986726B (zh) * 2010-10-25 2012-11-07 西安西电捷通无线网络通信股份有限公司 一种基于wapi的管理帧保护方法
KR101521080B1 (ko) * 2011-04-15 2015-05-18 인텔 코포레이션 무선 네트워크에서 채널 액세스를 위한 방법 및 장치
CN102750750A (zh) * 2012-06-18 2012-10-24 北京大学 一种基于Wi-Fi的打卡方法及其系统
CN103686881A (zh) * 2012-09-11 2014-03-26 华为技术有限公司 信道切换方法、设备及系统
JP6068657B2 (ja) * 2012-10-12 2017-01-25 エルジー エレクトロニクス インコーポレイティド 無線ｌａｎシステムにおいて短いｍａｃヘッダーを支援するフレーム送受信方法及び装置
US9820131B2 (en) * 2013-01-11 2017-11-14 Qualcomm Incorporated Systems and methods for formatting frames in neighborhood aware networks
CN104333862B (zh) * 2013-07-22 2018-03-16 中国科学院信息工程研究所 一种无线局域网细粒度管控方法
CN104469764A (zh) * 2013-09-16 2015-03-25 中兴通讯股份有限公司 一种wlan组网方法及系统
CN105049422B (zh) * 2015-06-25 2018-04-13 迪爱斯信息技术股份有限公司 一种wifi探测识别设备、系统以及wifi探测识别方法
US20170111469A1 (en) * 2015-10-15 2017-04-20 Samsung Electronics Co., Ltd. Method for assigning dynamic identifier to electronic device and device thereof
US10049000B2 (en) * 2015-12-28 2018-08-14 Samsung Electronics Co., Ltd Method and apparatus for partial packet recovery during WLAN scanning
CN105635185A (zh) * 2016-03-25 2016-06-01 珠海网博信息科技股份有限公司 一种wifi环境下防止监听的方法和装置
CN107306386B (zh) * 2016-04-22 2020-02-14 华为技术有限公司 接入点触发终端漫游的方法及接入点
US10492139B2 (en) * 2016-08-31 2019-11-26 Futurewei Technologies, Inc. System and method for secure and quick wake up of a station
CN106412883B (zh) * 2016-11-10 2021-11-05 新华三技术有限公司 一种接入无线网络的方法及装置
CN107995671A (zh) * 2017-12-01 2018-05-04 海尔优家智能科技（北京）有限公司 连接无线访问接入点的方法、装置、设备及存储介质
CN108282551B (zh) * 2018-03-07 2021-04-09 成都众网行科技有限公司 报文识别处理方法、装置、监听设备及可读存储介质
US10271215B1 (en) * 2018-06-27 2019-04-23 Hewlett Packard Enterprise Development Lp Management frame encryption and decryption
CN111278036B (zh) * 2018-12-04 2024-01-09 京东科技信息技术有限公司 一种采集mac地址的方法及装置
US20200367124A1 (en) * 2019-05-16 2020-11-19 Mediatek Singapore Pte. Ltd. Synchronization Of Client And Access Point During Channel Switch In Wireless Communications
US11219078B2 (en) * 2019-09-05 2022-01-04 Apple Inc. System and method for enhanced high throughput (EHT) stations
CN114698149A (zh) * 2020-01-21 2022-07-01 华为技术有限公司 一种数据传输方法及设备
US11330519B1 (en) * 2020-02-13 2022-05-10 Amazon Technologies, Inc. Device power management transitions in wireless networks
US11805416B2 (en) * 2020-08-20 2023-10-31 Apple Inc. Systems and methods for multi-link device privacy protection
CN112737718B (zh) * 2020-12-29 2023-01-10 Oppo广东移动通信有限公司 信道切换方法、装置、电子设备及存储介质
CA3211917A1 (en) * 2021-03-12 2022-09-15 Michael Montemurro Method and system for wlan multi-link management frame addressing
EP4211913A4 (en) * 2021-04-01 2024-03-06 Samsung Electronics Co., Ltd. METHOD, ACCESS POINT DEVICE AND STATION DEVICE FOR A CLOSED WIFI HOTSPOT NETWORK

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030063593A1 (en) * 2001-09-29 2003-04-03 Kabushiki Kaisha Toshiba Wireless communication system and wireless LAN access point
WO2006120316A1 (fr) * 2005-05-13 2006-11-16 France Telecom Procede de communication pour reseaux sans fil par trames de gestion comportant une signature electronique
CN107846685A (zh) * 2017-11-16 2018-03-27 北京小米移动软件有限公司 配置信息的传输方法、装置及系统、存储介质
WO2020011276A1 (zh) * 2018-07-11 2020-01-16 杭州博联智能科技股份有限公司 利用wifi管理帧的数据发送、接收和通信方法、设备、存储介质
CN113613245A (zh) * 2021-08-19 2021-11-05 支付宝(杭州)信息技术有限公司 管理通信信道的方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4319229A4

Also Published As

Publication number Publication date
CN113613245B (zh) 2025-07-25
EP4319229A4 (en) 2024-10-23
EP4319229A1 (en) 2024-02-07
US20240098488A1 (en) 2024-03-21
CN113613245A (zh) 2021-11-05

Similar Documents

Publication Publication Date Title
US10652766B2 (en) Method and apparatus for base station self-configuration
US8838972B2 (en) Exchange of key material
US8254581B2 (en) Lightweight key distribution and management method for sensor networks
JP5678138B2 (ja) ダイレクトリンク通信のための拡張されたセキュリティ
WO2023020164A1 (zh) 管理通信信道的方法和装置
JP5480890B2 (ja) 制御信号の暗号化方法
KR20180130203A (ko) 사물인터넷 디바이스 인증 장치 및 방법
WO2020216047A1 (zh) 一种认证信息处理方法、终端和网络设备
CN115765979B (zh) 一种通信方法及通信装置
Singh et al. Elliptic curve cryptography based mechanism for secure Wi-Fi connectivity
Qachri et al. A formally verified protocol for secure vertical handovers in 4G heterogeneous networks
WO2025214457A1 (zh) 信令安全保障方法、装置、通信设备和存储介质
KR20260056273A (ko) 정보 프레임 전송 방법, 네트워크 설비 및 저장 매체
Kambourakis et al. Key Management in 802.16 e

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22857477

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 22857477.8

Country of ref document: EP

Ref document number: 2022857477

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022857477

Country of ref document: EP

Effective date: 20231103

NENP Non-entry into the national phase

Ref country code: DE