WO2023093277A1 - 一种漫游方法及系统 - Google Patents

一种漫游方法及系统 Download PDF

Info

Publication number
WO2023093277A1
WO2023093277A1 PCT/CN2022/121585 CN2022121585W WO2023093277A1 WO 2023093277 A1 WO2023093277 A1 WO 2023093277A1 CN 2022121585 W CN2022121585 W CN 2022121585W WO 2023093277 A1 WO2023093277 A1 WO 2023093277A1
Authority
WO
WIPO (PCT)
Prior art keywords
sta
random number
address
control device
master
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/121585
Other languages
English (en)
French (fr)
Inventor
黄晨骥
孙荣彬
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP22897363.2A priority Critical patent/EP4418711A4/en
Publication of WO2023093277A1 publication Critical patent/WO2023093277A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/08—Reselecting an access point
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present application relates to the communication field, and in particular to a roaming method and system.
  • STA Before the workstation (Station, STA) formally transmits data frames with the access point (Access Point, AP), it needs to go through three stages before it can access: scanning (SCAN), authentication (Authentication), association (Association), as shown in Figure 1 shown.
  • scanning if the wireless STA is set to the network node mode, the Institute of Electrical and Electronics Engineers (IEEE) 802.11MAC uses Scanning to search for APs. There are two methods: active scanning and passive scanning. In the active scanning mode, STAs send Probe Request frames on 11 channels in turn to find APs on the channels. In the passive scanning mode, the STA passively waits for the Beacon frame sent by the AP at regular intervals.
  • active scanning mode STAs send Probe Request frames on 11 channels in turn to find APs on the channels.
  • passive scanning mode the STA passively waits for the Beacon frame sent by the AP at regular intervals.
  • the Beacon frame provides information about the AP and its basic service set (BSS).
  • BSS basic service set
  • the scanning phase the scanning of the AP list is completed, and the STA enters the authentication phase according to the AP selected by the user.
  • the authentication phase the STA sends an authentication request (Authentication Request) to the AP, and the AP responds with an authentication response (Authentication Response), completing the link authentication.
  • Authentication Request an authentication request
  • Authentication Response an authentication response
  • Commonly used authentication methods include open-system authentication, shared-key authentication, Wi-Fi Protected Access (WPA) PSK (Pre-shared key) authentication and 802.1 X (Extensible Authentication Protocol, EAP) authentication.
  • WPA Wi-Fi Protected Access
  • PSK Pre-shared key
  • 802.1 X Extensible Authentication Protocol, EAP
  • the distribution system can record the location of each STA.
  • the STA sends an association request to the AP, and the AP returns an association response to the STA. So far, the access process is completed, the STA is initialized, and can begin to transmit data frames to the AP.
  • the fourth stage is required: Extensible Authentication Protocol over LAN (EAPoL) four-way handshake based on local area network (LAN), and access authentication through EAPoL four-way handshake.
  • EAPoL Extensible Authentication Protocol over LAN
  • PTK Pairwise Transient Key
  • the wireless access process has many steps and takes a long time. In the case of packet loss and retransmission, it can be clearly perceived that the access time is long.
  • a distributed networking scenario as shown in Figure 2, when a STA is connected to an AP, other APs cannot perceive it.
  • the reassociation action is as described above, which requires authentication, association and four-way handshake. In this way, even if the STA roams in the same network, the actions and time of the reassociation process after roaming are the same as those of accessing a new network, resulting in many steps and a long time-consuming access process.
  • the embodiment of the present application provides a roaming method, which can reduce the roaming access duration.
  • a roaming system including a master control device and multiple access points APs controlled by the master control device, where the multiple APs include a first AP and a second AP.
  • the master control device is used to generate secret key information
  • the secret key information includes a first random number, a second random number, an AP address, and a paired master key PMK
  • the master control device is also used to send the second random number to the second An AP and a second AP send the key information.
  • the first AP and the second AP are respectively used to generate a pairwise transmission key PTK according to the key information.
  • the first AP is further configured to send the first random number, the second random number, and the AP address to the STA after receiving the first association request message from the workstation STA, the The first random number, the second random number, and the AP address are used by the STA to generate the PTK.
  • the second AP is further configured to receive a second association request message sent by the STA when the STA moves from the area covered by the first AP to the area covered by the second AP, and determine that the STA
  • the STA that has accessed the AP controlled by the master device sends a second association response message to the STA, where the second association response message is used to indicate that the STA has accessed the second AP.
  • the second AP is further configured to communicate with the STA according to the PTK.
  • the first AP is configured to send the second random number and the AP address to the For the STA, the first AP is configured to send the first random number to the STA through an extended authentication protocol EAPoL.
  • the first AP is further configured to, after receiving the first association request message from the workstation STA , sending the first random number, the second random number, and the AP address to the STA, including: the master control device is used to receive the first association from the workstation STA at the first AP After the request message, the first AP forwards the first random number, the second random number, and the AP address to the STA.
  • the master control device is configured to pass the first association response message sending the second random number and the AP address to the STA, and the master control device is configured to send the first random number to the STA through an extended authentication protocol EAPoL.
  • the second association request message carries an indication that the STA requests Information for quick access.
  • the second association response message carries an indication that the second The AP agrees to the STA's quick access information.
  • the AP address is the media access A control (media access control, MAC) address, or the AP address is a pre-configured address.
  • the first AP and the second AP are further respectively used
  • the PTK is generated according to the STA address of the STA; the first AP is used to obtain the STA address when the STA accesses the first AP; the second AP is used to pass the second AP Obtain the address of the STA through an association request message, or obtain the address of the STA through the master control device.
  • the STA is further configured to: The PMK input by the user generates the PTK, and the PMK input by the user is the same as the PMK generated by the master control device.
  • the master control device is further configured to Before the area covered by the first AP moves to the area covered by the second AP, determine that the RSSI of the STA is weakened, and determine that the STA will roam to the second AP according to the RSSIs of the multiple APs .
  • the second AP receives the second Before the association request message, the first AP is also used to instruct the STA to switch to the second AP;
  • the master control device sends information indicating that the STA has moved out of the first AP.
  • the second AP is configured to Request the identifier of the STA in the message, and query the main control device whether the STA is an STA that has accessed the AP controlled by the main control device.
  • a roaming method including the main control device generating key information, where the key information includes a first random number, a second random number, an AP address, and a paired master key PMK.
  • the master control device sends the key information to a first access point AP and a second AP, and the first AP and the second AP are controlled by the master control device.
  • the first AP and the second AP respectively generate a pairwise transmission key PTK according to the key information.
  • the first AP After the first AP receives the first association request message from the workstation STA, the first AP sends the first random number, the second random number, and the AP address to the STA, The first random number, the second random number, and the AP address are used by the STA to generate the PTK.
  • the second AP receives the second association request message sent by the STA, and determines that the STA is connected
  • the STA that has entered the AP controlled by the master control device sends a second association response message to the STA, where the association response message is used to indicate that the STA has accessed the second AP.
  • the second AP communicates with the STA according to the PTK.
  • a roaming method including that the second access point AP receives key information from a master control device, and the key information includes a first random number, a second random number, an AP address, a paired master A secret key PMK, where the secret key information is used by the second AP to generate a pairwise transmission key PTK.
  • the second AP is controlled by the master control device.
  • the second AP receives an association request message from the workstation STA, determines that the STA is an STA that has accessed the AP controlled by the main control device, and sends an association response message to the STA, and the association response message It is used to indicate that the STA has accessed the second AP.
  • the second AP communicates with the STA according to the PTK.
  • a roaming method including that when a workstation STA moves from an area covered by a first access point AP to an area covered by a second AP, the STA sends an association request message to the first AP, and the The association request message carries indication information, and the indication information is used by the second AP to determine that the STA is an STA that has accessed the first AP.
  • the first AP and the second AP communicate using the same pairwise transmission key PTK.
  • the STA receives an association response message from the second AP, where the association response message is used to indicate that the STA has accessed the second AP.
  • a method for generating a secret key includes generating secret key information by a master control device, where the secret key information includes a first random number, a second random number, an AP address, and a paired master key PMK.
  • the main control device sends the key information to the first access point AP and the second AP, and the key information is used for the first AP and the second AP to generate a paired transmission key PTK respectively.
  • the first AP and the second AP are controlled by the master device.
  • a method for generating a secret key including that the first access point AP receives secret key information from a master control device, and the secret key information includes a first random number, a second random number, an AP address, a
  • the key information is used by the first AP to generate a paired transmission key PTK; the first AP is controlled by the master control device.
  • the first AP sends the first random number, the second random number, and the AP address to the STA, and the first random number, the The second random number and the AP address are used by the STA to generate the PTK.
  • a terminal device including a sending module and a receiving module.
  • the sending module is configured to send an association request message to the second AP when the terminal device moves from an area covered by the first access point AP to an area covered by the second AP, and the association request message Carry indication information, the indication information is used by the second AP to determine that the STA is the STA that has accessed the first AP; the first AP and the second AP use the same pairwise transmission key
  • the PTK communicates; the receiving module is configured to receive an association response message from the second AP, where the association response message is used to indicate that the terminal device has accessed the second AP.
  • the association request message carries information indicating that the terminal device requests quick access.
  • the association response message carries information indicating that the second AP agrees to the quick access of the terminal.
  • the indication information is an identifier of the terminal device.
  • the identifier of the terminal device is the MAC address of the terminal device.
  • a computing device is provided, and the computing device is used to implement the above first aspect to the sixth aspect, and one of the various implementation manners of the first aspect.
  • the main control device generates key information, and then synchronizes the key information to all access points controlled by the main control device, so that all access points in the network use the same set of key information , realizing the purpose of completing the roaming access after only one handshake during the roaming process, reducing the steps and time of roaming access, and enhancing the roaming experience.
  • FIG. 1 is a flow chart of an access process in the prior art
  • FIG. 2 is a schematic diagram of a roaming method in the prior art
  • FIG. 3 is a schematic diagram of a network architecture according to an embodiment of the present application.
  • FIG. 4 is a flowchart of a roaming method according to an embodiment of the present application.
  • FIG. 5 is a flow chart of roaming judgment according to an embodiment of the present application.
  • FIG. 6 is a flow chart of roaming handover according to an embodiment of the present application.
  • Fig. 7 is a flowchart of a roaming method according to another embodiment of the present application.
  • the embodiment of this application provides a roaming system, so that STAs that have access to the distributed network do not need to go through the authentication, association and four-way handshake process again when roaming in the distributed network, reducing the steps and time of roaming, and enhancing roaming experience.
  • FIG. 3 is a schematic diagram of a network architecture according to an embodiment of the present application.
  • the network is a distributed network, which includes a main control device, a first AP, a second AP and STAs.
  • the first AP and the second AP are APs controlled by the master device.
  • the main control device may also control other APs, which are not shown in FIG. 3 .
  • the master control device may be a gateway.
  • STA can be a terminal device that supports WIFI, such as mobile phone, tablet computer, wearable device, smart car, etc.
  • WIFI wireless local area network
  • FIG. 4 is a flowchart of a roaming method according to an embodiment of the present application.
  • the master control device generates secret key information, where the secret key information includes a first random number, a second random number, an AP address, and a pairwise master key (Pairwise Master Key, PMK).
  • the secret key information includes a first random number, a second random number, an AP address, and a pairwise master key (Pairwise Master Key, PMK).
  • the first random number is the random number (ANonce) of the AP
  • the second random number is the random number (SNonce) of the STA.
  • the AP address may be a Media Access Control (Media Access Control, MAC) address of the master device, or a pre-agreed fixed address.
  • the master control device sends the key information to the first AP and the second AP.
  • the first AP and the second AP respectively generate a PTK according to the key information.
  • the first AP After the first AP receives the first association request message from the STA, the first AP sends the first random number, the second random number, and the AP address to the STA.
  • the STA generates a PTK according to the first random number, the second random number, the AP address, the STA address, and the PMK input by the user.
  • the PMK input by the user is the same as the PMK generated by the master device.
  • the PTK generated by the STA is the same as the PTK generated by the first AP and the second AP in S403.
  • the first AP and the second AP also generate PTKs according to the addresses of the STAs.
  • the first AP obtains the address of the STA when the STA accesses the first AP.
  • the first AP can obtain the address of the STA through a message sent by the STA when it accesses the first AP, for example, an authentication request message and an association request message sent by the STA to the first AP.
  • the second AP may obtain the STA address through the master control device, for example, the master control device broadcasts the STA address after the STA accesses the first AP.
  • the second AP may also obtain the STA address through the second association request message in S407.
  • the process for the STA to access the first AP may be completed between the STA and the first AP by using an existing access procedure.
  • the STA does not support IEEE 802.11r
  • scanning, authentication, association, and four-way handshake are required.
  • Authentication and association are required when the STA supports IEEE 802.11r. For brevity, some steps are not shown in FIG. 4 .
  • the first AP sends the second random number and the AP address to the STA through the first association response message, and sends the first random number to the STA through the first step of the EAPoL four-way handshake.
  • the first AP checks whether the message integrity check (Message Integrity Check, MIC) sent by the STA through the second step of EAPoL is correct. If it is correct, the subsequent first AP and STA can use the above-mentioned PTK to communicate.
  • message integrity check Message Integrity Check, MIC
  • the STA reports an online event to the main control device after accessing the first AP.
  • the master device records the STA as a device that has accessed the network.
  • a received signal strength indicator (RSSI) appears Weaken, and trigger the master device to make a roaming decision.
  • the master device determines the AP to which the STA will roam according to the RSSIs of the multiple APs it controls.
  • the master device determines that the AP to which the STA will roam is the second AP as an example for description.
  • the specific process is shown in Figure 5.
  • the STA's support for IEEE 802.11k and IEEE 802.11v there are two situations for the STA to perform roaming handover.
  • the STA does not support 11kv
  • the first AP will forcibly disconnect from the STA, and the STA will choose another AP to connect to.
  • the STA supports IEEE 802.11k and IEEE 802.11v
  • the specific process is shown in Figure 6.
  • the STA sends a second association request message to the second AP to access the second AP.
  • the second association request message carries information indicating that the STA requests quick access.
  • the second AP determines that the STA is a device that has accessed the network.
  • the second AP queries the main control device whether the STA has accessed the network according to the indication information carried in the second association request message.
  • the indication information may be the identifier of the STA. For example, according to the MAC address of the STA, the master device is queried whether the STA has access to the network. The master control device determines that the STA is a device that has connected to the network according to the list of devices that have connected to the network.
  • the second AP sends a second association response message to the STA, where the second association response message is used to indicate that the STA has completed accessing the second AP.
  • the second association response message carries information indicating that the second AP agrees to the fast access of the STA.
  • the information instructing the STA to request quick access in S408 and the information instructing the second AP to agree to the STA's quick access in S409 may be carried in a dedicated IE field.
  • the type-length-value (TLV) in the IE field includes element ID (Element ID), field length (Length), and fast access status code (Fast Assoc Status Code).
  • the value of the Fast Assoc Status Code is 1, indicating that the STA requests fast access to the AP, a value of 2, indicating that the AP agrees to the STA's fast access, and a value of 3, indicating that the AP rejects the STA's fast access.
  • both the second AP and the STA use the PTK to communicate with each other.
  • the master control device generates the secret key information, and then synchronizes the secret key information to all the access points controlled by the master control device, so that all the access points in the network use the same set of secret keys, realizing In the roaming process, only one handshake is required to complete the roaming access, reducing the steps and time of roaming access, and enhancing the roaming experience.
  • the step of generating the PTK by the first AP according to the key information in S403 can be completed after S404 and before the first AP and the STA communicate using the PTK.
  • the step of generating the PTK by the second AP according to the key information in S403 may be completed after S404 and before S410.
  • FIG. 7 is a flowchart of a roaming method according to another embodiment of the present application. Different from the embodiment in FIG. 4 , the authentication process when the STA accesses the first AP is completed between the STA and the first AP, while the association involving key exchange and the four-way handshake process are completed between the STA and the master device.
  • the main control device generates key information, where the key information includes a first random number, a second random number, an AP address, and a PMK.
  • the main control device sends the key information to the first AP and the second AP.
  • the first AP and the second AP respectively generate a PTK according to the key information.
  • the first AP After the first AP receives the first association request message from the STA, the first AP forwards the first association request message to the main control device, and the main control device sends the first random number, the second Two random numbers and the AP address are forwarded to the STA.
  • the STA generates a PTK according to the first random number, the second random number, the AP address, the STA address, and the PMK input by the user.
  • the PMK input by the user is the same as the PMK generated by the master device.
  • the PTK generated by the STA is the same as the PTK generated by the first AP and the second AP in S703.
  • the first AP and the second AP also generate PTKs according to the addresses of the STAs.
  • the first AP obtains the address of the STA when the STA accesses the first AP.
  • the first AP can obtain the address of the STA by receiving or forwarding the message sent by the STA when it accesses the first AP, such as receiving the authentication request message sent by the STA to the first AP, and then forwarding the association request message to the master device, etc. .
  • the second AP may obtain the STA address through the master control device, for example, the master control device broadcasts the STA address after the STA accesses the first AP.
  • the second AP may also acquire the STA address through the second association request message in S707.
  • the authentication process for the STA to access the first AP can be completed between the STA and the first AP by using an existing access process.
  • the STA association and four-way handshake are completed between the STA and the main control device, and the first AP forwards related information.
  • the main control device sends the second random number and the AP address to the STA through the first association response message, and sends the first random number to the STA through the first step of the EAPoL four-way handshake.
  • the main control device checks whether the MIC sent by the STA through the second step of EAPoL is correct, and if it is correct, the subsequent first AP and STA can use the above-mentioned PTK to communicate.
  • the main control device After the STA accesses the first AP, the main control device records the STA online event.
  • a received signal strength indicator (received signal strength indicator, RSSI) appears Weaken, and trigger the master device to make a roaming decision.
  • the master device determines the AP to which the STA will roam according to the RSSIs of the multiple APs it controls.
  • the STA sends a second association request message to the second AP to access the second AP.
  • the second AP determines that the STA is a device that has accessed the network.
  • the second AP sends a second association response message to the STA, where the second association response message is used to indicate that the STA has completed accessing the second AP.
  • both the second AP and the STA use the PTK to communicate with each other.
  • the master control device generates the secret key information, and then synchronizes the secret key information to all the access points controlled by the master control device, so that all the access points in the network use the same set of secret keys, realizing In the roaming process, only one handshake is required to complete the roaming access, reducing the steps and time of roaming access, and enhancing the roaming experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请的实施例提供一种漫游方法。主控设备生成密钥信息，密钥信息包括第一随机数、第二随机数、AP地址、成对主密钥PMK，向第一AP和第二AP发送密钥信息。第一AP和第二AP分别根据密钥信息生成成对传输密钥PTK。第一AP在接收到来自工作站STA的第一关联请求报文后，将第一随机数、第二随机数、AP地址发送给STA以生成PTK。第二AP在STA从第一AP覆盖的区域移动至第二AP覆盖的区域时，接收STA发送的第二关联请求报文，确定STA为已接入主控设备控制的AP的STA，向STA发送指示STA已接入第二AP的第二关联响应报文。第二AP根据该PTK与STA通信。本申请实施例提供的漫游方法减少了漫游接入的步骤和时间。

Description

一种漫游方法及系统
本申请要求于2021年11月23日提交中国国家知识产权局、申请号202111395423.4、申请名称为“一种漫游方法及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种漫游方法及系统。
背景技术
工作站(Station，STA)正式和接入点(Access Point，AP)传送数据帧前，要经过三个阶段才能够接入：扫描(SCAN)，认证(Authentication)，关联(Association)，如图1所示。在扫描阶段中，若无线STA设成网络节点模式，电气电子工程师学会(Institute of Electrical and Electronics Engineers，IEEE)802.11MAC使用Scanning来搜索AP，有两种方式：主动扫描方式和被动扫描方式。主动扫描方式中，STA依次在11个信道发出Probe Request帧，寻找该信道上的AP。被动扫描方式中，STA被动等待AP每隔一段时间定时送出的Beacon信标帧，该Beacon帧提供了AP及所在基本服务组合(basic service set，BSS)相关信息。扫描阶段完成AP列表的扫描，STA根据用户选择的AP进入认证阶段。在认证阶段中，STA向AP发送认证请求(Authentication Request)，AP回应认证响应(Authentication Response)，完成链路认证。只有身份认证通过的STA才能进行无线接入访问。常用的认证方法有开放系统身份认证(open-system authentication)，共享密钥认证(shared-key authentication)，WIFI安全访问协议(Wi-Fi Protected Access，WPA)PSK(Pre-shared key)认证以及802.1X(Extensible Authentication Protocol，EAP)认证。当AP向STA返回认证响应信息，身份认证获得通过后，传输系统(distribution system)得以记录每部STA的位置。在关联阶段中，STA向AP发送关联请求，AP向STA返回关联响应。至此，接入过程完成，STA初始化完毕，可以开始向AP传送数据帧。当网络为加密模式时，需要进行第四阶段：基于局域网(local area network，LAN)的扩展认证协议(Extensible Authentication Protocol over LAN，EAPoL)四次握手，通过EAPoL四次握手进行接入认证。通过STA和AP之间的四次握手流程可以安全地协商和交换成对传输秘钥(PairwiseTransient Key，PTK)。四次握手完成以后，之后的帧传播就都会以加密的方式进行。
如上所示，无线接入过程步骤较多，耗时较长，在出现丢包重传的情况下，可以明显感知到接入时间长。在分布式组网场景下，如图2所示，当一个STA连接到 某个AP上时，其他AP是无法感知到的，当STA从一个AP漫游到另一个AP上时，需要重新进行关联，重新关联动作如前文描述，需要进行认证、关联和四次握手。这样STA即便在同一个网络中漫游，其漫游后重新关联过程的动作和时间都和接入一个新网络没有区别，导致接入过程步骤多，耗时长。
发明内容
本申请的实施例提供一种漫游方法，能够降低漫游接入时长。
第一方面，提供了一种漫游系统，包括主控设备以及所述主控设备控制的多个接入点AP，所述多个AP中包括第一AP和第二AP。所述主控设备用于生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK，所述主控设备还用于向所述第一AP和第二AP发送所述秘钥信息。所述第一AP和所述第二AP分别用于根据所述秘钥信息生成成对传输秘钥PTK。所述第一AP还用于在接收到来自工作站STA的第一关联请求报文后，将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，所述第一随机数、所述第二随机数、所述AP地址用于所述STA生成所述PTK。所述第二AP还用于在所述STA从所述第一AP覆盖的区域移动至所述第二AP覆盖的区域时，接收所述STA发送的第二关联请求报文，确定所述STA为已接入所述主控设备控制的AP的STA，向所述STA发送第二关联响应报文，所述第二关联响应报文用于指示所述STA已接入所述第二AP。所述第二AP还用于根据所述PTK与所述STA通信。
结合第一方面的实现方式，在第一方面第一种可能的实现方式中，所述第一AP用于通过第一关联响应报文将所述第二随机数、所述AP地址发送给所述STA，所述第一AP用于通过扩展认证协议EAPoL将所述第一随机数发送给所述STA。
结合第一方面或第一方面的第一种可能的实现方式中，在第二种可能实现的方式中，所述第一AP还用于在接收到来自工作站STA的第一关联请求报文后，将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，包括：所述主控设备用于在所述第一AP接收到来自工作站STA的第一关联请求报文后，通过所述第一AP将所述第一随机数、所述第二随机数、所述AP地址转发给所述STA。
结合第一方面或第一方面的第一种至第二种可能的实现方式中的任意一种，在第三种可能实现的方式中，所述主控设备用于通过第一关联响应报文将所述第二随机数、所述AP地址发送给所述STA，所述主控设备用于通过扩展认证协议EAPoL将所述第一随机数发送给所述STA。
结合第一方面或第一方面的第一种至第三种可能的实现方式中的任意一种，在第四种可能实现的方式中，所述第二关联请求报文携带指示所述STA请求快速接入的信息。
结合第一方面或第一方面的第一种至第四种可能的实现方式中的任意一种，在第五种可能实现的方式中，所述第二关联响应报文携带指示所述第二AP同意所述STA快速接入的信息。
结合第一方面或第一方面的第一种至第五种可能的实现方式中的任意一种，在 第六种可能实现的方式中，所述AP地址为所述主控设备的媒体存取控制(mediaaccess control，MAC)地址，或者所述AP地址为预配置的地址。
结合第一方面或第一方面的第一种至第六种可能的实现方式中的任意一种，在第七种可能实现的方式中，所述第一AP和所述第二AP还分别用于根据所述STA的STA地址生成所述PTK；所述第一AP用于在所述STA接入所述第一AP时获取所述STA地址；所述第二AP用于通过所述第二关联请求报文获取所述STA地址，或通过所述主控设备获取所述STA地址。
结合第一方面或第一方面的第一种至第七种可能的实现方式中的任意一种，在第八种可能实现的方式中，所述STA还用于根据所述STA的STA地址和用户输入的PMK生成所述PTK，所述用户输入的PMK与所述主控设备生成的PMK相同。
结合第一方面或第一方面的第一种至第八种可能的实现方式中的任意一种，在第九种可能实现的方式中，所述主控设备还用于在所述STA从所述第一AP覆盖的区域移动至第二AP覆盖的区域之前，确定所述STA的接收信号强度指示RSSI减弱，并根据所述多个AP的RSSI确定所述STA将要漫游至所述第二AP。
结合第一方面或第一方面的第一种至第九种可能的实现方式中的任意一种，在第十种可能实现的方式中，在所述第二AP接收所述STA发送的第二关联请求报文之前，所述第一AP还用于指示所述STA切换至所述第二AP；所述第一AP还用于在所述STA接受切换至所述第二AP后，向所述主控设备发送指示所述STA已迁出所述第一AP的信息。
结合第一方面或第一方面的第一种至第十种可能的实现方式中的任意一种，在第十一种可能实现的方式中，所述第二AP用于根据所述第二关联请求报文中的所述STA的标识，向所述主控设备查询所述STA是否为已接入所述主控设备控制的AP的STA。
第二方面，提供了一种漫游方法，包括主控设备生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK。所述主控设备向第一接入点AP和第二AP发送所述秘钥信息，所述第一AP和所述第二AP受所述主控设备控制。所述第一AP和所述第二AP分别根据所述秘钥信息生成成对传输秘钥PTK。在所述第一AP接收到来自工作站STA的第一关联请求报文后，所述第一AP将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，所述第一随机数、所述第二随机数、所述AP地址用于所述STA生成所述PTK。在所述STA从所述第一AP覆盖的区域移动至所述第二AP覆盖的区域时，所述第二AP接收所述STA发送的第二关联请求报文，确定所述STA为已接入所述主控设备控制的AP的STA，向所述STA发送第二关联响应报文，所述关联响应报文用于指示所述STA已接入所述第二AP。所述第二AP根据所述PTK与所述STA通信。
第三方面，提供了一种漫游方法，包括第二接入点AP接收来自主控设备的秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK，所述秘钥信息用于所述第二AP生成成对传输秘钥PTK。所述第二AP受所述主控设备控制。所述第二AP接收来自工作站STA的关联请求报文，确定所述STA为已接入所述主控设备控制的AP的STA，向所述STA发送关联响应报文，所述关联响应报文用 于指示所述STA已接入所述第二AP。所述第二AP根据所述PTK与所述STA通信。
第四方面，提供了一种漫游方法，包括工作站STA从第一接入点AP覆盖的区域移动至第二AP覆盖的区域时，所述STA向所述第AP发送关联请求报文，所述关联请求报文携带指示信息，所述指示信息用于所述第二AP确定所述STA为已接入所述第一AP的STA。所述第一AP和所述第二AP使用相同的成对传输秘钥PTK进行通信。所述STA接收来自所述第二AP的关联响应报文，所述关联响应报文用于指示所述STA已接入所述第二AP。
第五方面，提供了一种秘钥生成方法，包括主控设备生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK。所述主控设备向第一接入点AP和第二AP发送所述秘钥信息，所述秘钥信息用于所述第一AP和所述第二AP分别生成成对传输秘钥PTK。所述第一AP和所述第二AP受所述主控设备控制。
第六方面，提供了一种秘钥生成方法，包括第一接入点AP接收来自主控设备的秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK，所述秘钥信息用于所述第一AP生成成对传输秘钥PTK；所述第一AP受所述主控设备控制。在工作站STA接入所述第一AP时，所述第一AP将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，所述第一随机数、所述第二随机数、所述AP地址用于所述STA生成所述PTK。
第七方面，提供了一种终端设备，包括发送模块和接收模块。所述发送模块，用于在所述终端设备从第一接入点AP覆盖的区域移动至第二AP覆盖的区域时，向所述第二AP发送关联请求报文，所述关联请求报文携带指示信息，所述指示信息用于所述第二AP确定所述STA为已接入所述第一AP的STA；所述第一AP和所述第二AP使用相同的成对传输秘钥PTK进行通信；所述接收模块，用于接收来自所述第二AP的关联响应报文，所述关联响应报文用于指示所述终端设备已接入所述第二AP。
结合第七方面，在第七方面第一种可能的实现方式中，所述关联请求报文携带指示所述终端设备请求快速接入的信息。
结合第七方面以及第七方面第一种可能的实现方式，在第二种可能的实现方式中，所述关联响应报文携带指示所述第二AP同意所述终端快速接入的信息。
结合第七方面以及第七方面第一种至第二种可能的实现方式，在第三种可能的实现方式中，所述指示信息为所述终端设备的标识。
结合第七方面以及第七方面第一种至第三种可能的实现方式，在第四种可能的实现方式中，所述终端设备的标识为所述终端设备的MAC地址。
第八方面，提供了一种计算设备，该计算设备用于执行上述第一方面至第六方面，以及第一方面的各种实现方式中的一种。
根据本申请实施例提供的技术方案，主控设备生成秘钥信息，再将该秘钥信息同步给该主控设备控制的所有接入点，使得网络中的所有接入点使用同一套秘钥，实现了在漫游过程中仅经过一次握手即可完成漫游接入的目的，减少了漫游接入的步骤和时间，增强了漫游体验。
附图说明
为了更清楚地说明本申请实施例和现有技术中的技术方案，下面将对实施例描述中以及现有技术中所需要使用的附图作简单地介绍。
图1是现有技术的一种接入过程流程图；
图2是现有技术的一种漫游方法的示意图；
图3是依据本申请一实施例的网络架构示意图；
图4是依据本申请一实施例的漫游方法的流程图；
图5是依据本申请一实施例的漫游判决的流程图；
图6是依据本申请一实施例的漫游切换的流程图；
图7是依据本申请另一实施例的漫游方法的流程图。
具体实施方式
本申请的实施例提供一种漫游系统，使得已经接入分布式网络中的STA，在分布式网络中漫游的时候无需重新走认证、关联和四次握手过程，减少漫游的步骤和时间，增强漫游体验。
图3是依据本申请一实施例的网络架构示意图。该网络为分布式网络，其中包括主控设备、第一AP、第二AP以及STA。第一AP和第二AP为主控设备控制的AP。主控设备还可以控制有其他AP，图3中暂未示出。在该分布式网络中，主控设备可以为网关。STA可以为支持WIFI的终端设备，例如手机，平板电脑，可穿戴设备，智能汽车等。网络中的STA第一次接入网络时可以采用现有的认证、关联和握手流程(如STA接入第一AP)，在STA漫游时，可以采用一次握手连接到另一AP(如STA接入第二AP)。
在图3的架构下，图4是依据本申请一实施例的漫游方法的流程图。
S401，主控设备生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥(Pairwise Master Key，PMK)。
其中，第一随机数为AP的随机数(ANonce)，第二随机数为STA的随机数(SNonce)。AP地址可以为主控设备的媒体存取控制(Media AccessControl，MAC)地址，也可以为预先约定的固定地址。
S402，主控设备向第一AP和第二AP发送该秘钥信息。
S403，第一AP和第二AP分别根据该秘钥信息生成PTK。
S404，在第一AP接收到来自STA的第一关联请求报文后，第一AP将第一随机数、第二随机数、AP地址发送给该STA。STA根据第一随机数、第二随机数、AP地址、STA地址以及用户输入的PMK生成PTK。用户输入的PMK与主控设备生成的PMK相同。STA生成的PTK与S403中第一AP和第二AP生成的PTK相同。
S403中，第一AP和第二AP还分别根据STA地址生成PTK。第一AP在STA接入该第一AP时获取STA地址。第一AP可以通过STA接入第一AP时发送的报文来获取STA地址，例如STA向第一AP发送的认证请求报文，关联请求报文等。第二AP可以通过主控设备获取所述STA地址，例如主控设备在STA接入第一AP后广播STA地址。第二AP也可以通过S407中的第二关联请求报文获取STA地址。
S404中，STA接入第一AP的过程可采用已有的接入流程，在STA和第一AP之间完成。当STA不支持IEEE 802.11r时，需要进行扫描、认证、关联、四次握手。当STA支持IEEE 802.11r时需要认证、关联。为简洁，图4中部分步骤未示出。
在一种实现方式中，第一AP通过第一关联响应报文将第二随机数和AP地址发送给STA，通过EAPoL四次握手的第一个步骤将第一随机数发送给STA。第一AP校验STA通过EAPoL的第二个步骤发送来的信息完整性检查(Message Integrity Check，MIC)是否正确，若正确，后续第一AP和STA可以使用上述PTK进行通信。
S405，STA接入第一AP后向主控设备上报上线事件。
主控设备将该STA记录为已接入网络的设备。
S406，STA在该分布式网络中进行漫游，从第一AP覆盖的区域移动至其他AP覆盖的区域时(如第二AP覆盖的区域)，出现接收信号强度指示(received signal strength indicator，RSSI)减弱，触发主控设备进行漫游判决。主控设备根据其控制的多个AP的RSSI确定该STA将要漫游至的AP。
本实施例中以主控设备确定该STA将要漫游至的AP是第二AP为例进行说明。具体过程如图5所示。
根据STA对IEEE 802.11k和IEEE 802.11v的支持情况，STA进行漫游切换的过程分两种情况。当STA不支持11kv时，第一AP强制断开与STA的连接，由STA自己选择另外一个AP进行连接。当STA支持IEEE 802.11k和IEEE 802.11v时，具体过程如图6所示。
S407，STA向第二AP发送第二关联请求报文以接入第二AP。
第二关联请求报文携带指示STA请求快速接入的信息。
S408，第二AP确定该STA为已经接入该网络的设备。
具体的，第二AP根据该第二关联请求报文携带的指示信息，向主控设备查询该STA是否已接入网络。该指示信息可以为STA的标识。例如，根据STA的MAC地址向主控设备查询该STA是否已接入网络。主控设备根据已接入网络的设备列表确定该STA为已接入网络的设备。
S409，第二AP向该STA发送第二关联响应报文，该第二关联响应报文用于指示该STA已完成接入第二AP。
具体的，第二关联响应报文携带指示第二AP同意该STA快速接入的信息。
对于S408中的指示STA请求快速接入的信息，以及S409中的指示第二AP同意该STA快速接入的信息，可以通过专有IE字段携带。IE字段中的类型长度值(type-length-value，TLV)包括元素标识(Element ID)，字段长度(Length)，快速接入状态码(Fast Assoc Status Code)。在一种实现方式中，Fast Assoc Status Code取值为1表示STA请求快速接入AP，取值为2表示AP同意STA快速接入，取值为3表示AP拒绝STA快速接入。
S410，第二AP和STA都使用该PTK与对方通信。
本申请提供的实施例中，主控设备生成秘钥信息，再将该秘钥信息同步给该主控设备控制的所有接入点，使得网络中的所有接入点使用同一套秘钥，实现了在漫游过程中仅经过一次握手即可完成漫游接入的目的，减少了漫游接入的步骤和时间， 增强了漫游体验。
上述步骤的先后顺序可以改变，例如，S403中第一AP根据秘钥信息生成PTK的步骤可以在S404之后，并在第一AP和STA使用该PTK进行通信之前完成。再例如，S403中第二AP根据秘钥信息生成PTK的步骤可以在S404之后，在S410之前完成。
在图3的架构下，图7是依据本申请另一实施例的漫游方法的流程图。与图4实施例不同，STA在接入第一AP时的认证过程在STA和第一AP之间完成，而涉及秘钥交换的关联和四次握手流程在STA和主控设备之间完成。
S701，主控设备生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、PMK。
S702，主控设备向第一AP和第二AP发送所述秘钥信息。
S703，第一AP和第二AP分别根据该秘钥信息生成PTK。
S704，在第一AP接收到来自STA的第一关联请求报文后，第一AP讲该第一关联请求报文转发给主控设备，主控设备通过第一AP将第一随机数、第二随机数、AP地址转发给STA。STA根据第一随机数、第二随机数、AP地址、STA地址以及用户输入的PMK生成PTK。用户输入的PMK与主控设备生成的PMK相同。STA生成的PTK与S703中第一AP和第二AP生成的PTK相同。
S703中，第一AP和第二AP还分别根据STA地址生成PTK。第一AP在STA接入该第一AP时获取STA地址。第一AP可以通过接收或转发STA接入第一AP时发送的报文来获取STA地址，例如接收STA向第一AP发送的认证请求报文，再例如向主控设备转发关联请求报文等。第二AP可以通过主控设备获取所述STA地址，例如主控设备在STA接入第一AP后广播STA地址。第二AP也可以通过S707中的第二关联请求报文获取STA地址。
S704中，STA接入第一AP的认证过程可采用已有的接入流程，在STA和第一AP之间完成。STA的关联和四次握手在STA和主控设备之间完成，由第一AP转发相关信息。
在一种实现方式中，主控设备通过第一关联响应报文将第二随机数和AP地址发送给STA，通过EAPoL四次握手的第一个步骤将第一随机数发送给STA。主控设备校验STA通过EAPoL的第二个步骤发送来的MIC是否正确，若正确，后续第一AP和STA可以使用上述PTK进行通信。
S705，STA接入第一AP后，主控设备记录STA上线事件。
S706，STA在该分布式网络中进行漫游，从第一AP覆盖的区域移动至其他AP覆盖的区域时(如第二AP覆盖的区域)，出现接收信号强度指示(received signal strength indicator，RSSI)减弱，触发主控设备进行漫游判决。主控设备根据其控制的多个AP的RSSI确定该STA将要漫游至的AP。
S707，STA向第二AP发送第二关联请求报文以接入第二AP。
S708，第二AP确定该STA为已经接入该网络的设备。
S709，第二AP向该STA发送第二关联响应报文，该第二关联响应报文用于指示该STA已完成接入第二AP。
S710，第二AP和STA都使用该PTK与对方通信。
上述S701-S703具体过程可参考图4实施例S401-S403，S705-S710具体过程可参考图4实施例S405-S410，此处不再赘述。
本申请提供的实施例中，主控设备生成秘钥信息，再将该秘钥信息同步给该主控设备控制的所有接入点，使得网络中的所有接入点使用同一套秘钥，实现了在漫游过程中仅经过一次握手即可完成漫游接入的目的，减少了漫游接入的步骤和时间，增强了漫游体验。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (28)

  1. 一种漫游系统，其特征在于，包括主控设备以及所述主控设备控制的多个接入点AP，所述多个AP中包括第一AP和第二AP：
    所述主控设备用于生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK，所述主控设备还用于向所述第一AP和第二AP发送所述秘钥信息；
    所述第一AP和所述第二AP分别用于根据所述秘钥信息生成成对传输秘钥PTK；
    所述第一AP还用于在接收到来自工作站STA的第一关联请求报文后，将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，所述第一随机数、所述第二随机数、所述AP地址用于所述STA生成所述PTK；
    所述第二AP还用于在所述STA从所述第一AP覆盖的区域移动至所述第二AP覆盖的区域时，接收所述STA发送的第二关联请求报文，确定所述STA为已接入所述主控设备控制的AP的STA，向所述STA发送第二关联响应报文，所述第二关联响应报文用于指示所述STA已接入所述第二AP；
    所述第二AP还用于根据所述PTK与所述STA通信。
  2. 根据权利要求1所述的系统，其特征在于，所述第一AP用于通过第一关联响应报文将所述第二随机数、所述AP地址发送给所述STA，所述第一AP用于通过扩展认证协议EAPoL将所述第一随机数发送给所述STA。
  3. 根据权利要求1所述的系统，其特征在于，所述第一AP还用于在接收到来自工作站STA的第一关联请求报文后，将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，包括：
    所述主控设备用于在所述第一AP接收到来自工作站STA的第一关联请求报文后，通过所述第一AP将所述第一随机数、所述第二随机数、所述AP地址转发给所述STA。
  4. 根据权利要求3所述的系统，其特征在于，所述主控设备用于通过第一关联响应报文将所述第二随机数、所述AP地址发送给所述STA，所述主控设备用于通过扩展认证协议EAPoL将所述第一随机数发送给所述STA。
  5. 根据权利要求1至4任意一项所述的系统，其特征在于，所述第二关联请求报文携带指示所述STA请求快速接入的信息。
  6. 根据权利要求1至5任意一项所述的系统，其特征在于，所述第二关联响应报文携带指示所述第二AP同意所述STA快速接入的信息。
  7. 根据权利要求1至6任意一项所述的系统，其特征在于，所述AP地址为所述主控设备的媒体存取控制MAC地址，或者所述AP地址为预配置的地址。
  8. 根据权利要求1至7任意一项所述的系统，其特征在于，所述第一AP和所述第二AP还分别用于根据所述STA的STA地址生成所述PTK；所述第一AP用于在所述STA接入所述第一AP时获取所述STA地址；所述第二AP用于通过所述第二关联请求报文获取所述STA地址，或通过所述主控设备获取所述STA地址。
  9. 根据权利要求1至8任意一项所述的系统，其特征在于，所述STA还用于 根据所述STA的STA地址和用户输入的PMK生成所述PTK，所述用户输入的PMK与所述主控设备生成的PMK相同。
  10. 根据权利要求1至9任意一项所述的系统，其特征在于，所述主控设备还用于在所述STA从所述第一AP覆盖的区域移动至第二AP覆盖的区域之前，确定所述STA的接收信号强度指示RSSI减弱，并根据所述多个AP的RSSI确定所述STA将要漫游至所述第二AP。
  11. 根据权利要求1至10任意一项所述的系统，其特征在于，在所述第二AP接收所述STA发送的第二关联请求报文之前，所述第一AP还用于指示所述STA切换至所述第二AP；所述第一AP还用于在所述STA接受切换至所述第二AP后，向所述主控设备发送指示所述STA已迁出所述第一AP的信息。
  12. 根据权利要求1至11任意一项所述的系统，其特征在于，所述第二AP用于根据所述第二关联请求报文中的所述STA的标识，向所述主控设备查询所述STA是否为已接入所述主控设备控制的AP的STA。
  13. 一种漫游方法，其特征在于，包括以下步骤：
    主控设备生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK；
    所述主控设备向第一接入点AP和第二AP发送所述秘钥信息，所述第一AP和所述第二AP受所述主控设备控制；
    所述第一AP和所述第二AP分别根据所述秘钥信息生成成对传输秘钥PTK；
    在所述第一AP接收到来自工作站STA的第一关联请求报文后，所述第一AP将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，所述第一随机数、所述第二随机数、所述AP地址用于所述STA生成所述PTK；
    在所述STA从所述第一AP覆盖的区域移动至所述第二AP覆盖的区域时，所述第二AP接收所述STA发送的第二关联请求报文，确定所述STA为已接入所述主控设备控制的AP的STA，向所述STA发送第二关联响应报文，所述关联响应报文用于指示所述STA已接入所述第二AP；
    所述第二AP根据所述PTK与所述STA通信。
  14. 根据权利要求13所述的方法，其特征在于，所述第一AP通过第一关联响应报文将所述第二随机数、所述AP地址发送给所述STA，所述第一AP通过扩展认证协议EAPoL将所述第一随机数发送给所述STA。
  15. 根据权利要求13所述的方法，其特征在于，在所述第一AP接收到来自工作站STA的第一关联请求报文后，所述第一AP将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，包括：
    所述主控设备在所述第一AP接收到来自工作站STA的第一关联请求报文后，通过所述第一AP将所述第一随机数、所述第二随机数、所述AP地址转发给所述STA。
  16. 根据权利要求15所述的方法，其特征在于，所述主控设备通过第一关联响应报文将所述第二随机数、所述AP地址发送给所述STA，所述主控设备通过扩展认证协议EAPoL将所述第一随机数发送给所述STA。
  17. 根据权利要求13至16任意一项所述的方法，其特征在于，所述第二关联请求报文携带指示所述STA请求快速接入的信息。
  18. 根据权利要求13至17任意一项所述的方法，其特征在于，所述第二关联响应报文携带指示所述第二AP同意所述STA快速接入的信息。
  19. 根据权利要求13至18任意一项所述的方法，其特征在于，所述AP地址为所述主控设备的媒体存取控制MAC地址，或者所述AP地址为预配置的地址。
  20. 根据权利要求13至19任意一项所述的方法，其特征在于，所述第一AP和所述第二AP还分别根据所述STA的STA地址生成所述PTK；所述第一AP在所述STA接入所述第一AP时获取所述STA地址；所述第二AP通过所述第二关联请求报文获取所述STA地址，或通过所述主控设备获取所述STA地址。
  21. 根据权利要求13至20任意一项所述的方法，其特征在于，所述STA还根据所述STA的STA地址和用户输入的PMK生成所述PTK，所述用户输入的PMK与所述主控设备生成的PMK相同。
  22. 根据权利要求13至21任意一项所述的方法，其特征在于，所述主控设备还在所述STA从所述第一AP覆盖的区域移动至第二AP覆盖的区域之前，确定所述STA的接收信号强度指示RSSI减弱，并根据所述多个AP的RSSI确定所述STA将要漫游至所述第二AP。
  23. 根据权利要求13至22任意一项所述的方法，其特征在于，在所述第二AP接收所述STA发送的第二关联请求报文之前，所述第一AP还指示所述STA切换至所述第二AP；所述第一AP还在所述STA接受切换至所述第二AP后，向所述主控设备发送指示所述STA已迁出所述第一AP的信息。
  24. 根据权利要求13至23任意一项所述的方法，其特征在于，所述第二AP根据所述第二关联请求报文中的所述STA的标识，向所述主控设备查询所述STA是否为已接入所述主控设备控制的AP的STA。
  25. 一种漫游方法，其特征在于，包括以下步骤：
    第二接入点AP接收来自主控设备的秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK，所述秘钥信息用于所述第二AP生成成对传输秘钥PTK；所述第二AP受所述主控设备控制；
    所述第二AP接收来自工作站STA的关联请求报文，确定所述STA为已接入所述主控设备控制的AP的STA，向所述STA发送关联响应报文，所述关联响应报文用于指示所述STA已接入所述第二AP；
    所述第二AP根据所述PTK与所述STA通信。
  26. 一种漫游方法，其特征在于，包括以下步骤：
    工作站STA从第一接入点AP覆盖的区域移动至第二AP覆盖的区域时，所述STA向所述第二AP发送关联请求报文，所述关联请求报文携带指示信息，所述指示信息用于所述第二AP确定所述STA为已接入所述第一AP的STA；所述第一AP和所述第二AP使用相同的成对传输秘钥PTK进行通信；
    所述STA接收来自所述第二AP的关联响应报文，所述关联响应报文用于指示所述STA已接入所述第二AP。
  27. 一种秘钥生成方法，其特征在于，包括以下步骤：
    主控设备生成秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK；
    所述主控设备向第一接入点AP和第二AP发送所述秘钥信息，所述秘钥信息用于所述第一AP和所述第二AP分别生成成对传输秘钥PTK；所述第一AP和所述第二AP受所述主控设备控制。
  28. 一种秘钥生成方法，其特征在于，包括以下步骤：
    第一接入点AP接收来自主控设备的秘钥信息，所述秘钥信息包括第一随机数、第二随机数、AP地址、成对主秘钥PMK，所述秘钥信息用于所述第一AP生成成对传输秘钥PTK；所述第一AP受所述主控设备控制；
    在工作站STA接入所述第一AP时，所述第一AP将所述第一随机数、所述第二随机数、所述AP地址发送给所述STA，所述第一随机数、所述第二随机数、所述AP地址用于所述STA生成所述PTK。
PCT/CN2022/121585 2021-11-23 2022-09-27 一种漫游方法及系统 Ceased WO2023093277A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22897363.2A EP4418711A4 (en) 2021-11-23 2022-09-27 ROAMING METHOD AND SYSTEM

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111395423.4 2021-11-23
CN202111395423.4A CN116156493A (zh) 2021-11-23 2021-11-23 一种漫游方法及系统

Publications (1)

Publication Number Publication Date
WO2023093277A1 true WO2023093277A1 (zh) 2023-06-01

Family

ID=86372387

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/121585 Ceased WO2023093277A1 (zh) 2021-11-23 2022-09-27 一种漫游方法及系统

Country Status (3)

Country Link
EP (1) EP4418711A4 (zh)
CN (1) CN116156493A (zh)
WO (1) WO2023093277A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2025178477A1 (ko) * 2024-02-20 2025-08-28 엘지전자 주식회사 무선랜 시스템에서 액세스 포인트들 간의 보안을 위한 방법 및 장치
WO2025184396A1 (en) * 2024-02-28 2025-09-04 Cisco Technology, Inc. Seamless roaming framework
WO2025258934A1 (en) * 2024-06-12 2025-12-18 Samsung Electronics Co., Ltd. Association procedures for seamless roaming in wlans

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2025207692A1 (en) * 2024-03-25 2025-10-02 Cisco Technology, Inc. Key generation for seamless roaming
CN120935563A (zh) * 2024-05-11 2025-11-11 中兴通讯股份有限公司 终端漫游方法、存储介质和电子装置

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102883316A (zh) * 2011-07-15 2013-01-16 华为终端有限公司 建立连接的方法、终端和接入点
CN103096307A (zh) * 2011-10-27 2013-05-08 中兴通讯股份有限公司 密钥验证方法及装置
CN103888941A (zh) * 2012-12-20 2014-06-25 杭州华三通信技术有限公司 一种无线网络密钥协商的方法及装置
CN105848131A (zh) * 2016-05-09 2016-08-10 厦门四信通信科技有限公司 一种通过云ac实现sta跨域漫游的方法
US20170134940A1 (en) * 2015-11-09 2017-05-11 Meru Networks Selective key caching for fast roaming of wireless stations in communication networks
CN106941405A (zh) * 2017-04-28 2017-07-11 北京星网锐捷网络技术有限公司 一种在无线局域网中终端认证的方法和装置
CN107690138A (zh) * 2016-08-05 2018-02-13 华为技术有限公司 一种快速漫游方法、装置、系统、接入点和移动站
CN111083804A (zh) * 2020-01-21 2020-04-28 华为技术有限公司 一种数据传输方法及设备
US20210345105A1 (en) * 2021-06-25 2021-11-04 Intel Corporation 4-way handshake optimization

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080072047A1 (en) * 2006-09-20 2008-03-20 Futurewei Technologies, Inc. Method and system for capwap intra-domain authentication using 802.11r

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102883316A (zh) * 2011-07-15 2013-01-16 华为终端有限公司 建立连接的方法、终端和接入点
CN103096307A (zh) * 2011-10-27 2013-05-08 中兴通讯股份有限公司 密钥验证方法及装置
CN103888941A (zh) * 2012-12-20 2014-06-25 杭州华三通信技术有限公司 一种无线网络密钥协商的方法及装置
US20170134940A1 (en) * 2015-11-09 2017-05-11 Meru Networks Selective key caching for fast roaming of wireless stations in communication networks
CN105848131A (zh) * 2016-05-09 2016-08-10 厦门四信通信科技有限公司 一种通过云ac实现sta跨域漫游的方法
CN107690138A (zh) * 2016-08-05 2018-02-13 华为技术有限公司 一种快速漫游方法、装置、系统、接入点和移动站
CN106941405A (zh) * 2017-04-28 2017-07-11 北京星网锐捷网络技术有限公司 一种在无线局域网中终端认证的方法和装置
CN111083804A (zh) * 2020-01-21 2020-04-28 华为技术有限公司 一种数据传输方法及设备
US20210345105A1 (en) * 2021-06-25 2021-11-04 Intel Corporation 4-way handshake optimization

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NOKIA NETWORKS: "Security and authentication in LWA", 3GPP DRAFT; R2-156483 SECURITY AND AUTHENTICATION IN LWA, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. RAN WG2, no. Anaheim, USA; 20151116 - 20151120, 6 November 2015 (2015-11-06), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051024579 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2025178477A1 (ko) * 2024-02-20 2025-08-28 엘지전자 주식회사 무선랜 시스템에서 액세스 포인트들 간의 보안을 위한 방법 및 장치
WO2025184396A1 (en) * 2024-02-28 2025-09-04 Cisco Technology, Inc. Seamless roaming framework
WO2025258934A1 (en) * 2024-06-12 2025-12-18 Samsung Electronics Co., Ltd. Association procedures for seamless roaming in wlans

Also Published As

Publication number Publication date
EP4418711A1 (en) 2024-08-21
EP4418711A4 (en) 2024-11-20
CN116156493A (zh) 2023-05-23

Similar Documents

Publication Publication Date Title
EP2019518B1 (en) Method for fast roaming in a wireless network
WO2023093277A1 (zh) 一种漫游方法及系统
JP6022596B2 (ja) 融合ワイヤレスネットワークにおいての認証の方法およびデバイス
US8549293B2 (en) Method of establishing fast security association for handover between heterogeneous radio access networks
US9451460B2 (en) Method and apparatus for associating station (STA) with access point (AP)
US8037305B2 (en) Securing multiple links and paths in a wireless mesh network including rapid roaming
CN113747502A (zh) 多链路试关联方法及相关装置
US10263960B2 (en) Wireless communication system and wireless communication method
EP4061038B1 (en) Wireless network switching method and device
US11310724B2 (en) Key management for fast transitions
KR101873391B1 (ko) Ap에 접속된 sta에 대한 재연관 시간 감소
WO2013181847A1 (zh) 一种无线局域网接入鉴权方法、设备及系统
US20210014732A1 (en) Rapidly disseminated operational information for wlan management
JP2018527819A (ja) アクセス認証の方法および装置
WO2024145946A1 (en) Apparatus, method, and computer program
CN100558187C (zh) 一种无线接入方法及接入控制器
US20240430787A1 (en) Dynamic mesh service set identifier
WO2025200906A1 (zh) 通信方法和通信装置
CN121619632A (zh) 链路添加过程期间的ptk导出

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897363

Country of ref document: EP

Kind code of ref document: A1

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112024009675

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2022897363

Country of ref document: EP

Effective date: 20240513

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 112024009675

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20240515