CN119255234A - A key generation method, system, device and storage medium - Google Patents
A key generation method, system, device and storage medium Download PDFInfo
- Publication number
- CN119255234A CN119255234A CN202411528990.6A CN202411528990A CN119255234A CN 119255234 A CN119255234 A CN 119255234A CN 202411528990 A CN202411528990 A CN 202411528990A CN 119255234 A CN119255234 A CN 119255234A
- Authority
- CN
- China
- Prior art keywords
- pmk
- key
- sta
- target
- rnonce
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/041—Key generation or derivation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention relates to the field of wireless communication and discloses a key generation method, a system, equipment and a storage medium, wherein the method comprises the steps that a target AP acquires an STA air interface frame in a fast roaming process; the target AP calculates pmk_r1 from the information in the null frame, calculates a random value RNonce from pmk_r1, and returns a random value RNonce to the STA by replying to the null frame. The present disclosure eliminates the need for distribution of PMK R1 keys over ethernet frames, enabling seamless connection and communication between wireless network devices produced by different manufacturers using 802.11R fast roaming protocols.
Description
Technical Field
The disclosure relates to the technical field of wireless communication, and in particular relates to a key generation method, a system, equipment and a storage medium.
Background
In modern Wireless Local Area Networks (WLANs), seamless roaming of devices becomes critical to enhance the user experience. The IEEE 802.11r standard, fast Transition (FT) protocol, aims to solve the problem of delay when a device switches between different access points. By proposing a three-layer key structure, 802.11r can rapidly finish reauthentication when equipment roams, and ensure continuity and security of network connection.
To achieve fast roaming, the 802.11r standard specifies a range of key generation and distribution mechanisms. R0KH (PMK-R0 key holder in the Authenticator, PMK-R0 key management entity at authenticator end, target AP end) generates PMK_R0 and PMK_R1 (PAIRWISE MASTER KEY _R1, pair master key R1) corresponding to each AP (Access Point) at the time of initial authentication, and distributes PMK_R1 among all Access Points (APs) in Mobility Domain (MD). Each AP uses these keys to perform fast transition authentication with a terminal (STA) to generate a new PTK (PAIRWISE TRANSIENT KEY, pairwise temporary key) for encrypted communications. Since the protocol does not specify the distribution mode of the pmk_r1 key, the implementation of the key distribution mechanism is different according to manufacturers, and fast roaming cannot be performed. And the key distribution of PMK_R1 among the APs is performed by wire, so that the use scenario is limited.
In the 802.11R protocol, when the STA performs initial association with the mobile domain MD for the first time, R0KH generates a master key pmk_r0 (PAIRWISE MASTER KEY _r0, a pair of master keys R0), and calculates a corresponding subkey pmk_r1 for each R1KH (PMK-R1 key holder in the Authenticator, PMK-R1 key management entity at the authenticator end, and PMK-R1 key management entity at the authenticator end at the target AP end). Subsequently, R0KH distributes these PMKR 1's to each R1KH within the MD. When the STA roams, PTK can be calculated through PMK_R1 distributed in advance, if R1KH of the target AP does not store PMK_R1 and R0KH required by the STA, PMK_R1 and PMKRLNAME are recalculated based on R1KH_ID and sent to the required R1KH, so that quick roaming authentication is realized. The key distribution process is shown in fig. 1, in which WTP (Wireless Transaction Protocol ) is a communication protocol used in a wireless network environment for data transmission and transaction processing between mobile devices, R0KH and R1KH are key management entities at the end of an authenticator (target AP), the computation of pmk_r0 and pmk_r1 is controlled by R0KH, R0KH is also responsible for providing pmk_r1 to R1KH, and the computation of PTK is controlled by R1KH. S0KH is PMK-S0 key management entity at the end of the applicant (STA), S1KH is PMK-S1 key management entity at the end of the applicant (STA), the functions of S0KH and S1KH correspond to those of R0KH and R1KH, R0KH-ID is the identification (NAS-ID) of R0KH, and is 1-48 bytes long according to IEEE standard, and can be customized by manufacturers, and R0KH-ID and R1KH-ID are both MAC addresses of the authenticator. S0KH-ID and S1KH-ID are both MAC addresses of the applicant (STA). From this process, the distribution of pmk_r1 runs through the whole roaming authentication flow, but because the protocols used in the mode of distributing pmk_r1 by different chip schemes have large differences, the interworking cannot be realized. Thus, there is a need for a local key management and distribution mechanism to enable interworking between different chip schemes.
Disclosure of Invention
Embodiments of the present disclosure provide a method, a system, an apparatus, and a storage medium for generating a key, so as to solve or alleviate one or more of the above technical problems in the prior art.
According to one aspect of the present disclosure, there is provided a key generation method including:
in the fast roaming process, the target AP acquires an STA air interface frame;
calculating PMK_R1 according to the information in the air interface frame;
calculating a random value RNonce according to PMK_R1;
The target AP returns a random value RNonce to the STA by replying to the null frame.
In one possible implementation, after the target AP returns the random value RNonce to the STA by replying to the air interface frame, it includes:
After receiving the random value RNonce, the STA calculates the PTK by using the random value RNonce and SNonce of the STA;
re-association of the STA with the target AP is accomplished through the PTK.
In one possible implementation, the method includes:
The information in the air interface frame contains SSID, MDID, R KH_ID and S0KH_ID, wherein SSID is service set identifier, MDID is Mesh distributed identifier, R0KH_ID is PMK-R0 key management entity identifier of target AP terminal, and S0KH_ID is PMK-S0 key management entity identifier of STA terminal.
In one possible implementation, calculating pmk_r1 from information in the air interface frame includes:
Calculating SSIDLENGTH, SSIDLENGTH the length of the SSID according to the length of the SSID character string;
Calculating R0KHlength according to the R0KH_ID string length, wherein R0KHlength is the length of R0 KH_ID;
Calculating PMK_R0 according to SSIDLENGTH, SSID, MDID, R KHlength, R0KH_ID and S0 KH_ID;
And then calculating PMK_R1 according to PMK_R0 and R1KH_ID and R0KH_ID in the air interface frame.
In one possible implementation, the calculation formula of pmk_r0 is:
R0_Key_Data=KDF_384(XXXKey,"FT_R1",SSIDlength||SSID
||MDID||R0KHlength||R0KH_ID||S0KH_ID)
PMK_R0=L(R0_Key_Data,0,256);
Where R0_Key_Data represents R0 Key Data, KDF_384 represents a Key derivation function using 384 bits of output, XXXKey represents a pre-shared Key, "FT_R1" represents an identifier as a fixed value, PMK_R0 represents a pairwise master Key R0, and L (R0_Key_Data, 0,256) represents a value of 256 bits from bit 0 of R0_Key_Data as PMK_R0.
In one possible implementation, the calculation formula of pmk_r1 is:
PMK_R1=KDF_256(PMK_R0,"FT_R1","R1KH_ID"||"R0KH_ID");
In the formula, PMK_R1 represents a pairwise master key R1, KDF_256 represents a key derivation function using 256-bit output, and R1KH_ID represents a PMK-R1 key management entity identifier of a target AP side.
According to one aspect of the present disclosure, there is provided a key generation system including:
The target AP is used for acquiring the STA air interface frame in the fast roaming process;
calculating PMK_R1 according to the information in the air interface frame;
calculating a random value RNonce according to PMK_R1;
The target AP returns a random value RNonce to the STA by replying to the null frame.
In one possible implementation, the key generation system further includes:
The STA is used for calculating the PTK by utilizing the random value RNonce and SNonce of the STA after receiving the random value RNonce;
and the re-association unit is used for completing re-association of the STA and the target AP through the PTK.
The method has the beneficial effects that the method for generating the key locally based on the 802.11R is designed, the distribution of the PMK R1 can be calculated locally through information such as PMK-R0, R1KH_ID, R0KH_ID and the like, and the distribution of the PMK R1 key is not needed through an Ethernet frame, so that wireless network devices produced by different manufacturers can be connected and communicated in a seamless mode by using an 802.11R fast roaming protocol.
The details of one or more embodiments of the application are set forth in the accompanying drawings and the description below. Other features and advantages of the application will be apparent from the accompanying drawings of the specification. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description, serve to explain the principles of the disclosure. It will be apparent to those of ordinary skill in the art that the drawings in the following description are merely examples of the disclosure and that other drawings may be derived from them without undue effort.
FIG. 1 is a schematic diagram of a prior art key distribution process;
fig. 2 is a flowchart of a key generation method of the present exemplary embodiment;
FIG. 3 is a local key calculation flow chart of the present exemplary embodiment;
FIG. 4 is a fast handoff Over-the-Air schematic diagram of the present exemplary embodiment;
FIG. 5 is a fast handoff Over-the-DS schematic diagram of the present exemplary embodiment;
fig. 6 is a block diagram of a key generation system of the present exemplary embodiment;
fig. 7 is a schematic structural view of an apparatus of the present exemplary embodiment.
Detailed Description
Example embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments may be embodied in many forms and should not be construed as limited to the examples set forth herein, but rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the present disclosure. One skilled in the relevant art will recognize, however, that the aspects of the disclosure may be practiced without one or more of the specific details, or with other methods, components, devices, steps, etc. In other instances, well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the present disclosure.
In addition, the same reference numerals in the drawings denote the same or similar parts, and thus a repetitive description thereof will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software or in one or more hardware units or integrated circuits or in different networks and/or processor devices and/or microcontroller devices.
The flow diagrams depicted in the figures are exemplary only and not necessarily all steps are included. For example, some steps may be decomposed, and some steps may be combined or partially combined, so that the order of actual execution may be changed according to actual situations.
The terms first, second and the like in the description and in the claims and in the above-described figures, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the application described herein may be implemented, for example, in sequences other than those illustrated or otherwise described herein.
Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or sub-modules is not necessarily limited to those steps or sub-modules that are expressly listed or inherent to such process, method, article, or apparatus, but may include other steps or sub-modules that are not expressly listed.
Fig. 2 is a flowchart of a key generation method of the present exemplary embodiment, and as shown in fig. 2, the exemplary embodiment of the present disclosure provides a key generation method including:
in the fast roaming process, the target AP acquires an STA air interface frame;
calculating PMK_R1 according to the information in the air interface frame;
calculating a random value RNonce according to PMK_R1;
The target AP returns a random value RNonce to the STA by replying to the null frame.
Specifically, in the fast roaming process, the STA (Station) sends an air interface frame (i.e. Authentication Request in fig. 4) to a target AP (Access Point);
After receiving the air interface frame, the target AP calculates PMK_R1 (PAIRWISE MASTER KEY _R1, paired master key R1) according to the information in the air interface frame, and calculates a random value RNonce (Reassociation Nonce, random value) according to the PMK_R1;
The target AP returns a random value RNonce to the STA through replying to the air interface frame;
after receiving the random value RNonce, the STA calculates the PTK (PAIRWISE TRANSIENT KEY, pairwise temporary key) by using the random value RNonce and the STA's own SNonce (server random number);
re-association of the STA with the target AP is accomplished through the PTK.
The embodiment designs a method for generating keys locally based on 802.11R, which can locally calculate PMK R1 through PMK_R0 (PAIRWISE MASTER KEY _R0, pair master key R0), R1KH_ID, R0KH_ID and other information, distribute the PMK_R1 key through an air interface frame, and realize 11R intercommunication of different chips without distributing the PMK_R1 key through an Ethernet frame, thereby reducing roaming delay and enabling equipment to perform fast roaming more efficiently.
Fast basic service set switching (Fast BSS Transition, FBT) can be divided into two modes, over-the-Air and Over-the-DS, depending on the manner of handoff. The Over-the-Air (STA) communicates directly with the target AP (target AP), and the Over-the-DS (STA) communicates with the target AP through the current AP (current AP).
Specifically, in the fast roaming process, the STA transmitting the air interface frame to the target AP includes:
in the Over-the-Air mode:
The STA transmits a null frame to the target AP, where RSNIE (Robust Security Network Information Element ) in the null frame contains PMKR0 _0_name (PAIRWISE MASTER KEY R0_name, pairwise master key R0 Name), and FTIE (Fast BSS Transition Information Element, fast basic service set conversion information element) contains SNonce (server random number), r0kh_id (PMK-R0 key management entity identifier at the target AP end), and MDIE (key deployment information element).
As shown in fig. 4 (Associated with current AP in fig. 4 indicates association with the current AP; FTAA is called FAST TERMINAL Authentication Algorithm for fast terminal authentication algorithm; FTIE is called FAST TERMINAL INTEGRITY for Evaluation of terminal integrity; RIC is called Radio Identity Code for wireless identity code), in this embodiment, in the Over-the-Air mode, the distributed fast handover authentication procedure generated based on local key is as follows:
in the Fast roaming process, the STA sends a null frame to the AP, where the RSNIE in the null frame includes PMKR0_name, and FTIE includes SNonce, r0kh_id, and MDIE, and the authentication algorithm of the null frame is FT (Fast Transition).
Specifically, after receiving the air interface frame, the target AP performs pmk_r1 calculation according to information in the air interface frame, including:
after receiving the air interface frame, the target AP calculates PMK_R0 according to SSID (service set identifier), MDID, R0KH_ID and MAC address related information of STA in the air interface frame;
And then calculating PMK_R1 according to PMK_R0 and R1KH_ID and R0KH_ID in the air interface frame.
Specifically, completing the re-association of the STA with the target AP through the PTK includes:
The STA sends Reassociation Request (re-association request) frames to the target AP, and Reassociation Request frames contain PMKR Name, anonce (AP random number), snonce, MIC (MESSAGE INTEGRITY CHECK, information integrity check) values, r1kh_id and r0kh_id;
After receiving Reassociation Request frames, the target AP verifies the correctness of Reassociation Request frames;
If the verification is passed, a Reassociation Response (reassociation reply) frame is replied to the STA, and the Reassociation Response frame is provided with an encrypted GTK (Group Temporal Key, group temporary key);
the STA decrypts and acquires the GTK by using the PTK to finish the re-association between the STA and the target AP;
after the re-association is completed, the 802.1X controlled port is opened and the STA uses the network normally.
Specifically, the calculation formula of pmk_r0 is:
R0_Key_Data=KDF_384(XXXKey,"FT_R1",SSIDlength||SSID
||MDID||R0KHlength||R0KH_ID||S0KH_ID)
PMK_R0=L(R0_Key_Data,0,256);
Where R0_Key_Data denotes R0 Key Data, KDF_384 denotes a Key derivation function using 384 bits of output, XXXKey denotes a pre-shared Key, "FT_R1" denotes an identifier, SSIDLENGTH is the length of SSID, SSID is a service set identifier, MDID is a Mesh distributed identifier, R0KHlength is the length of R0KH_ID, R0KH_ID is an R0 Key holder identifier, S0KH_ID is an S0 Key holder identifier, PMK_R0 denotes a pairwise master Key R0, and L (R0_Key_Data, 0,256) denotes taking 256 bits from bit 0 of R0_Key_Data as the value of PMK_R0.
As shown in fig. 3, (Wtp is Wireless Termination Point, wireless access point) specifically, the calculation formula of pmk_r1 is:
PMK_R1=KDF_256(PMK_R0,"FT_R1","R1KH_ID"||"R0KH_ID");
where pmk_r1 represents a pairwise master key R1, kdf_256 represents a key derivation function using 256-bit output, and r1kh_id represents an r1 key holder identifier.
In this embodiment, a new random value RNonce is calculated by pmk_r1 and a new PTK is generated using this random number and the previous PMKR. The AP returns RNonce to the STA over Authentication Response frames.
After receiving RNonce, the STA calculates a new PTK using its own SNonce and RNonce. The STA sends a reassociation request Reassociation Request to the target AP, containing PMKR, a Name, anonce, snonce, MIC value, R1KH-ID, and R0KH-ID.
The target AP receives the reassociation null frame and verifies its correctness. If the verification is passed, reassociation Response frames are returned to the STA, and the frames are provided with the encrypted GTK. The STA acquires the GTK using PTK decryption. After the re-association is completed, the 802.1X controlled port is opened and the STA uses the network normally.
Specifically, in the fast roaming process, the STA transmitting the air interface frame to the target AP includes:
in the Over-the-DS mode:
The STA sends FT Request (Fast BSS Transition Request, fast basic service set transition Request) containing the MAC address of the target AP to the current AP;
The current AP forwards the FT Request frame to the target AP through wired transmission;
after receiving the FT Request frame, the target AP identifies a forwarding source and replies the FT Request frame, and the FT Request frame is forwarded to the STA through the current AP.
As shown in fig. 5, in the Over-the-DS mode, the re-association procedure is similar to Over-the-Air, except that the STA first sends an FT Request frame containing the MAC address of the target AP to the current AP, which forwards the frame to the target AP via wired transmission. Specifically, after receiving the FT Request frame of the STA, the current AP recognizes that its destination address is not self, encapsulates the frame in a frame of ethernet type 0x890d, and adds its own address, and forwards the frame to the destination AP via ethernet. After the target AP receives the FT Request frame, a forwarding source is identified, the corresponding FT Request frame is replied, and finally the FT Request frame is forwarded to the STA through the current AP.
Fig. 6 is a block diagram of a key generation system of the present exemplary embodiment, and as shown in fig. 6, the exemplary embodiment of the present disclosure provides a key generation system including:
The target AP is used for acquiring the STA air interface frame in the fast roaming process;
calculating PMK_R1 according to the information in the air interface frame;
calculating a random value RNonce according to PMK_R1;
The target AP returns a random value RNonce to the STA by replying to the null frame.
Specifically, the key generation system further includes:
The STA is used for calculating the PTK by utilizing the random value RNonce and SNonce of the STA after receiving the random value RNonce;
and the re-association unit is used for completing re-association of the STA and the target AP through the PTK.
Fig. 7 is a schematic structural view of an apparatus of the present exemplary embodiment. As shown in fig. 7, the present disclosure also provides an apparatus corresponding to the above-provided key generation method. Since the embodiments of the apparatus are similar to the method embodiments described above, the description is relatively simple, and reference should be made to the description of the method embodiments section described above, the apparatus described below being merely illustrative. The device may comprise a processor (processor) 1, a memory (memory) 2 and a communication bus (i.e. the above mentioned device bus) and a look-up engine, wherein the processor 1 and the memory 2 communicate with each other via the communication bus and with the outside via a communication interface. The processor 1 may call logic instructions in the memory 2 to perform the key generation method.
Further, the logic instructions in the memory 2 described above may be implemented in the form of software functional units and may be stored in a computer readable storage medium when sold or used as a stand alone product. Based on such understanding, the technical solution of the present disclosure may be embodied in essence or a part contributing to the prior art or a part of the technical solution, or in the form of a software product stored in a storage medium, including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of the various embodiments of the present disclosure. The storage medium includes a Memory chip, a usb disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, an optical disk, or other various media capable of storing program codes.
On the other hand, the embodiments of the present disclosure also provide a processor-readable storage medium, on which a computer program 3 is stored, which computer program 3 is implemented when executed by the processor 1 to perform the key generation method provided by the above embodiments.
The processor-readable storage medium may be any available medium or data storage device that can be accessed by the processor 1 including, but not limited to, magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical memory (e.g., CD, DVD, BD, HVD, etc.), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid State Disk (SSD)), etc.
The above is only a preferred embodiment of the present disclosure, and the protection scope of the present disclosure is not limited to the above examples, but all technical solutions belonging to the concept of the present disclosure belong to the protection scope of the present disclosure. It should be noted that several modifications and adaptations to those skilled in the art without departing from the principles of the present disclosure should and are intended to be within the scope of the present disclosure.
Claims (10)
1. A key generation method, comprising:
in the fast roaming process, the target AP acquires an STA air interface frame;
calculating PMK_R1 according to the information in the air interface frame;
calculating a random value RNonce according to PMK_R1;
The target AP returns a random value RNonce to the STA by replying to the null frame.
2. The key generation method of claim 1, wherein the target AP returns the random value RNonce to the STA by replying to the air interface frame, comprising:
After receiving the random value RNonce, the STA calculates the PTK by using the random value RNonce and SNonce of the STA;
re-association of the STA with the target AP is accomplished through the PTK.
3. The key generation method according to claim 1, comprising:
The information in the air interface frame contains SSID, MDID, R KH_ID and S0KH_ID, wherein SSID is service set identifier, MDID is Mesh distributed identifier, R0KH_ID is PMK-R0 key management entity identifier of target AP terminal, and S0KH_ID is PMK-S0 key management entity identifier of STA terminal.
4. A key generation method according to claim 3, wherein calculating pmk_r1 from information in the air interface frame comprises:
Calculating SSIDLENGTH, SSIDLENGTH the length of the SSID according to the length of the SSID character string;
Calculating R0KHlength according to the R0KH_ID string length, wherein R0KHlength is the length of R0 KH_ID;
Calculating PMK_R0 according to SSIDLENGTH, SSID, MDID, R KHlength, R0KH_ID and S0 KH_ID;
And then calculating PMK_R1 according to PMK_R0 and R1KH_ID and R0KH_ID in the air interface frame.
5. The key generation method according to claim 4, wherein a calculation formula of pmk_r0 is:
R0_Key_Data=KDF_384(XXXKey,"FT_R1",SSIDlength||SSID
||MDID||R0KHlength||R0KH_ID||S0KH_ID)
PMK_R0=L(R0_Key_Data,0,256);
Where R0_Key_Data represents R0 Key Data, KDF_384 represents a Key derivation function using 384 bits of output, XXXKey represents a pre-shared Key, "FT_R1" represents an identifier as a fixed value, PMK_R0 represents a pairwise master Key R0, and L (R0_Key_Data, 0,256) represents a value of 256 bits from bit 0 of R0_Key_Data as PMK_R0.
6. The key generation method according to claim 5, wherein the calculation formula of pmk_r1 is:
PMK_R1=KDF_256(PMK_R0,"FT_R1","R1KH_ID"||"R0KH_ID");
In the formula, PMK_R1 represents a pairwise master key R1, KDF_256 represents a key derivation function using 256-bit output, and R1KH_ID represents a PMK-R1 key management entity identifier of a target AP side.
7. A key generation system, comprising:
The target AP is used for acquiring the STA air interface frame in the fast roaming process;
calculating PMK_R1 according to the information in the air interface frame;
calculating a random value RNonce according to PMK_R1;
The target AP returns a random value RNonce to the STA by replying to the null frame.
8. The key generation system of claim 7, further comprising:
The STA is used for calculating the PTK by utilizing the random value RNonce and SNonce of the STA after receiving the random value RNonce;
and the re-association unit is used for completing re-association of the STA and the target AP through the PTK.
9. An apparatus, comprising:
A processor and a memory;
The memory is used for storing a computer program, and the processor calls the computer program stored in the memory to execute the key generation method as claimed in any one of claims 1 to 6.
10. A computer readable storage medium, characterized in that the computer readable storage medium has stored therein a computer program which, when executed by a processor, enables the processor to perform the key generation method of any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411528990.6A CN119255234A (en) | 2024-10-30 | 2024-10-30 | A key generation method, system, device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411528990.6A CN119255234A (en) | 2024-10-30 | 2024-10-30 | A key generation method, system, device and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN119255234A true CN119255234A (en) | 2025-01-03 |
Family
ID=94016534
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202411528990.6A Pending CN119255234A (en) | 2024-10-30 | 2024-10-30 | A key generation method, system, device and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN119255234A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070206537A1 (en) * | 2006-03-06 | 2007-09-06 | Nancy Cam-Winget | System and method for securing mesh access points in a wireless mesh network, including rapid roaming |
| CN107690138A (en) * | 2016-08-05 | 2018-02-13 | 华为技术有限公司 | A kind of method for fast roaming, device, system, access point and movement station |
| CN108012306A (en) * | 2016-10-31 | 2018-05-08 | 华为技术有限公司 | A kind of WLAN loaming method and device |
| CN111328066A (en) * | 2018-12-14 | 2020-06-23 | 中国电信股份有限公司 | Method and system for fast roaming of heterogeneous wireless network, master and slave access point equipment |
| GB202311697D0 (en) * | 2023-07-28 | 2023-09-13 | Canon Kk | Method and apparatus for performing an enhanced fast BSS transition for CPE stations implementing changing mac address |
| CN118338371A (en) * | 2023-01-10 | 2024-07-12 | 华为技术有限公司 | Method, device, equipment and system for terminal association with AP |
-
2024
- 2024-10-30 CN CN202411528990.6A patent/CN119255234A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070206537A1 (en) * | 2006-03-06 | 2007-09-06 | Nancy Cam-Winget | System and method for securing mesh access points in a wireless mesh network, including rapid roaming |
| CN107690138A (en) * | 2016-08-05 | 2018-02-13 | 华为技术有限公司 | A kind of method for fast roaming, device, system, access point and movement station |
| CN108012306A (en) * | 2016-10-31 | 2018-05-08 | 华为技术有限公司 | A kind of WLAN loaming method and device |
| CN111328066A (en) * | 2018-12-14 | 2020-06-23 | 中国电信股份有限公司 | Method and system for fast roaming of heterogeneous wireless network, master and slave access point equipment |
| CN118338371A (en) * | 2023-01-10 | 2024-07-12 | 华为技术有限公司 | Method, device, equipment and system for terminal association with AP |
| GB202311697D0 (en) * | 2023-07-28 | 2023-09-13 | Canon Kk | Method and apparatus for performing an enhanced fast BSS transition for CPE stations implementing changing mac address |
Non-Patent Citations (1)
| Title |
|---|
| REDPARROT2008: "802.11R无线交互", pages 1 - 9, Retrieved from the Internet <URL:https://wandersky.blog.csdn.net/article/details/123251473?spm=1001.2101.3001.6650.6&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromBaidu%7ERate-6-123251473-blog-107375490.235%5Ev43%5Epc_blog_bottom_relevance_base7&depth_1-ut> * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP1974553B1 (en) | Wireless router assisted security handoff (wrash) in a multi-hop wireless network | |
| EP1414262B1 (en) | Authentication method for fast handover in a wireless local area network | |
| US8122249B2 (en) | Method and arrangement for providing a wireless mesh network | |
| KR101683883B1 (en) | Method and system for supporting security in mobile telecommunication system | |
| CN1846398B (en) | Authenticated key exchange based on pairwise master keys | |
| US20080072047A1 (en) | Method and system for capwap intra-domain authentication using 802.11r | |
| CN108966220A (en) | Safety implementation method, relevant apparatus and system | |
| CN101155396B (en) | Terminal node switching method | |
| JP2012217207A (en) | Exchange of key material | |
| TWI726890B (en) | Network architecture and security with encrypted network reachability contexts | |
| US12156028B2 (en) | Wireless network switching method and device | |
| US20220030428A1 (en) | Communication Method and Communications Device | |
| CN104982053A (en) | Method and network node for obtaining a permanent identity of an authenticating wireless device | |
| EP1121822A1 (en) | Authentication in a mobile communications system | |
| CN100488281C (en) | Method for acquring authentication cryptographic key context from object base station | |
| CN102056168A (en) | Access method and device | |
| WO2025026874A1 (en) | Method and apparatus for performing an enhanced fast bss transition for cpe stations implementing changing mac address | |
| CN1801705B (en) | Pre-authentication method | |
| CN119255234A (en) | A key generation method, system, device and storage medium | |
| CN114727285B (en) | Authentication method, authentication network element and security anchor point entity | |
| Zheng et al. | Handover keying and its uses | |
| WO2025099004A1 (en) | Method and apparatus for operating with enhanced data privacy features for stations implementing changing mac address | |
| CN117560795A (en) | Autonomous networking processing method and device based on multiple Access Points (APs) | |
| CN113709719A (en) | Access method, base station and access functional entity | |
| CN102196427A (en) | Air interface key updating method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |