WO2010130133A1

WO2010130133A1 - Method and system for station switching when wpi is implemented by access controller in convergent wlan

Info

Publication number: WO2010130133A1
Application number: PCT/CN2009/075566
Authority: WO
Inventors: 铁满霞; 曹军; 杜志强; 赖晓龙; 黄振海
Original assignee: 西安西电捷通无线网络通信有限公司
Priority date: 2009-05-14
Filing date: 2009-12-14
Publication date: 2010-11-18
Also published as: CN101557592B; CN101557592A

Abstract

A method and system for a station switching when WPI (WLAN (Wireless Local Area Network) Privacy Infrastructure) is implemented by an access controller in a convergent WLAN are disclosed by the present invention. The method includes the following steps: the station re-associates with a destination access controller via a destination wireless terminal point; the destination access controller requests a base key or unicast session key from the associated access controller; the associated access controller informs the associated wireless terminal point to delete the station; the destination access controller informs the destination wireless terminal point to add the station; the station and the destination access controller negotiate about a session key based on the requested unicast session key or base key; the destination access controller informs the destination wireless terminal point to turn on the controlled port. By the present invention, in the convergent WLAN based on WAPI (WLAN Authentication and Privacy Infrastructure) protocol, the station can roam and switch rapidly and safely between different wireless terminal points of different controllers.

Description

Method and system for switching a site when a WPI is completed by an access controller in a convergence WLAN. The application is filed on May 14, 2009, the Chinese Patent Office, the application number is 2009100225 27.3, and the invention name is "a convergent WLAN. The priority of the Chinese Patent Application for the STA Roaming Switching Method and the System of the AC when the AC completes the WPI, the entire contents of which are hereby incorporated by reference. Technical field

The present invention relates to the field of communications technologies, and in particular, to a method and system for site switching when a WPI is completed by an access controller in a convergence WLAN. Background technique

At present, the wireless local area network (WLAN) or the wireless local area network (WLAN) station (Station, referred to as STA) roaming switching method is based on the WLAN Authentication and Privacy Infrastructure (WAPI) protocol. The proposed autonomous WLAN architecture cannot be directly applied to the WAPI-based convergence WL AN architecture. In the convergence WLAN architecture, access control devices such as Access Contra Her (AC), wireless switches, or wireless routers centrally manage the authentication and policy enforcement functions of WLA N. These devices can also provide centralized bridging. Forward, encrypt and decrypt user data and other functions. Summary of the invention

In order to solve the defect that the STA roaming handover method in the current WAPI-based WLAN is only applicable to the autonomous architecture, the present invention provides a convergence WLAN architecture, when the WLAN architecture is implemented by the access controller. Structure (WLAN Privacy Infrastructure, WPI for short), the wireless termination point of the site under different access controllers (Wirele) Method and system for switching between ss Terminal Point (WTP). The access controller here can also be replaced by a device such as a wireless switch or a wireless router.

The technical solution of the present invention is: The present invention provides a method for site switching when a WPI is completed by an access controller in a convergence WLAN. The method includes:

The site re-associates with the destination access controller through the destination wireless terminal; the destination access controller requests the unicast session key or the base key from the associated access controller; the associated access controller notifies the associated wireless terminal to delete the site ;

The destination access controller notifies the destination wireless terminal to join the site;

The site and destination access controller negotiates a session key based on the requested unicast session key or base key;

The destination access controller informs the destination wireless terminal to open the controlled port.

The foregoing site re-associates with the destination access controller by using the destination wireless terminal point, which may include:

The beacon frame of the wireless terminal point of the passive listening target of the station obtains related parameters of the destination wireless terminal point including the WAPI information element, and the WAPI information element includes an authentication and key management suite and a cipher suite supported by the destination wireless terminal; or The station actively sends a query request frame to the destination wireless terminal, and after receiving the query request frame of the site, the destination wireless terminal sends a probe response frame to the site, and the site receives the query response frame to obtain the destination wireless terminal including the WAPI information element. Point related parameters, the WAPI information element includes an authentication and key management suite and a cipher suite supported by the destination wireless terminal;

In the Medium Access Control (MAC) mode, the station sends a link verification request frame to the destination wireless terminal, requesting link verification with the destination wireless terminal, and the destination wireless terminal is based on the chain of the site. The path verification request frame sends a link verification response frame to the station; in the split MAC mode, the station sends a link verification request frame to the destination access controller, requesting link verification with the destination access controller, and the destination access controller Sending a link verification response frame to the station according to the link verification request frame of the station; After the link verification is successful, the station sends a re-association request frame to the destination access controller, and the request is re-associated with the destination access controller. The station includes the identifier of the currently associated wireless terminal point and the associated access controller in the re-association request frame. The identity and WAPI information element determine the authentication and key management suite and cipher suite selected by the site; wherein the authentication and key management suite and cipher suite selected by the site are preferably associated with the associated access controller Select the same package; the destination access controller resolves the site's reassociation request frame and sends a reassociation response frame to the site.

The foregoing destination access controller requests the unicast session key or the base key from the associated access controller, and specifically includes:

The destination access controller sends a unicast session key or base key request information to the associated access controller using a pre-established secure channel with the associated access controller, including site deletion information;

The associated access controller sends a unicast session key to the destination access controller by using a secure channel between the associated access controller and the destination access controller according to the unicast session key or base key request information of the destination access controller. Or a base key, wherein the unicast session key sent to the destination access controller is either exactly equal to the unicast session key between the site and the associated access controller, or a single between the site and the associated access controller The broadcast session key is calculated by a one-way function using the extended parameters; the base key sent to the destination access controller is either exactly equal to the base key between the site and the associated access controller, or by the site and associated access The base key between the controllers is calculated by the one-way function using the extended parameters; the extended parameters are pre-known parameters between the site and the destination access controller.

The foregoing associated access controller notifies the associated wireless terminal to delete the site, and specifically includes: the associated access controller accesses the unicast session key of the controller or the site deletion information in the base key request information according to the destination access The wireless terminal point sends a Control and Provisioning of Wireless Access Points protocol (CAP WAP) Site Configuration Request message, and the message includes the deletion. Message elements other than the site (Delete Station);

The associated wireless terminal point sends a CAPWAP Site Configuration Response (Station Configuration Response) message to the associated access controller, which contains a Result Code message element identifying the result of the processing of the CAPWAP Site Configuration Request message.

The destination access controller notifies the destination wireless terminal to join the site, which may include: the destination access controller sends a CAPWAP Site Configuration Request (Satio n Configuration Request) message to the destination wireless terminal, where the request message includes a force entry site (Add) Station ), GB15629.il join site (GB15629.il Add Station), GB15629.il site session key (GB15629.il Station Session Key) message element; where, GB15629.il site session key message element A is placed 1 is used to notify the destination wireless terminal that the WTP closes the controlled port, and only forwards the WLAN Authentication Infrastructure (WAI) protocol data from the corresponding site;

The destination wireless terminal sends a CAPWAP Site Configuration Response (Statio n Configuration Response) message to the destination access controller, where the response message includes a processing result for identifying a CAPWAP Site Configuration Request message sent by the destination access controller to the destination wireless terminal point. Result Code Message element.

The foregoing site and the destination access controller negotiate the session key based on the requested unicast session key or the base key, which may specifically include:

When the destination access controller requests the associated key to the associated access controller, the destination access controller and the site perform WAI unicast key negotiation based on the requested base key. Specifically, the destination wireless terminal may be from the point pair. The WAI unicast key negotiation data encapsulated in the CAPWAP data encapsulation format of the destination access controller is decapsulated and forwarded to the site; the destination wireless terminal points to the WAI unicast key negotiation data from the site, according to the CAPWAP data encapsulation format. After being encapsulated, sent to the destination access controller;

When the destination access controller requests the unicast session key, the destination access controller and the site perform WAI multicast key advertisement; specifically, the destination wireless terminal points to the destination access controller. The WAI multicast key advertisement data encapsulated according to the CAPWAP data encapsulation format is decapsulated and forwarded to the site; the destination wireless terminal points the WAI multicast key advertisement data from the site, and encapsulates according to the CAPWAP data encapsulation format. Send to the destination access controller.

The destination access controller notifies the destination wireless terminal to open the controlled port, and the method may include: the destination access controller sends a CAPWAP Site Configuration Request (Satio n Configuration Request) message to the destination wireless terminal, where the request message includes a force port entry site (Add Station), GB15629.il join site (GB15629.il Add Station), GB15629.il site session key (GB15629.il Station Session Key) message element; where C in the site session key message element is set to 1, Used to inform the destination wireless terminal to open the controlled port corresponding to the site, and forward all data from the site, including WAI protocol data and non-WAI protocol data;

The present invention also provides a site switching system for completing a WPI by an access controller in a convergence WLAN, the system comprising:

Destination access controller, associated access controller, destination wireless termination point, associated wireless endpoint, and site;

The site re-associates with the destination access controller through the destination wireless terminal; the destination access controller requests a unicast session key or a base key from the associated access controller; the associated access controller notifies that Associate the wireless terminal point to delete the site;

The site and the destination access controller negotiate a session key based on the requested unicast session key or base key.

The present invention provides a method and system for performing site handover when a WPI is completed by an access controller in a convergence WLAN, by using a base key or a unicast session generated by a WAI negotiation between a STA and an AC. The key is cached, and the session key between the STA and the destination WTP is generated by using the cached base key or the unicast session key in the STA roaming handover process, and the site join between the AC and the WTP is implemented based on the CAPWAP control message. The present invention can quickly and securely implement roaming handover between WTPs of STAs under different ACs. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic diagram of an embodiment of a site roaming handover scenario provided by the present invention;

FIG. 2 is a flowchart of an embodiment of a method for roaming a site roaming according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without the creative work are all within the scope of the present invention.

Referring to FIG. 1, the present invention caches a Base Key (BK) or a Unicast Session Key (USK) generated by negotiation between a STA and an AC via a WAI (WLAN Authentication Infrastructure). The session key between the STA and the destination WTP is generated by using the cached BK or USK in the STA roaming handover process, and STA joining, STA deleting, and key synchronization operations between the AC and the WTP are implemented based on the CAPWAP control message. A fast and secure roaming handover method and system for STA between WTPs under different ACs under a W API-based convergence WLAN architecture.

Referring to FIG. 2, a method for roaming handover between ST As under different ACs according to the present invention is provided. In an embodiment, the method may include the following steps:

Step 1: The STA re-associates with the destination AC through the destination WTP. Step 1 may include: Step 11: The STA passively listens to the beacon frame of the destination WTP to obtain a related parameter of the destination WTP including the WAPI information element, and the WAPI information element includes an authentication and key management suite and a cipher suite supported by the destination WTP. Or the STA sends an inquiry request frame to the destination WTP. After receiving the inquiry request frame of the STA, the destination WTP sends an inquiry response frame to the STA. The STA receives the inquiry response frame and obtains the relevant WTP including the WAPI information element. Parameters, the WAPI information element includes an authentication and key management suite and a cipher suite supported by the destination WTP;

Step 12: In the local MAC mode, the STA sends a link verification request frame to the destination WTP to request link verification with the destination WTP. The destination WTP sends a link verification response frame to the ST according to the link verification request frame of the STA. In the split MAC mode, the STA sends a link verification request frame to the destination AC, requesting link verification with the destination AC, and the destination AC sends a link verification response frame to the STA according to the link verification request frame of the STA;

Step 13: After the link verification is successful, the STA sends a re-association request frame to the destination AC, and the request is re-associated with the destination AC. The STA includes the identifier of the currently associated WTP, the identifier of the associated AC, and the WAPI in the re-association request frame. The information element determines the authentication and key management suite and cipher suite selected by the STA, etc., wherein the authentication and key management suite and cipher suite selected by the STA are preferably the same as the suite selected when initially associated with the AC; The destination AC parses the STA's reassociation request frame and sends a reassociation response frame to the STA.

Step 2: Destination AC requests USK or extended unicast session key to the associated AC (Extended U

SK, referred to as EUSK) or BK or Extended BK (EBK). Step 2 can include:

Step 21: Using the pre-established secure channel with the associated AC, the destination AC sends USK or EUSK or BK or EBK request information to the associated A C, including the STA deletion information.

Step 22: According to the USK or EUSK or BK or EBK request information of the destination AC, the AC has been associated Medium, EUSK=F (USK, extended parameter), EBK=F (ΒΚ, extended parameter), extended parameter is

STA and destination AC are known in advance, such as the MAC address of both parties, and F is a one-way function.

Step 3: Associated AC Notification Associated WTP Delete STA. Step 3 can include:

Step 31: The associated AC sends a CAPWAP Site Configuration Request (Station Configuration Request) message to the associated WTP according to the STA deletion information in the USK or EUSK or BK or EBK request information of the destination AC, and the message includes the deletion station (Delete Station) ) and other message elements. The delete site message element can include the site's MAC address.

Step 32: Associated WTP sends a CAPWAP Site Configuration Response to the Associated AC (Station

A Configuration Response message containing a Result Code message element that identifies the result of processing a CAPWAP Site Configuration Request message.

Step 4: Purpose AC notification destination WTP joins the STA. Step 4 can include:

Step 41: The destination AC sends a CAPWAP Site Configuration Request (Station Configuration Request) message to the destination WTP, where the message includes a join station (Add Station), a GB15629.il join site (GB15629.il Add Station), and a GB15629.il site session secret. Key (GB156

29.11 Station Session Key) and other message elements; where, GB15629.i l site session key (G

B15629.l l Station Session Key ) A in the message element is set to 1 to inform the destination WT

P turns off the controlled port and forwards only the WAI protocol data from the corresponding STA;

Step 42: The destination WTP sends a CAPWAP Site Configuration Response (Station Configuration Response) message to the destination AC, where the result code (Result Code) message element for identifying the processing result of the CAPWAP Site Configuration Request message is included. .

Step 5: STA and destination The AC negotiates the session key based on the requested USK or EUSK or BK or EBK. Step 5 can include:

Step 51: When the destination AC requests BK or EBK from the associated AC, the destination AC and the STA^ perform unicast key negotiation on the WAI of the requested BK or EBK. Specifically, the destination AC may include: The WTP is forwarded to the STA after being unpacked. The destination WTP encapsulates the WAI unicast key negotiation data from the STA according to the CAP WAP data encapsulation format and then sends it to the destination AC. When the destination AC requests the associated AC to be USK or EUSK, it is omitted. Step 51 and directly perform step 52;

Step 52: The destination AC and the STA perform WAI multicast key advertisement. Specifically, the destination WTP is decapsulated and forwarded to the STA. The destination WTP encapsulates the WAI multicast key advertisement data from the STA according to the C APWAP data encapsulation format. After sending to the destination AC.

Step 6: Purpose The AC informs the destination that WTP opens the controlled port. Step 6 can include:

Step 61: The destination AC sends a CAPWAP Site Configuration Request (Station Configuration Request) message to the destination WTP, where the message includes a join station (Add Station), a GB15629.il join site (GB15629.il Add Station), and a GB15629.il site session secret. Message element such as key (GB1562 9.11 Station Session Key); where C is set to 1 in the GB15629.il Station Session Key (G B15629.ll Station Session Key) message element, used to inform the destination WT P to open corresponding to the STA The controlled port forwards all data from the STA, including WAI protocol data and non-WAI protocol data. The join site message element can include the site's MAC address.

Step 62: The destination WTP sends a CAPWAP Site Configuration Response (Station Configuration Response) message to the destination AC, where the result code (Result Code) message element for identifying the processing result of the CAPWAP Site Configuration Request message is included. .

The present invention also provides a site switching system in a convergence WLAN when WPI is completed by an access controller, the system includes a destination access controller, an associated access controller, a destination wireless terminal point, an associated wireless terminal point, and a site. The site re-associates with the destination access controller through the destination wireless terminal; the destination access controller requests the unicast session key or the base key from the associated access controller; the associated access controller notifies the associated wireless terminal point Delete the site; the destination access controller notifies the destination wireless terminal to join the site; the site and destination access controller are based on the request The unicast session key or base key negotiates the session key.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The steps of the foregoing method embodiments are included; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are replaced by equivalents; and the modifications or substitutions do not deviate from the spirit of the technical solutions of the embodiments of the present invention. range.

Claims

Claim

A method for switching a WPI site by an access controller in a convergence type WLAN, the method comprising:

2. The method according to claim 1, wherein the station re-associates with the destination access controller by using the destination wireless terminal, including:

In the local media access control mode, the station sends a link verification request frame to the destination wireless terminal point, requesting link verification with the destination wireless terminal point, and the destination wireless terminal point sends the link verification request frame to the station according to the site. Link verification response frame; In the split media access control mode, the station sends a link verification request frame to the destination access controller, requesting link verification with the destination access controller, and the destination access controller performs link verification according to the site. Requesting a frame, sending a link verification response frame to the station;

After the link verification succeeds, the station sends a re-association request frame to the destination access controller, requesting and The destination access controller performs re-association, and the site includes the identifier of the currently associated wireless terminal point, the identifier of the associated access controller, and the authentication and key management suite and cipher suite selected by the WAPI information element in the re-association request frame. Wherein, the authentication and key management suite and cipher suite selected by the site are the same as the key management suite and cipher suite selected when associated with the associated access controller; the destination access controller resolves the re-association request frame of the site; , Send a reassociation response frame to the site.

The method according to claim 1 or 2, wherein the destination access controller requests a unicast session key or a base key from the associated access controller, including:

The destination access controller sends a unicast session key or base key request information to the associated access controller using a pre-established secure channel with the associated access controller, wherein the unicast session key or base key request The information contains site deletion information;

The associated access controller sends a unicast session key to the destination access controller by using a secure channel between the associated access controller and the destination access controller according to the unicast session key or base key request information of the destination access controller. Or a base key, wherein the unicast session key sent to the destination access controller is either exactly equal to the unicast session key between the site and the associated access controller, or a single between the site and the associated access controller The broadcast session key is calculated by the one-way function using the extended parameter; the base key sent to the destination access controller is either exactly equal to the base key between the site and the associated access controller, or by the site and the associated access controller The base key between them is calculated by a one-way function using extended parameters; the extended parameter is a parameter that is known in advance between the site and the destination access controller.

The method according to claim 3, wherein the associated access controller notifies the associated wireless terminal to delete the station, including:

The associated access controller sends a wireless access point control and configuration protocol site configuration request message to the associated wireless terminal point according to the unicast session key of the destination access controller or the site deletion information in the base key request information, the site The configuration request message includes a delete site message element;

The associated wireless terminal point sends a wireless access point control and configuration protocol to the associated access controller A site configuration response message, the site configuration response message containing a result code message element for identifying a result of processing a site configuration request message sent by the associated access controller to the associated wireless terminal point.

The method according to any one of claims 1-4, wherein the destination access controller notifies the destination wireless terminal to join the site, including:

The destination access controller sends a wireless access point control and configuration protocol site configuration request message to the destination wireless terminal, where the wireless access point control and configuration protocol site configuration request message includes the joining site, GB15629.il join site, GB15629.il Site session key message element; where A in the B B6292.91 site session key message element is set to 1 to inform the destination wireless terminal to close the controlled port and forward only the WLAN authentication infrastructure from the corresponding site Protocol data; the destination wireless terminal sends a wireless access point control and configuration protocol site configuration response message to the destination access controller, and the wireless access point control and configuration protocol site configuration response message includes a purpose for identifying the destination access controller The result code message element of the processing result of the site configuration request message sent by the wireless terminal.

The method according to any one of claims 1-5, wherein the site and the destination access controller negotiate a session key based on the requested unicast session key or base key, including:

When the destination access controller requests the base key from the associated access controller, the destination access controller and the station perform WLAN authentication infrastructure unicast key negotiation based on the requested base key;

When the destination access controller requests the unicast session key from the associated access controller, the destination access controller and the station perform a WLAN authentication infrastructure multicast key advertisement.

7. The method of claim 6 wherein:

When the destination access controller requests the base key from the associated access controller, the destination access controller negotiates with the site for the WLAN authentication infrastructure unicast key based on the requested base key, including: The destination wireless terminal points to the wireless access from the destination access controller. The unicast key negotiation data of the WLAN authentication infrastructure encapsulated in the data packet encapsulation format is configured to be decapsulated and forwarded to the site; the destination wireless terminal points to the WLAN unicast key negotiation data of the WLAN from the site, After being encapsulated according to the wireless access point control and the configuration protocol data encapsulation format, the packet is sent to the destination access controller;

When the destination access controller requests the unicast session key from the associated access controller, the destination access controller and the station perform WLAN authentication infrastructure multicast key advertisement, including: destination wireless terminal point pair The WLAN authentication infrastructure multicast key advertisement data encapsulated by the wireless access point control and the configuration protocol data encapsulation format from the destination access controller is decapsulated and forwarded to the site; the destination wireless terminal points to the wireless from the site The local area network authentication infrastructure multicast key advertisement data is encapsulated according to the wireless access point control and the configuration protocol data encapsulation format, and then sent to the destination access controller.

The method according to any one of claims 1-7, wherein the destination access controller notifies the destination wireless terminal to open the controlled port, including:

The destination access controller sends a wireless access point control and configuration protocol site configuration request message to the destination wireless terminal, where the site configuration request message includes a joining site, a GB15629.il joining site, and a GB15629.il site session key. Message element; wherein C in the site session key message element is set to 1 to inform the destination wireless terminal to open the controlled port corresponding to the site, and forward all data from the site, including WLAN authentication infrastructure protocol data and Non-wireless LAN authentication infrastructure protocol data;

The destination wireless terminal sends a wireless access point control and configuration protocol site configuration response message to the destination access controller, where the site configuration response message includes a site for identifying a destination access controller to send to the destination wireless terminal A result code message element that configures the processing result of the request message.

9. A convergent WLAN in which a WPI site switching system is implemented by an access controller, the features of which include:

Destination access controller, associated access controller, destination wireless termination point, associated wireless termination Endpoints and sites;

The site and destination access controller negotiate a session key based on the requested unicast session key or base key.