The present disclosure relates to methods, apparatuses, and systems for addressing win wireless local area networks (WLANs).
Initially, it is noted that Institute of Electrical and Electronics Engineers (IEEE) Standard 802.11-2020 is used as the base reference for disclosures used herein, the entire contents of which are incorporated herein by reference. The IEEE 802.11-2020 Standard is commonly referred to as “Wi-Fi” and may be referred to as such or simply as “the Standard” herein. This disclosure relates to the addressing used by devices that are based upon the IEEE 802.11 technology.
The medium access control (MAC) address of a Wi-Fi device has historically been a unique hardware address that identified the device. However, having this MAC address openly broadcast has meant that the device may be easily observed and tracked, without the user's permission.
In order to associate to the AP 110, STA 120 sends an Association Request management frame to the AP 110 with Address 1, RA 215 set to the MAC address of the AP 110, and Address 2, TA 216, set to the STA's MAC address. Similarly, if STA 120 is searching for AP 110, it may transmit Probe Request management frames again setting Address 2 TA 216 to the MAC address of the STA 120.
As described in the Standard (Clause 4.5.4.10), when a Wi-Fi station, STA 120, is searching for, or connects to a Wi-Fi network, i.e., an access point AP 110, it defines the addressing of its MAC layer for the particular connection. Similarly, when a STA attempts to discover services on a network before associating, i.e., during preassociation, it also defines the addressing of its MAC layer. If STA 120 uses a fixed MAC address, it is trivial to track the STA 120, and this tracking may be used to glean private and sensitive information regarding the individual behind the STA 120. Furthermore, even without establishing a connection, a mobile or portable STA 120 that gratuitously transmits Probe Request frames containing service set identifiers (SSIDs) of favored networks can reveal potentially sensitive information about the STA's location and location history. To mitigate this privacy concern, a STA may periodically change its MAC address prior to association.
“Requirements for support of MAC privacy enhancements” was introduced in the IEEE 802.11-2020 Standard. The Standard states that a STA 120 may periodically change its MAC address to a random value while not associated. However, the STA 120 is expected to set the locally administered address bit in the MAC address, but if the STA 120 is (re)associating with an AP with which it has been previously associated, the STA should change its MAC address to that used when previously associated.
The introduction of MAC randomization has generally prevented the tracking of users but has also caused impact and problems with some network operations and “use cases” that require knowledge of an identity of a STA. In other words, randomization of the MAC address can create issues. Such issues may include the steering of STAs to appropriate APs/networks, parental controls, network access controls, device limits, and diagnostics. Although some “requirements,” such as that a STA 120 uses the same MAC address every time it (re)associates to the same AP 110, may be used to mitigate some of the issues to some extent, such “requirements” are not without privacy concerns.
Some embodiments provide methods, apparatuses, and/or systems for associating to an access point (AP). According to one aspect, a method for a mobile station (STA) is described. The method may be performed to use an identifiable medium access control (MAC) random (IRM) address (IRMA) to associate to an access point (AP). The method includes exchanging one IRM key (IRMK) with the AP for each association of a plurality of associations; determining an IRM hash using the IRMA and the IRMK exchanged with the AP at an immediately previous association of the plurality of associations and/or a temporal element; associating to the AP using the IRMA as a transmitted address (TA); and transmitting an association request including the IRM hash. The transmitted association request triggers the AP to one or both of check a list of stored IRMKs to find one stored IRMK that together with the IRMA produces the IRM hash included in the association request and identify the STA by the one IRMK.
According to another aspect, a mobile station (STA) is described. The STA is configured to use an identifiable medium access control (MAC) random (IRM) address (IRMA) to associate to an access point (AP). The STA includes processing circuitry configured to cause exchange of one IRM key (IRMK) with the AP for each association of a plurality of associations and determine an IRM hash using the first or both of: (1) the IRMA and the IRMK exchanged with the AP at an immediately previous association of the plurality of associations; and (2) a temporal element. The processing circuitry is further configured to associate to the AP using the IRMA as a transmitted address (TA); and cause transmission of an association request including the IRM hash, the transmitted association request triggering the AP to one or both of check a list of stored IRMKs to find one stored IRMK that together with the IRMA produces the IRM hash included in the association request; and identify the STA by the one IRMK.
According to another aspect, a system comprising a mobile station (STA) and an access point (AP) is described. The STA is configured to use an identifiable medium access control (MAC) random (IRM) address (IRMA) to associate to the AP. The STA comprises first processing circuitry configured to one or both of cause transmission of one IRM key (IRMK) to the AP for each association of a plurality of associations; and receive one IRM key (IRMK) from the AP for each association of a plurality of associations. The first processing circuitry is further configured to determine an IRM hash using the IRMA and an IRMK provided to or received from the AP at an immediately previous association of the plurality of associations; associate to the AP using the IRMA as a transmitted address (TA); cause transmission of an association request including the IRM hash. The AP comprises second processing circuitry configured to check a list of stored IRMKs to find one stored IRMK that together with the IRMA produces the IRM hash included in the association request; and identify the STA by the one IRMK.
A more complete understanding of the present invention, and the attendant advantages and features thereof, will be more readily understood by reference to the following detailed description when considered in conjunction with the accompanying drawings wherein:
A method, “identifiable random MAC (IRM)”, and apparatus is disclosed for a STA 120 to indicate to an AP 110, that the MAC address used by the STA 120 is random but also “identifiable” and that while still preventing third parties from tracking the STA 120, a trusted AP 110 can recognize or identify that STA 120.
Referring again to the drawing figures in which like reference designators refer to like elements, an Association Request management frame has the format shown in
A more complete understanding of the present invention, and the attendant advantages and features thereof, will be more readily understood by reference to the following definitions for certain terms used herein:
A more complete understanding of the details of the present invention will be more readily understood by first providing an outline of the IRM method, set forth as follows. Two methods of allocating the IRMK are disclosed: exchange of robust action frames and including key data into message 2 or 4 of the 4-way handshake used to provide and exchange keys during association.
An AP 110 may indicate that it supports IRM by setting an IRM Capability bit in the Extended Capabilities Information element that is transmitted in its Beacons. A STA 120 may indicate that it supports IRM by setting a IRM Capability bit in in the Extended Capabilities Information element that is transmitted in an Association Request frame. When a STA 120 sends an Association Request to an AP 110, it uses an identifiable randomized MAC address, known as an IRMA, as the transmitter address TA. The STA 120 also includes an IRM element in the Association Request. The IRM element may include an IRM Hash. The STA 120 also may indicate in the IRM element whether it has previously associated with the AP 110 or not. If the STA 120 has not previously associated with the AP 110, then, the IRM element does not include an IRM Hash and the TA may be a random MAC address. Then, in one embodiment, once associated, the AP 110 may transmit an IRMK Request Action frame to the STA 120, and the STA 120 may respond with an IRMK Response Action frame which includes an IRMK determined by the STA 120. In another embodiment, STA 120 may include an IRMK in key data in message 2 or 4 of the 4-way handshake. The AP 110 may then store that IRMK as an identifier for that STA 120. If the STA 120 has previously been associated with the AP 110, the IRM element will include an IRM Hash which is derived using the IRMA and an IRMK.
The AP 110 can confirm that a stored IRMK, together with the TA, i.e., IRMA, used by the STA 120, produces the same IRM Hash value that was included in the IRM element sent by the STA 120 in its Association Request. Hence, the AP 110 may identify the STA 120 by the IRMK. Each time the STA 120 associates to the AP 110, the TA, i.e., IRMA, and the IRM Hash value in the Association Request will be different, but the IRMK used to derive the IRM Hash, is the same as the one previously provided to and stored by the AP 110 for that STA 120 and may be used to identify STA 120.
In some embodiments, the IRM Hash field 605 is a hash function derived from the IRMA and the IRMK. Hash functions may be used for various integrity and authenticity applications. In particular, hash functions may be used for “key derivation functions”. A typical usage of such a key derivation function is to take information that is intended to remain private, such as a password or a shared key, and a random number (known as a ‘salt’) to produce a ‘key’. Methods of producing a ‘key’ by calculating a hash function from a random ‘salt’ and a shared (i.e., private) key are known and are beyond the scope of this disclosure. In the IRM method and arrangements described in this disclosure, the IRM Hash is a function of the random MAC address (IRMA) and the shared private key, i.e., the IRM key (IRMK). The disclosed method and arrangements provided herein relate to how the IRMK may be securely shared between a STA 120 and an AP 110 and how the STA 120 indicates to the AP 110 that the MAC address (TA), i.e., IRMA, may be interpreted as an identifiable random address. In Wi-Fi networks, and in particular networks that may have a need to identify a STA, the number of STAs may be large. Hence, the identification of many STAs and IRMKs may be needed in addition to the requirement that the identity of a STA and its IRMK is required to be secure.
The IRMK Check field 606 may have two sub fields, IRMK Offset 607 and Check 608. In one embodiment of this disclosure, both the IRMK Offset field 507 and the Check field 608 are 1 octet in length, i.e., 8 bits, but may have any other length. The IRMK Offset field 607 indicates the Nth bit in the IRMK. The Check field then may include the 8 bits of the IRMK b(N) to b(N+7). For example, if N=102, then the Check field 608 comprises b102 to b109 of the IRMK.
In another preferred embodiment of this disclosure, the Check field 508 may include 8 bits representing the exclusive OR logical operation (EX-OR) of the 8 bits of the IRMK, b(N) to b(N+7) with the following 8 bits, b(N+8) to b(N+15).
i.e., for n=0 to 7 bn=EX-OR (bN+n, bN+n+8) (1)
As an example, if the IRMK Offset field 507 has a value of 102, n=102, then in the Check field 508, b0 is EX_OR of b102 and b110 of the IRMK, and Check field b7 is EX-OR of b109 and b117 of the IRMK.
A STA 120 may advertise support for IRM by setting the IRM Capability bit 500 to 1 in the Extended Capabilities element in Probe Request, Association Request and Reassociation Request frames. A STA 120 may include an IRM element 600 in its Association Request and Reassociation Request frames. An AP 110 may advertise support for IRM by setting the IRM Capability bit 500 to 1 in the Extended Capabilities element in its Beacon and Probe Response frames. For example, to indicate that the STA 120 intends to be identifiable, the STA 120 may set the IRM Indicator field 604 to “Unknown” 720, or “Known” 730. If the STA 120 intends to not be identifiable, the IRM Indicator field 604 may be set to “Private” 710.
Each time the STA 120 associates to an AP 110, the STA 120 sends a new IRMK to the AP 110. The AP 110 can then store that IRMK as an identifier for that STA 120.
When STA 120 associates with an IRMA as the TA and indicates “Known” 730, the IRM element 600 includes an IRM Hash field 605. The IRM Hash field 605 value may be derived from the IRMA (TA) and the IRMK that was provided by STA 120 at the last association with that AP 110. The AP then may calculate (i.e., determine) an IRM Hash value using each of its stored IRMKs and the TA 216 until it finds the IRMK that produces the same IRM Hash field value 605 as that included in the IRM element 600.
A list of IRMKs and STAs 120 may be stored by the AP 110 and used as an identifier for each STA 120 that has previously associated. A STA 120 may store the last IRMK exchanged with a particular AP 110 such that the next time the STA 120 associates to that AP 110, the AP 110 can identify the STA 120.
In one embodiment of this disclosure, a STA 120, that supports IRM, receives beacons from AP 110 indicating that the AP supports IRM. STA 120 may send an Association Request to AP 110 using a randomized MAC address as Address 2 TA 216. If the STA 120 is not associating using an identifiable random MAC address (IRMA) but with a private randomized MAC address, then the IRM Indicator field 604 value in the IRM element 600 in the Association Request frame may be set to “Private” 710, and neither the IRM Hash field 605 nor Check field 606 are present in the IRM element 600.
If the STA 120 is associating using an identifiable random MAC address (IRMA) and STA 120 has not previously provided an IRMK to the AP 110 (i.e., this is the first time that STA 120 is associating to AP 110), then the IRM Indicator field 604 value in the IRM element 600 in the Association Request frame may be set to “Unknown” 720. If the STA 120 has previously provided an IRMK to the AP 110, then the IRM Indicator field 604 value may be set to “Known” 730.
As discussed above with reference to
IRM Hash=function {IRMA, IRMK} (2)
In one embodiment of this disclosure, the IRMK and the IRM Hash may each have 128 bits, and the IRM Hash field value is the SHA-256/128 function of the IRMK and the IRMA. SHA-256/128 is the truncated SHA-256 function where the leftmost 128 bits of the 256-bit hash generated by SHA-256 are selected as the truncated 128 bit IRM Hash, hence:
IRM Hash=SHA-256/128 {IRMK, IRMA} (3)
SHA-256 and SHA-256/128 are known. Many different sizes of the IRMK and the IRM Hash could be used, and there are also several other hash functions that could be used. For example, a key derivation function such as hash-based message authentication code (HMAC)-based Extract-and-Expand Key Derivation Function (HKDF) may be used. In one or more embodiments of the following discussions, the size of the IRM Hash and IRMK are both assumed to be 128 bits each. However, these values should not be construed as limitations on the scope, and many other variations are possible. In yet another embodiment, with reference to equations (2) and (3), a third term may be added to the IRM Hash function that is temporal. For example, the temporal term may be based upon the timestamp of a recent beacon frame.
As discussed above with reference to
In one embodiment of this disclosure, a set of (IRM) action frames may be used for the STA 120 to provide the IRMK to the AP 110.
To indicate that the STA 120 intends to be identifiable, an IRM Hash field 605 is included in the IRM element 600 sent in an Association Request and a Reassociation Request. If the STA 120 intends to not be identifiable, then in the IRM element 600, the IRM Indicator field 604 is set to “Private” 710, and neither the IRM Hash field 605 nor the IRMK Check field 606 is present.
If a STA 120 associates to an AP 110 using an IRMA and the IRM Indicator field 604 is set to “Unknown” 720, then, once STA 120 is associated, the AP 110 may transmit an IRMK Request Action frame 900, to STA 120 and STA 120 may then send an IRMK Response Action frame 1000 to the AP 110 that includes an IRMK 1010. The AP 110 may then store that IRMK and use it as an identifier for STA 120. The STA 120 may also store the IRMK used for AP 110.
If an STA 120 associates to an AP 110 using an IRMA and the IRM Indicator field 604 is set to “Known” 730, the STA may include in the IRM element 600 the IRM Hash field 605 and also include the IRMK Check field 606. Including the IRMK Check field 606 can aid (e.g., be usable to) the AP 110 in down-selecting the stored IRMKs, e.g., in the case that the AP 110 has many stored IRMKs. The AP 110 may, prior to completion of the STA 120 association, check the stored IRMKs in order to determine the IRMK that, together with the IRMA, produces the IRM Hash field 605 value that the STA 120 included in the IRM element 600. Alternatively, the AP 110 may, after STA 120 has associated, check the stored IRMKs in order to determine the IRMK that, together with the IRMA, produces the IRM Hash field 605 value that the STA 120 included in the IRM element 600.
When STA 120 is associated, AP 110 may transmit an IRMK Request Action frame 1200 to STA 120. On receipt of a IRMK Request Action frame 1200, STA 120 may then respond with an IRMK Response Action frame 1000 with a new IRMK. Changing the IRMK every association provides higher security and deters any listening station from attempting to find the IRMK.
In another embodiment of this disclosure, the IRMK is inserted in key data is inserted in a message in the 4-way handshake.
The processing circuitry 1320 may include a processor 1321, a memory 1322, and the IRM unit 1323. In addition to a traditional processor and memory, processing circuitry 1320 may comprise integrated circuitry for processing and/or control, e.g., one or more processors and/or processor cores and/or FPGAs (Field Programmable Gate Array) and/or ASICs (Application Specific Integrated Circuitry). Processor 1321 may be configured to access (e.g., write to and/or reading from) memory 1322, which may comprise any kind of volatile and/or non-volatile memory, e.g., cache and/or buffer memory and/or RAM (Random Access Memory) and/or ROM (Read-Only Memory) and/or optical memory and/or EPROM (Erasable Programmable Read-Only Memory). Such memory 1322 may be configured to store code executable by processor 1321 and/or other data, e.g., data pertaining to communication, e.g., configuration and/or address data of nodes, etc. In some embodiments, the IRM unit 1323 may be implemented by the processor and/or the memory module 1322.
Processing circuitry 1320 may be configured to control any of the methods and/or processes described herein and/or to cause such methods and/or processes to be performed, e.g., by mobile station STA 120. Corresponding instructions may be stored in the memory 1322 and/or in the IRM unit 1323, which may be readable and/or readably connected to processor 1321. In other words, processing circuitry 1320 may comprise a microprocessor and/or microcontroller and/or FPGA (Field-Programmable Gate Array) device and/or ASIC (Application Specific Integrated Circuit) device. The IRM unit 1323 may be configured to perform one or more IRM processes described herein, such as determining values for use as IRMKs, performing the computations for the IRM Hash, and writing to the memory 1322 for the storage of the allocated IRMKs and their corresponding APs.
The processing circuitry 1420 may include a processor 1421, a memory 1422, and the IRM unit 1423. In addition to a traditional processor and memory, processing circuitry 1420 may comprise integrated circuitry for processing and/or control, e.g., one or more processors and/or processor cores and/or FPGAs (Field Programmable Gate Array) and/or ASICs (Application Specific Integrated Circuitry). Processor 1421 may be configured to access (e.g., write to and/or reading from) memory 1422, which may comprise any kind of volatile and/or non-volatile memory, e.g., cache and/or buffer memory and/or RAM (Random Access Memory) and/or ROM (Read-Only Memory) and/or optical memory and/or EPROM (Erasable Programmable Read-Only Memory). Such memory 1422 may be configured to store code executable by processor 1421 and/or other data, e.g., data pertaining to communication, e.g., configuration and/or address data of nodes, etc. In some embodiments, the IRM unit 1423 may be implemented by the processor and/or the memory module 1422.
Processing circuitry 1420 may be configured to control any of the methods and/or processes described herein and/or to cause such methods and/or processes to be performed, e.g., by AP 110. Corresponding instructions may be stored in the memory 1422, and/or the IRM unit 1423 which may be readable and/or readably connected to processor 1421. In other words, processing circuitry 1420 may comprise a microprocessor and/or microcontroller and/or FPGA (Field-Programmable Gate Array) device and/or ASIC (Application Specific Integrated Circuit) device. The IRM unit 1423 may be configured to perform one or more IRM processes described herein, such as computation of the IRM Hash and writing to the memory 1022 for the storage of the allocated IRMKs and their corresponding STAs.
Note that the modules discussed herein may be implemented in hardware or a combination of hardware and software. For example, the modules may be implemented by a processor executing software instructions or by application specific integrated circuitry configured to implement the functions attributable to the modules. Also note that the term “connected to” as used herein refers to “being in communication with” and is not intended to mean a physical connection nor a direct connection. It is contemplated that the signal path between one element and another may traverse multiple physical devices.
Thus, in some embodiments, the processing circuitries 1320 and 1420 may include the memory 1322 and 1422 respectively, a processor 1321 and 1421 respectively, the memories 1322 and 1422 containing instructions which, when executed by the processors 1321 and 1421 respectively, configure the processor 1321 or 1421 to perform the one or more functions described herein. Similarly, in some embodiments, the processing circuitries 1320 and 1420 may include the memory 1322 and 1422 respectively, an IRM unit 1323 and 1423 respectively, the memories 1322 and 1422 containing instructions which, when executed by the IRM units 1323 and 1423 respectively, configure the processor 1321 or 1421 to perform the one or more functions described herein. In addition to a traditional processor and memory, the processing circuitries 1320 and 1420 may comprise integrated circuitry for processing and/or control, e.g., one or more processors and/or processor cores and/or FPGAs (Field Programmable Gate Array) and/or ASIC s (Application Specific Integrated Circuitry).
The processors 1321 and 1421 may include and/or be connected to and/or be configured for accessing (e.g., writing to and/or reading from) the memories 1322 and 1422 respectively, which may include any kind of volatile and/or non-volatile memory, e.g., cache and/or buffer memory and/or RAM (Random Access Memory) and/or ROM (Read-Only Memory) and/or optical memory and/or EPROM (Erasable Programmable Read-Only Memory). Such memory 1322 and 1422 may be configured to store code executable by control circuitry and/or other data, e.g., data pertaining to communication, configuration and/or address data of nodes, etc. The processing circuitry 1320 and 1420 may be configured to control any of the methods described herein and/or to cause such methods to be performed, e.g., by the processors 1321 and 1421 or by the IRM units 1323 and 1423. Corresponding instructions may be stored in the memory 1322 or 1422, which may be readable and/or readably connected to the processing circuitry 1320 or 1420. In other words, the processing circuitries 1320 and 1420 may include a controller, which may comprise a microprocessor and/or microcontroller and/or FPGA (Field-Programmable Gate Array) device and/or ASIC (Application Specific Integrated Circuit) device. It may be considered that the processing circuitries 1320 and 1420 include or may be connected or connectable to memory, which may be configured to be accessible for reading and/or writing by the controller and/or processing circuitry 1320 or 1420.
According to an embodiment of the disclosure, STA 120 is arranged to receive transmissions of another wireless device such as AP 110, and processing circuitry 1320 is arranged to monitor attributes of those transmissions. For example, processing circuitry 1320 or IRM unit 1323 may be arranged to monitor attributes of beacon transmissions of AP 110 and determine that AP 110 supports IRM by examination of the Extended Capabilities field in the Beacon and determining that the IRM capability bit is set therein. Furthermore, IRM unit 1323 in processing circuitry 1320 in STA 120 is arranged to calculate a value for the IRM Hash field 605 and the values for the IRMK Check field 606. STA 120 is arranged to transmit to AP 110 an Association Request frame that includes an IRM element 600 and processing circuitry 1320 may be arranged to determine the individual field values for that element, such as Element ID 301, Length 302, Element ID Extension 303, IRM Indicator field 604, IRM Hash field 605, and IRMK Check field 606. According to another embodiment of the disclosure, AP 110 is arranged to monitor the Association Request frame from STA 120, that includes an IRM element 600 and processing circuitry 1420 may be arranged to detect the individual fields of the Association Request frame and take the appropriate action as described herein. The processing circuitry 1420 in AP 110 may be arranged to check through stored IRMKs to find the IRMK that produces the same IRM Hash value that is contained in the IRM Hash field 605 in the Association Request sent by STA 120. The IRM unit 1423 in processing circuitry 1420 in AP 110 may also be arranged to check through stored IRMKs to first find the IRMKs that satisfy the down-selection process as discussed above with reference to
According to an embodiment of the disclosure, STA 120 and AP 110 are arranged to be capable of carrying out the function of association, as described in the Standard, and to communicate with each other, securely, once associated. In one embodiment of this disclosure, once associated, STA 120 and AP 110 are arranged to exchange Action frames 400 and their processing circuitries 1320 and 1420 are particularly arranged to exchange and interpret the IRMK Request 900 and IRMK Response Action frames 900 and 1000 respectively, the details of which are discussed above with reference to
In another embodiment of this disclosure, STA 120 and AP 110 are arranged to carry out the 4-way handshake as discussed above with reference to
If, at step 1502, STA 120 has chosen to use an identifiable address, then at step 1508 STA 120 constructs an identifiable random MAC address (IRMA). The IRMA may consist of 46 random bits with the least significant bit of the first octet, the “I/G” bit, set to 0 (unicast) and the second least significant bit of the first octet, the “U/L” bit, set to 1 (locally administered) as specified in the Standard. At step 1510, STA 120 may check if AP 110 is an AP that STA 120 has previously associated to and has previously exchanged an IRMK with. If so, then step 1510 may be followed by step 1512 where STA 120 may select the IRMK that it allocated to AP 110 in its last association. STA 120 may store a list of APs and IRMKs in memory 1422, and IRM unit 1423 may be arranged to search through that list to determine if AP 110 and an associated IRMK is present. In step 1514, STA 120 may calculate the IRM Hash value as discussed above with reference to equations (2) and (3), using the IRMK selected in step 1512 and the IRMA created in step 1508. The IRM Hash calculation may take place in the IRM unit 1423 of the processing circuitry 1420, and the IRM Hash field 605 value in the IRM element 600 is set to the result of that calculation. STA 120, at step 1518, may set the IRM Indicator field 604 in the IRM element 600 to “Known” 730. In step 1522, STA 120 may select the value for the IRM Offset field 607, and then in step 1524, determine the values for the Check field 608 as described above with reference to
If, at step 1510, STA 120 determines that AP 110 is an AP that STA 120 has not previously associated to and has not previously exchanged an IRMK with, then, if robust action frames are to be used, as discussed below with reference to
If, at step 1602, the IRM indicator 604 was not “Known” 730, then at step 1605, it may be checked if the IRM Indicator 604 is “Unknown” 720, and if so then the process advances to step 1608. If, at step 1605, the IRM Indicator 604 is not “Unknown”, then it may be assumed that the IRM Indicator 604 is “Private” 710, and at step 1606, STA 120 associates using a private random address.
If STA 120 sends directed probe requests to AP 110, STA 120 may, if it has an IRMK stored at that AP 110, include an IRM element in the probe request. STA 120 may use a different IRMA and IRM Hash for each probe request and AP 110 should be able to identify STA 120. As the IRMA (TA) and IRM Hash change each probe request, tracking the STA is made almost impossible. Similarly, if STA 120 sends a broadcast probe and AP 110 receives it, then AP 110 should be able to identify STA A 120.
In some embodiments, the method further includes at a first association of the plurality of associations, either: selecting a first IRMK; associating to the AP; and transmitting to the AP the transmitted first IRMK; or: associating to the AP; and receiving from the AP the first IRMK. The method further includes triggering the AP and STA to store the first IRMK.
In some other embodiments, the method further includes, at a second association of the plurality of associations, creating the IRMA; determining the IRM hash based on the IRM and the first IRMK; transmitting an association request frame to the AP using the IRMA as the TA; associating to the AP and exchanging a second IRMK with the AP; and including the IRM hash in the association.
In an embodiment, the method further includes, at each one of one or more associations subsequent to the first and second associations, creating another IRMA; determining another IRM hash using one IRMK the STA exchanged with the AP at the previous association; transmitting another association request frame to the AP using the other IRMA as the TA; associating to the AP and exchanging another IRMK with the AP; and including the IRM hash in the association.
In another embodiment, the one IRMK is transmitted by the STA to the AP in one or more of an IRMK response packet in response to an IRMK request packet transmitted by the AP; a second message of a four-way handshake; and a fourth message of the four-way handshake.
In some embodiments, the one IRMK is transmitted by the AP to the STA in a third message of a four-way handshake.
In some other embodiments, the method further includes including an IRM element in the association request.
In an embodiment, the IRM element one or more of indicates an IRM hash value; includes first information indicating whether the STA has previously associated with that AP; and includes second information associated with the IRMK usable by the AP in down selecting a list of stored IRMKs.
In another embodiment, the second information comprises an IRMK check field comprising an offset field and a check value field.
In some embodiments, the offset field has a value N, and the check field include eight bits where for n=0 to 7, bn=(bN, bN+7), where bN is Nth bit in IRMK.
In some other embodiments, the offset field has a value N, and the check field include eight bits representing an exclusive or (EX-OR) logical operation where for n=0 to 7, bn =EX-OR (bN+n, bN+n+8), where bN is Nth bit in the IRMK.
In some embodiments, at least a first association and a second association of the plurality of associations are performed by one or both of the STA and the AP. At a first association, the method includes either receiving and storing a first IRMK from the STA, or transmitting a first IRMK to the STA; and at a second association, receiving from or transmitting to and then storing a second IRMK from the STA; determining an IRM hash value for each stored IRMK, from the IRMA; finding the first IRMK, where the first IRMK produces the IRM hash value included by the STA in the association request; and identifying the STA based on the found first IRMK.
In some other embodiments, the one IRMK is transmitted using one of secure action frames and key data encapsulation (KDE) in a four way handshake.
Some embodiments are described herein with reference to flowchart illustrations and/or block diagrams of methods, systems and computer program products. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer (to thereby create a special purpose computer), special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
It is to be understood that the functions/acts noted in the blocks may occur out of the order noted in the operational illustrations. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality/acts involved. Although some of the diagrams include arrows on communication paths to show a primary direction of communication, it is to be understood that communication may occur in the opposite direction to the depicted arrows.
Computer program code for carrying out operations of the concepts described herein may be written in an object oriented programming language such as Java® or C++. However, the computer program code for carrying out operations of the disclosure may also be written in conventional procedural programming languages, such as the “C” programming language. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer. In the latter scenario, the remote computer may be connected to the user's computer through a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
While the above description contains many specifics, these should not be construed as limitations on the scope, but rather as an exemplification of several embodiments thereof. Many other variants are possible including, for examples: the details of the frame formats; the nomenclature used for fields in the frames; the order of the steps in the methods 1500, 1600 and 1700; the number of bits in the IRM Hash; the number of bits in the IRMK; the hash function used to determine the IRM Hash. Accordingly, the scope should be determined not by the embodiments illustrated, but by the claims and embodiments.
It will be appreciated by persons skilled in the art that the present invention is not limited to what has been particularly shown and described herein above. In addition, unless mention was made above to the contrary, it should be noted that all of the accompanying drawings are not to scale. A variety of modifications and variations are possible in light of the above teachings without departing from the scope.
This application is related to and claims priority to U.S. Provisional Patent Application No. 63/287137, filed Dec. 8, 2021, entitled IDENTIFIABLE RANDOM MAC ADDRESSING, the entirety of which is incorporated herein by reference, and U.S. Provisional Patent Application No. 63/359048, filed Jul. 7, 2022, entitled IDENTIFIABLE RANDOM MAC ADDRESSING, the entirety of which is incorporated herein by reference.
Number | Date | Country | |
---|---|---|---|
63287137 | Dec 2021 | US | |
63359048 | Jul 2022 | US |