Patent Application
20110029776
This application claims the benefit of Chinese patent application No. 200810017344.8 filed with the Chinese Patent Office on Jan. 18, 2008 and titled “Primitive-based Wireless Personal Area Network Access Method”, which is incorporated herein by reference in its entirety.
The present invention relates to a Wireless Personal Area Network access method and in particular to a primitive-based Wireless Personal Area Network access method.
In recent years, wireless communications advance rapidly, and all sorts of new technologies have been developed, from 3G in cellular communications, to Local Multipoint Distribution Services (LMDS) and Multichannel Microwave Distribution System (MMDS) in Broadband Wireless Access, further to WLAN Authentication and Privacy Infrastructure (WAPI), IEEE 802.11b, 802.11a and 802.11g in Wireless LAN. With wireless communication technologies, the world has become smaller than ever before. New concepts and new products, including ubiquitous network terminals, people-oriented customized and smart mobile computing, and convenient and rapid wireless access and wireless interconnection, are fitting into people's work and life. Various consumer electronics, such as mobile phones, Personal Digital Assistants (PDAs), laptops and digital cameras, have become a part of people's life. As the peripheral devices increase, it turns into an annoying problem to realize information sharing between these devices in a limited and changeful office or home environment with low cost and simple measures. Wireless Personal Area Network (WPAN) is a new wireless communication technology to solve this problem that requires limited operation area, supports a variety of service types and serves a particular group, and to realize seamless wireless connections.
As a wireless network with a smaller coverage than Wide Area Network and Local Area Network, WPAN has become an important component in communication networks. WPAN is also a prominent technology in 4G wireless communications and control, and supports seamless connections with various air interfaces in 2G and 3G mobile communications. If we say that the access network is the “last kilometer” to digitalization, then WPAN must be the “last 50 meters”. WPAN provides in the Personal Operating Space (POS) seamless wireless connections with a variety of service types and serving a particular group. The POS is a small region in proximity to an individual, typically having a radius of 10 meters, where communication is accomplished based on Ad hoc. The POS is tied to a person, particularly to a handheld operated by the person, and moves along with the person. WPAN provides for devices in the POS the ability to communicate, and allows them to communicate with other devices entering the POS. WPAN can form naturally when needed, without user intervention, and provides interoperability with established networks or independent networks. WPAN also supports authentication and secure operation modes, permitting rapid connections with authorized personal devices and preventing connections to other unauthorized devices. WPAN is intended for the personal use market, realizing convenient and rapid data transmission among consumer electronics, and thus having the advantages such as cheap, small in size, easy to use, and energy-efficient.
To access a WPAN, a device has to connect with a coordinator in the WPAN. The coordinator provides for the device access to the WPAN and routing functions. Normally, the coordinator itself may also function as a terminal. There are three access methods for WPAN:
Access method 1: the device accesses the WPAN in a non-secure mode and obtains a network address, then communicates with other devices in the WPAN; or, the device obtains a secure service key from the WPAN then performs secure communication with other devices in the WPAN.
Access method 2: the device performs a security operation on the association process using a pre-shared key, and if the coordinator can desecure the security operation, the coordinator allows the device to access the WPAN, and the device accesses the WPAN in a secure mode and obtains a network address.
Access method 3: the device accesses the WPAN in a non-secure mode and obtains a network address, then performs authentication with a WPAN administrator, and if the authentication succeeds, the device is allowed to access the WPAN; otherwise, the device is removed from the WPAN.
The access method 1, which is enough for WPANs requiring no security or WPANs where only secure communication is needed, is an optional access form in establishing a WPAN. The access method 2 requires pre-sharing of a session key, and due to its lack of randomness, the pre-shared session key is easy to be cracked, therefore the access method 2 is of poor safety. The access method 3 requires authentication between each device to access the WPAN and the WPAN administrator, resulting in high communication traffic and low efficiency; in addition, any device may launch a DoS attack, that is, to access the WPAN in a non-secure mode and obtain a network address then performs authentication with the WPAN administrator, which is ended with authentication failure.
In the layered model of network, the layers follow a strict one-way dependency, and division and cooperation of the layers reflect on the interfaces between neighboring layers.
“Service” is an abstract concept describing the relationship between neighboring layers, that is, a group of operations provided by a layer to the layer above it. The layer below is the service provider, and the layer above is the user requesting services. A representation of service is primitive, such as a system call or a library function. A system call is a service primitive provided by a system core to a network application or a high-layer protocol. An (N)-layer always provides to an (N+1) layer a service more complete than an (N−1) layer; otherwise the (N)-layer is needless.
An object of the present invention is to provide a primitive-based Wireless Personal Area Network access method, solving the technical problem that the existing Wireless Personal Area Network access method is of poor safety and low efficiency.
The technical solution provided by the invention includes:
A primitive-based Wireless Personal Area Network (WPAN) access method, includes:
step 11: broadcasting, by a coordinator, a beacon frame to a device requesting to access a WPAN, the beacon frame including authentication requirement information for the device and suites of authentication and key management supported by the coordinator;
step 12: verifying, by the device, the authentication requirement information, and if the coordinator requires authentication of the device, the coordinator performs primitive-based authentication with the device, obtains a session key and performs association according to the session key; if the coordinator does not require authentication of the device, the coordinator performs association with the device.
Preferably, the coordinator performing primitive-based authentication with the device includes:
step 21: obtaining, by the device, the suites of authentication and key management supported by the coordinator from the beacon frame sent by the coordinator;
step 22: sending, by the device, an access request to the coordinator, after selecting one of the suites of authentication and key management;
step 23: performing, by the coordinator, authentication process with the device based on an authentication primitive under the suite of authentication and key management selected by the device, on reception of the access request from the device, wherein authentication protocol data is encapsulated and transmitted in an authentication command frame of the MAC layer.
Preferably, the obtaining a session key includes: generating, in the authentication process, the session key between the coordinator and the device.
Preferably, the obtaining a session key includes: generating, in the authentication process, a master key between the coordinator and the device; and performing, by the coordinator and the device, a session key negotiation process by using the master key based on a session key negotiation primitive, wherein session key negotiation protocol data is encapsulated and transmitted in a session key negotiation command frame of the MAC layer.
Preferably, the performing association according to the session key includes:
step 51: sending, by the device, an association request to the coordinator; and performing, by the device, a security operation on the association request by using the session key;
step 52: performing, by the coordinator, desecuring on the association request, on reception of the association request sent by the device; and generating an association response after verifying association request information;
step 53: sending, by the coordinator, the association response to the device;
step 54: accessing, by the device, the WPAN via the coordinator.
Preferably, the coordinator performing association with the device if the coordinator does not require authentication of the device includes:
step 61: sending, by the device, an association request to the coordinator;
step 62: generating, by the coordinator, an association response after verifying association request information, on reception of the association request sent by the device;
step 63: sending, by the coordinator, the association response to the device;
step 64: accessing, by the device, the WPAN via the coordinator.
Preferably, the association response includes: a network address assigned by the coordinator to the device, or a reason for an association failure.
The invention has the following advantages:
1. The device may be connected to the WPAN without authentication, or may be connected to the WPAN with authentication. Moreover, the authentication is between the device and the coordinator, thereby avoiding DoS attacks and improving compatibility, security and performance for connecting the device to the WPAN.
2. The device and the coordinator both define an authentication primitive and a session key negotiation primitive in the MAC layer, and authentication protocol data and session key negotiation protocol data are encapsulated and transmitted in an authentication command frame and a session key negotiation command frame of the MAC layer, thereby improving integrability for connecting the device to the WPAN, so that the authentication and session key negotiation process can be integrated in hardware.
3. Compared with the existing WPAN access methods, the association process is not changed at all. Only access requesting, and authentication and session key negotiation processes are added before the association process, with their particular components replaceable; if the coordinator does not require authentication of the device, the whole access process is the same as the existing WPAN access methods, thereby achieving good compatibility and improving extensibility for connecting the device to the WPAN.
4. Under the scenario with authentication, the session key used by the device and the coordinator during the association process is generated by the device and the coordinator in the authentication process or negotiated by using the master key generated in the authentication process, thereby providing good relevance between the authentication process and the association process between the device and the coordinator, and providing randomness of the session key, which further increases the safety for connecting the device to the WPAN.
As shown in
An access method for a primitive-based WPAN access system may be implemented as below, with reference to
Step 1) The coordinator broadcasts a beacon frame. If the coordinator does not require authentication of the device, the coordinator indicates in the beacon frame that authentication of the device is not required; otherwise, the coordinator indicates in the beacon frame that authentication of the device is required, and indicates in the beacon frame that the suites of authentication and key management are supported by the coordinator.
Step 2) On reception of the beacon frame sent by the coordinator in step 1), the device first verifies the authentication requirement for the device, and if the coordinator does not require authentication of the device, then go to step 5); if the coordinator requires authentication of the device and the device supports authentication, then the device selects an authentication and key management suite that is supported by the coordinator, and sends an access request to the coordinator. The access request includes the authentication and key management suite selected by the device.
Step 3) On reception of the access request sent by the device in step 2), the coordinator first identifies the authentication and key management suite selected by the device, and initiates an authentication process with the device. If the authentication fails, the access process is terminated; otherwise, if the coordinator and the device generate a session key between the coordinator and the device during the authentication process, then go to step 5); if the coordinator and the device generate a master key between the coordinator and the device during the authentication process, then go to step 4). Both the device and the coordinator define an authentication primitive in the MAC layer, the authentication between the device and the coordinator is performed based on the authentication primitive, and authentication protocol data is encapsulated and transmitted in an authentication command frame and a session key negotiation command frame of the MAC layer.
Step 4) If the coordinator and the device generate a master key between the coordinator and the device in step 3), the coordinator and the device perform a session key negotiation process using the master key between the coordinator and the device. If the session key negotiation fails, the access process is terminated; otherwise, go to step 5). Similarly to step 3), both the device and the coordinator define a session key negotiation primitive in the MAC layer, the session key negotiation between the device and the coordinator is performed based on the session key negotiation primitive, and session key negotiation protocol data is encapsulated and transmitted in a session key negotiation command frame of the MAC layer.
Step 5) If the device learns in step 2) that the coordinator does not require authentication of the device, or, if the device and the coordinator obtains a session key between the device and the coordinator through the authentication and session key negotiation process, the device sends an association request to the coordinator. If the device and the coordinator have a session key, the device performs a security operation on the association request using the session key.
Step 6): On reception of the association request sent by the device in step 5), the coordinator verifies whether the association request is with the security operation. If the association request sent by the device in step 5) is with the security operation, then the coordinator performs desecuring on the association request, and sends an association response to the device after verifying the association request information, the association response being an association response with a security operation performed using the session key between the device and the coordinator. Otherwise, the coordinator generates an association response and sends it to the device after verifying the association request information, the association response being an association response without a security operation. If the coordinator allows the device to access the WPAN, then the association response includes a network address assigned by the coordinator to the device, the device accesses the WPAN via the coordinator, and thereby achieving normal communication between the device and the coordinator; otherwise, the association response includes a reason for the failure of the association between the device and the coordinator.
| Number | Date | Country | Kind |
|---|---|---|---|
| 200810017344.8 | Jan 2008 | CN | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/CN09/70137 | 1/14/2009 | WO | 00 | 7/16/2010 |
