WO2010096996A1 - Method for realizing integration of wapi and capwap in local mac mode - Google Patents

Abstract

A method for realizing integration of Wireless Local Area Network Authentication and Privacy Infrastructure (WAPI) and Control and Provisioning of Wireless Access Point (CAPWAP) in local Media Access Control (MAC) mode. The method includes two steps: 1) a local MAC mode is constructed through separating MAC function and WAPI function of a wireless access point apart to a Wireless Terminal Point (WTP) and an Access Controller (AC); 2) CAPWAP specification binds with WAPI in the local MAC mode. Step 2) includes that: an association connection is performed among a station (STA), the WTP and the AC; the start of performing a WLAN Authentication Infrastructure (WAI) protocol is announced between the AC and the WTP; the WAI protocol is performed between the STA and the AC; the end of performing the WAI protocol is announced between the AC and the WTP; secret communication is performed between WTP and STA using WLAN Privacy Infrastructure (WPI). The present invention not only satisfies large-scale arrangement of WLAN, but also ensures the safety of the WLAN under convergent system architecture.

Description

 Implementing WAPI and CAPWAP fusion method in local MAC mode

 This application claims priority to Chinese Patent Application No. 200910021417.5, entitled "A Method for Implementing WAPI and CAPWAP Fusion in Local MAC Mode", submitted to the Chinese Patent Office on February 27, 2009. The citations are incorporated herein by reference. Technical field

 The present invention relates to the field of network applications, and in particular, to a method for implementing WAPI and CAPWAP fusion in a local MAC mode.

Background technique

 In the wireless local area network (WLAN) of the autonomous architecture, the access point AP (Access Point) acts as a separate entity on the network and fully deploys and terminates the GB15629.il function, which needs to be managed independently. At present, the autonomous system architecture is adopted based on the WLAN authentication and confidentiality base. However, with the expansion of the WLAN deployment scale, the network working mode of the autonomous architecture has gradually become an obstacle to the development of wireless technology due to its inherent defects.

 First, in an autonomous architecture WLAN, the AP acts as an Internet Protocol (IP) addressable device and needs to be managed independently, including monitoring, configuration, and control. When a large-scale network is deployed, a large number of APs will incur huge management overhead and impose a heavy burden on the network. Especially when the configuration and management methods of APs in the network are different from each other, this phenomenon is more obvious and will hinder the development of wireless technologies.

 Second, in an autonomous architecture WLAN, it is difficult to ensure the consistency of all AP configuration parameters. Because AP configuration is more than static parameters, more parameters are dynamically configured. In a large-scale WLAN, the workload of dynamically updating the dynamic configuration of the AP over the entire network is very heavy or even impossible.

 Third, in the WLAN, the wireless transmission medium is used as a shared resource. In order to improve the performance of the network, each AP must be monitored in real time and dynamically updated according to the current usage of the shared medium, and manually configured and wirelessly transmitted. Media-related AP parameters will consume a lot of manpower and material resources.

Fourth, in an autonomous architecture WLAN, it is more difficult to securely access the network and prevent the joining of illegal APs. Under normal circumstances, the AP's deployment location makes it difficult to protect it once AP Theft will cause leakage of the loaded security information, posing a threat to network security.

 In summary, in the WLAN of the autonomous architecture, especially in the case of large-scale deployment, monitoring, configuring, and controlling the AP will impose a heavy management burden on the network. Moreover, maintaining the consistency of the AP configuration is also very difficult. In addition, the sharing and dynamic characteristics of the wireless transmission medium require the AP collaboration in the network to achieve maximum network performance and minimum wireless interference, which puts higher requirements on the AP configuration management. Security is one of the important factors to consider when designing a wireless network. Large-scale deployment will also pose a huge challenge to the security of WLAN. It can be seen that the autonomous architecture WLAN working mode cannot be applied to the deployment requirements of large-scale networks. It is urgent to design a WAPI-based converged WLAN network architecture, namely the WAPI thin AP architecture. Currently, WLANs based on wireless access point control and configuration CAPWAP (Control And Provisioning of Wireless Access Points) protocol IEEE 802.11 binding specification inevitably inherit the security flaws of IEEE 802.11i, so a more secure alternative solution is needed.

Summary of the invention

 The purpose of the present invention is to overcome the shortcomings of the above-mentioned autonomous WLAN network architecture, and to provide a CAPWAP (Control And Provisioning of Wireless Access Points) specification in a Medium Access Control MAC (Medium Access Control) mode. A method of binding a WLAN Authentication and Privacy Infrastructure (WAPI) to propose a workflow for a more secure WAPI-based converged WLAN architecture.

 The technical solution of the present invention is:

 The present invention provides a method for implementing WAPI and CAPWAP fusion in a local MAC mode, which is special in that the method includes the following steps:

 1) Steps of constructing a local MAC mode: Separating the MAC function and the WAPI function of the wireless access point from the wireless terminal point and the access controller;

 2) In the local MAC mode, perform the steps of binding the WAPI local MAC mode to the CAPWAP specification:

2.1) the process of associating the site with the wireless terminal point and the access controller; 2.2) the process of informing the wireless local area network authentication infrastructure WAI (WLAN Authentication Infrastructure) between the access controller and the wireless terminal point; 2.3) The process of executing the WAI protocol between the site and the access controller;

 2.4) Between the access controller and the wireless terminal point to announce the end of the WAI protocol execution;

2.5) The process of secure communication between the wireless terminal point and the site using the WLAN Privacy Infrastructure (WPI).

 The specific steps of step 2.1 above are as follows:

 2.1.1) The station passively listens to the beacon frame of the wireless terminal point to obtain parameters of the wireless terminal point including the WAPI information element;

 Alternatively, the station actively sends a query request frame to the wireless terminal point, and after receiving the probe request frame of the station, the wireless terminal point sends a probe response frame to the station, and the station obtains the WAPI information element from the query response frame of the received wireless terminal point. a parameter of the wireless terminal point; the WAPI information element includes an authentication and key management suite and a cipher suite supported by the wireless terminal point;

 2.1.2) The station sends a link verification request frame to the wireless terminal point, requesting link verification with the wireless terminal point;

 2.1.3) The wireless terminal point sends a link verification response frame to the station according to the link verification request frame of the station;

 2.1.4) After successful link verification, the wireless terminal sends an association request frame to the access controller, requesting association with the access controller, and the association request frame includes a WAPI information element to determine the authentication and key management suite for the site selection. And cipher suites;

 2.1.5) The access controller resolves the association request frame of the site and sends an association response frame to the site.

 The specific steps of step 2.2) above are as follows:

 2.2.1) The access controller sends a CAPWAP Site Configuration Request message to the wireless terminal. The message includes Add Station, GB15629.il Join Station and GB15629.il Site Session Key. (Station Session Key) message element, where A in the site session key message element is set to 1 to inform the wireless terminal to close the controlled port, and only forward WAI protocol data from the corresponding site; where A is GB15629.il One of the identifiers in the site session key message element, A is used as the flag bit. If the flag is set to 1, it is used to inform the wireless terminal to open the controlled port and forward only the WAI protocol data.

2.2.2) The wireless terminal sends a CAPWAP Site Configuration Response (Station Configuration Response) message to the access controller, including the Result Code message element, The result of processing the request message to the CAPWAP site configuration request.

 The specific steps of step 2.3) above are as follows:

 2.3.1) accessing the WAI authentication process between the controller and the site; comprising: the wireless terminal point unpacking the WAI authentication data encapsulated according to the CAPWAP data encapsulation format from the access controller and forwarding the data to the site; The authentication data is encapsulated according to the CAPWAP data encapsulation format and sent to the access controller;

 2.3.2) accessing the WAI unicast key negotiation process between the controller and the site; comprising: the wireless terminal point unpacking and forwarding the WAI unicast key negotiation data encapsulated according to the CAPWAP data encapsulation format from the access controller To the site; the WAI unicast key negotiation data from the site is encapsulated according to the CAPWAP data encapsulation format and sent to the access controller;

 2.3.3) accessing the WAI multicast key advertisement process between the controller and the site; comprising: the wireless terminal point unpacking and forwarding the WAI multicast key advertisement data encapsulated according to the CAPWAP data encapsulation format from the access controller To the site; WAI multicast key advertisement data from the site is encapsulated according to the CAPWAP data encapsulation format and sent to the access controller.

 The specific steps of step 2.4) above are as follows:

 2.4.1) The access controller sends a CAPWAP Site Configuration Request message to the wireless terminal, the message including the joining site, the GB15629.il joining site and the GB15629.il site session key message element; a MAC address, the wireless terminal opens a controlled port corresponding to the MAC address, and forwards all data from the site, including WAI protocol data and non-WAI protocol data;

 2.4.2) The wireless terminal point sends a CAPWAP Site Configuration Response message to the access controller, including a result code message element, for identifying the processing result of the CAPWAP Site Configuration Request message.

 The specific steps of step 2.5) above are as follows:

 2.5.1) The wireless terminal encrypts the data from the access controller and sends it to the site;

 2.5.2) The wireless terminal locates and forwards the data from the site.

 Step 2.5) above also includes step 2.6) accessing the unicast key update process between the controller and the site.

 The specific steps of step 2.6) above are as follows:

2.6.1) When a unicast key update is required, the WAI is executed between the access controller and the site. Broadcast key negotiation process;

 2.6.2) After the WAI unicast key negotiation process is completed, the access controller sends a CAPWAP Site Configuration Request message to the wireless terminal, including the joining site, GB 15629.11 joining site, GB15629.il site session key and GB15629. Il information element message element;

 2.6.3) The wireless terminal point sends a CAPWAP Site Configuration Response message to the access controller, which includes a result code message element for identifying the processing result of the CAPWAP Site Configuration Request message.

 The above steps 2.5) or 2.6) also include step 2.7) accessing the multicast key update process between the controller and the site.

 The specific steps of step 2.7 above are as follows:

 2.7.1) When the access controller needs to perform multicast key update, first send to the wireless terminal

GB15629.11 WLAN configuration request (GB 15629.11 WLAN Configuration Request) message, which contains GB15629.il update WLAN (GB 15629.11 Update WLAN) message element, the GB15629.il update WLAN message element includes multicast session key MSK (Multicast Session Key) Key data, MSK index, MSK update start identifier, and data packet sequence number PN (Packet Number);

 2.7.2) The wireless terminal sends a GB 15629.11 WLAN Configuration Response (GB15629.il WLAN Configuration Response) message to the access controller, which contains the result code message element, which is used to identify the processing result of the GB15629.il WLAN configuration request message;

 2.7.3) Performing a WAI multicast key notification process between the access controller and the site;

 2.7.4) When the WAI multicast key advertisement process is completed, the access controller sends a point to the wireless terminal.

GB15629.11 WLAN configuration request message, which includes GB15629.il update WLAN message element, the GB15629.il update WLAN message element includes MSK index and MSK update end identifier;

2.7.5) The wireless terminal sends a GB15629.il WLAN configuration response message to the access controller, which contains a result code message element for identifying the processing result of the GB15629.11 WLAN configuration request message. The communication interaction process separates the MAC function and the WAPI function of the AP from the wireless terminal point WTP (Wireless Terminal Point) and the access controller AC (Access Controller). WTP implements the interaction of the real-time information required by the GB15629.il standard with the STA (Station), including the beacon frame, the response to the interrogation request frame, etc., and implements the WPI protocol, which is implemented by the AC and the STA. Real-time interaction, including associations, WAI protocols, and more. The communication between AC and WTP is implemented based on the CAPWAP GB15629.il binding specification. The division mode of this AP function is referred to as a local MAC mode. Compared with the prior art, the present invention has the following advantages: The present invention provides a method for implementing WAPI and CAPWAP fusion in a local MAC mode, and realizing centralized control of the entire network AP by dividing the MAC function and the WAPI function of the AP. And management, able to meet the deployment needs of large-scale WLAN. Overcoming the limitations of the current autonomous network architecture based on the WAPI protocol cannot be applied to large-scale WLAN deployment requirements. It adopts the mode of separating the MAC function, realizes the unified monitoring, configuration and control of the AC to the WTP, so as to achieve the purpose of centralized management of the WTP in the WLAN. The WAI protocol is implemented by the AC, the WPI protocol is implemented by the WTP, and the WAPI protocol is implemented. The converged WLAN architecture seamlessly integrates to ensure WLAN security. The invention can not only meet the large-scale deployment requirements of the WLAN, but also ensure the security of the WLAN under the convergence architecture. DRAWINGS

 FIG. 1 is a message flow diagram of implementing WAPI and CAPWAP fusion in a local MAC mode; FIG. 2 is a flowchart of unicast key update between an AC and a STA;

 Figure 3 is a flow chart of multicast key update between the AC and the STA. detailed description

 Referring to Figure 1, in accordance with a preferred embodiment of the present invention, the specific method is as follows:

 1) Build a local MAC mode: Separate the MAC function and WAPI function of the AP to WTP and AC;

 2) In the local MAC mode, implement the local binding of the CAPWAP specification to WAPI.

MAC mode;

 2.1) the process of association between STA and WTP and AC;

2.1.1) STA passively listens to WTP beacon frames to obtain WTP related parameters, including WAPI information elements (WTP-supported authentication and key management suite, cipher suite, etc.); Or, the STA sends an inquiry request frame to the WTP, and after receiving the inquiry request frame of the STA, the WTP sends a query response frame to the STA, and the STA obtains the WTP related parameter from the WTP inquiry response frame, including the WAPI information element.

 The WAPI information element includes an authentication and key management suite supported by WTP, a cipher suite, and the like;

 2.1.2) The STA sends a link verification request to the WTP to request a link verification with the WTP;

 2.1.3) WTP sends a link verification response frame to the STA according to the link verification request frame of the STA;

 2.1.4) After the link verification succeeds, the STA sends an association request frame to the AC, and the request is associated with the AC. The association request frame includes a WAPI information element to determine the authentication and key management suite, the cipher suite, and the like selected by the STA;

 2.1.5) The AC resolves the association request frame of the STA, and sends an association response frame to the STA;

2.2) The notification process between the AC and WTP where the WAI protocol begins to be executed;

 2.2.1) The AC sends a CAPWAP Site Configuration Request message to the WTP, including the joining site (the MAC address of the STA), the GB15629. il joining the site (WLAN ID), and the GB15629. il site session key (A is set to 1) Wait for message elements. The A in the site session key message element is set to 1 to inform the WTP to close the controlled port, and only forward the WAI protocol data from the corresponding STA; where A is GB15629. il one of the site session key message elements Bit, A as the flag bit, if the flag is set to 1, it is used to inform the wireless terminal to open the controlled port, and only forward the WAI protocol data;

 2.2.2) The WTP sends a CAPWAP Site Configuration Response message to the AC, which contains a Result Code message element, which is used to identify the processing result of the CAPWAP Site Configuration Request message.

 2.3) The execution process of the WAI protocol between the STA and the AC;

 2.3.1) The WAI authentication process between the AC and the STA; the method includes: WTP decapsulates the WAI authentication data encapsulated according to the CAPWAP data encapsulation format from the AC, and then forwards the WAI authentication data to the STA; and wraps the WAI authentication data from the STA according to the CAPWAP data. The format is encapsulated and sent to the AC;

2.3.2) WAI unicast key negotiation process between the AC and the STA; includes: WTP pair The WAI unicast key negotiation data encapsulated by the AC according to the CAPWAP data encapsulation format is decapsulated and then forwarded to the STA; the WAI unicast key negotiation data from the STA is encapsulated according to the CAPWAP data encapsulation format and then sent to the AC;

 2.3.3) The WAI multicast key advertisement process between the AC and the STA; the method includes: WTP decapsulating the WAI multicast key advertisement data encapsulated according to the CAPWAP data encapsulation format from the AC, and then forwarding the data to the STA; The WAI multicast key advertisement data is encapsulated according to the CAPWAP data encapsulation format and sent to the AC.

 2.4) The notification process for the end of the WAI protocol between AC and WTP;

 2.4.1) The AC sends a CAPWAP Site Configuration Request message to the WTP, including the joining site (the MAC address of the STA), GB15629. il joining the site (WLAN ID), GB15629. il site session key (key data), GB15629 . il information element (WAPIIE (password algorithm is WPI-SMS4)) and other message elements. According to the MAC address of the STA in the joining site message element, the WTP opens the controlled port of the site corresponding to the MAC address, and forwards all data from the STA, including WAI protocol data and non-WAI protocol data;

 2.4.2) The WTP sends a CAPWAP Site Configuration Response message to the AC, which contains a Result Code message element, which is used to identify the processing result of the CAPWAP Site Configuration Request message.

 2.5) The process of using WPI for secure communication between WTP and STA;

 2.5.1) WTP encrypts data from the AC and sends it to the STA;

 2.5.2) WTP decrypts and forwards data from the STA.

 Referring to FIG. 2, in addition, the process of the present invention further includes the step 2.6) a unicast key update process between the AC and the STA:

 2.6.1) When a unicast key update is required, the WAI unicast key negotiation process is performed between the AC and the STA.

 2.6.2) After the WAI unicast key negotiation process is completed, the AC sends a CAPWAP Site Configuration Request message to the WTP, where the message includes the joining site (the MAC address of the STA),

GB15629. il join site (WLAN ID), GB15629. il site session key (unicast session key USK (Unicast Session Key) key data), GB15629. il information element ( WAPIIE (password algorithm is WPI-SMS4)) And other message elements;

2.6.3) WTP sends a CAPWAP site configuration response message to the AC, which contains the result. The code message element is used to identify the processing result of the C APWAP site configuration request message.

 Referring to FIG. 3, in addition, the process of the present invention further includes the step 2.7) a multicast key update process between the AC and the STA:

 2.7.1) When the AC needs to perform multicast key update, it first sends an IEEE 802.11 WLAN configuration request message to the WTP, which includes GB15629. il updates the WLAN message element, which contains MSK key data, MSK index, MSK. Update start identifier, data packet number PN, etc.;

 2.7.2) The WTP sends a GB15629.11 WLAN configuration response message to the AC, which contains a result code message element for identifying the processing result of the GB15629.il WLAN configuration request message;

 2.7.3) Performing the WAI multicast key notification process between the AC and the STA;

 2.7.4) After the WAI multicast key advertisement process is completed, the AC sends an IEEE 802.11 WLAN configuration request message to the WTP, which includes GB15629. il updates the WLAN (MSK index, MSK update end identifier) and other message elements;

 2.7.5) WTP sends a GB15629.il WLAN configuration response message to the AC, which contains the result code message element, which is used to identify the processing result of the GB15629.il WLAN configuration request message.

 The method for implementing WAPI and CAPWAP fusion in the local MAC mode is introduced in detail. The principles and implementation manners of the present invention are described in the following examples. The description of the above embodiments is only used. In order to facilitate the understanding of the method of the present invention and its core idea, at the same time, there will be changes in the specific embodiments and application scopes according to the idea of the present invention. In conclusion, the contents of this specification are not to be construed as limiting the invention.

Claims

Rights request  1. A local media access control MAC mode for wireless local area network authentication and privacy infrastructure WAPI and wireless access point control and configuration CAPWAP fusion method, characterized in that: the method comprises the following steps:  1) Steps of constructing a local MAC mode: Separating the MAC function and the WAPI function of the wireless access point from the wireless terminal point and the access controller, respectively;  2) In the local MAC mode, the steps to bind the CAPWAP specification to the local MAC mode of the WAPI:  2.1) The process of associating the site with the wireless terminal point and the access controller; 2.2) advertised the wireless local area network authentication infrastructure between the access controller and the wireless terminal point The process in which the WAI protocol begins to be implemented;  2.3) The process of executing the WAI protocol between the site and the access controller;  2.4) The process of notifying the end of the WAI protocol between the access controller and the wireless terminal; 2.5) The process of using WPI for secure communication between the wireless terminal and the station.  2. A method for implementing WAPI in a local MAC mode according to claim 1 The CAPWAP fusion method is characterized in that: the specific steps of the step 2.1) are as follows: 2.1.1) The station passively listens to the beacon frame of the wireless terminal point to obtain the parameters of the wireless terminal point including the WAPI information element; or  The station actively sends a query request frame to the wireless terminal point, and after receiving the inquiry request frame of the station, the wireless terminal point sends a query response frame to the station, and the station obtains the wireless terminal including the WAPI information element from the query response frame of the received wireless terminal point. Point parameters; the WAPI information element includes an authentication and key management suite and cipher suite supported by the wireless terminal point;  2.1.2) The station sends a link verification request frame to the wireless terminal point, requesting link verification with the wireless terminal point;  2.1.3) The wireless terminal point sends a link verification response frame to the station according to the link verification request frame of the station; 2.1.4) After successful link verification, the wireless terminal sends an association request frame to the access controller, requesting association with the access controller, and the association request frame contains WAPI information elements to determine the authentication and key management suite for site selection. And cipher suites; 2.1.5) The access controller resolves the association request frame of the site and sends an association response frame to the site. The method for implementing WAPI and CAPWAP fusion in a local MAC mode according to claim 1 or 2, wherein: the specific steps of the step 2.2) are as follows: 2.2.1) The access controller sends a CAPWAP Site Configuration Request message to the wireless endpoint, the message containing the joining site, the GB15629.il joining site and the GB 15629.il site session key message element, wherein the site session key message element is The identifier A is set to 1 to inform the wireless terminal to close the controlled port, and only forward the WAI protocol data from the corresponding site; 2.2.2) The wireless terminal sends a CAPWAP Site Configuration Response message to the access controller, which contains a result code message element for identifying the processing result of the CAPWAP Site Configuration Request message.  The method for implementing WAPI and CAPWAP fusion in a local MAC mode according to any one of claims 1-3, wherein: the specific steps of the step 2.3) are as follows: 2.3.1) accessing the WAI authentication process between the controller and the site; comprising: the wireless terminal point unpacking the WAI authentication data encapsulated according to the CAPWAP data encapsulation format from the access controller, and forwarding the data to the site, the CAPWAP data encapsulation The format is defined by the CAPWAP GB15629. il binding specification; the WAI authentication data from the site is encapsulated according to the CAPWAP data encapsulation format and sent to the access controller;  2.3.2) Accessing the WAI unicast key negotiation process between the controller and the site; comprising: the wireless terminal point unpacking and forwarding the WAI unicast key negotiation data encapsulated according to the CAPWAP data encapsulation format from the access controller For the site, the CAPWAP data encapsulation format is defined by the CAPWAP GB 15629.11 binding specification; the WAI unicast key negotiation data from the site is encapsulated according to the CAPWAP data encapsulation format and sent to the access controller;  2.3.3) accessing the WAI multicast key advertisement process between the controller and the site; comprising: the wireless terminal point unpacking and forwarding the WAI multicast key advertisement data encapsulated according to the CAPWAP data encapsulation format from the access controller To the site, the CAPWAP data encapsulation format is defined by the CAPWAP GB 15629.11 binding specification; the WAI multicast key advertisement data from the site is encapsulated according to the CAPWAP data encapsulation format and sent to the access controller. The method for implementing WAPI and CAPWAP fusion in a local MAC mode according to any one of claims 1-4, wherein: the specific steps of the step 2.4) are as follows: 2.4.1) The access controller sends a CAPWAP Site Configuration Request message to the wireless endpoint, the message including the joining site, GB15629.il joining site, GB15629.il site session key and GB 15629.11 information element message element. According to the MAC address of the site in the joining site message element, the wireless terminal opens a controlled port corresponding to the MAC address, and forwards all data from the site, including WAI protocol data and non-WAI protocol data;  2.4.2) The wireless terminal sends a CAPWAP Site Configuration Response message to the access controller, which contains a result code message element for identifying the processing result of the CAPWAP Site Configuration Request message.  The method for implementing WAPI and CAPWAP fusion in a local MAC mode according to any one of claims 1-5, wherein: the specific steps of the step 2.5) are as follows: 2.5.1) The wireless terminal encrypts the data from the access controller and sends it to the site;  2.5.2) The wireless terminal locates and forwards the data from the site.  The method for implementing WAPI and CAPWAP fusion in a local MAC mode according to any one of claims 1-6, wherein: after the step 2.5), the method further comprises: step 2.6) accessing between the controller and the station Unicast key update process.  8. A method for implementing WAPI and CAPWAP fusion in a local MAC mode according to claim 7, wherein: the specific steps of the step 2.6) are as follows: 2.6.1) When a unicast key update is required, the WAI unicast key negotiation process is performed between the access controller and the site;  2.6.2) After the WAI unicast key negotiation process is completed, the access controller sends a CAPWAP Site Configuration Request message to the wireless terminal, including the joining site, GB 15629.11 joining the site, GB15629. il site session key and GB15629. Il information element message element; 2.6.3) The wireless terminal point sends a CAPWAP Site Configuration Response message to the access controller, including a result code message element, for identifying the processing result of the CAPWAP Site Configuration Request message.  The method for implementing WAPI and CAPWAP fusion in a local MAC mode according to any one of claims 1-8, wherein: after the step 2.5), the method further comprises: step 2.7) accessing between the controller and the station. The multicast key update process. 10. A method for implementing WAPI in a local MAC mode according to claim 9. The CAPWAP fusion method is characterized in that: the specific steps of the step 2.7) are as follows: 2.7.1) When the access controller needs to perform multicast key update, first send a GB15629.il WLAN configuration request message to the wireless terminal, which includes GB15629.il to update the WLAN message element, and the GB15629.il updates the WLAN message element. Include MSK key data, MSK index, MSK update start identifier, and data packet sequence number PN;  2.7.2) The wireless terminal point sends a GB15629.il WLAN configuration response message to the access controller, including a result code message element, for identifying the processing result of the GB15629.il WLAN configuration request message;  2.7.3) Performing a WAI multicast key notification process between the access controller and the site;  2.7.4) After the WAI multicast key advertisement process is completed, the access controller sends a GB15629.il WLAN configuration request message to the wireless terminal, including GB15629.il to update the WLAN message element, and the GB15629.il update WLAN message element includes MSK index and MSK update end identifier;  2.7.5) The wireless terminal point sends a GB15629.il WLAN configuration response message to the access controller, including a result code message element, which is used to identify the processing result of the GB15629.il WLAN configuration request message.