[go: up one dir, main page]

WO2015144050A1 - 分配寻址标识的方法及接入点、站点和通信系统 - Google Patents

分配寻址标识的方法及接入点、站点和通信系统 Download PDF

Info

Publication number
WO2015144050A1
WO2015144050A1 PCT/CN2015/075002 CN2015075002W WO2015144050A1 WO 2015144050 A1 WO2015144050 A1 WO 2015144050A1 CN 2015075002 W CN2015075002 W CN 2015075002W WO 2015144050 A1 WO2015144050 A1 WO 2015144050A1
Authority
WO
WIPO (PCT)
Prior art keywords
mac address
site
new
access point
sites
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2015/075002
Other languages
English (en)
French (fr)
Inventor
李小仙
方平
丁志明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Device Co Ltd
Original Assignee
Huawei Device Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Device Co Ltd filed Critical Huawei Device Co Ltd
Priority to EP15768040.6A priority Critical patent/EP3116252B1/en
Priority to KR1020167029538A priority patent/KR101826936B1/ko
Priority to JP2016559311A priority patent/JP2017515353A/ja
Publication of WO2015144050A1 publication Critical patent/WO2015144050A1/zh
Priority to US15/274,751 priority patent/US10382435B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0414—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/30—Managing network names, e.g. use of aliases or nicknames
    • H04L61/3015—Name registration, generation or assignment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5038—Address allocation for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/08—Reselecting an access point
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/26—Network addressing or numbering for mobility support
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present invention relates to the field of communications, and in particular, to a method for allocating addressing identifiers, and an access point, a station, and a communication system.
  • a wireless local area network can provide wireless data transmission services for terminals therein within a limited range.
  • IEEE 802.11-based WLAN also known as Wi-Fi, Wireless Fidelity, Wireless Fidelity
  • devices such as gateways can also be used to connect terminal devices to the Internet.
  • Wi-Fi has been widely used in various industries due to its rapid deployment, ease of use, and high transmission rate.
  • the IEEE 802.11 specification specifies addressing in a WLAN based on a Media Access Control (MAC) address.
  • MAC Media Access Control
  • the eavesdropper can obtain the MAC address of the wireless message sender by receiving and analyzing the message message on the air interface.
  • the privacy information of the terminal user can be obtained, such as the location and time that often occurs, and the privacy information of the end user's living habits, interests, and social relationships can be obtained through a large amount of data analysis.
  • an access point allocates a temporary MAC address to a terminal in the basic service set it serves, and the eavesdropper obtains the MAC of all terminals under the basic service set.
  • the address when it is found that one MAC address no longer appears, and another new MAC address appears, the new MAC address can be determined to be the changed MAC address of the original terminal, thereby continuing to track the terminal.
  • the embodiment of the invention provides a method for assigning an address identifier, an access point and a site, so as to prevent the eavesdropper from tracking the terminal to obtain user privacy through the MAC address, thereby ensuring the privacy of the user.
  • the present invention provides a method for allocating an addressing identifier, the addressing identifier comprising a medium access control MAC address, the addressing identification method comprising: at least two within a basic service set BSS to which an access point serves Sites notify each site of the corresponding encrypted new MAC address and indicate a predetermined change condition such that the at least two sites change the respective MAC address to the respective new MAC when the predetermined change condition is reached Addressing, when the predetermined change condition is reached, the access point updates the MAC address of the at least two sites to the new MAC address corresponding to the site, so that the subsequent receiving and forwarding from the site When the station sends a message, the new MAC address is used as the MAC address of the station.
  • the addressing identifier further includes an association identifier AID; the access point notifies each of the at least two sites in the basic service set BSS When the site corresponds to the encrypted new MAC address, the site also notifies the encrypted new AID corresponding to the site; when the predetermined change condition is reached, the access point updates the MAC address of the at least two sites to correspond to the site The new MAC address updates the AID of the at least two sites to the new AID corresponding to the site.
  • the access point notifies the at least two sites in the basic service set BSS served by the access point to the encryption corresponding to each site
  • the method further includes: the access point confirming a new MAC address and a new AID corresponding to each of at least two sites in the basic service set BSS of the service, each of the sites Corresponding to different new MAC addresses and new AIDs.
  • the access point confirms that each of the at least two sites in the basic service set BSS of the service corresponds to the new one
  • the step of the MAC address and the new AID includes: the access point receiving a change request of the at least two sites within the BSS of the service, and the change request of each of the sites includes a new MAC requested by each of the sites An address; the access point uniquely verifies a new MAC address requested by each of the sites, and when the uniqueness verification passes, assigns a new AID to each of the sites, and each of the sites requests Said new MAC address and the assigned AID are the confirmed new MAC address and new AID of the site; the notifying the at least two sites of the encrypted new MAC address corresponding to each of the sites and
  • the steps of the new AID include: the connection The ingress unicasts an acknowledgment message to each of the sites, the acknowledgment message indicating that the site is authorized to use the requested new MAC address
  • the access point confirms that each of the at least two sites in the basic service set BSS of the service corresponds to the new one
  • the step of the MAC address and the new AID includes: the access point assigns a new MAC address and a new AID to at least two sites in the BSS to which it serves, and the new MAC address and the new AID assigned to each of the sites are acknowledgements
  • the step of notifying the at least two sites of the encrypted new MAC address and the new AID corresponding to each of the sites includes: separately performing the unicast mode
  • the at least two stations send the encrypted new MAC address and new AID corresponding to the site.
  • the indicating the predetermined change condition includes: the access point to When at least two sites in the basic service set BSS of the service notify the encrypted new MAC address corresponding to each site, carrying a predetermined time or a predetermined time point indicating the change; or the basic service to which the access point serves After the at least two sites in the set BSS notify the encrypted new MAC address corresponding to each site, respectively send a change indication message to the at least two sites in a unicast manner; or the access point serves the same After the at least two sites in the basic service set BSS notify the encrypted new MAC address corresponding to each site, the change indication message is sent to the at least two sites by broadcast.
  • the step of sending an update indication message to the at least two site groups by means of a broadcast includes: broadcasting The beacon frame to which the indication bit is added sends an update indication message to the at least two sites, the indication bit including change indication information for indicating that the at least two sites perform the addressing identification change.
  • the step that the access point notifies each site of the encrypted new MAC address to at least two sites in the basic service set BSS served by the access point The method further includes: performing encryption key negotiation between the access point and the at least two sites, where the access point acquires an encryption key used to encrypt a new MAC address of each of the sites,
  • the encryption key is a symmetric encryption key or an asymmetric encryption key.
  • an embodiment of the present invention provides a method for allocating an address identifier, where the address identifier includes a medium access control MAC address, and the method for assigning an address identifier includes: the website learns a basic service set BSS from which the station is located The encrypted new MAC address corresponding to the site notified by the access point, decrypting to obtain a new MAC address, and acquiring a predetermined change condition, the site changing the currently used MAC address to The new MAC address is such that when the message is received from the access point and sent to the access point, the new MAC address is used as the MAC address of the station.
  • the addressing address further includes an association identifier AID
  • the website acquires the encrypted new MAC address corresponding to the site, The encrypted new AID corresponding to the site; when the site satisfies the predetermined change condition, the site changes the currently used MAC address to the new MAC address, and changes the currently used AID to the new AID.
  • the step of the site learning the encrypted new MAC address and the new AID corresponding to the site includes: receiving the site The access point is an encrypted new MAC address and a new AID assigned to the site.
  • the step that the site learns the encrypted new MAC address and the new AID corresponding to the site includes: The access point sends a change request, the change request of the site includes a new MAC address requested by the site, and the site learns the encryption corresponding to the site from the confirmation message that the access point responds to the change request New MAC address, and further learn the encrypted new AID from the acknowledgment message that the access point responds to the change request or another message sent from the access point.
  • the method before the step of the site obtaining the encrypted new MAC address corresponding to the site, the method further includes: performing, by the site, an encryption key negotiation with the access point. So that the station decrypts the new MAC address according to the negotiated encryption key type using a corresponding decryption method, and the encryption key is a symmetric encryption key or an asymmetric encryption key.
  • an embodiment of the present invention provides an access point, where the access point includes a notification module and an update module, where: the notification module is used to provide a basic service set to the access point. At least two stations in the BSS notify each site of the encrypted new medium access control MAC address, and indicate a predetermined change condition, so that the at least two sites change their respective MAC addresses when the predetermined change condition is reached. The respective new MAC address; the update module is configured to update the MAC address of the at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, so as to enable subsequent When the message is received from the station and sent to the station, the new MAC address is used as the MAC address of the station.
  • the notification module notifies at least two sites in the basic service set BSS served by the access point of the encrypted new MAC address corresponding to each site And notifying, to the at least two sites, the encrypted new association identifier AID corresponding to each site; the update module updating the MAC addresses of the at least two sites to the location when the predetermined change condition is reached The new MAC address corresponding to the site, and updating the AID of the at least two sites to the new AID corresponding to the site.
  • the access point further includes a confirmation module, where: the confirmation module is specifically configured to confirm the connection
  • the confirmation module is specifically configured to confirm the connection
  • Each of the at least two sites in the basic service set BSS of the ingress service corresponds to a new MAC address and a new AID, and each site corresponds to a different new MAC address and a new AID.
  • the determining module is specifically configured to receive the at least two in the BSS of the access point service a change request of the site, each of the change request of the site includes a new MAC address requested by each of the sites, and a unique verification of a new MAC address requested by each of the sites, when the uniqueness verification is passed Reassigning a new AID to each of the sites, and the new MAC and the assigned new AID requested by each of the sites are the new MAC address and the new AID of the confirmed site; the notification module Specifically, an acknowledgment message is replied to each of the sites by means of unicast, the acknowledgment message indicating that the new MAC address of the request is agreed to be used by the site, and each new site is notified of a new AID, where the new AID is located The confirmation message is carried in or sent by another message.
  • the acknowledgment module is specifically configured to allocate a new MAC address to at least two sites in the BSS served by the access point.
  • the address and the new AID, the new MAC address and the new AID assigned by each of the sites are the confirmed new MAC address and the new AID;
  • the notification module is specifically The unicast mode separately sends the encrypted new MAC address and the new AID corresponding to the site to the at least two sites.
  • the notification module specifically indicates the reservation by one of the following manners a change condition: the notification module carries a predetermined time or a predetermined time point indicating the change when notifying the encrypted new MAC address corresponding to each site to at least two sites in the basic service set BSS served by the access point; Or the notification module notifies the at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site, and separately, to the at least two sites in a unicast manner. Transmitting the change indication message; or the notification module notifying the at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site, and broadcasting to the at least Two site groups send change indication messages.
  • the notification module sends the beacon frame with the indication bit to the at least two sites by broadcasting An update indication message, the indication bit including change indication information for indicating that the at least two sites perform an addressing identification change.
  • the access point further includes a key acquisition module, wherein: the key acquisition module is configured to be used between the at least two sites Encryption key negotiation is performed to obtain an encryption key for encrypting a new MAC address of each site, which is a symmetric encryption key or an asymmetric encryption key.
  • an embodiment of the present invention provides a site, where the site includes an obtaining module and a modifying module, where: the obtaining module is configured to learn, by the access point in the basic service set BSS where the site is located, The encrypted new media access control MAC address corresponding to the site, decrypting to obtain a new MAC address, and acquiring a predetermined change condition, each of the sites corresponding to a different new MAC address; the change module is configured to meet the predetermined change When the condition is changed, the MAC address currently used by the site is changed to the new MAC address corresponding to the site, so that when the subsequent access point receives and sends a message to the access point, the new The MAC address is used as the MAC address of the site.
  • the obtaining module when learning the encrypted new MAC address corresponding to the site, further knows that the site corresponds to the adding
  • the new association identifier AID decrypts the new MAC address and the new AID; the change module changes the MAC address and AID currently used by the site to the new MAC address and the new corresponding to the site when the predetermined change condition is met. AID.
  • the obtaining module is configured to receive, by using an access point, an encrypted new MAC address that is corresponding to the site The new AID decrypts the new MAC address and the new AID.
  • the obtaining module is configured to send a change request to the access point, where the change request of the site includes Determining, by the access point, the new MAC address requested by the site, from the confirmation message of the access point responding to the change request, the encrypted new MAC address corresponding to the site, and further responding to the change request from the access point
  • the encrypted new AID is known in the acknowledgement message or in another message sent from the access point.
  • the site further includes a key negotiation module, where: the key negotiation module is configured to perform encryption key negotiation with the access point; The obtaining module decrypts and obtains the new MAC address according to the encryption key type negotiated by the key negotiation module, and uses the corresponding decryption method to obtain the new MAC address, where the encryption key is a symmetric encryption key or an asymmetric encryption key.
  • the embodiment of the present invention provides a communication system, where the communication system includes the access point in any one of the possible implementations of the third aspect or the third aspect, and any one of the fourth aspect or the fourth aspect. Sites in possible implementations.
  • the invention has the beneficial effects that, different from the prior art, the present invention adjusts the MAC address transformation of multiple sites in the entire basic service set through the access point, and notifies the multiple sites of the encrypted new MAC address corresponding to each site. So that each site changes its respective MAC address to its corresponding new MAC address when the predetermined change condition is reached. When the predetermined change condition is reached, the access point also updates the MAC address of multiple sites to the site corresponding. New MAC address. In this way, the new MAC address sent by the access point to the site is encrypted, and the eavesdropper cannot steal the new MAC address. By controlling multiple sites to change the MAC address, after changing the MAC address, the eavesdropper cannot continue to track the terminal MAC address to obtain user privacy, thus ensuring the privacy of the user.
  • FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a first method for allocating an addressing identifier according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a second method for allocating an addressing identifier according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of an operation frame according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of an operation frame for allocating a new MAC address and a new AID sent by a first access point to a station according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of an operation frame of a site replying access point confirmation message according to an embodiment of the present invention.
  • FIG. 7 is an operation frame for allocating a new MAC address and a new AID sent by a second access point to a station according to an embodiment of the present invention
  • FIG. 8 is a schematic diagram of an operation frame of an identity change message sent by an access point to each station in a broadcast manner according to an embodiment of the present invention
  • FIG. 9 is a flowchart of a third method for allocating an address identifier according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of an IE format in which a station sends a change request to an access point according to an embodiment of the present invention
  • FIG. 11 is a schematic diagram of a frame format in which a station 1 sends a re-association request to an access point according to an embodiment of the present invention
  • FIG. 12 is a schematic diagram of a frame format in which an access point sends a re-association response to a station 1 according to an embodiment of the present invention
  • FIG. 13 is a schematic diagram of a beacon frame in which an access point sends change indication information to a station according to an embodiment of the present invention
  • FIG. 14 is a flowchart of a fourth method for allocating an addressing identifier according to an embodiment of the present invention.
  • 15 is a flowchart of a fifth method for allocating an addressing identifier according to an embodiment of the present invention.
  • 16 is a flowchart of a sixth method for allocating an addressing identifier according to an embodiment of the present invention.
  • 17 is a flowchart of a seventh method for allocating an addressing identifier according to an embodiment of the present invention.
  • FIG. 18 is a schematic structural diagram of a first access point according to an embodiment of the present invention.
  • FIG. 19 is a schematic structural diagram of a second access point according to an embodiment of the present disclosure.
  • FIG. 20 is a schematic structural diagram of a first station according to an embodiment of the present invention.
  • FIG. 21 is a schematic structural diagram of a third access point according to an embodiment of the present invention.
  • FIG. 22 is a schematic structural diagram of a second station according to an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present invention.
  • the communication system includes an access point AP and a site in a basic service set (BSS) of the AP service range.
  • BSS basic service set
  • the IEEE 802.11 specification specifies the physical layer and MAC layer protocols for wireless transmission over the 2.4 GHz, 5 GHz, and even 60 GHz spectrum.
  • an AP is a site in a BSS that assumes the function of a controlling entity, and provides access to a distribution system (DS) to other sites associated with it.
  • the AP can also use the Point Control Function (PCF) to coordinate data transmission at each site.
  • the AP in the communication system in this embodiment associates five sites at sites 1 to 5.
  • the following refers to the site mentioned in the embodiment of the present invention, which refers to a user site or a user terminal.
  • FIG. 2 is a flowchart of a first method for allocating an address identifier according to an embodiment of the present invention. This embodiment is described by using an access point, and the method for allocating an address identifier in this embodiment. include:
  • the access point notifies at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site, and indicates a predetermined change condition;
  • the addressing identifier includes a MAC address.
  • the access point notifies each of the sites of the encrypted new MAC address to at least two sites, respectively, and indicates a predetermined change condition. So that at least two sites change their respective MAC addresses to their respective new MAC addresses when the predetermined change conditions are reached.
  • the change indication message is sent to the at least two sites by using a unicast manner
  • the change indication message is sent to the at least two sites by broadcast.
  • the predetermined change condition is indicated to be unicast or broadcast, wherein it is preferably transmitted by broadcast.
  • the same notification can be made Time to send and carry the time information for the change.
  • the access point may broadcast a change indication message on the working channel instructing the station to make a change in the MAC address.
  • Each station configures a new MAC address to the MAC layer when it obtains its corresponding new MAC address and reaches the predetermined change condition.
  • the new MAC address of the site is used as the addressing identifier.
  • the access point updates the MAC address of the at least two sites to the new MAC address corresponding to the site, so that when the subsequent site receives and sends a message to the site, the new MAC address is used as the MAC address of the site. address;
  • the access point Upon reaching the predetermined change condition, the access point updates the MAC address of at least two of its internal stations to the new MAC address corresponding to the station. Thus, in the next message received from the site and the message sent to the site, the new MAC address of the site is used as the MAC address of the site.
  • the present invention adjusts the MAC address translation of multiple sites in the entire basic service set through the access point, and notifies the multiple sites of the encrypted new MAC address corresponding to each site.
  • Each station is changed to its corresponding new MAC address when the predetermined change condition is reached.
  • the access point also updates the MAC address of the multiple sites to the new corresponding to the site. MAC address.
  • the new MAC address sent by the access point to the site is encrypted, and the eavesdropper cannot steal the new MAC address.
  • the eavesdropper cannot continue to track the terminal MAC address to obtain user privacy, thus ensuring the privacy of the user.
  • FIG. 3 is a flowchart of a method for allocating an address identifier according to an embodiment of the present invention. This embodiment is described by using an access point, and the method for allocating an address identifier in this embodiment. include:
  • S201 Perform an encryption key negotiation between the access point and at least two sites, where the access point acquires an encryption key used to encrypt a new MAC address of each site.
  • the access point negotiates with each of the at least two sites for shared encryption key, and the access point obtains an encryption key Ekey for encrypting the new MAC address of the site.
  • the encryption key in the embodiment of the present invention may be a symmetric encryption key or an asymmetric encryption key.
  • the access point and the site 1 perform encryption key negotiation as an example.
  • the access point performs the shared encryption key negotiation with the site 1, and the access point obtains the Ekey1, the access point.
  • the new MAC address of Site 1 is encrypted by using Ekey1 as the encryption key of the symmetric encryption algorithm.
  • the association ID (AID) of the site needs to be updated at the same time, the new AID is also encrypted with the encryption key.
  • Site 1 decrypts with Ekey1 to get the new MAC address and the new AID.
  • the access point and the station 1 generate a Pairwise Transient Key (PTK) by a Pairwise Master Key (PMK) in the four-step handshake phase of the authentication phase, and then generate a temporary key by the PTK. (Temporal Key, TK).
  • PTK Pairwise Transient Key
  • PMK Pairwise Master Key
  • the TK obtained by 128 bits can be directly intercepted by the PTK as Ekey1; or the KCK (Key Confirmation Key) and the KEK (Key Encryption Key) can be intercepted by the PTK.
  • the 128-bit key is used as the Ekey1 in the remaining bits after the TK; or the access point and the site 1 perform the random number (Nonce) exchange, and the Ekey1 is derived by the random number and the TK of both parties; more, After the entry point and site 1 perform the random number (Nonce) exchange, Ekey1 is derived by the random number, timestamp and TK of both parties.
  • the key negotiation process is a four-step handshake and a random number exchange process.
  • the encryption key is an asymmetric encryption key, it is usually a public key.
  • the encryption key negotiation between the access point and the site 1 is taken as an example.
  • Ekey1 is an RSA public key that Site 1 sends to the access point.
  • the access point encrypts the new MAC address and the new AID of the site 1 by Ekey1, and the site 1 receives the corresponding RSA private key for decryption.
  • the corresponding key negotiation process is mainly for the public key transmission and reception process.
  • the access point encrypts the new MAC address and the new AID of the site with an encryption key negotiated with the site.
  • the encryption of the new MAC address and the new AID can be encrypted together, or separately.
  • Ekey1 encrypts the new MAC address (MAC1-1) and the new AID (AID1-1) of Site 1.
  • Ekey1 may be a symmetric encryption key or an asymmetric encryption key. In the embodiment of the present invention, a symmetric encryption key is preferred.
  • Ekey1 is a symmetric encryption key
  • the encryption mode of encrypting MAC1-1 and AID1-1 can be AES-CCM mode
  • Ekey1 is a 128-bit key.
  • the encryption type can be expressed as:
  • Encrypted MAC1-1 and AID1-1 AES-CCM-128 Ekey1 (MAC1-1 and AID1-1)
  • MAC1-1 and AID1-1 can be separately encrypted, such as
  • Encrypted MAC1-1 AES-CCM-128 Ekey1 (MAC1-1)
  • the above is only an example of the encryption key negotiation between the access point and the site 1.
  • the process of negotiating the encryption key of the access point with other sites and encrypting the new MAC address and the new AID are basically the same as above. This is not repeated.
  • the access point confirms a new MAC address corresponding to each of at least two sites in the basic service set BSS of the service;
  • the site's AID can be updated simultaneously.
  • the access point confirms the new MAC address of each of the at least two sites in the basic service set BSS of the service, the new AID corresponding to each site is also confirmed.
  • Each site corresponds to a different new MAC address and a new AID.
  • the first way the access point receives the change request of at least two sites in the BSS of its service, and the change request of each site includes the new MAC address requested by each site.
  • the site will carry the new MAC address that it prefers to use in the request.
  • the new MAC address requested by each site is uniquely verified, and each site is assigned a new AID when the uniqueness verification is passed.
  • the new MAC address and the assigned new AID requested by each site are used as the new MAC address and the new AID corresponding to the determined site.
  • a possible implementation manner for uniquely verifying a new MAC address requested by a site may be: a new MAC address requested by the site and all sites in the basic service set BSS of the access point service. The MAC address is compared. If the new MAC address requested by the site is not currently used by any site in the BSS of the access point service, the unique MAC address uniqueness requested by the site is verified.
  • the second mode the access point allocates a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site are the new MAC address and the new AID corresponding to the confirmed site. .
  • S203 The access point notifies at least two sites to the encrypted new MAC address corresponding to each site, and indicates a predetermined change condition.
  • the access point notifies each of the sites of the encrypted new MAC address to at least two sites, respectively, and indicates a predetermined change condition. So that at least two sites change their respective MAC addresses to their respective new MAC addresses when the predetermined change conditions are reached.
  • the AID of the site is also changed together while updating the MAC address of the site. Therefore, in a preferred embodiment, when the access point notifies at least two sites of the encrypted new MAC address corresponding to each site, the encrypted new AID corresponding to each site may also be notified. So that at least two sites change their respective MAC address and new AID to their respective new MAC address and new AID when the predetermined change condition is reached.
  • the access point When the access point confirms that the new MAC address and the new AID corresponding to at least two sites in the BSS of the service are implemented by the foregoing first manner, the access point replies to the acknowledgment message to each site in a unicast manner, and confirms The message indicates that the site agrees to use the new MAC address it requested and notifies each site of the new AID.
  • the acknowledgment message of the reply carries a new MAC address that is unique.
  • the new AID may be carried in the acknowledgement message or sent through another message.
  • the access point may separately send the site to the at least two sites by using the unicast mode. Corresponding encrypted new MAC address and new AID.
  • an information element or a new management frame (Management Frame) can be defined to complete the related message interaction of the MAC address and the AID change; in addition, a definition is also defined in IEEE802.11.
  • a management frame called an Action Frame defines the management frame required for a single business activity by defining a new Action Category. This embodiment is described by taking an operation frame as an example, but is not limited thereto.
  • FIG. 4 is a schematic diagram of an operation frame according to the embodiment.
  • RA is the Receiver Address, which is the receiving address of the message
  • TA is the Transmitter Address, which is the sending address of the message
  • a new operation category identifier is defined in the frame body of the operation frame, indicating that the ID (Identity) is changing the service.
  • the operation is represented by Change ID, which is simplified as CID and has a length of 1 byte.
  • the CID message mode bit indicates whether the operation frame is used to identify a change schedule indication or to identify a change confirmation.
  • the identifier change schedule indication is used to indicate that the frame is sent by the access point to the station, and is used to indicate that the address identifier is changed, and the identifier change confirmation indicates that the frame is sent by the station to the access point, and the access point is sent to the access point. Change the confirmation of the addressing ID indication.
  • the access point when the access point sends information such as a new MAC address and AID to the site 1, the CID message mode ID is set to 1, and the encrypted MAC and AID are carried in the content of the subsequent CID element and Identify change time information.
  • RA is the current address of station 1 MAC1-0, that is, the MAC address before the change.
  • the station 1 After receiving the message sent by the access point, the station 1 decrypts the MAC1-1 and the AID1-1, and replies to the AP with an acknowledgement message indicating that the MAC1-1 and the AID1-1 are accepted. As shown in Figure 6.
  • the access point when the access point sends the MAC address and the AID to the station, the access point may send the MAC1-1 and the AID1-1 to the station 1 as an example, and the operation frame of the access point is as shown in FIG. 7.
  • the access point can broadcast a change indication message to each station to make changes to each station.
  • the broadcast message can also be implemented by an operation frame. As shown in Figure 8.
  • the change indication message may also be indicated to each station by adding an indication bit (such as Indication shown in FIG. 8) to a broadcast message such as a beacon frame, for example, when the indication bit is set, the station receives the beacon.
  • MAC address and AID update after frame, when the indicator bit is set to 0 When the station receives the beacon frame, it does not update the MAC address and AID.
  • the above is an example of the interaction between the access point and the site 1.
  • the interaction process between the access point and other sites is basically the same, and will not be repeated.
  • the access point updates the MAC address of the at least two sites to the new MAC address corresponding to the site, so that when the subsequent site receives and sends a message to the site, the new MAC address is used as the MAC of the site. address.
  • the access point updates the MAC address and AID of at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached.
  • the time information received by each station can ensure that each station and the access point change after the same time, such as
  • the time information is a timing
  • the time of the TSF (Timing Synchronization Function) of each station is synchronized with the access point.
  • each station The new MAC and the new AID assigned by the access point are configured to the MAC layer, and the access point also updates the MAC address and the AID of each site, so that when the site message of the new MAC address is received, the access is received.
  • the point can determine the information of the site and the shared information of the site, such as a shared data encryption key.
  • at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
  • the AP assigns a 16-bit AID to the site during the association phase.
  • the PS-Poll (Power Saving Poll) message sent by the terminal will carry the AID in plain text. Therefore, if the terminal only changes the MAC address, the eavesdropper can also find the new and old MAC of the terminal by analyzing the AID. The correspondence of the addresses, thereby relocking the terminal. Therefore, in the method for allocating the addressing identifier provided in this embodiment, the MAC address of each station is updated, and the AID is also changed at the same time. On the one hand, the new MAC address and the new AID sent by the access point to the site are encrypted, and the eavesdropper cannot steal the new MAC address and the new AID. On the other hand, by controlling multiple sites to change the MAC address and AID, after the change, the eavesdropper cannot continue to track the terminal MAC address and AID to obtain user privacy, thereby ensuring the privacy of the user.
  • the PS-Poll Power Saving Poll
  • FIG. 9 is a flowchart of a method for allocating an address identifier according to an embodiment of the present invention.
  • the method for assigning an address identifier in this embodiment includes the following steps. :
  • S301 The station learns the encrypted new MAC address corresponding to the site notified by the access point in the basic service set BSS, decrypts the new MAC address, and obtains a predetermined change condition, and each site corresponds to a different new MAC address. ;
  • the AP assigns a 16-bit AID to the site during the association phase.
  • the PS-Poll (Power Saving Poll) message sent by the terminal will carry the AID in plain text. Therefore, if the terminal only changes the MAC address, the eavesdropper can also find the new and old MAC of the terminal by analyzing the AID. The correspondence of the addresses, thereby relocking the terminal.
  • the site's MAC address and AID can be changed at the same time to prevent the eavesdropper from tracking the user's private information by tracking the site's AID.
  • the access point notifies the site of the new MAC address, it also notifies the site of the new AID corresponding to the site. Therefore, in the preferred embodiment of the present invention, when the site learns the encrypted new MAC address corresponding to the site, it also knows the encrypted new AID corresponding to the site, decrypts and obtains the new MAC address and the new AID, and each site corresponds to a different new MAC. Address and new AID.
  • the site further includes: performing encryption key negotiation between the site and the access point, so that the site uses the corresponding decryption method according to the negotiated encryption key type. Decrypt to get the new MAC address and the new AID.
  • the encryption key can be a symmetric encryption key or an asymmetric encryption key.
  • the site decrypts with the corresponding key
  • the encryption key is an asymmetric encryption key
  • the site decrypts with the private key corresponding to the key.
  • An implementation manner in which the site learns the encrypted new MAC address and the new AID corresponding to the site is that the site receives the encrypted new MAC address and the new AID allocated by the access point, so as to know the corresponding encrypted new MAC address and the new one. AID.
  • the station requests a MAC address change from the access point, that is, sends a change request to the access point, and the change request of the site may include a new MAC address requested by the site, where it needs to be stated that the request carries
  • the new MAC address is also encrypted.
  • the access point receives the change of the site, please Find and decrypt the requested new MAC address, perform a uniqueness check, and then give a confirmation message as a response to the change request.
  • the station learns the encrypted new MAC address corresponding to the site from the confirmation message of the access point responding to the change request, and can further learn the new AID.
  • the new MAC address corresponding to the site is the new MAC address requested by the site, and when the new MAC address requested by the site does not pass the uniqueness verification, the new MAC address corresponding to the site is The access point assigns a unique new MAC address to the site, and the new AID corresponding to the site is allocated by the access point for the site.
  • the new AID can be carried in the acknowledgment message or can be sent separately through another message.
  • the site sends a change request to the access point.
  • the site may also be implemented by defining an operation frame or a new management frame or a new information element (IE).
  • the method for defining the operation frame is in the second embodiment and the embodiment. The third has been explained.
  • a new IE is defined as an example, but is not limited thereto.
  • the newly defined information elements can be carried in various management frames, such as Probe Request/Response, Reassociation Request/Response, and Beacon frames.
  • FIG. 10 is a schematic diagram of an IE format in which a station sends a change request to an access point according to an embodiment of the present invention.
  • RA is the receiving address and TA is the sending address.
  • the CID information elements mainly include:
  • Information element ID 1 byte, when redefining a new information element for a certain service, a new information element ID needs to be registered, and when the receiving party receives the message, the service type is identified according to the information element ID;
  • Information element length defines the length of the information element
  • CID message mode and CID element content carry different content according to different message modes, such as requesting the request mode (1 in the corresponding table) carrying the priority MAC address, and responding to the response mode (2 in the corresponding table) carrying the confirmation indication and
  • the AID indicates that the bit Indication mode (4 in the corresponding table) carries empty content, as shown in Table 2.
  • Site 1 determines a priority MAC address MAC1-1 and encrypts it, as described above.
  • Site 1 sends a re-association request to the access point, carrying the CID IE, and its frame format is as shown in FIG.
  • the access point obtains the CID IE therein after receiving the reassociation request, and then decrypts the encrypted MAC1-1 therein to obtain MAC1-1.
  • the access point then performs MAC 1-1 uniqueness verification in the BSS.
  • the verification method may be to compare the MAC 1-1 with the MAC address of all stations in the BSS. When the MAC 1-1 is not currently used by any STA, the MAC 1- 1 is unique within the BSS.
  • the access point encrypts the newly assigned AID 1-1 for Site 1.
  • the access point sends a re-association response to the station 1, carrying the CID IE, and its frame format is as shown in FIG.
  • the access point may broadcast a message carrying the indication information.
  • an access point can broadcast a beacon frame.
  • the location identifier in this embodiment, the MAC address, or the MAC address and the AID
  • the CID IE is carried in the Beacon frame, and the message format is as shown in FIG. Show.
  • the access point also carries the change time T in the confirmation message to the station.
  • At least two stations in the BSS where the access point is located can support the change of the addressing identifier (in this embodiment, the MAC address, or the MAC address and the AID).
  • the identification change trigger condition is met, at least two sites will send a MAC address change request to the access point within a certain time period t after the identification change trigger condition is met. Therefore, when the access point receives the change request of the first station, if the time is T0, the time T specified by the access point meets the following conditions, and it can be guaranteed that at least two sites will be changed before the T time arrives.
  • Request ie T>T0+t.
  • the site When the site meets the predetermined change condition, the site changes the currently used MAC address to a new MAC address corresponding to the site, so that when the subsequent access point receives and sends a message to the access point, Use the new MAC address as the MAC address of the site;
  • the site updates the currently used MAC address and AID to its corresponding new MAC address when the predetermined change condition is met. New AID.
  • the site i represents any site other than the site 1.
  • MAC1-1 and AID1-1 are the new MAC address and new AID of Site 1, respectively, and MAC1-0 is the MAC address before Site 1 is changed.
  • MACi-1 and AIDi-1 are the new MAC address and new AID of site i, respectively, and MACi-0 is the MAC address before site i is changed.
  • FIG. 14 is a flowchart of a fourth method for allocating an address identifier according to an embodiment of the present invention.
  • the embodiment is applicable to the access point mentioned above to actively allocate a new MAC address and a new AID to a station.
  • the method of this embodiment includes the following steps:
  • the access point performs shared encryption key negotiation with site 1 (Ekey1);
  • the access point and the site 1 perform a shared encryption key negotiation to determine a key Ekey1 for encrypting the new MAC and the new AID of the site 1.
  • the access point performs shared encryption key negotiation with the site i (Ekeyi);
  • a shared encryption key negotiation is performed between the access point and the site i to determine a key Ekeyi for encrypting the new MAC and the new AID of the site i.
  • the access point encrypts MAC1-1 and AID1-1;
  • the access point sends an operation frame (MAC1-1, AID1-1, T) to the station 1.
  • the access point sends an operation frame to the station 1, the operation frame carries the encrypted MAC1-1 and AID1-1, and the identification change time T, and the corresponding reception address is MAC1-0.
  • Site 1 decrypts to obtain MAC1-1 and AID1-1;
  • Site 1 sends an operation frame (confirm) to the access point;
  • Site 1 sends an operation frame to the access point to confirm that MAC1-1 and AID1-1 have been received, and the corresponding sending address is MAC1-0.
  • the access point sends an operation frame (MACi-1, AIDi-1, T) to the station i.
  • the access point sends an operation frame to the station i, the operation frame carries the encrypted MACi-1 and AIDi-1, and the identification change time T, and the corresponding reception address is MACi-0.
  • Site i decrypts to obtain MACi-1 and AIDi-1;
  • Site i sends an operation frame (confirm) to the access point
  • Site i sends an operation frame to the access point to confirm that MACi-1 and AIDi-1 have been received, and the corresponding transmission address is MACi-0.
  • the access point updates the MAC address and the AID of each site.
  • Site 1 is updated to MAC1-1 and AID1-1;
  • Site i is updated to MACi-1 and AIDi-1;
  • both the access point and the station's timer After both the access point and the station's timer are clocked to T, both the access point and the site update the MAC address and AID.
  • FIG. 15 is a fifth type of address addressing address provided by the embodiment of the present invention.
  • the flow chart of the method, the difference between the embodiment shown in FIG. 15 and the embodiment shown in FIG. 14 is:
  • step 404 and step 407 the operation frame sent by the access point to the station does not carry the indication change time T, and the step 410 becomes: the access point sends an operation frame (identification change indication) to the station, and the corresponding receiving address is Broadcast address.
  • the specific implementation of the remaining steps is consistent with the embodiment shown in Figure 14, please refer to the previous detailed description.
  • the access point when the access point notifies the new MAC address and the new AID of the station, it does not indicate the change time, but after transmitting the new MAC and the new AID, by broadcasting an operation frame for indicating the change, the site After receiving the indication, the MAC and AID are updated, and the access point also updates the MAC and AID of each station after issuing an instruction.
  • FIG. 16 is a flowchart of a sixth method for allocating an address identifier according to an embodiment of the present invention.
  • the embodiment is applicable to the above mentioned site by requesting an access point to obtain a new MAC address and a new one.
  • the method of this embodiment includes the following steps:
  • the access point performs shared encryption key negotiation with site 1 (Ekey1);
  • the access point and the site 1 perform a shared encryption key negotiation to determine a key Ekey1 for encrypting the new MAC and the new AID of the site 1.
  • the access point performs shared encryption key negotiation with the site i (Ekeyi);
  • a shared encryption key negotiation is performed between the access point and the site i to determine a key Ekey1 for encrypting the new MAC and the new AID of the site i.
  • Site 1 encrypts the new MAC address MAC1-1 that it prefers to use.
  • Site 1 sends a re-association request (MAC1-1) to the access point;
  • the station 1 sends a re-association request to the access point, where the request includes the encrypted MAC1-1 that the station 1 preferentially uses, and the corresponding sending address is MAC1-0.
  • the access point decrypts MAC1-1 to verify uniqueness
  • the access point decrypts to obtain MAC1-1, and uniquely verifies the MAC1-1.
  • a possible implementation manner for the access point to perform unique authentication on the MAC 1-1 may be: comparing the MAC 1-1 with the MAC addresses of all sites in the basic service set BSS of the access point service, if MAC1 If the -1 address is not currently used by any site in the BSS served by the access point, the MAC1-1 unique check is considered to pass.
  • the access point encrypts AID1-1;
  • the access point When MAC1-1 passes the uniqueness verification, the access point assigns the new association identifier AID1-1 to the site 1, and encrypts the AID1-1.
  • the access point sends a re-association response (AID1-1) to the station 1;
  • the access point sends a re-association response to the station 1, instructing it to use the MAC1-1, and carrying the AID1-1 in the response, and the corresponding receiving address is MAC1-0.
  • Site 1 decrypts AID1-1
  • Site 1 decrypts to obtain AID1-1.
  • Site i encrypts the new MAC address MACi-1 that it prefers to use.
  • Site i sends a re-association request (MACi-1) to the access point.
  • the station i sends a re-association request to the access point, where the request includes the encrypted MACi-1 that the station i preferentially uses, and the corresponding sending address is MACi-0.
  • the access point sends a re-association response (AIDi-0) to the station i.
  • the access point decrypts the MACi-1 and performs uniqueness verification.
  • the site i is assigned a new association identifier AIDi-1.
  • the access point sends a reassociation response to the station i, instructing it to use the MACi-1, and carrying the AIDi-1 in the response, the receiving address being MAC1-0.
  • Site i obtains AIDi-1 by decryption.
  • the access point broadcasts a beacon frame (identification change indication);
  • the access point broadcasts a beacon frame to each station, instructing each station to make changes to the MAC address and AID.
  • the access point updates the MAC address and the AID of each site.
  • Site 1 is updated to MAC1-1 and AID1-1;
  • Site i is updated to MACi-1 and AIDi-1;
  • the station When the station receives the beacon frame, it updates the respective MAC address and AID. After the broadcast beacon frame is broadcast, the access point also updates the MAC address and AID of each station.
  • FIG. 17 is a seventh type of addressing addressing identifier provided by the embodiment of the present invention.
  • the flow chart of the method, the difference between the embodiment shown in FIG. 17 and the embodiment shown in FIG. 16 is:
  • step 507 and 511 the re-association response sent by the access point to the station carries the indication change time T;
  • step 513 becomes:
  • the access point when the access point makes a re-association response to the station, the access point indicates the time T of the change, and the access point and the station both update the MAC address and the AID after timing to T.
  • the access point and the site 1 perform a shared key negotiation, or the site 1 sends a re-association request to the access point, the site i to the access point, etc., which may be in actual operation. It is not strictly different, and it is even possible to execute simultaneously. Therefore, those skilled in the art should understand that the numbers of the above steps are not the order of execution in the actual sense.
  • FIG. 18 is a schematic structural diagram of a first access point according to an embodiment of the present invention.
  • the access point 100 of this embodiment includes a notification module 11 and an update module 12, where:
  • the notification module 11 is configured to notify at least two sites in the basic service set BSS served by the access point of the encrypted new MAC address corresponding to each site, and indicate a predetermined change condition, so that at least two sites reach the predetermined change condition. , changing their respective MAC addresses to their respective new MAC addresses;
  • the notification module 11 notifies each of the sites of the encrypted new MAC address to at least two sites, respectively, and indicates a predetermined change condition. So that at least two sites change their respective MAC addresses to their respective new MAC addresses when the predetermined change conditions are reached.
  • the notification module 11 indicates that the predetermined change condition may have the following possible implementation manners:
  • the change indication message is sent to at least two sites by broadcast.
  • the notification module 11 indicates that the predetermined change condition can be transmitted in a unicast or broadcast manner, wherein it is preferably transmitted by broadcast.
  • the notification module 11 can transmit and carry the time information for making the change at the same time when the notification is made.
  • the notification module 11 can broadcast a change indication message on the working channel instructing the station to make a change in the MAC address.
  • Each station configures a new MAC address to the MAC layer when it obtains its corresponding new MAC address and reaches the predetermined change condition.
  • the new MAC address of the site is used as the addressing identifier.
  • the update module 12 is configured to update the MAC address of the at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, so that the new MAC address is used as the MAC address of the site when the subsequent site receives and sends a message to the site. address.
  • the update module 12 updates the MAC address of at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, and addresses the new MAC address of the site in the next message sent to the site and the message received from the site. logo.
  • the present invention adjusts the MAC address translation of multiple sites in the entire basic service set through the access point, and notifies the multiple sites of the encrypted corresponding to each site.
  • the new MAC address so that each site changes its respective MAC address to its corresponding new MAC address when the predetermined change condition is reached.
  • the access point also updates the MAC address of multiple sites.
  • the new MAC address corresponding to the site In this way, the new MAC address sent by the access point to the site is encrypted, and the eavesdropper cannot steal the new MAC address.
  • the eavesdropper cannot continue to track the MAC address to obtain the privacy of the end user, thus ensuring the privacy of the user.
  • FIG. 19 is a schematic structural diagram of a second access point according to an embodiment of the present invention.
  • the access point 200 of this embodiment includes a notification module 21, an update module 22, a confirmation module 23, and a key acquisition module. 24, where:
  • the notification module 21 is configured to notify at least two sites of the encrypted new MAC address corresponding to each site, and indicate a predetermined change condition, so that at least two sites change their respective MAC addresses to their respective ones when the predetermined change condition is reached. New MAC address.
  • the site's AID can be updated simultaneously to prevent the eavesdropper from tracking user privacy by tracking the AID.
  • the notification module 21 notifies the at least two sites of the encrypted new MAC address corresponding to each site, and also notifies the at least two sites of the encrypted new AID corresponding to each site.
  • the update module 22 is configured to update the MAC address of the at least two sites to the new MAC address corresponding to the site when the predetermined change condition is reached, so that the new MAC address is used as the MAC address of the site when receiving and sending the message from the site. address.
  • the update module 22 updates the MAC address and the AID of at least two sites to the station when the predetermined change condition is reached. Point the new MAC address and the new AID.
  • the subsequent reception from the site and the sending of the message to the site at least one of the new MAC address of the site and the new AID is used as the addressing address.
  • the confirmation module 23 is configured to confirm a new MAC address and a new AID corresponding to each of at least two sites in the basic service set BSS of the access point service, and each site corresponds to a different new MAC address and a new AID.
  • the confirmation module 23 is configured to receive a change request of at least two sites in the BSS of the access point service, where the change request of each site includes a new MAC address requested by each site, and the new MAC address requested by each site is unique. Sexual verification, when the unique verification is passed, each station is assigned a new AID, and the new MAC and the assigned new AID requested by each site are the new MAC address and the new AID of the confirmed site.
  • the notification module 21 replies to each site with a confirmation message in a unicast manner, the confirmation message instructs the site to use the requested new MAC address, and notifies each site of the new AID.
  • the new AID is carried in the acknowledgement message or sent through another message.
  • the confirmation module 23 is configured to allocate a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site are the new MAC address and the new AID corresponding to the confirmed site.
  • the notification module 21 sends the encrypted new MAC address and the new AID corresponding to the site to the at least two sites by unicast.
  • Each site corresponds to a different new MAC address and a new AID.
  • the confirmation module 23 is provided to confirm two possible implementation manners of the new MAC address and the new AID corresponding to at least two sites in the BSS of the access point service, and of course, the object of the present invention can be achieved. On the basis of it, it can also be implemented in other possible ways.
  • the first way the access point receives the change request of at least two sites in the BSS of its service, and the change request of each site includes the new MAC address requested by each site.
  • the site will carry the new MAC address that it prefers to use in the request.
  • the new MAC address requested by each site is uniquely verified, and each site is assigned a new AID when the uniqueness verification is passed.
  • the new MAC address and the assigned new AID requested by each site are used as the new MAC address and the new AID corresponding to the determined site.
  • the second mode the access point allocates a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site correspond to the confirmed site. New MAC address and new AID.
  • the notification module 21 replies with a confirmation message to each site in a unicast manner, and confirms The message indicates that the site agrees to use the new MAC address it requested and notifies each site of the new AID.
  • the acknowledgment message of the reply carries a new MAC address that is unique.
  • the new AID may be carried in the acknowledgement message or sent through another message.
  • the notification module 21 separately sends the site correspondence to the at least two sites by using the unicast mode. Encrypted new MAC address and new AID.
  • an information element or a new management frame (Management Frame) can be defined to complete the related message interaction of the MAC address and the AID change; in addition, a definition is also defined in IEEE802.11.
  • a management frame called an Action Frame defines the management frame required for a single business activity by defining a new Action Category. This embodiment is described by taking an operation frame as an example, but is not limited thereto.
  • the key obtaining module 24 is configured to perform encryption key negotiation with at least two sites to obtain an encryption key for encrypting a new MAC address of each site, and the encryption key is a symmetric encryption key or asymmetric encryption. Key.
  • the access point performs shared encryption key negotiation with each of the at least two sites through the key obtaining module 24 to obtain an encryption key Ekey for encrypting the new MAC address of the site.
  • the encryption key in the embodiment of the present invention may be a symmetric encryption key or an asymmetric encryption key.
  • the access point negotiates with the site 1 for the encryption key.
  • the access point negotiates with the site 1 for the shared encryption key.
  • the access point obtains Ekey1 and the access point uses Ekey1.
  • the new MAC address of Site 1 is encrypted for the encryption key of the symmetric encryption algorithm.
  • the AID of the site needs to be updated simultaneously, the new AID is also encrypted with the encryption key.
  • Site 1 decrypts with Ekey1 to get the new MAC address and the new AID.
  • the access point and the station 1 generate a Pairwise Transient Key (PTK) by a Pairwise Master Key (PMK) in the four-step handshake phase of the authentication phase, and then generate a temporary key by the PTK. (Temporal Key, TK).
  • PTK Pairwise Transient Key
  • PMK Pairwise Master Key
  • the TK of 128 bits can be directly intercepted by the PTK as Ekey1; or the key of 128 bits is taken as the Ekey1 by the PTK in the remaining bits after intercepting KCK, KEK, and TK; or, the access point and After the site 1 performs the random number (Nonce) exchange, the Ekey1 is derived by the random number and the TK of the two parties; moreover, the access point and the station 1 perform the random number (Nonce) exchange, and the two parties have a random number and a time stamp ( Timestamp) and TK to derive Ekey1.
  • the key negotiation process is a four-step handshake and a random number exchange process.
  • the encryption key is an asymmetric encryption key, it is usually a public key.
  • the encryption key negotiation between the access point and the site 1 is taken as an example.
  • Ekey1 is an RSA public key that Site 1 sends to the access point.
  • the access point encrypts the new MAC address and the new AID of the site 1 by Ekey1, and the site 1 receives the corresponding RSA private key for decryption.
  • the corresponding key negotiation process is mainly for the public key transmission and reception process.
  • the access point encrypts the new MAC address and the new AID of the site with an encryption key negotiated with the site.
  • the encryption of the new MAC address and the new AID can be encrypted together, or separately.
  • Ekey1 encrypts the new MAC address (MAC1-1) of Site 1 and the new association identifier (AID1-1).
  • Ekey1 may be a symmetric encryption key or an asymmetric encryption key. In the embodiment of the present invention, a symmetric encryption key is preferred.
  • Ekey1 is a symmetric encryption key
  • the encryption mode of encrypting MAC1-1 and AID1-1 can be AES-CCM mode
  • Ekey1 is a 128-bit key.
  • the encryption type can be expressed as:
  • Encrypted MAC1-1 and AID1-1 AES-CCM-128 Ekey1 (MAC1-1 and AID1-1)
  • MAC1-1 and AID1-1 can be separately encrypted, such as
  • Encrypted MAC1-1 AES-CCM-128 Ekey1 (MAC1-1)
  • the key acquisition module 24 notifies the confirmation module 23 of the acquired encryption key, and the confirmation module 23 encrypts the new MAC address and the new AID of the site with the encryption key, and then notifies the site through the notification module 21.
  • the update module 22 Upon reaching the predetermined change condition notified by the notification module 21, the update module 22 will internalize it.
  • the MAC address of at least two sites is updated to the new MAC address corresponding to the site, and the AID of at least two sites is changed to the new AID corresponding to the site.
  • the time information received by each station can ensure that each station and the access point change after the same time. For example, when the time information is a timing moment, the TSF time of each station is synchronized with the access point. When the timers of each station and the access point are timed to the moment, each station will allocate a new MAC to the access point.
  • the new AID is configured to the MAC layer, and the access point also updates the MAC address and the AID of each site, so that when receiving the site message with the sending address as the new MAC address, the access point can determine the information of the site and Shared information for the site, such as shared data encryption keys.
  • the access point In the subsequent message interaction, at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
  • the access points in the embodiments shown in FIG. 18 and FIG. 19 can implement the steps of the method in the embodiment shown in FIG. 2 and FIG. 3 of the present invention.
  • the division of each module is only one.
  • the division of each module in the access point may also be other manners, for example, several modules are integrated into one module to implement.
  • FIG. 20 is a schematic structural diagram of a first site according to an embodiment of the present invention.
  • the site 300 of this embodiment includes an obtaining module 31 and a changing module 32, where:
  • the obtaining module 31 is configured to learn the encrypted new MAC address corresponding to the site, decrypt the obtained new MAC address, and obtain a predetermined change condition, where each site corresponds to a different new MAC address;
  • the access point in order to prevent the eavesdropper from tracking the user's private information by tracking the AID of the site, the access point notifies the site of the new MAC address, but also notifies the site of the new AID corresponding to the site. Therefore, in the preferred embodiment of the present invention, the obtaining module 31 can also obtain the encrypted new AID corresponding to the site when decrypting the encrypted new MAC address corresponding to the site, and decrypt the obtained new MAC address and the new AID.
  • the obtaining module 31 decrypts and obtains the new MAC address and the new AID by receiving the encrypted new MAC address and the new AID allocated by the access point for the site correspondence.
  • the obtaining module 31 sends a change request to the access point, and the change request of the site includes the new MAC address requested by the site, and the encrypted new MAC address corresponding to the site is obtained from the confirmation message of the access point responding to the change request, and Further knowledge of the new AID.
  • the obtaining module 31 learns the new AID from the confirmation message of the access point responding to the change request; or The new AID is known from another message sent by the ingress.
  • An implementation manner of the obtaining module 31 for obtaining the encrypted new MAC address and the new AID corresponding to the site is to receive the encrypted new MAC address and the new AID allocated by the access point, so as to obtain the encrypted new MAC address corresponding to the site and New AID.
  • the obtaining module 31 requests a MAC address change from the access point, that is, sends a change request to the access point, where the change request includes a new MAC address requested by the site, where it is required to be described in the request.
  • the new MAC address is also encrypted.
  • the access point receives the request from the site and decrypts the requested new MAC address for uniqueness verification, and then presents a confirmation message as a response to the request.
  • the station learns the encrypted new MAC address corresponding to the site from the confirmation message of the access point responding to the change request, and further learns the new AID.
  • the new MAC address corresponding to the site is the new MAC address requested by the site, and when the new MAC address requested by the site does not pass the uniqueness verification, the new MAC address corresponding to the site is The access point assigns a unique new MAC address to the site, and the new AID corresponding to the site is allocated by the access point for the site.
  • the new AID can be carried in the acknowledgment message or can be sent separately through another message.
  • the access point also carries the change time T in the confirmation message to the station.
  • At least two stations in the BSS where the access point is located can support the addressing identifier (in this embodiment, a MAC address, or a MAC address and an AID).
  • the change trigger condition is met, at least two sites will send a MAC address change request to the access point within a certain time period t after the change trigger condition is met. Therefore, when the access point receives the change request of the first station, if the time is T0, the time T specified by the access point meets the following conditions, and it can be guaranteed that at least two sites will be changed before the T time arrives.
  • Request ie T>T0+t.
  • the site sends a change request to the access point.
  • the site may also be implemented by defining an operation frame or a new management frame or a new information element (IE).
  • the method for defining the operation frame is in the second embodiment and the embodiment. The third has been explained.
  • a new IE is defined as an example, but is not limited thereto.
  • the newly defined information elements can be carried in various management frames, such as Probe Request/Response, Reassociation Request/Response, and Beacon frames.
  • the change module 32 is configured to change the site's MAC address to when the predetermined change condition is met.
  • the new MAC address corresponding to the site so that when the subsequent access from the access point receives and sends a message to the access point, the new MAC address is used as the MAC address of the site.
  • the change module 32 updates the MAC address currently used by the station to the new MAC address corresponding to the station, under the predetermined change condition.
  • the change module 32 updates the current MAC address and AID of the site to the new corresponding to the site when the predetermined condition is met.
  • the MAC address and the new AID at the next reception of the message, use at least one of the new MAC address and the new AID as the addressing identifier.
  • the site 300 further includes a key agreement module 33, where:
  • the key agreement module 33 is configured to perform encryption key negotiation with the access point.
  • the obtaining module 31 decrypts and obtains the new MAC address and the new AID according to the encryption key type negotiated by the key agreement module 33, and uses the corresponding decryption method to obtain the new MAC address and the new AID.
  • the encryption key is a symmetric encryption key or an asymmetric encryption key.
  • the obtaining module 31 further includes: the key negotiation module 33 performs encryption key negotiation with the access point, so that the obtaining module 31 is based on the negotiated encryption key type. , decrypt the new MAC address and the new AID using the corresponding decryption method.
  • the encryption key can be a symmetric encryption key or an asymmetric encryption key.
  • the site decrypts with the corresponding key
  • the encryption key is the army called the encryption key
  • the site decrypts with the private key corresponding to the key.
  • the station provided in the embodiment shown in FIG. 20 can implement the steps in the method embodiment shown in FIG. 9.
  • the division of each module in the site is only an example, and is not specifically limited. The scope of the invention.
  • the functional modules of the site may also be other division manners, such as several modules integrated on one module implementation.
  • FIG. 21 is a schematic structural diagram of a third access point according to an embodiment of the present invention.
  • the access point 400 of this embodiment includes a processor 41 (may be one or more, in various embodiments of the present invention. Taking one as an example), a memory 42, a receiver 43, a transmitter 44, and a bus system 45, wherein:
  • the processor 41 controls the operation of the access point 400, which may also be referred to as a CPU (Central Processing Unit).
  • Processor 41 may be an integrated circuit chip with signal processing capabilities.
  • the processor 41 can also be a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuit (ASIC), a Field-Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • Memory 42 may include read only memory and random access memory and provides instructions and data to processor 41. A portion of the memory 42 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the various components of the access point 400 are coupled together by a bus system 45, which may include, in addition to the data bus, a power bus, a control bus, a status signal bus, and the like.
  • the bus system may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus.
  • the bus may be one or more physical lines, and when it is a plurality of physical lines, it may be divided into an address bus, a data bus, a control bus, and the like.
  • the processor 41, the memory 42, and the receiver 43, the transmitter 44 may also be directly connected through a communication line.
  • various buses are labeled as bus system 45 in the figure.
  • the memory 42 stores the following elements, executable modules or data structures, or subsets thereof, or their extended sets:
  • Operation instructions include various operation instructions for implementing various operations.
  • Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the processor 41 performs the following operations by calling an operation instruction stored in the memory 42 (the operation instruction can be stored in the operating system):
  • the processor 41 notifies the at least two sites in the basic service set BSS served by the access point to the encrypted new MAC address corresponding to each site through the transmitter 44, and indicates a predetermined change condition, so that at least two sites are reaching the predetermined change. When conditions are met, change their respective MAC addresses to their respective New MAC address.
  • the processor 41 when the processor 41 notifies the at least two sites of the encrypted new MAC address corresponding to each site by the transmitter 44, the at least two sites may also be notified of the encrypted new AID corresponding to each site. .
  • the processor 41 indicates that the predetermined change condition by the transmitter 44 can have the following possible implementation manners:
  • the change indication message is sent to at least two sites by broadcast.
  • the processor 41 indicates that the predetermined change condition can be transmitted in a unicast or broadcast manner, wherein it is preferably transmitted by broadcast.
  • the processor 41 can transmit and carry the time information for the change at the same time when the notification is made by the transmitter 44.
  • the processor 41 can broadcast a change indication message on the working channel through the transmitter 44, instructing the station to make a change in the MAC address and the AID.
  • Each station configures a new MAC address and a new AID to the MAC layer when obtaining respective new MAC addresses and new AIDs and reaching a predetermined change condition.
  • at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
  • the processor 41 further updates the MAC address of the at least two sites of the access point to the new MAC address corresponding to the site when the predetermined change condition is reached, so that when the message is received and sent to the site from the site, the new MAC address is used as the new MAC address.
  • the MAC address of the site is updated.
  • the processor 41 When the processor 41 notifies the site of the new AID corresponding to the site, when the predetermined change condition is reached, the MAC addresses of the at least two sites are updated to the new MAC address corresponding to the site, and the AIDs of the at least two sites are updated to correspond to the site.
  • the new AID when subsequently sent to or received from the site, uses at least one of the new MAC address of the site and the new AID as the addressing identifier.
  • the processor 41 is further configured to confirm a new MAC address and a new AID corresponding to each of at least two sites in the basic service set BSS of the access point service, where each site corresponds to a different new MAC address and a new AID.
  • the processor 41 receives the change request of at least two sites in the BSS of the access point service through the receiver 43.
  • the change request of each site includes a new MAC address requested by each site, and a new MAC address requested for each site.
  • each site is assigned a new AID when the uniqueness verification is passed, and the new MAC and the assigned new AID requested by each site are the new MAC address and the new AID of the confirmed site.
  • the processor 41 replies to the acknowledgment message to each of the stations in a unicast manner by the transmitter 44, the acknowledgment message instructing the site to use the requested new MAC address, and notifying each station of the new AID.
  • the new AID is carried in the acknowledgement message or sent through another message.
  • the processor 41 is further configured to allocate a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID allocated by each site are the new MAC address corresponding to the confirmed site and the new AID.
  • the processor 41 transmits the encrypted new MAC address and the new AID corresponding to the station to the at least two sites by the transmitter 44 in a unicast manner.
  • Each site corresponds to a different new MAC address and a new AID.
  • the processor 41 confirms two possible implementation manners of a new MAC address and a new AID corresponding to at least two sites in the BSS of the access point service, and of course, can achieve the object of the present invention. On the basis of this, other possible ways can also be implemented.
  • the processor 41 receives the change request of at least two sites in the BSS of the access point service through the receiver 43, and the change request of each site includes the new MAC address requested by each site. In other words, the site will carry the new MAC address that it prefers to use in the request.
  • the processor 41 receives the change request of at least two sites through the receiver 43, the new MAC address requested by each site is uniquely verified, and each site is assigned a new AID when the uniqueness verification is passed.
  • the new MAC address and the assigned new AID requested by each site are used as the new MAC address and the new AID corresponding to the determined site.
  • the second mode the processor 41 allocates a new MAC address and a new AID to at least two sites in the BSS served by the access point, and the new MAC address and the new AID assigned by each site are the new MAC addresses corresponding to the confirmed site and New AID.
  • the processor 41 When the processor 41 confirms that the new MAC address and the new AID corresponding to at least two sites in the BSS of the service are respectively implemented by the first mode, the processor 41 replies to each site by the transmitter 44 in a unicast manner. A confirmation message indicating that the site is permitted to use its request New MAC address and notify each site of the new AID. When the new MAC address requested by the site fails to pass the uniqueness verification, the acknowledgment message of the reply carries a new MAC address that is unique. The new AID may be carried in the acknowledgement message or sent through another message.
  • the processor 41 When the processor 41 confirms that the new MAC address and the new AID corresponding to each of the at least two sites in the BSS of the access point service are implemented by the foregoing second manner, the processor 41 unicasts to at least the transmitter 44.
  • the two sites send the encrypted new MAC address and the new AID corresponding to the site.
  • an Information Element or a new Management Frame is defined to complete the related message interaction of the MAC address and the AID change; in addition, a definition called IEEE802.11 is also defined.
  • the management frame of the Action Frame defines the management frame required for a single business activity by defining a new Action Category.
  • the processor 41 is further configured to obtain an encryption key for encrypting a new MAC address of each site by using the sender 44 and the receiver 43 to perform encryption key negotiation with at least two sites, and encrypt the key. Is a symmetric encryption key or an asymmetric encryption key.
  • the processor 41 performs shared encryption key negotiation with each of the at least two sites to obtain an encryption key Ekey for encrypting the new MAC address and the new AID of the site.
  • the encryption key in the embodiment of the present invention may be a symmetric encryption key or an asymmetric encryption key.
  • the access point negotiates with the site 1 for encryption key
  • the processor 41 performs shared encryption key negotiation with the site 1
  • the processor 41 obtains Ekey1
  • the processor 41 uses Ekey1.
  • the new MAC address of Site 1 is encrypted for the encryption key of the symmetric encryption algorithm.
  • the AID needs to be updated simultaneously, the new AID is also encrypted with the encryption key.
  • Site 1 decrypts with Ekey1 to get the new MAC address and the new AID.
  • the access point and the station 1 generate a Pairwise Transient Key (PTK) by a Pairwise Master Key (PMK) in the four-step handshake phase of the authentication phase, and then generate a temporary key by the PTK. (Temporal Key, TK).
  • PTK Pairwise Transient Key
  • PMK Pairwise Master Key
  • the TK obtained by 128 bits can be directly intercepted by the PTK as Ekey1; or the 128-bit key is taken as the Ekey1 by the PTK in the remaining bits after intercepting KCK, KEK, and TK; or, the access point After random number exchange (Nonce) with station 1, randomize both sides Ekey1 is derived from the number and TK; moreover, the access point and the site 1 derive the Ekey1 by the random number, the timestamp and the TK after performing the random number exchange (Nonce).
  • the key negotiation process is a four-step handshake and a random number exchange process.
  • the encryption key is an asymmetric encryption key, it is usually a public key.
  • the encryption key negotiation between the access point and the site 1 is taken as an example.
  • Ekey1 is an RSA public key that Site 1 sends to the access point.
  • the access point encrypts the new MAC address and the new AID of the site 1 by Ekey1, and the site 1 receives the corresponding RSA private key for decryption.
  • the corresponding key negotiation process is mainly for the public key transmission and reception process.
  • the processor 41 encrypts the new MAC address and the new AID of the site with an encryption key negotiated with the site.
  • the encryption of the new MAC address and the new AID can be encrypted together, or separately.
  • Ekey1 encrypts the new MAC address (MAC1-1) and the new AID (AID1-1) of Site 1.
  • Ekey1 may be a symmetric encryption key or an asymmetric encryption key. In the embodiment of the present invention, a symmetric encryption key is preferred.
  • the above is only an example of the encryption key negotiation between the access point and the site 1.
  • the process of negotiating the encryption key of the access point with other sites and encrypting the new MAC address and the new AID are basically the same as above. This is not repeated.
  • the processor 41 notifies the station of the new MAC address and the new AID by the transmitter 44, when the predetermined time or the predetermined time point indicating the change is carried, the time information received by each station can ensure that the stations and the access points after the unified time Make changes. For example, when the time information is a timing moment, the TSF time of each station is synchronized with the access point. When the timers of each station and the access point are timed to the moment, each station will allocate a new MAC to the access point.
  • the new AID is configured to the MAC layer, and the access point also updates the MAC address and the AID of each site, so that when receiving the site message with the sending address as the new MAC address, the access point can determine the information of the site and Shared information for the site, such as shared data encryption keys.
  • the access point In the subsequent message interaction, at least one of the new MAC address of the station and the new AID is used as the addressing identifier.
  • each step of the above method may be completed by an integrated logic circuit of hardware in the processor 41 or an instruction in a form of software.
  • Embodiments of the invention may be implemented or implemented The various methods, steps, and logic blocks disclosed.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 42, and the processor 41 reads the information in the memory 42 and performs the steps of the above method in combination with its hardware.
  • FIG. 22 is a schematic structural diagram of a second site according to an embodiment of the present invention.
  • the site 500 of the embodiment includes a processor 51 (may be one or more, and one embodiment of the present invention takes one as an example). ), memory 52, receiver 53, transmitter 54, and bus system 55, wherein:
  • the processor 51 controls the operation of the station 500, which may also be referred to as a CPU (Central Processing Unit).
  • Processor 51 may be an integrated circuit chip with signal processing capabilities.
  • the processor 51 can also be a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuit (ASIC), a Field-Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • Memory 52 can include read only memory and random access memory and provides instructions and data to processor 51. A portion of memory 52 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the various components of the station 500 are coupled together by a bus system 55, which may include, in addition to the data bus, a power bus, a control bus, a status signal bus, and the like.
  • the bus system may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus.
  • the bus may be one or more physical lines, and when it is a plurality of physical lines, it may be divided into an address bus, a data bus, a control bus, and the like.
  • the processor 51, the memory 52, and the receiver 53, the transmitter 54 may also be directly connected through a communication line.
  • various buses are labeled as bus system 55 in the figure.
  • the memory 52 stores the following elements, executable modules or data structures, or their Subsets, or their extension sets:
  • Operation instructions include various operation instructions for implementing various operations.
  • Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the processor 51 performs the following operations by calling an operation instruction stored in the memory 52 (the operation instruction can be stored in the operating system):
  • the processor 51 learns the encrypted new MAC address corresponding to the site, decrypts and obtains a new MAC address, and acquires a predetermined change condition, and each site corresponds to a different new MAC address.
  • the access point in order to prevent the eavesdropper from tracking the user's private information by tracking the AID of the site, the access point notifies the site of the new MAC address, but also notifies the site of the new AID corresponding to the site. Therefore, in the preferred embodiment of the present invention, when the processor 51 learns the encrypted new MAC address corresponding to the site, the processor 51 can also learn the encrypted new AID corresponding to the site, and decrypt the obtained new MAC address and the new AID.
  • the processor 51 can receive the encrypted new MAC address and the new AID allocated by the access point for the site correspondingly through the receiver 53, and decrypt the obtained new MAC address and the new AID.
  • the processor 51 sends a change request to the access point through the transmitter 54, and the change request of the site includes the new MAC address requested by the site, and the encrypted new MAC address corresponding to the site is obtained from the confirmation message of the access point responding to the change request. Address and further learn about the new AID.
  • the processor 51 learns the new AID from the confirmation message of the access point responding to the change request; or learns the new AID from another message sent by the access point.
  • the processor 51 learns that the encrypted new MAC address and the new AID corresponding to the site are obtained by receiving the encrypted new MAC address and the new AID allocated by the access point, so as to obtain the encrypted corresponding to the site.
  • New MAC address and new AID are obtained by receiving the encrypted new MAC address and the new AID allocated by the access point, so as to obtain the encrypted corresponding to the site.
  • the processor 51 requests the access point to send a MAC address change to the access point, that is, sends a change request to the access point, where the change request includes a new MAC address of the site request, where it should be noted that
  • the new MAC address carried in the request is also encrypted.
  • the access point receives the request from the site and decrypts the requested new MAC address for uniqueness verification, and then presents a confirmation message as a response to the request.
  • the station learns the encrypted new MAC address corresponding to the site from the confirmation message of the access point responding to the change request, and further learns the new AID.
  • a possible implementation manner for the access point to perform unique authentication on the new MAC address requested by the site may be: all the new MAC addresses requested by the site and all the basic service sets in the BSS of the access point service. The MAC address of the site is compared. If the new MAC address requested by the site is not currently used by any site in the BSS of the access point service, the unique MAC address uniqueness requested by the site is verified.
  • the new MAC address corresponding to the site is the new MAC address requested by the site, and when the new MAC address requested by the site does not pass the uniqueness verification, the new MAC address corresponding to the site is The access point assigns a unique new MAC address to the site, and the new AID corresponding to the site is allocated by the access point for the site.
  • the new AID can be carried in the acknowledgment message or can be sent separately through another message.
  • the access point also carries the change time T in the confirmation message to the station.
  • At least two stations in the BSS where the access point is located can support the addressing identifier (in this embodiment, a MAC address, or a MAC address and an AID).
  • the change trigger condition is met, at least two sites will send a MAC address change request to the access point within a certain time period t after the change trigger condition is met. Therefore, when the access point receives the change request of the first station, if the time is T0, the time T specified by the access point meets the following conditions, and it can be guaranteed that at least two sites will be changed before the T time arrives.
  • Request ie T>T0+t.
  • the site sends a change request to the access point.
  • the site may also be implemented by defining an operation frame or a new management frame or a new information element (IE).
  • the method for defining the operation frame is in the second embodiment and the embodiment.
  • the third has been explained.
  • a new IE is defined as an example, but is not limited thereto.
  • the newly defined information elements can be carried in various management frames, such as Probe Request/Response, Reassociation Request/Response, and Beacon frames.
  • the processor 51 is further configured to change the MAC address of the site to a new MAC address corresponding to the site when the predetermined change condition is met, so that when the subsequent access point receives and sends a message to the access point, the new MAC address is used as the site. MAC address.
  • the processor 51 When the processor 51 obtains the new MAC address corresponding to the site and simultaneously learns the encrypted new AID corresponding to the site, the processor 51 updates the MAC address and the AID of the site to the new MAC address corresponding to the site when the predetermined condition is met. And the new AID, the next time the message is received, At least one of a new MAC address and a new AID is used as an addressing identifier.
  • the processor 51 is further configured to perform encryption key negotiation with the access point to decrypt the obtained new MAC address and the new AID by using a corresponding decryption method according to the negotiated encryption key type, where the encryption key is a symmetric encryption key or Asymmetric encryption key.
  • the processor 51 decrypts with the corresponding key
  • the processor 51 decrypts with the private key corresponding to the key.
  • the embodiment of the present invention further provides a communication system, where the communication system includes the access point provided by any of the foregoing embodiments, and the site provided by any of the foregoing embodiments.
  • the communication system includes the access point provided by any of the foregoing embodiments, and the site provided by any of the foregoing embodiments.
  • each step of the above method may be completed by an integrated logic circuit of hardware in the processor 51 or an instruction in a form of software.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 52, and the processor 51 reads the information in the memory 52 and performs the steps of the above method in combination with its hardware.
  • the method for allocating the addressing identifier and the access point, the station, and the communication system provided by the embodiment of the present invention can be understood that the present invention adjusts the MAC address transformation of multiple sites in the entire basic service set through the access point to multiple sites. Notifying each site of the encrypted new MAC address and the new AID, so that each site changes its respective MAC address and AID to its corresponding new MAC address and new AID when the predetermined change condition is reached, when the reservation is reached. When the condition is changed, the access point also updates the MAC address of multiple sites to the new MAC address corresponding to the site, and updates the AID of the site to the new AID corresponding to the site.
  • the new MAC address and the new AID sent by the access point to the site are encrypted, and the eavesdropper cannot steal the new MAC address and the new AID.
  • the eavesdropper cannot continue after the change Track the MAC address and AID to obtain the privacy of the end user, and protect the privacy of the user.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种分配寻址标识的方法及接入点、站点、通信系统。其中，分配寻址标识的方法包括：接入点向至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件，以使得至少两个站点在达到所述预定更改条件时，分别将各自的MAC地址更改为各自的新MAC地址；在达到预定更改条件时，接入点将至少两个站点的MAC地址更新为站点对应的新MAC地址，以使得后续自站点接收和向站点发送消息时，以新MAC地址作为站点的MAC地址。通过上述方式，本发明能够使窃听者无法通过MAC地址来追踪终端获取用户隐私，保障了用户的隐私安全。

Description

分配寻址标识的方法及接入点、站点和通信系统
本申请要求于2014年3月25日提交中国专利局、申请号为201410114893.2中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域，特别是涉及一种分配寻址标识的方法及接入点、站点和通信系统。
背景技术
无线局域网(wireless local area network，WLAN)能够在一个有限的范围内为其中的终端提供无线数据传输服务。在基于IEEE802.11的WLAN(又称Wi-Fi，Wireless Fidelity，无线保真)中，通过网关等设备还能够使其中的终端设备接入因特网(Internet)。由于Wi-Fi具有的部署快速、使用便利和传输速率高等优势，因而已被广泛应用于各个行业。
IEEE802.11规范中规定了WLAN中基于介质访问控制(Media Access Control，MAC)地址进行寻址。通常窃听者通过在空口上接收和分析消息报文，可以得到无线消息收发方的MAC地址。通过追踪某一个终端的MAC地址，可以获得该终端用户的隐私信息，如经常出现的地点、时间，通过大量数据分析可以获知该终端用户的生活习惯、兴趣爱好甚至社会关系等隐私信息。
为了保证用户隐私安全，目前也有向站点分配寻址标识的方案，但是这不足以彻底解决MAC地址追踪用户隐私的问题。例如，在某一时间内，接入点(Access Point，AP)向其服务的基本服务集内的某一个终端分配了临时MAC地址，窃听者若获取了该基本服务集下的所有终端的MAC地址，当发现有一个MAC地址不再出现，而另一个新的MAC地址出现时，就能认定该新MAC地址为原终端更改后的MAC地址，从而继续对该终端进行追踪。
发明内容
本发明实施例提供一种分配寻址标识的方法及接入点、站点，以避免窃听者通过MAC地址来追踪终端获取用户隐私，保障了用户的隐私安全。
第一方面，本发明提供一种分配寻址标识的方法，所述寻址标识包括介质访问控制MAC地址，所述寻址标识方法包括：接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件，以使得所述至少两个站点在达到所述预定更改条件时，将各自的MAC地址更改为各自的所述新MAC地址；在达到所述预定更改条件时，所述接入点将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，以使得后续自所述站点接收和向所述站点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
结合第一方面，在第一方面的第一种可能的实现方式中：所述寻址标识还包括关联标识AID；所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址时，还通知站点对应的加密的新AID；在达到预定更改条件时，所述接入点将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，将所述至少两个站点的AID更新为所述站点对应的所述新AID。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中：接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的所述新MAC地址和新AID的步骤之前，还包括：所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID，每个所述站点分别对应不同的新MAC地址和新AID。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中：所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID的步骤包括：所述接入点接收其服务的BSS内的所述至少两个站点的更改请求，每个所述站点的更改请求中包括每个所述站点请求的新MAC地址；所述接入点对每个所述站点请求的新MAC地址进行唯一性查证，在所述唯一性查证通过时，为每个所述站点分配新AID，每个所述站点请求的所述新MAC地址和分配的所述AID即为确认的所述站点的新MAC地址和新AID；所述向所述至少两个站点通知每个所述站点对应的加密的所述新MAC地址和新AID的步骤包括：所述接 入点以单播方式向每个所述站点回复确认消息，所述确认消息指示同意所述站点使用请求的所述新MAC地址，并向每个所述站点通知新AID；所述新AID在所述确认消息中携带或通过从所述接入点发送的另一消息发送。
结合第一方面的第二种可能的实现方式，在第一方面的第四种可能的实现方式中：所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID的步骤包括：所述接入点为其服务的BSS内的至少两个站点分配新MAC地址和新AID，每个所述站点分配的所述新MAC地址和新AID为确认的所述站点对应的新MAC地址和新AID；所述向所述至少两个站点通知每个所述站点对应的加密的所述新MAC地址和新AID的步骤包括：通过单播方式分别向所述至少两个站点发送所述站点对应的加密的所述新MAC地址和新AID。
结合第一方面或第一方面第一种至第四种任一可能的实现方式，在第一方面的第五种可能的实现方式中：所述指示预定更改条件包括：所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址时，携带指示更改的预定时间或预定时间点；或所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过单播的方式分别向所述至少两个站点发送更改指示消息；或所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过广播的方式向所述至少两个站点群发更改指示消息。
结合第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现方式中：所述通过广播的方式向所述至少两个站点群发更新指示消息的步骤包括：通过广播添加了指示位的信标帧向所述至少两个站点群发更新指示消息，所述指示位包含用于指示所述至少两个站点进行寻址标识更改的更改指示信息。
结合第一方面，在第一方面的第七种可能的实现方式中：所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址的步骤之前，还包括：所述接入点与所述至少两个站点之间进行加密密钥协商，所述接入点获取用于对每个所述站点的新MAC地址进行加密的加密密钥，所述加密密钥为对称加密密钥或非对称加密密钥。
第二方面，本发明实施例提供一种分配寻址标识的方法，所述寻址标识包括介质访问控制MAC地址，所述分配寻址标识的方法包括：站点获知由其所在的基本服务集BSS内的接入点通知的所述站点对应的加密的新MAC地址，解密获得新MAC地址，并获取预定更改条件，所述站点在满足所述预定更改条件时，将当前使用的MAC地址更改为所述新MAC地址，以使得后续自所述接入点接收和向所述接入点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
结合第二方面，在第二方面的第一种可能的实现方式中：所述寻址地址还包括关联标识AID，所述站点获知所述站点对应的加密的新MAC地址的同时，还获取所述站点对应的加密的新AID；所述站点在满足所述预定更改条件时，将当前使用的MAC地址更改为所述新MAC地址，并将当前使用的AID更改为所述新AID。
结合第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中：站点获知所述站点对应的加密的新MAC地址和新AID的步骤包括：所述站点接收接入点为所述站点对应分配的加密的新MAC地址和新AID。
结合第二方面的第一种可能的实现方式，在第二方面的第三种可能的实现方式中：站点获知所述站点对应的加密的新MAC地址和新AID的步骤包括：所述站点向接入点发送更改请求，所述站点的更改请求中包括所述站点请求的新MAC地址，所述站点从所述接入点响应所述更改请求的确认消息中，获知所述站点对应的加密的新MAC地址，并进一步从所述接入点响应所述更改请求的所述确认消息中或从所述接入点发送的另一消息中获知加密的新AID。
结合第二方面，在第二方面的第四种可能的实现方式中：站点获知所述站点对应的加密的新MAC地址的步骤之前，还包括：所述站点与接入点进行加密密钥协商，以使所述站点根据协商的加密密钥类型，使用对应的解密方法解密获得所述新MAC地址，所述加密密钥为对称加密密钥或非对称加密密钥。
第三方面，本发明实施例提供一种接入点，所述接入点包括通知模块以及更新模块，其中：所述通知模块用于向所述接入点服务的基本服务集 BSS内至少两个站点通知每个站点对应的加密的新介质访问控制MAC地址，并指示预定更改条件，以使得所述至少两个站点在达到所述预定更改条件时，将各自的MAC地址更改为各自的所述新MAC地址；所述更新模块用于在达到所述预定更改条件时，将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，以使得后续自所述站点接收和向所述站点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
结合第三方面，在第三方面的第一种可能的实现方式中：所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址时，还向所述至少两个站点通知每个站点对应的加密的新关联标识AID；所述更新模块在达到所述预定更改条件时，将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，并将所述至少两个站点的AID更新为所述站点对应的所述新AID。
结合第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中：所述接入点还包括确认模块，其中：所述确认模块具体用于确认所述接入点服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID，每个站点分别对应不同的新MAC地址和新AID。
结合第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中：所述确认模块具体用于接收所述接入点服务的BSS内的所述至少两个站点的更改请求，每个所述站点的更改请求中包括每个所述站点请求的新MAC地址，对每个所述站点请求的新MAC地址进行唯一性查证，在所述唯一性查证通过时，为每个所述站点分配新AID，每个所述站点请求的所述新MAC和分配的所述新AID即为所述确认的所述站点的新MAC地址和新AID；所述通知模块具体通过单播方式向每个所述站点回复确认消息，所述确认消息指示同意所述站点使用请求的所述新MAC地址，并向每个所述站点通知新AID，所述新AID在所述确认消息中携带或通过另一消息发送。
结合第三方面的第二种可能的实现方式，在第三方面的第四种可能的实现方式中：所述确认模块具体用于为接入点服务的BSS内的至少两个站点分配新MAC地址和新AID，每个所述站点分配的所述新MAC地址和新AID为确认的所述站点对应的新MAC地址和新AID；所述通知模块具体通 过单播方式分别向所述至少两个站点发送所述站点对应的加密的所述新MAC地址和新AID。
结合第三方面或第三方面的第一种至第四种任一种可能的实现方式，在第三方面的第五种可能的实现方式中：所述通知模块具体通过以下方式之一指示预定更改条件：所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址时，携带指示更改的预定时间或预定时间点；或所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过单播的方式分别向所述至少两个站点发送更改指示消息；或所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过广播的方式向所述至少两个站点群发更改指示消息。
结合第三方面的第五种可能的实现方式，在第三方面的第六种可能的实现方式中：所述通知模块具体通过广播添加了指示位的信标帧向所述至少两个站点群发更新指示消息，所述指示位包含用于指示所述至少两个站点进行寻址标识更改的更改指示信息。
结合第三方面，在第三方面的第七种可能的实现方式中：所述接入点还包括密钥获取模块，其中：所述密钥获取模块用于与所述至少两个站点之间进行加密密钥协商，获取用于对每个站点的新MAC地址进行加密的加密密钥，所述加密密钥为对称加密密钥或非对称加密密钥。
第四方面，本发明实施例提供一种站点，所述站点包括获得模块和更改模块，其中：所述获得模块用于获知由所述站点所在的基本服务集BSS内的接入点通知的所述站点对应的加密的新介质访问控制MAC地址，解密获得新MAC地址，并获取预定更改条件，每个所述站点分别对应不同的所述新MAC地址；所述更改模块用于在满足预定更改条件时，将所述站点当前使用的MAC地址更改为所述站点对应的所述新MAC地址，以使得后续自所述接入点接收和向所述接入点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
结合第四方面，在第四方面的第一种可能的实现方式中：所述获得模块在获知所述站点对应的加密的新MAC地址时，还获知所述站点对应的加 密的新关联标识AID，解密获得新MAC地址和新AID；所述更改模块在满足预定更改条件时，将所述站点当前使用的MAC地址和AID更改为所述站点对应的新MAC地址和新AID。
结合第四方面的第一种可能的实现方式，在第四方面的第二种可能的实现方式中：所述获得模块具体通过接收接入点为所述站点对应分配的加密的新MAC地址和新AID，解密获得所述新MAC地址和新AID。
结合第四方面的第一种可能的实现方式，在第四方面的第三种可能的实现方式中：所述获得模块具体通过向接入点发送更改请求，所述站点的更改请求中包括所述站点请求的新MAC地址，从所述接入点响应所述更改请求的确认消息中，获知所述站点对应的加密的新MAC地址，并进一步从所述接入点响应所述更改请求的所述确认消息中或从所述接入点发送的另一消息中获知加密的新AID。
结合第四方面，在第四方面的第四种可能的实现方式中：所述站点还包括密钥协商模块，其中：所述密钥协商模块用于与接入点进行加密密钥协商；所述获得模块根据所述密钥协商模块协商的加密密钥类型，使用对应的解密方法解密获得所述新MAC地址，所述加密密钥为对称加密密钥或非对称加密密钥。
第五方面，本发明实施例提供一种通信系统，所述通信系统包括第三方面或第三方面的任一种可能的实现方式中的接入点以及第四方面或第四方面任一种可能的实现方式中的站点。
本发明的有益效果是：区别于现有技术的情况，本发明通过接入点来调整整个基本服务集中多个站点的MAC地址变换，向多个站点通知每个站点对应的加密的新MAC地址，以使每个站点在达到预定更改条件时，分别将各自的MAC地址更改为其对应的新MAC地址，在达到预定更改条件时，接入点也将多个站点的MAC地址更新为站点对应的新MAC地址。通过这样的方式，接入点向站点发送的新MAC地址经过加密，窃听者无法窃取到新MAC地址。通过控制多个站点都变换MAC地址，因此更改MAC地址后，窃听者无法继续追踪终端MAC地址获取用户隐私，保障了用户的隐私安全。
附图说明
图1是本发明实施例提供的一种通信系统的示意图；
图2是本发明实施例提供的第一种分配寻址标识的方法的流程图；
图3是本发明实施例提供的第二种分配寻址标识的方法的流程图；
图4是本发明实施例提供的一种操作帧的示意图；
图5是本发明实施例提供的第一种接入点向站点发送的分配新MAC地址和新AID的操作帧示意图；
图6是本发明实施例提供的站点回复接入点确认消息的操作帧示意图；
图7是本发明实施例提供的第二种接入点向站点发送的分配新MAC地址和新AID的操作帧；
图8是本发明实施例提供的接入点以广播方式向各站点发送的标识更改消息的操作帧示意图；
图9是本发明实施例提供的第三种分配寻址标识的方法的流程图；
图10是本发明实施例中站点向接入点发送更改请求的IE格式示意图；
图11是本发明实施例中站点1向接入点发送重新关联请求的帧格式示意图；
图12是本发明实施例中接入点向站点1发送重新关联响应的帧格式示意图；
图13是本发明实施例中接入点向站点发送更改指示信息的信标帧示意图；
图14是本发明实施例提供的第四种分配寻址标识的方法的流程图；
图15是本发明实施例提供的第五种分配寻址标识的方法的流程图；
图16是本发明实施例提供的第六种分配寻址标识的方法的流程图；
图17是本发明实施例提供的第七种分配寻址标识的方法的流程图
图18是本发明实施例提供的第一种接入点的结构示意图；
图19是本发明实施例提供的第二种接入点的结构示意图；
图20是本发明实施例提供的第一种站点的结构示意图；
图21是本发明实施例提供的第三种接入点的结构示意图；
图22是本发明实施例提供的第二种站点的结构示意图。
具体实施方式
请参阅图1，图1为本发明实施例提供的一种通信系统的示意图，通信系统包括接入点AP以及AP服务范围的基本服务集(Basic Service Set，BSS)内的站点。
IEEE802.11规范规定了2.4GHz、5GHz甚至60GHz频谱上的无线传输的物理层和MAC层协议。在一个IEEE802.11规范规定的基本服务集BSS中，AP为一个BSS中的承担控制实体功能的站点，向与其关联的其他站点提供到分布系统(Distribution System，DS)的接入。此外AP还可以用点协调功能(Point Control Function，PCF)来协调各站点的数据发送。本实施例中的通信系统中的AP关联了站点1～5共5个站点。
其中，以下本发明实施例中所提到的站点，是指用户站点或用户终端等。
请参阅图2，图2是本发明实施例提供的第一种分配寻址标识的方法的流程图，本实施例以接入点的角度来进行描述，本实施例的分配寻址标识的方法包括：
S101：接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件；
其中，本实施例中，寻址标识包括MAC地址。
接入点分别向至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件。以使得至少两个站点在达到预定更改条件时，分别将各自的MAC地址更改为各自的新MAC地址。
其中，指示预定更改条件可以有以下几种可能的实现方式：
1)接入点向至少两个站点通知每个站点对应的加密的新MAC地址时，携带指示更改的预定时间或预定时间点；
2)接入点向至少两个站点通知每个站点对应的加密的新MAC地址后，通过单播的方式分别向至少两个站点发送更改指示消息；
3)接入点向至少两个站点通知每个站点对应的加密的新MAC地址后，通过广播的方式向至少两个站点群发更改指示消息。
也就是说，指示预定更改条件可以以单播或广播的方式发送，其中，优选通过广播发送。当以单播的方式发送时，可以在进行所述通知的同一 时间发送并携带进行更改的时间信息。当以广播发送时，接入点可以在工作信道上广播一个更改指示消息，指示站点进行MAC地址的更改。
各个站点在获得各自对应的新MAC地址，并达到预定更改条件时，将新MAC地址配置到MAC层。在随后的消息交互中，以站点的新MAC地址作为寻址标识。
S102：在达到预定更改条件时，接入点将至少两个站点的MAC地址更新为站点对应的新MAC地址，以使得后续自站点接收和向站点发送消息时，以新MAC地址作为站点的MAC地址；
在达到预定更改条件时，接入点将其内部的至少两个站点的MAC地址更新为站点对应的新MAC地址。这样，在下一个自站点接收的消息和向站点发送的消息中，以站点的新MAC地址作为站点的MAC地址。
通过上述本发明实施例的详细描述，可以理解，本发明通过接入点来调整整个基本服务集中多个站点的MAC地址变换，向多个站点通知每个站点对应的加密的新MAC地址，以使每个站点在达到预定更改条件时，分别将各自的MAC地址更改为其对应的新MAC地址，在达到预定更改条件时，接入点也将多个站点的MAC地址更新为站点对应的新MAC地址。通过这样的方式，接入点向站点发送的新MAC地址经过加密，窃听者无法窃取到新MAC地址。通过控制多个站点都变换MAC地址，因此更改MAC地址后，窃听者无法继续追踪终端MAC地址获取用户隐私，保障了用户的隐私安全。
请参阅图3，图3是本发明实施例提供的第二种分配寻址标识的方法的流程图，本实施例以接入点的角度来进行描述，本实施例的分配寻址标识的方法包括：
S201：接入点与至少两个站点之间进行加密密钥协商，接入点获取用于对每个站点的新MAC地址进行加密的加密密钥；
接入点与至少两个站点的每个站点分别进行共享加密密钥协商，接入点得到用于对站点的新MAC地址进行加密的加密密钥Ekey。本发明实施例中的加密密钥可以是对称加密密钥或非对称加密密钥。
当加密密钥为对称加密密钥时，以接入点与站点1进行加密密钥协商为例，接入点跟站点1进行共享加密密钥协商，接入点得到Ekey1，接入点 以Ekey1为对称加密算法的加密密钥，对站点1的新MAC地址进行加密。当在优选实施例中，需要同时更新站点的关联标识(Association ID，AID)时，也用该加密密钥对新AID进行加密。站点1用Ekey1解密得到新MAC地址和新AID。其中，接入点与站点1在认证阶段的四步握手阶段由成对主密钥(Pairwise Master Key，PMK)生成成对瞬时密钥(Pairwise Transient Key，PTK)，再由PTK生成临时密钥(Temporal Key，TK)。
本实施例中，可以由PTK直接截取128位得到的TK来做为Ekey1；或者由PTK在截取KCK(Key Confirmation Key，密钥确认密钥)、KEK(Key Encryption Key，密钥加密密钥)、TK后的剩余位中取128位的密钥来作为Ekey1；或者，接入点与站点1进行随机数(Nonce)交换后，以双方随机数及TK来衍生出Ekey1；更多地，接入点与站点1在进行随机数(Nonce)交换后，以双方随机数、时间戳(timestamp)及TK来衍生出Ekey1。衍生方法有多种，如以随机数、时间戳和TK进行散列算法运算SHA-256后取高128位或低128位等。相应地，密钥协商过程为四步握手及随机数交换等过程。
当加密密钥为非对称加密密钥时，通常是一个公钥。同样以接入点与站点1进行加密密钥协商为例。比如，当使用RSA(Rivest Shamir Adleman)算法时，Ekey1为站点1发送给接入点的一个RSA公钥。接入点以Ekey1对站点1的新MAC地址和新AID进行加密，站点1收到后以相应的RSA私钥进行解密。相应的密钥协商过程主要为公钥发送接收过程。
接入点以与站点协商好的加密密钥对站点的新MAC地址和新AID进行加密。其中，对新MAC地址和新AID的加密可以两个一起加密，也可以分开单独加密。比如以Ekey1对站点1的新MAC地址(MAC1-1)和新AID(AID1-1)进行加密为例。这里的Ekey1可以是对称加密密钥或非对称加密密钥，本发明实施例中优选对称加密密钥。
当Ekey1为对称加密密钥时，加密MAC1-1和AID1-1的加密方式可以为AES-CCM方式，Ekey1为128比特的密钥，其加密式可以表示为：
加密的MAC1-1和AID1-1＝AES-CCM-128Ekey1(MAC1-1和AID1-1)
需要说明的是，MAC1-1和AID1-1可以分别进行加密，如
加密的MAC1-1＝AES-CCM-128Ekey1(MAC1-1)
加密的AID1-1＝AES-CCM-128Ekey1(AID1-1)
上述只是以接入点与站点1进行加密密钥协商为例进行说明，接入点与其他站点的加密密钥协商的过程以及对新MAC地址和新AID进行加密的过程跟上述基本一致，在此不一一赘述。
S202：接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址；
在优选实施例中，为进一步避免窃听者通过跟踪AID而追踪到用户隐私，可以同时更新站点的AID。当需要同时更新站点的AID时，接入点确认其服务的基本服务集BSS内的至少两个站点各自的新MAC地址时，同时确认每个站点对应的新AID。
其中，每个站点分别对应不同的新MAC地址和新AID。
其中，本实施例中提供接入点确认其服务的BSS内的至少两个站点各自对应的新MAC地址和新AID的两种可能的实现方式，当然，在能够实现本发明目的的基础上，也可以采用其他可能的方式来实现。
第一种方式：接入点接收其服务的BSS内的至少两个站点的更改请求，每个站点的更改请求中包括每个站点请求的新MAC地址。也就是说，站点会在请求中携带自己优先希望使用的新MAC地址。当接入点接收到至少两个站点的更改请求后，对每个站点请求的新MAC地址进行唯一性查证，在唯一性查证通过时，为每个站点分配新AID。以每个站点请求的新MAC地址和分配的新AID作为确定的站点对应的新MAC地址和新AID。
其中，本发明实施例中，对站点请求的新MAC地址进行唯一性查证的一种可能的实现方式可以是：将站点请求的新MAC地址与接入点服务的基础服务集BSS内的所有站点的MAC地址进行比对，若站点请求的新MAC地址当前未被接入点服务的BSS内任何一个站点使用过，则认为站点请求的新MAC地址唯一性查证通过。
第二种方式：接入点为其服务的BSS内的至少两个站点分配新MAC地址和新AID，每个站点分配的新MAC地址和新AID为确认的站点对应的新MAC地址和新AID。
需要说明的是，上述步骤S201与S202在实际应用过程中，不严格区分先后，也就是说，可以先执行S201再执行S202，或者先执行S202再执 行S201，甚至可以S201与S202同步执行。
S203：接入点向至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件；
接入点分别向至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件。以使得至少两个站点在达到预定更改条件时，分别将各自的MAC地址更改为各自的新MAC地址。
其中，在优选实施例中，为了避免窃听者通过跟踪AID进一步获取用户隐私，在更新站点的MAC地址的同时，将站点的AID也一起更改。因此，在优选实施例中，接入点向至少两个站点通知每个站点对应的加密的新MAC地址时，还可以通知每个站点对应的加密的新AID。以使得至少两个站点在达到预定更改条件时，将各自的MAC地址和新AID都更改为各自的新MAC地址和新AID。
当接入点确认其服务的BSS内的至少两个站点各自对应的新MAC地址和新AID是通过上述第一种方式实现时，接入点以单播方式向每个站点回复确认消息，确认消息指示同意站点使用其请求的新MAC地址，并向每个站点通知新AID。而当站点请求的新MAC地址在唯一性查证没有通过时，回复的确认消息中携带一个符合唯一性的新MAC地址。其中，新AID可以在确认消息中携带，或通过另一消息发送。
当接入点确认其服务的BSS内的至少两个站点各自对应的新MAC地址和新AID是通过上述第二种方式实现时，接入点可以通过单播方式分别向至少两个站点发送站点对应的加密的新MAC地址和新AID。
在实际实现中，可以定义一个信息元素(Information Element，IE)或是一个新的管理帧(Management Frame)来完成MAC地址和AID更改的相关消息交互；此外在IEEE802.11中还定义了一种叫做操作帧(Action Frame)的管理帧，通过定义新的操作类别(Action Category)来定义一种单独业务活动需要的管理帧。本实施例以定义一种操作帧为例进行说明，但并不以此为限。
请参阅图4，图4是本实施例提供的一种操作帧的示意图，其中在MAC头中的帧控制字段中，如果Type域的Type Value＝00，指示该帧为管理帧，如Subtype域的Subtype Value＝1101，则进一步指示该帧为管理帧中的操作 帧(也可以示意为如图5中所示的Subtype＝操作帧)。其中，RA表示Receiver Address，即消息的接收地址；TA表示Transmitter Address，即消息的发送地址；在操作帧的帧主体中定义一个新的操作类别的标识，表示为ID(Identity，身份)更改业务的操作，以Change ID表示，简化表示为CID，长度为1字节。CID消息模式位表示该操作帧是用于标识更改安排指示还是用于标识更改确认。其中，标识更改安排指示是用于指示该帧是接入点向站点发送的，用于指示更改寻址标识，而标识更改确认是指示该帧是站点向接入点发送的，对接入点更改寻址标识指示的确认。
其中，示例性的，CID消息模式ID对应关系可以见下表1所示：
表1：CID消息模式ID对应情况
Figure PCTCN2015075002-appb-000001
例如，根据表1的描述，当接入点向站点1发送新的MAC地址和AID等信息时，CID消息模式ID设为1，并在后面的CID元素内容中带上加密的MAC和AID及标识更改时间信息。如图5所示，其中RA为站点1当前地址MAC1-0，即更改前的MAC地址。
站点1接收接入点发送的消息后，解密得到MAC1-1和AID1-1，向AP回复一个确认消息，表示接受MAC1-1和AID1-1。如图6所示。
另外，接入点向站点发送MAC地址和AID时，可以不带时间信息T，以接入点向站点1发送MAC1-1和AID1-1为例，其操作帧的示意图如图7所示。在这种情况下，接入点可以以广播方式向各站点发送一个更改指示消息来使各站点进行更改，该广播消息也可以通过一个操作帧来实现。如图8所示。
或者，更改指示消息也可以通过信标(Beacon)帧等广播消息添加一个指示位(如图8所示的Indication)来向各站点指示，比如当指示位被置1时，站点接收到信标帧后进行MAC地址和AID的更新，当指示位被置0 时，站点接收到信标帧后不进行MAC地址和AID的更新。
上述都是以接入点与站点1的交互进行举例说明，接入点跟其他站点的交互过程基本一致，不一一赘述。
S204：在达到预定更改条件时，接入点将至少两个站点的MAC地址更新为站点对应的新MAC地址，以使得后续自站点接收和向站点发送消息时，以新MAC地址作为站点的MAC地址。
当同时需要更新站点的AID时，在达到预定更改条件时，接入点将至少两个站点的MAC地址和AID更新为站点对应的新MAC地址。
当接入点向站点通知新MAC地址和新AID时携带了指示更改的预定时间或预定时间点时，各站点收到的时间信息能够保证各站点和接入点在同一时间后进行更改，如当时间信息为一个计时时刻，各站点的TSF(Timing Synchronization Function，定时同步功能)时间与接入点是保持同步的，当各站点与接入点的计时器都计时到该时刻后，各站点将接入点分配的新MAC和新AID配置到MAC层，接入点也将各站点的MAC地址和AID进行更新，以使得当收到发送地址为新的MAC地址的站点消息时，接入点可以确定该站点的信息及该站点的共享信息，如共享数据加密密钥等。在随后的消息交互中，以站点的新MAC地址、新AID的至少一种作为寻址标识。
因为，AP在关联阶段向站点分配了16位的AID。在省电模式下，终端发送的PS-Poll(Power Saving Poll，省电轮询)消息中会明文携带AID，因此终端若仅仅变换了MAC地址，窃听者还可以通过分析AID找到终端的新旧MAC地址的对应关系，从而重新锁定该终端。所以本实施例中所提供的分配寻址标识的方法，每个站点的MAC地址进行更新的同时，也同时更改AID。一方面，接入点向站点发送的新MAC地址和新AID都经过加密，窃听者无法窃取到新MAC地址和新AID。另一方面，通过控制多个站点都变换MAC地址和AID，因此更改后，窃听者无法继续追踪终端MAC地址和AID获取用户隐私，保障了用户的隐私安全。
需要说明的是，本发明各实施例中的各种帧的示意图仅是一种示意，每个帧中各字段或域的取值或取值所代表的含义也仅是一种示意，具体可以根据实际情况来确定，本发明对此不作限定，其他地方不再赘述。
请参阅图9，图9是本发明实施例提供的第三种分配寻址标识的方法的流程图，本实施例以站点的角度来进行描述，本实施例分配寻址标识的方法包括以下步骤：
S301：站点获知由其所在的基本服务集BSS内的接入点通知的站点对应的加密的新MAC地址，解密获得新MAC地址，并获取预定更改条件，每个站点分别对应不同的新MAC地址；
因为，AP在关联阶段向站点分配了16位的AID。在省电模式下，终端发送的PS-Poll(Power Saving Poll，省电轮询)消息中会明文携带AID，因此终端若仅仅变换了MAC地址，窃听者还可以通过分析AID找到终端的新旧MAC地址的对应关系，从而重新锁定该终端。
所以在一种较为优选的实施例中，可以同时更改站点的MAC地址和AID来避免窃听者通过跟踪站点的AID来追踪到用户的隐私信息。接入点向站点通知新MAC地址的同时，同时也向站点通知站点对应的新AID。因此，在本发明优选实施例中，站点获知站点对应的加密的新MAC地址时，同时获知站点对应的加密的新AID，解密获得新MAC地址和新AID，每个站点分别对应不同的新MAC地址和新AID。
其中，站点在获知其对应的加密的新MAC地址和新AID之前，还包括：站点与接入点之间进行加密密钥协商，以使站点根据协商的加密密钥类型，使用对应的解密方法解密获得新MAC地址和新AID。加密密钥可以是对称加密密钥或非对称加密密钥。比如当加密密钥为对称加密密钥时，站点用对应的密钥进行解密，而当加密密钥为非对称加密密钥时，站点以密钥对应的私钥进行解密。其中，密钥协商以及加密过程可以参考上述实施例中相关部分，在此不一一赘述。
站点获知站点对应的加密的新MAC地址和新AID的一种实现方式是站点接收接入点为其对应分配的加密的新MAC地址和新AID，从而获知其对应的加密的新MAC地址和新AID。
另一种实现方式是：站点向接入点请求MAC地址更改，即向接入点发送更改请求，站点的更改请求中可以包括站点请求的新MAC地址，其中，需要说明的是，请求中携带的新MAC地址也是经加密的，其加密方式可以参考上述实施例的相关部分，在此不再赘述。接入点接收到站点的更改请 求，并解密得到请求的新MAC地址，进行唯一性查证，然后给出一个确认消息以作为对所述更改请求的响应。站点从接入点响应更改请求的确认消息中，获知站点对应的加密的新MAC地址，并可进一步获知新AID。
当站点请求的新MAC地址通过唯一性查证时，站点对应的新MAC地址即为其请求的新MAC地址，而当站点请求的新MAC地址没有通过唯一性查证时，站点对应的新MAC地址为接入点为站点分配的符合唯一性的新MAC地址，而站点对应的新AID都是接入点为站点分配的。新AID可以在确认消息中携带，也可以通过另一消息单独发送。
其中，站点向接入点发送更改请求，在具体实现中，也可以通过定义操作帧或新的管理帧或者新的信息元素(IE)来实现，操作帧的定义方法在实施例二及实施例三中已进行了说明。本实施例中以定义新的IE为例进行说明，但并不以此为限。新定义的信息元素可以携带在各类管理帧中发送，如探测请求/响应(Probe Request/Response)、重新关联请求/响应(Reassociation Request/Response)、信标(Beacon)帧等管理帧。
如图10是本发明实施例中站点向接入点发送更改请求的IE格式示意图。其中，Subtype表示该IE将在哪种管理帧中带出，例如，当该IE在重新关联请求帧中带出时，Subtype value＝0010；当该IE在重新关联响应帧中带出时，Subtype value＝0011；当在信标帧中带出时，Subtype value＝1000。RA为接收地址，TA为发送地址。
CID信息元素主要包括:
信息元素ID:1字节，针对某一业务重新定义一个新的信息元素时，需要新注册一个信息元素ID，当接收方接收到消息时，根据信息元素ID识别业务类型；
信息元素长度：定义了该信息元素的长度；
CID消息模式和CID元素内容：根据不同的消息模式携带不同的内容，如请求request模式(对应表中为1)时携带优先MAC地址，响应response模式(对应表中为2)时携带确认指示和AID，指示位Indication模式(对应表中为4)时携带空内容，如表2所示。
表2：CID消息模式与内容对应表
Figure PCTCN2015075002-appb-000002
Figure PCTCN2015075002-appb-000003
以站点1向接入点请求为例。站点1决定一个优先MAC地址MAC1-1，并对其进行加密，加密方式如前所述。站点1向接入点发送重新关联请求，携带CID IE，其帧格式如图11所示。
接入点在接收到重新关联请求后获得其中的CID IE，然后解密其中的加密的MAC1-1，得到MAC1-1。随后接入点将MAC1-1进行BSS内唯一性查证，查证方式可以是将MAC1-1与BSS内所有站点的MAC地址进行对比，当MAC1-1当前未被任何一个STA使用时，认为MAC1-1在BSS内具备唯一性。接入点对为站点1新分配的AID1-1进行加密。
接入点向站点1发送重新关联响应，携带CID IE，其帧格式如图12所示。
当接入点接收到至少两个站点的更改请求时，接入点可以广播一个消息，携带指示信息。比如，接入点可以广播一个信标(Beacon)帧。在Beacon帧中以某一位来指示各站点进行寻址标识(本实施例中为MAC地址，或，MAC地址和AID)更改；或者，在Beacon帧中携带CID IE，消息格式如图13所示。
在另一种可能的实现方式中，接入点向站点的确认消息中还携带了更改时间T。接入点所在的BSS内至少两个站点能够支持寻址标识(本实施例中是指MAC地址，或MAC地址与AID)的更改。当满足标识更改触发条件时，至少两个站点会在满足标识更改触发条件后某一个时间段t内向接入点发送MAC地址更改请求。因此，当接入点接收到第一个站点的更改请求后，若计时为T0，则接入点规定的时间T满足以下条件时，可以保证T时刻到达前会至少收到两个站点的更改请求，即T＞T0+t。
S302：站点在满足预定更改条件时，将当前使用的MAC地址更改为站点对应的新MAC地址，以使得后续自接入点接收和向接入点发送消息时， 以新MAC地址作为站点的MAC地址；
当站点在获知站点对应的加密的新MAC地址，同时获知了站点对应的加密的新AID时，站点在满足预定更改条件时，将当前使用的MAC地址和AID更新为其对应的新MAC地址和新AID。
在以上提供实施例的基础上，为更进一步清楚描述本发明的分配寻址标识的方法，以下通过接入点与至少两个站点的交互作为举例说明，其中，在以下举例的几个实施例中，站点i表示站点1以外的任何一个站点。MAC1-1和AID1-1分别是站点1的新MAC地址和新AID，MAC1-0为站点1更改前的MAC地址。同理，MACi-1和AIDi-1分别是站点i的新MAC地址和新AID，MACi-0为站点i更改前的MAC地址。
请参阅图14，图14是本发明实施例提供的第四种分配寻址标识的方法的流程图，本实施例适用于以上所提到的接入点主动为站点分配新MAC地址和新AID的情形，本实施例的方法包括以下步骤：
401：接入点与站点1进行共享加密密钥协商(Ekey1)；
接入点与站点1之间进行共享加密密钥协商，确定用于对站点1的新MAC和新AID进行加密的密钥Ekey1。
402：接入点与站点i进行共享加密密钥协商(Ekeyi)；
接入点与站点i之间进行共享加密密钥协商，确定用于对站点i的新MAC和新AID进行加密的密钥Ekeyi。
403：接入点加密MAC1-1和AID1-1；
404：接入点向站点1发送操作帧(MAC1-1，AID1-1，T)；
接入点向站点1发送操作帧，该操作帧携带加密的MAC1-1和AID1-1，以及标识更改时间T，相应的接收地址为MAC1-0。
405：站点1解密获得MAC1-1和AID1-1；
406：站点1向接入点发送操作帧(确认)；
站点1向接入点发送一个操作帧，用于确认已收到MAC1-1和AID1-1，相应的发送地址为MAC1-0。
407：接入点向站点i发送操作帧(MACi-1，AIDi-1，T)；
接入点向站点i发送操作帧，该操作帧携带加密的MACi-1和AIDi-1，以及标识更改时间T，相应的接收地址为MACi-0。
408：站点i解密获得MACi-1和AIDi-1；
站点i接收后，进行解密获得MACi-1，AIDi-1。
409：站点i向接入点发送操作帧(确认)；
站点i向接入点发送一个操作帧，用于确认已收到MACi-1和AIDi-1，相应的发送地址为MACi-0。
410-1：接入点计时器计时到T；
410-2：站点1计时器计时到T；
410-3：站点i计时器计时到T；
上述410-1至410-3只是为了便于区分的步骤编号，事实上，其本身并没有实质的先后顺序之分。
411：接入点更新各站点的MAC地址和AID；
412：站点1更新为MAC1-1和AID1-1；
413：站点i更新为MACi-1和AIDi-1；
在接入点与站点的计时器都计时到T后，接入点和站点都进行MAC地址和AID的更新。
作为另一种可能的实现方式，接入点向站点发送操作帧时，可以不携带指示更改时间T，见图15所示，图15是本发明实施例提供的第五种分配寻址地址的方法的流程图，图15所示实施例与图14所示实施例的区别在于：
在步骤404以及步骤407中，接入点向站点发送的操作帧中不携带指示更改时间T，而步骤410变为：接入点向站点发送操作帧(标识更改指示)，相应的接收地址为广播地址。其余各个步骤的具体实现都跟图14所示实施例一致，请参见之前的详细描述。
也就是说，在本实施例中，接入点在通知站点新MAC和新AID时，不指示更改时间，而在发送新MAC和新AID后，通过广播一个操作帧，用于指示更改，站点在接收到指示后，进行MAC和AID的更新，接入点也在发出指示后，进行各个站点的MAC和AID的更新。
请参阅图16，图16是本发明实施例提供的第六种分配寻址标识的方法的流程图，本实施例适用于以上所提到站点通过向接入点请求以获得新MAC地址和新AID的情形，本实施例的方法包括以下步骤：
501：接入点与站点1进行共享加密密钥协商(Ekey1)；
接入点与站点1之间进行共享加密密钥协商，确定用于对站点1的新MAC和新AID进行加密的密钥Ekey1。
502：接入点与站点i进行共享加密密钥协商(Ekeyi)；
接入点与站点i之间进行共享加密密钥协商，确定用于对站点i的新MAC和新AID进行加密的密钥Ekey1。
503：站点1加密MAC1-1；
站点1将自己优先希望使用的新MAC地址MAC1-1进行加密。
504：站点1向接入点发送重新关联请求(MAC1-1)；
站点1向接入点发送重新关联请求，该请求中包括站点1优先希望使用的加密的MAC1-1，相应的发送地址为MAC1-0。
505：接入点解密MAC1-1，查证唯一性；
接入点解密得到MAC1-1，并对MAC1-1进行唯一性查证。其中，接入点对MAC1-1进行唯一性查证的一种可能的实现方式可以是：将MAC1-1与接入点服务的基础服务集BSS内的所有站点的MAC地址进行比对，若MAC1-1地址当前未被接入点服务的BSS内任何一个站点使用过，则认为MAC1-1唯一性查证通过。
506：接入点加密AID1-1；
在MAC1-1通过唯一性查证时，接入点为站点1分配新关联标识AID1-1，并对AID1-1进行加密。
507：接入点向站点1发送重新关联响应(AID1-1)；
接入点向站点1发送重新关联响应，指示同意其使用MAC1-1，并在响应中携带AID1-1，相应的接收地址为MAC1-0。
508：站点1解密AID1-1；
站点1解密获得AID1-1。
509：站点i加密MACi-1；
站点i将自己优先希望使用的新MAC地址MACi-1进行加密。
510：站点i向接入点发送重新关联请求(MACi-1)；
站点i向接入点发送重新关联请求，该请求中包括站点i优先希望使用的加密的MACi-1，相应的发送地址为MACi-0。
511：接入点向站点i发送重新关联响应(AIDi-0)；
接入点解密获得MACi-1，并进行唯一性查证，在MACi-1通过唯一性查证时，为站点i分配一个新关联标识AIDi-1。接入点向站点i发送重新关联响应，指示同意其使用MACi-1，并在响应中携带AIDi-1，接收地址为MAC1-0。
512：站点i通过解密获得AIDi-1。
513：接入点广播信标帧(标识更改指示)；
接入点向各站点广播信标帧，指示各站点进行MAC地址和AID的更改。
514：接入点更新各站点的MAC地址和AID；
515：站点1更新为MAC1-1和AID1-1；
516：站点i更新为MACi-1和AIDi-1；
站点在接收到信标帧时，进行各自MAC地址和AID的更新，接入点在广播信标帧后，也进行各站点MAC地址和AID的更新。
作为另一种可能的实现方式，接入点向站点发送重新关联响应时，可以携带指示更改时间T，见图17所示，图17是本发明实施例提供的第七种分配寻址标识的方法的流程图，图17所示实施例与图16所示实施例的区别在于：
在步骤507以及511接入点向站点发送的重新关联响应中携带了指示更改时间T；
相应的，步骤513变为：
513-1：接入点计时器计时到T；
513-2：站点1计时到T；
513-3：站点i计时到T；
其余各个步骤的具体实现与图16所示实施例的一致，请参阅上述的详细描述。
也就是说，本实施例中，接入点在向站点做出重新关联响应时，指示了更改的时间T，接入点与站点都在计时到T后，进行MAC地址和AID的更新。
需要说明的是，图14-17所示实施例中，只是本发明实施例的一种具体 举例，在进行描述的时候，为了便于区分给各个步骤的编号，事实上并不是用于限定步骤的先后顺序。比如接入点与站点1、接入点与站点i之间进行共享密钥协商，或者站点1向接入点、站点i向接入点发送重新关联请求等，这些在实际运行过程中，可能并不严格区分先后，甚至有可能同步执行。因此，本领域技术人员应该理解，上述各个步骤的编号并不是实际意义上的执行先后顺序。
请参阅图18，图18是本发明实施例提供的第一种接入点的结构示意图，本实施例的接入点100包括通知模块11以及更新模块12，其中：
通知模块11用于向接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件，以使得至少两个站点在达到预定更改条件时，将各自的MAC地址更改为各自的新MAC地址；
通知模块11分别向至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件。以使得至少两个站点在达到预定更改条件时，分别将各自的MAC地址更改为各自的新MAC地址。
其中，通知模块11指示预定更改条件可以有以下几种可能的实现方式：
1)向至少两个站点通知每个站点对应的加密的新MAC地址时，携带指示更改的预定时间或预定时间点；
2)向至少两个站点通知每个站点对应的加密的新MAC地址后，通过单播的方式分别向至少两个站点发送更改指示消息；
3)向至少两个站点通知每个站点对应的加密的新MAC地址后，通过广播的方式向至少两个站点群发更改指示消息。
也就是说，通知模块11指示预定更改条件可以以单播或广播的方式发送，其中，优选通过广播发送。当以单播的方式发送时，通知模块11可以在进行所述通知的同一时间发送并携带进行更改的时间信息。当以广播发送时，通知模块11可以在工作信道上广播一个更改指示消息，指示站点进行MAC地址的更改。
各个站点在获得各自对应的新MAC地址，并达到预定更改条件时，将新MAC地址配置到MAC层。在随后的消息交互中，以站点的新MAC地址作为寻址标识。
更新模块12用于在达到预定更改条件时，将至少两个站点的MAC地址更新为站点对应的新MAC地址，以使得后续自站点接收和向站点发送消息时，以新MAC地址作为站点的MAC地址。
更新模块12在达到预定更改条件时，将至少两个站点的MAC地址更新为站点对应的新MAC地址，在下一个向站点发送的消息和自站点接收的消息中，以站点的新MAC作为寻址标识。
通过上述本发明实施例提供的接入点的详细描述，可以理解，本发明通过接入点来调整整个基本服务集中多个站点的MAC地址变换，向多个站点通知每个站点对应的加密的新MAC地址，以使每个站点在达到预定更改条件时，分别将各自的MAC地址更改为其对应的新MAC地址，在达到预定更改条件时，接入点也将多个站点的MAC地址更新为站点对应的新MAC地址。通过这样的方式，接入点向站点发送的新MAC地址都经过加密，窃听者无法窃取到新MAC地址。通过控制多个站点都变换MAC地址，因此更改MAC地址后，窃听者无法继续追踪MAC地址获取终端用户隐私，保障了用户的隐私安全。
请进一步参阅图19，图19是本发明实施例提供的第二种接入点的结构示意图，本实施例的接入点200包括通知模块21、更新模块22、确认模块23以及密钥获取模块24，其中：
通知模块21用于向至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件，以使得至少两个站点在达到预定更改条件时，将各自的MAC地址更改为各自的新MAC地址。
在优选实施例中，为避免窃听者通过跟踪AID而追踪到用户隐私，可以同时更新站点的AID。当需要同时更新站点的AID时，通知模块21向至少两个站点通知每个站点对应的加密的新MAC地址的同时，还向至少两个站点通知每个站点对应的加密的新AID。
更新模块22用于在达到预定更改条件时，将至少两个站点的MAC地址更新为站点对应的新MAC地址，以使得后续自站点接收和向站点发送消息时，以新MAC地址作为站点的MAC地址。
如果通知模块21中同时通知了站点对应的加密的新AID时，更新模块22在达到预定更改条件时，将至少两个站点的MAC地址和AID更新为站 点对应的新MAC地址和新AID。以使得后续自站点接收和向站点发送消息时，以站点的新MAC地址、新AID的至少一种作为寻址地址。
确认模块23用于确认接入点服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID，每个站点分别对应不同的新MAC地址和新AID。
确认模块23用于接收接入点服务的BSS内的至少两个站点的更改请求，每个站点的更改请求中包括每个站点请求的新MAC地址，对每个站点请求的新MAC地址进行唯一性查证，在唯一性查证通过时，为每个站点分配新AID，每个站点请求的新MAC和分配的新AID即为确认的站点的新MAC地址和新AID。
通知模块21以单播方式向每个站点回复确认消息，确认消息指示同意站点使用请求的新MAC地址，并向每个站点通知新AID。
其中，新AID在确认消息中携带或通过另一消息发送。
确认模块23用于为接入点服务的BSS内的至少两个站点分配新MAC地址和新AID，每个站点分配的新MAC地址和新AID为确认的站点对应的新MAC地址和新AID。
通知模块21通过单播方式分别向至少两个站点发送站点对应的加密的新MAC地址和新AID。
每个站点分别对应不同的新MAC地址和新AID。
也就是说，本实施例中提供确认模块23确认接入点服务的BSS内的至少两个站点各自对应的新MAC地址和新AID的两种可能的实现方式，当然，在能够实现本发明目的的基础上，也可以采用其他可能的方式来实现。
第一种方式：接入点接收其服务的BSS内的至少两个站点的更改请求，每个站点的更改请求中包括每个站点请求的新MAC地址。也就是说，站点会在请求中携带自己优先希望使用的新MAC地址。当接入点接收到至少两个站点的更改请求后，对每个站点请求的新MAC地址进行唯一性查证，在唯一性查证通过时，为每个站点分配新AID。以每个站点请求的新MAC地址和分配的新AID作为确定的站点对应的新MAC地址和新AID。
第二种方式：接入点为其服务的BSS内的至少两个站点分配新MAC地址和新AID，每个站点分配的新MAC地址和新AID为确认的站点对应 的新MAC地址和新AID。
当确认模块23确认其服务的BSS内的至少两个站点各自对应的新MAC地址和新AID是通过上述第一种方式实现时，通知模块21以单播方式向每个站点回复确认消息，确认消息指示同意站点使用其请求的新MAC地址，并向每个站点通知新AID。而当站点请求的新MAC地址在唯一性查证没有通过时，回复的确认消息中携带一个符合唯一性的新MAC地址。其中，新AID可以在确认消息中携带，或通过另一消息发送。
当确认模块23确认其服务的BSS内的至少两个站点各自对应的新MAC地址和新AID是通过上述第二种方式实现时，通知模块21通过单播方式分别向至少两个站点发送站点对应的加密的新MAC地址和新AID。
在实际实现中，可以定义一个信息元素(Information Element，IE)或是一个新的管理帧(Management Frame)来完成MAC地址和AID更改的相关消息交互；此外在IEEE802.11中还定义了一种叫做操作帧(Action Frame)的管理帧，通过定义新的操作类别(Action Category)来定义一种单独业务活动需要的管理帧。本实施例以定义一种操作帧为例进行说明，但并不以此为限。
密钥获取模块24用于与至少两个站点之间进行加密密钥协商，获取用于对每个站点的新MAC地址进行加密的加密密钥，加密密钥为对称加密密钥或非对称加密密钥。
接入点通过密钥获取模块24与至少两个站点的每个站点分别进行共享加密密钥协商，得到用于对站点的新MAC地址进行加密的加密密钥Ekey。本发明实施例中的加密密钥可以是对称加密密钥或非对称加密密钥。
当加密密钥为对称加密密钥时，以接入点与站点1进行加密密钥协商为例，接入点跟站点1进行共享加密密钥协商，接入点得到Ekey1，接入点以Ekey1为对称加密算法的加密密钥，对站点1的新MAC地址进行加密。当在优选实施例中，需要同时更新站点的AID时，也用该加密密钥对新AID进行加密。站点1用Ekey1解密得到新MAC地址和新AID。其中，接入点与站点1在认证阶段的四步握手阶段由成对主密钥(Pairwise Master Key，PMK)生成成对瞬时密钥(Pairwise Transient Key，PTK)，再由PTK生成临时密钥(Temporal Key，TK)。
本实施例中，可以由PTK直接截取128位的TK来做为Ekey1；或者由PTK在截取KCK、KEK、TK后的剩余位中取128位的密钥来作为Ekey1；或者，接入点与站点1进行随机数(Nonce)交换后，以双方随机数及TK来衍生出Ekey1；更多地，接入点与站点1在进行随机数(Nonce)交换后，以双方随机数、时间戳(timestamp)及TK来衍生出Ekey1。衍生方法有多种，如以随机数、时间戳和TK进行散列算法运算SHA-256后取高128位或低128位等。相应地，密钥协商过程为四步握手及随机数交换等过程。
当加密密钥为非对称加密密钥时，通常是一个公钥。同样以接入点与站点1进行加密密钥协商为例。比如，当使用RSA(Rivest Shamir Adleman)算法时，Ekey1为站点1发送给接入点的一个RSA公钥。接入点以Ekey1对站点1的新MAC地址和新AID进行加密，站点1收到后以相应的RSA私钥进行解密。相应的密钥协商过程主要为公钥发送接收过程。
接入点以与站点协商好的加密密钥对站点的新MAC地址和新AID进行加密。其中，对新MAC地址和新AID的加密可以两个一起加密，也可以分开单独加密。比如以Ekey1对站点1的新MAC地址(MAC1-1)和新关联标识(AID1-1)进行加密为例。这里的Ekey1可以是对称加密密钥或非对称加密密钥，本发明实施例中优选对称加密密钥。
当Ekey1为对称加密密钥时，加密MAC1-1和AID1-1的加密方式可以为AES-CCM方式，Ekey1为128比特的密钥，其加密式可以表示为：
加密的MAC1-1和AID1-1＝AES-CCM-128Ekey1(MAC1-1和AID1-1)
需要说明的是，MAC1-1和AID1-1可以分别进行加密，如
加密的MAC1-1＝AES-CCM-128Ekey1(MAC1-1)
加密的AID1-1＝AES-CCM-128Ekey1(AID1-1)
上述只是以接入点与站点1进行加密密钥协商为例进行说明，接入点与其他站点的加密密钥协商的过程以及对新MAC地址和新AID进行加密的过程请参阅上述相关部分，在此不一一赘述。
密钥获取模块24将获取的加密密钥通知确认模块23，确认模块23用加密密钥对站点的新MAC地址和新AID进行加密后再通过通知模块21通知到站点。
在达到通知模块21通知的预定更改条件时，更新模块22将其内部的 至少两个站点的MAC地址更新为站点对应的新MAC地址，将至少两个站点的AID更改为站点对应的新AID。
当通知模块21向站点通知新MAC地址和新AID时携带了指示更改的预定时间或预定时间点时，各站点收到的时间信息能够保证各站点和接入点都到同一时间后进行更改。如当时间信息为一个计时时刻，各站点的TSF时间与接入点是保持同步的，当各站点与接入点的计时器都计时到该时刻后，各站点将接入点分配的新MAC和新AID配置到MAC层，接入点也将各站点的MAC地址和AID进行更新，以使得当收到发送地址为新的MAC地址的站点消息时，接入点可以确定该站点的信息及该站点的共享信息，如共享数据加密密钥等。在随后的消息交互中，以站点的新MAC地址、新AID的至少一种作为寻址标识。
需要说明的是，图18与图19所示实施例中的接入点能够实现本发明图2与图3所示实施例中方法的各个步骤，在本实施例中，各个模块的划分只是一种举例，在能够实现本发明目的的基础上，接入点内各个模块的划分也可以是其他方式，比如几个模块集成一个模块来实现。
请参阅图20，图20是本发明实施例提供的第一种站点的结构示意图，本实施例的站点300包括获得模块31和更改模块32，其中：
获得模块31用于获知站点对应的加密的新MAC地址，解密获得新MAC地址，并获取预定更改条件，每个站点分别对应不同的新MAC地址；
在一种较为优选的实施例中，为了避免窃听者通过跟踪站点的AID来追踪到用户的隐私信息，接入点向站点通知新MAC地址的同时，同时也向站点通知站点对应的新AID。因此，在本发明优选实施例中，获得模块31在获知站点对应的加密的新MAC地址时，还可以获知站点对应的加密的新AID，解密获得新MAC地址和新AID。
获得模块31通过接收接入点为站点对应分配的加密的新MAC地址和新AID，解密获得新MAC地址和新AID。
或者，获得模块31通过向接入点发送更改请求，站点的更改请求中包括站点请求的新MAC地址，从接入点响应更改请求的确认消息中，获知站点对应的加密的新MAC地址，并进一步获知新AID。
获得模块31从接入点响应更改请求的确认消息中获知新AID；或从接 入点发送的另一消息中获知新AID。
获得模块31获知站点对应的加密的新MAC地址和新AID的一种实现方式是接收接入点为其对应分配的加密的新MAC地址和新AID，从而获知站点对应的加密的新MAC地址和新AID。
另一种实现方式是：获得模块31向接入点请求MAC地址更改，即向接入点发送更改请求，更改请求中包括站点请求的新MAC地址，其中，需要说明的是，请求中携带的新MAC地址也是经加密的，其密钥协商以及加密过程可以参考上述实施例中相关部分，在此不再赘述。接入点接收到站点的请求，并解密得到请求的新MAC地址，进行唯一性查证，然后给出一个确认消息以作为对所述请求的响应。站点从接入点响应更改请求的确认消息中，获知站点对应的加密的新MAC地址，并进一步获知新AID。
当站点请求的新MAC地址通过唯一性查证时，站点对应的新MAC地址即为其请求的新MAC地址，而当站点请求的新MAC地址没有通过唯一性查证时，站点对应的新MAC地址为接入点为站点分配的符合唯一性的新MAC地址，而站点对应的新AID都是接入点为站点分配的。新AID可以在确认消息中携带，也可以通过另一消息单独发送。
在另一种可能的实现方式中，接入点向站点的确认消息中还携带了更改时间T。接入点所在的BSS内至少两个站点能够支持寻址标识(本实施例中为MAC地址，或MAC地址与AID)。当满足更改触发条件时，至少两个站点会在满足更改触发条件后某一个时间段t内向接入点发送MAC地址更改请求。因此，当接入点接收到第一个站点的更改请求后，若计时为T0，则接入点规定的时间T满足以下条件时，可以保证T时刻到达前会至少收到两个站点的更改请求，即T＞T0+t。
其中，站点向接入点发送更改请求，在具体实现中，也可以通过定义操作帧或新的管理帧或者新的信息元素(IE)来实现，操作帧的定义方法在实施例二及实施例三中已进行了说明。本实施例中以定义新的IE为例进行说明，但并不以此为限。新定义的信息元素可以携带在各类管理帧中发送，如探测请求/响应(Probe Request/Response)、重新关联请求/响应(Reassociation Request/Response)、信标(Beacon)帧等管理帧。
更改模块32用于在满足预定更改条件时，将站点的MAC地址更改为 站点对应的新MAC地址，以使得后续自接入点接收和向接入点发送消息时，以新MAC地址作为站点的MAC地址。
更改模块32在满足预定更改条件，将站点当前使用的MAC地址更新为站点对应的新MAC地址。
当获得模块31获得站点对应的新MAC地址时，同时获知了站点对应的加密的新AID时，更改模块32在满足预定条件时，将站点当前使用的MAC地址和AID都更新为站点对应的新MAC地址和新AID，在下一次接收消息时，以新MAC地址、新AID的至少一种作为寻址标识。
在本发明实施例提供的另一种站点中，请继续参阅图20，站点300进一步包括密钥协商模块33，其中：
密钥协商模块33用于与接入点进行加密密钥协商；
获得模块31根据密钥协商模块33协商的加密密钥类型，使用对应的解密方法解密获得所述新MAC地址和新AID，加密密钥为对称加密密钥或非对称加密密钥。
获得模块31在获知站点对应的加密的新MAC地址和新AID之前，还包括：密钥协商模块33与接入点之间进行加密密钥协商，以使获得模块31根据协商的加密密钥类型，使用对应的解密方法解密获得新MAC地址和新AID。加密密钥可以是对称加密密钥或非对称加密密钥。比如当加密密钥为对称加密密钥时，站点用对应的密钥进行解密，而当加密密钥为部队称加密密钥时，站点以密钥对应的私钥进行解密。其中，密钥协商以及加密过程可以参考上述实施例中的相关部分，在此不一一赘述。
需要说明的是，图20所示实施例提供的站点能够实现图9所示方法实施例中的各个步骤，在本实施例中站点的各个模块的划分只是一种举例说明，并不用于具体限定本发明的范围。在能够实现本发明目的的基础上，站点的功能模块也可以是别的划分方式，比如几个模块集成一个模块上实现等。
请参阅图21，图21是本发明实施例提供的第三种接入点的结构示意图，本实施例的接入点400包括处理器41(可以为一个或多个，本发明各实施例中以一个为例)、存储器42、接收器43、发送器44以及总线系统45，其中：
处理器41控制接入点400的操作，处理器41还可以称为CPU(Central Processing Unit，中央处理单元)。处理器41可能是一种集成电路芯片，具有信号的处理能力。处理器41还可以是通用处理器、数字信号处理器(DSP,Digital Signal Processing)、专用集成电路(ASIC,Application Specific Integrated Circuit)、现场可编程门阵列(FPGA,Field－Programmable Gate Array)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
存储器42可以包括只读存储器和随机存取存储器，并向处理器41提供指令和数据。存储器42的一部分还可以包括非易失性随机存取存储器(NVRAM)。
接入点400的各个组件通过总线系统45耦合在一起，其中总线系统45除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。该总线系统可以是ISA(Industry Standard Architecture，工业标准体系结构)总线、PCI(Peripheral Component Interconnect，外部设备互连)总线或EISA(Extended Industry Standard Architecture，扩展工业标准体系结构)总线等。所述总线可以是一条或多条物理线路，当是多条物理线路时可以分为地址总线、数据总线、控制总线等。在本发明的其它一些实施例中，处理器41、存储器42以及接收器43、发送器44也可以通过通信线路直接连接。但是为了清楚说明起见，在图中将各种总线都标为总线系统45。
存储器42存储了如下的元素，可执行模块或者数据结构，或者它们的子集，或者它们的扩展集:
操作指令：包括各种操作指令，用于实现各种操作。
操作系统：包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
在本发明实施例中，处理器41通过调用存储器42存储的操作指令(该操作指令可存储在操作系统中)，执行如下操作：
处理器41通过发送器44向接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件，以使得至少两个站点在达到预定更改条件时，将各自的MAC地址更改为各自的 新MAC地址。
作为一种优选的实施例，处理器41通过发送器44向至少两个站点通知每个站点对应的加密的新MAC地址时，还可以向至少两个站点通知每个站点对应的加密的新AID。
其中，处理器41通过发送器44指示预定更改条件可以有以下几种可能的实现方式：
1)向至少两个站点通知每个站点对应的加密的新MAC地址时，携带指示更改的预定时间或预定时间点；
2)向至少两个站点通知每个站点对应的加密的新MAC地址后，通过单播的方式分别向至少两个站点发送更改指示消息；
3)向至少两个站点通知每个站点对应的加密的新MAC地址后，通过广播的方式向至少两个站点群发更改指示消息。
也就是说，处理器41指示预定更改条件可以以单播或广播的方式发送，其中，优选通过广播发送。当以单播的方式发送时，处理器41通过发送器44可以在进行所述通知的同一时间发送并携带进行更改的时间信息。当以广播发送时，处理器41可以通过发送器44在工作信道上广播一个更改指示消息，指示站点进行MAC地址和AID的更改。
各个站点在获得各自对应的新MAC地址和新AID，并达到预定更改条件时，将新MAC地址和新AID配置到MAC层。在随后的消息交互中，以站点的新MAC地址、新AID的至少一种作为寻址标识。
处理器41进一步在达到预定更改条件时，将接入点端的至少两个站点的MAC地址更新为站点对应的新MAC地址，以使得后续自站点接收和向站点发送消息时，以新MAC地址作为站点的MAC地址。
当处理器41向站点通知了站点对应的新AID时，在达到预定更改条件时，将至少两个站点的MAC地址更新为站点对应的新MAC地址，将至少两个站点的AID更新为站点对应的新AID，在后续向站点发送或自站点接收消息时，以站点的新MAC地址、新AID的至少一种作为寻址标识。
处理器41还可进一步用于确认接入点服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID，每个站点分别对应不同的新MAC地址和新AID。
处理器41通过接收器43接收接入点服务的BSS内的至少两个站点的更改请求，每个站点的更改请求中包括每个站点请求的新MAC地址，对每个站点请求的新MAC地址进行唯一性查证，在唯一性查证通过时，为每个站点分配新AID，每个站点请求的新MAC和分配的新AID即为确认的站点的新MAC地址和新AID。
处理器41通过发送器44以单播方式向每个站点回复确认消息，确认消息指示同意站点使用请求的新MAC地址，并向每个站点通知新AID。
其中，新AID在确认消息中携带或通过另一消息发送。
处理器41还可以用于为接入点服务的BSS内的至少两个站点分配新MAC地址和新AID，每个站点分配的新MAC地址和新AID为确认的站点对应的新MAC地址和新AID。
处理器41通过发送器44以单播方式分别向至少两个站点发送站点对应的加密的新MAC地址和新AID。
每个站点分别对应不同的新MAC地址和新AID。
也就是说，本实施例中处理器41确认接入点服务的BSS内的至少两个站点各自对应的新MAC地址和新AID的两种可能的实现方式，当然，在能够实现本发明目的的基础上，也可以采用其他可能的方式来实现。
第一种方式：处理器41通过接收器43接收接入点服务的BSS内的至少两个站点的更改请求，每个站点的更改请求中包括每个站点请求的新MAC地址。也就是说，站点会在请求中携带自己优先希望使用的新MAC地址。当处理器41通过接收器43接收到至少两个站点的更改请求后，对每个站点请求的新MAC地址进行唯一性查证，在唯一性查证通过时，为每个站点分配新AID。以每个站点请求的新MAC地址和分配的新AID作为确定的站点对应的新MAC地址和新AID。
第二种方式：处理器41为接入点服务的BSS内的至少两个站点分配新MAC地址和新AID，每个站点分配的新MAC地址和新AID为确认的站点对应的新MAC地址和新AID。
当处理器41确认其服务的BSS内的至少两个站点各自对应的新MAC地址和新AID是通过上述第一种方式实现时，处理器41通过发送器44以单播方式向每个站点回复确认消息，确认消息指示同意站点使用其请求的 新MAC地址，并向每个站点通知新AID。而当站点请求的新MAC地址在唯一性查证没有通过时，回复的确认消息中携带一个符合唯一性的新MAC地址。其中，新AID可以在确认消息中携带，或通过另一消息发送。
当处理器41确认接入点服务的BSS内的至少两个站点各自对应的新MAC地址和新AID是通过上述第二种方式实现时，处理器41通过发送器44以单播方式分别向至少两个站点发送站点对应的加密的新MAC地址和新AID。
在实际实现中，定义一个信息元素(Information Element，IE)或是一个新的管理帧(Management Frame)来完成MAC地址和AID更改的相关消息交互；此外在IEEE802.11中还定义了一种叫做操作帧(Action Frame)的管理帧，通过定义新的操作类别(Action Category)来定义一种单独业务活动需要的管理帧。关于操作帧以及IE格式的相关介绍可以参阅前述实施例的相关部分描述，在此不再赘述。
处理器41还用于通过所述发送器44和接收器43与至少两个站点之间进行加密密钥协商，获取用于对每个站点的新MAC地址进行加密的加密密钥，加密密钥为对称加密密钥或非对称加密密钥。
处理器41与至少两个站点的每个站点分别进行共享加密密钥协商，得到用于对站点的新MAC地址和新AID进行加密的加密密钥Ekey。本发明实施例中的加密密钥可以是对称加密密钥或非对称加密密钥。
当加密密钥为对称加密密钥时，以接入点与站点1进行加密密钥协商为例，处理器41跟站点1进行共享加密密钥协商，处理器41得到Ekey1，处理器41以Ekey1为对称加密算法的加密密钥，对站点1的新MAC地址进行加密。当在优选实施例中，需要同时更新AID时，也用该加密密钥对新AID进行加密。站点1用Ekey1解密得到新MAC地址和新AID。其中，接入点与站点1在认证阶段的四步握手阶段由成对主密钥(Pairwise Master Key，PMK)生成成对瞬时密钥(Pairwise Transient Key，PTK)，再由PTK生成临时密钥(Temporal Key，TK)。
本实施例中，可以由PTK直接截取128位得到的TK来做为Ekey1；或者由PTK在截取KCK、KEK、TK后的剩余位中取128位的密钥来作为Ekey1；或者，接入点与站点1进行随机数(Nonce)交换后，以双方随机 数及TK来衍生出Ekey1；更多地，接入点与站点1在进行随机数(Nonce)交换后，以双方随机数、时间戳(timestamp)及TK来衍生出Ekey1。衍生方法有多种，如以随机数、时间戳和TK进行散列算法运算SHA-256后取高128位或低128位等。相应地，密钥协商过程为四步握手及随机数交换等过程。
当加密密钥为非对称加密密钥时，通常是一个公钥。同样以接入点与站点1进行加密密钥协商为例。比如，当使用RSA(Rivest Shamir Adleman)算法时，Ekey1为站点1发送给接入点的一个RSA公钥。接入点以Ekey1对站点1的新MAC地址和新AID进行加密，站点1收到后以相应的RSA私钥进行解密。相应的密钥协商过程主要为公钥发送接收过程。
处理器41以与站点协商好的加密密钥对站点的新MAC地址和新AID进行加密。其中，对新MAC地址和新AID的加密可以两个一起加密，也可以分开单独加密。比如以Ekey1对站点1的新MAC地址(MAC1-1)和新AID(AID1-1)进行加密为例。这里的Ekey1可以是对称加密密钥或非对称加密密钥，本发明实施例中优选对称加密密钥。
上述只是以接入点与站点1进行加密密钥协商为例进行说明，接入点与其他站点的加密密钥协商的过程以及对新MAC地址和新AID进行加密的过程跟上述基本一致，在此不一一赘述。
在处理器41通过发送器44向站点通知新MAC地址和新AID时携带了指示更改的预定时间或预定时间点时，各站点收到的时间信息能够保证各站点和接入点在统一时间后进行更改。如当时间信息为一个计时时刻，各站点的TSF时间与接入点是保持同步的，当各站点与接入点的计时器都计时到该时刻后，各站点将接入点分配的新MAC和新AID配置到MAC层，接入点也将各站点的MAC地址和AID进行更新，以使得当收到发送地址为新的MAC地址的站点消息时，接入点可以确定该站点的信息及该站点的共享信息，如共享数据加密密钥等。在随后的消息交互中，以站点的新MAC地址、新AID的至少一种作为寻址标识。
上述本发明实施例揭示的方法可以应用于处理器41中，或者由处理器41实现。在实现过程中，上述方法的各步骤可以通过处理器41中的硬件的集成逻辑电路或者软件形式的指令完成。可以实现或者执行本发明实施例 中的公开的各方法、步骤及逻辑框图。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器42，处理器41读取存储器42中的信息，结合其硬件完成上述方法的步骤。
请参阅图22，图22是本发明实施例提供的第二种站点的结构示意图，本实施例的站点500包括处理器51(可以为一个或多个，本发明各实施例中以一个为例)、存储器52、接收器53、发送器54以及总线系统55，其中：
处理器51控制站点500的操作，处理器51还可以称为CPU(Central Processing Unit，中央处理单元)。处理器51可能是一种集成电路芯片，具有信号的处理能力。处理器51还可以是通用处理器、数字信号处理器(DSP,Digital Signal Processing)、专用集成电路(ASIC,Application Specific Integrated Circuit)、现场可编程门阵列(FPGA,Field－Programmable Gate Array)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
存储器52可以包括只读存储器和随机存取存储器，并向处理器51提供指令和数据。存储器52的一部分还可以包括非易失性随机存取存储器(NVRAM)。
站点500的各个组件通过总线系统55耦合在一起，其中总线系统55除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。该总线系统可以是ISA(Industry Standard Architecture，工业标准体系结构)总线、PCI(Peripheral Component Interconnect，外部设备互连)总线或EISA(Extended Industry Standard Architecture，扩展工业标准体系结构)总线等。所述总线可以是一条或多条物理线路，当是多条物理线路时可以分为地址总线、数据总线、控制总线等。在本发明的其它一些实施例中，处理器51、存储器52以及接收器53、发送器54也可以通过通信线路直接连接。但是为了清楚说明起见，在图中将各种总线都标为总线系统55。
存储器52存储了如下的元素，可执行模块或者数据结构，或者它们的 子集，或者它们的扩展集:
操作指令：包括各种操作指令，用于实现各种操作。
操作系统：包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
在本发明实施例中，处理器51通过调用存储器52存储的操作指令(该操作指令可存储在操作系统中)，执行如下操作：
处理器51获知站点对应的加密的新MAC地址，解密获得新MAC地址，并获取预定更改条件，每个站点分别对应不同的新MAC地址。
在一种较为优选的实施例中，为了避免窃听者通过跟踪站点的AID来追踪到用户的隐私信息，接入点向站点通知新MAC地址的同时，同时也向站点通知站点对应的新AID。因此，在本发明优选实施例中，处理器51在获知站点对应的加密的新MAC地址时，还可以获知站点对应的加密的新AID，解密获得新MAC地址和新AID。
处理器51可以通过接收器53接收接入点为站点对应分配的加密的新MAC地址和新AID，解密获得新MAC地址和新AID。
或者，处理器51通过发送器54向接入点发送更改请求，站点的更改请求中包括站点请求的新MAC地址，从接入点响应更改请求的确认消息中，获知站点对应的加密的新MAC地址，并进一步获知新AID。
其中，处理器51从接入点响应更改请求的确认消息中获知新AID；或从接入点发送的另一消息中获知新AID。
也就是说，处理器51获知站点对应的加密的新MAC地址和新AID的一种实现方式是接收接入点为其对应分配的加密的新MAC地址和新AID，从而获知站点对应的加密的新MAC地址和新AID。
另一种实现方式是：处理器51通过发送器54向接入点请求MAC地址更改，即向接入点发送更改请求，更改请求中包括站点请求的新MAC地址，其中，需要说明的是，请求中携带的新MAC地址也是经加密的，其加密方式请参见前述实施例的相关部分，在此不再赘述。接入点接收到站点的请求，并解密得到请求的新MAC地址，进行唯一性查证，然后给出一个确认消息以作为对所述请求的响应。站点从接入点响应更改请求的确认消息中，获知站点对应的加密的新MAC地址，并进一步获知新AID。
其中，本实施例中接入点对站点请求的新MAC地址进行唯一性查证的一种可能的实现方式可以是：将站点请求的新MAC地址与接入点服务的基础服务集BSS内的所有站点的MAC地址进行比对，若站点请求的新MAC地址当前未被接入点服务的BSS内任何一个站点使用过，则认为站点请求的新MAC地址唯一性查证通过。
当站点请求的新MAC地址通过唯一性查证时，站点对应的新MAC地址即为其请求的新MAC地址，而当站点请求的新MAC地址没有通过唯一性查证时，站点对应的新MAC地址为接入点为站点分配的符合唯一性的新MAC地址，而站点对应的新AID都是接入点为站点分配的。新AID可以在确认消息中携带，也可以通过另一消息单独发送。
在另一种可能的实现方式中，接入点向站点的确认消息中还携带了更改时间T。接入点所在的BSS内至少两个站点能够支持寻址标识(本实施中为MAC地址，或MAC地址与AID)。当满足更改触发条件时，至少两个站点会在满足更改触发条件后某一个时间段t内向接入点发送MAC地址更改请求。因此，当接入点接收到第一个站点的更改请求后，若计时为T0，则接入点规定的时间T满足以下条件时，可以保证T时刻到达前会至少收到两个站点的更改请求，即T＞T0+t。
其中，站点向接入点发送更改请求，在具体实现中，也可以通过定义操作帧或新的管理帧或者新的信息元素(IE)来实现，操作帧的定义方法在实施例二及实施例三中已进行了说明。本实施例中以定义新的IE为例进行说明，但并不以此为限。新定义的信息元素可以携带在各类管理帧中发送，如探测请求/响应(Probe Request/Response)、重新关联请求/响应(Reassociation Request/Response)、信标(Beacon)帧等管理帧。其中，IE的相关示意以及详细信息描述请参阅前述实施例的相关部分。
处理器51进一步用于在满足预定更改条件时，将站点的MAC地址更改为站点对应的新MAC地址，以使得后续自接入点接收和向接入点发送消息时，以新MAC地址作为站点的MAC地址。
当处理器51获得站点对应的新MAC地址时，同时获知了站点对应的加密的新AID时，处理器51在满足预定条件时，将站点的MAC地址和AID都更新为站点对应的新MAC地址和新AID，在下一次接收消息时，以 新MAC地址、新AID的至少一种作为寻址标识。
其中，处理器51还用于与接入点进行加密密钥协商，以根据协商的加密密钥类型，使用对应的解密方法解密获得新MAC地址和新AID，加密密钥为对称加密密钥或非对称加密密钥。
比如当加密密钥为对称加密密钥时，处理器51用对应的密钥进行解密，而当加密密钥为部队称加密密钥时，处理器51以密钥对应的私钥进行解密。其中，密钥协商以及加密过程请参见上述实施例的相关部分描述，在此不一一赘述。
在以上实施例提供的接入点与站点的基础上，本发明实施例进一步提供一种通信系统，该通信系统包括上述任一实施例提供的接入点以及上述任一实施例提供的站点。接入点与站点的具体功能实现请参阅以上各个实施例的详细描述，在此不再赘述。
上述本发明实施例揭示的方法可以应用于处理器51中，或者由处理器51实现。在实现过程中，上述方法的各步骤可以通过处理器51中的硬件的集成逻辑电路或者软件形式的指令完成。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器52，处理器51读取存储器52中的信息，结合其硬件完成上述方法的步骤。
通过本发明实施例提供的分配寻址标识的方法及接入点、站点、通信系统，可以理解，本发明通过接入点来调整整个基本服务集中多个站点的MAC地址变换，向多个站点通知每个站点对应的加密的新MAC地址和新AID，以使每个站点在达到预定更改条件时，分别将各自的MAC地址和AID更改为其对应的新MAC地址和新AID，在达到预定更改条件时，接入点也将多个站点的MAC地址更新为站点对应的新MAC地址，将站点的AID更新为站点对应的新AID。通过这样的方式，接入点向站点发送的新MAC地址和新AID都经过加密，窃听者无法窃取到新MAC地址和新AID。通过控制多个站点都变换MAC地址和AID，因此更改后，窃听者无法继续 追踪MAC地址和AID获取终端用户隐私，保障用户的隐私安全。
在本发明所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅为本发明的实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (27)

  1. 一种分配寻址标识的方法，其特征在于，所述寻址标识包括介质访问控制MAC地址，所述方法包括：
    接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址，并指示预定更改条件，以使得所述至少两个站点在达到所述预定更改条件时，将各自的MAC地址更改为各自的所述新MAC地址；
    在达到所述预定更改条件时，所述接入点将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，以使得后续自所述站点接收和向所述站点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
  2. 根据权利要求1所述的方法，其特征在于，所述寻址标识还包括关联标识AID；所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址时，还通知站点对应的加密的新AID；
    在达到预定更改条件时，所述接入点将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，将所述至少两个站点的AID更新为所述站点对应的所述新AID。
  3. 根据权利要求2所述的方法，其特征在于，接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的所述新MAC地址和新AID的步骤之前，还包括：
    所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID，每个所述站点分别对应不同的新MAC地址和新AID。
  4. 根据权利要求3所述的方法，其特征在于，所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID的步骤包括：
    所述接入点接收其服务的BSS内的所述至少两个站点的更改请求，每个所述站点的更改请求中包括每个所述站点请求的新MAC地址；
    所述接入点对每个所述站点请求的新MAC地址进行唯一性查证，在所述唯一性查证通过时，为每个所述站点分配新AID，每个所述站点请求的所述新MAC地址和分配的所述AID即为确认的所述站点的新MAC地址和 新AID；
    所述向所述至少两个站点通知每个所述站点对应的加密的所述新MAC地址和新AID的步骤包括：
    所述接入点以单播方式向每个所述站点回复确认消息，所述确认消息指示同意所述站点使用请求的所述新MAC地址，并向每个所述站点通知新AID；所述新AID在所述确认消息中携带或通过从所述接入点发送的另一消息发送。
  5. 根据权利要求3所述的方法，其特征在于，所述接入点确认其服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID的步骤包括：
    所述接入点为其服务的BSS内的至少两个站点分配新MAC地址和新AID，每个所述站点分配的所述新MAC地址和新AID为确认的所述站点对应的新MAC地址和新AID；
    所述向所述至少两个站点通知每个所述站点对应的加密的所述新MAC地址和新AID的步骤包括：
    通过单播方式分别向所述至少两个站点发送所述站点对应的加密的所述新MAC地址和新AID。
  6. 根据权利要求1-5任一所述的方法，其特征在于，所述指示预定更改条件包括：
    所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址时，携带指示更改的预定时间或预定时间点；或
    所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过单播的方式分别向所述至少两个站点发送更改指示消息；或
    所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过广播的方式向所述至少两个站点群发更改指示消息。
  7. 根据权利要求6所述的方法，其特征在于，所述通过广播的方式向所述至少两个站点群发更新指示消息的步骤包括：
    通过广播添加了指示位的信标帧向所述至少两个站点群发更新指示消息，所述指示位包含用于指示所述至少两个站点进行寻址标识更改的更改指示信息。
  8. 根据权利要求1所述的方法，其特征在于，所述接入点向其服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址的步骤之前，还包括：
    所述接入点与所述至少两个站点之间进行加密密钥协商，所述接入点获取用于对每个所述站点的新MAC地址进行加密的加密密钥，所述加密密钥为对称加密密钥或非对称加密密钥。
  9. 一种分配寻址标识的方法，其特征在于，所述寻址标识包括介质访问控制MAC地址，所述分配寻址标识方法包括：
    站点获知由其所在的基本服务集BSS内的接入点通知的所述站点对应的加密的新MAC地址，解密获得新MAC地址，并获取预定更改条件，所述站点在满足所述预定更改条件时，将当前使用的MAC地址更改为所述新MAC地址，以使得后续自所述接入点接收和向所述接入点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
  10. 根据权利要求9所述的方法，其特征在于，所述寻址地址还包括关联标识AID，所述站点获知所述站点对应的加密的新MAC地址的同时，还获取所述站点对应的加密的新AID；
    所述站点在满足所述预定更改条件时，将当前使用的MAC地址更改为所述新MAC地址，并将当前使用的AID更改为所述新AID。
  11. 根据权利要求10所述的方法，其特征在于，站点获知所述站点对应的加密的新MAC地址和新AID的步骤包括：
    所述站点接收接入点为所述站点对应分配的加密的新MAC地址和新AID。
  12. 根据权利要求10所述的方法，其特征在于，站点获知所述站点对应的加密的新MAC地址和新AID的步骤包括：
    所述站点向接入点发送更改请求，所述站点的更改请求中包括所述站点请求的新MAC地址，所述站点从所述接入点响应所述更改请求的确认消息中，获知所述站点对应的加密的新MAC地址，并进一步从所述接入点响 应所述更改请求的所述确认消息中或从所述接入点发送的另一消息中获知加密的新AID。
  13. 根据权利要求9所述的方法，其特征在于，站点获知所述站点对应的加密的新MAC地址的步骤之前，还包括：
    所述站点与接入点进行加密密钥协商，以使所述站点根据协商的加密密钥类型，使用对应的解密方法解密获得所述新MAC地址，所述加密密钥为对称加密密钥或非对称加密密钥。
  14. 一种接入点，其特征在于，所述接入点包括通知模块以及更新模块，其中：
    所述通知模块用于向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新介质访问控制MAC地址，并指示预定更改条件，以使得所述至少两个站点在达到所述预定更改条件时，将各自的MAC地址更改为各自的所述新MAC地址；
    所述更新模块用于在达到所述预定更改条件时，将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，以使得后续自所述站点接收和向所述站点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
  15. 根据权利要求14所述的接入点，其特征在于，所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的加密的新MAC地址时，还向所述至少两个站点通知每个站点对应的加密的新关联标识AID；
    所述更新模块在达到所述预定更改条件时，将所述至少两个站点的MAC地址更新为所述站点对应的所述新MAC地址，并将所述至少两个站点的AID更新为所述站点对应的所述新AID。
  16. 根据权利要求15所述的接入点，其特征在于，所述接入点还包括确认模块，其中：
    所述确认模块用于确认所述接入点服务的基本服务集BSS内的至少两个站点各自对应的新MAC地址和新AID，每个站点分别对应不同的新MAC地址和新AID。
  17. 根据权利要求16所述的接入点，其特征在于，所述确认模块具体用 于接收所述接入点服务的BSS内的所述至少两个站点的更改请求，每个所述站点的更改请求中包括每个所述站点请求的新MAC地址，对每个所述站点请求的新MAC地址进行唯一性查证，在所述唯一性查证通过时，为每个所述站点分配新AID，每个所述站点请求的所述新MAC和分配的所述新AID即为所述确认的所述站点的新MAC地址和新AID；
    所述通知模块具体通过单播方式向每个所述站点回复确认消息，所述确认消息指示同意所述站点使用请求的所述新MAC地址，并向每个所述站点通知新AID，所述新AID在所述确认消息中携带或通过另一消息发送。
  18. 根据权利要求16所述的接入点，其特征在于，所述确认模块具体用于为接入点服务的BSS内的至少两个站点分配新MAC地址和新AID，每个所述站点分配的所述新MAC地址和新AID为确认的所述站点对应的新MAC地址和新AID；
    所述通知模块具体通过单播方式分别向所述至少两个站点发送所述站点对应的加密的所述新MAC地址和新AID。
  19. 根据权利要求14-18任一项所述的接入点，其特征在于，所述通知模块具体通过以下方式之一指示预定更改条件：
    所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址时，携带指示更改的预定时间或预定时间点；或
    所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过单播的方式分别向所述至少两个站点发送更改指示消息；或
    所述通知模块向所述接入点服务的基本服务集BSS内至少两个站点通知每个站点对应的所述加密的新MAC地址后，通过广播的方式向所述至少两个站点群发更改指示消息。
  20. 根据权利要求19所述的接入点，其特征在于，所述通知模块具体通过广播添加了指示位的信标帧向所述至少两个站点群发更新指示消息，所述指示位包含用于指示所述至少两个站点进行寻址标识更改的更改指示信息。
  21. 根据权利要求14所述的接入点，其特征在于，所述接入点还包括密 钥获取模块，其中：
    所述密钥获取模块用于与所述至少两个站点之间进行加密密钥协商，获取用于对每个站点的新MAC地址进行加密的加密密钥，所述加密密钥为对称加密密钥或非对称加密密钥。
  22. 一种站点，其特征在于，所述站点包括获得模块和更改模块，其中：
    所述获得模块用于获知由所述站点所在的基本服务集BSS内的接入点通知的所述站点对应的加密的新介质访问控制MAC地址，解密获得新MAC地址，并获取预定更改条件，每个所述站点分别对应不同的所述新MAC地址；
    所述更改模块用于在满足预定更改条件时，将所述站点当前使用的MAC地址更改为所述站点对应的所述新MAC地址，以使得后续自所述接入点接收和向所述接入点发送消息时，以所述新MAC地址作为所述站点的MAC地址。
  23. 根据权利要求22所述的站点，其特征在于，所述获得模块在获知所述站点对应的加密的新MAC地址时，还获知所述站点对应的加密的新关联标识AID，解密获得新MAC地址和新AID；
    所述更改模块在满足预定更改条件时，将所述站点当前使用的MAC地址和AID更改为所述站点对应的新MAC地址和新AID。
  24. 根据权利要求23所述的站点，其特征在于，所述获得模块具体通过接收接入点为所述站点对应分配的加密的新MAC地址和新AID，解密获得所述新MAC地址和新AID。
  25. 根据权利要求23所述的站点，其特征在于，所述获得模块具体通过向接入点发送更改请求，所述站点的更改请求中包括所述站点请求的新MAC地址，从所述接入点响应所述更改请求的确认消息中，获知所述站点对应的加密的新MAC地址，并进一步从所述接入点响应所述更改请求的所述确认消息中或从所述接入点发送的另一消息中获知加密的新AID。
  26. 根据权利要求22所述的站点，其特征在于，所述站点还包括密钥协商模块，其中：
    所述密钥协商模块用于与接入点进行加密密钥协商；
    所述获得模块根据所述密钥协商模块协商的加密密钥类型，使用对应 的解密方法解密获得所述新MAC地址，所述加密密钥为对称加密密钥或非对称加密密钥。
  27. 一种通信系统，其特征在于，所述通信系统包括权利要求14-21任一项所述的接入点以及权利要求22-26任一项所述的站点。
PCT/CN2015/075002 2014-03-25 2015-03-25 分配寻址标识的方法及接入点、站点和通信系统 Ceased WO2015144050A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP15768040.6A EP3116252B1 (en) 2014-03-25 2015-03-25 Method for allocating addressing identifier, access point, station and communication system
KR1020167029538A KR101826936B1 (ko) 2014-03-25 2015-03-25 주소지정 식별자를 할당하는 방법, 액세스 포인트, 스테이션 및 통신 시스템
JP2016559311A JP2017515353A (ja) 2014-03-25 2015-03-25 アドレス指定識別子の割り当て方法、アクセスポイント、ステーション、および通信システム
US15/274,751 US10382435B2 (en) 2014-03-25 2016-09-23 Method for allocating addressing identifier, access point, station, and communications system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410114893.2 2014-03-25
CN201410114893.2A CN104955038B (zh) 2014-03-25 2014-03-25 分配寻址标识的方法及接入点、站点和通信系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/274,751 Continuation US10382435B2 (en) 2014-03-25 2016-09-23 Method for allocating addressing identifier, access point, station, and communications system

Publications (1)

Publication Number Publication Date
WO2015144050A1 true WO2015144050A1 (zh) 2015-10-01

Family

ID=54169313

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/075002 Ceased WO2015144050A1 (zh) 2014-03-25 2015-03-25 分配寻址标识的方法及接入点、站点和通信系统

Country Status (6)

Country Link
US (1) US10382435B2 (zh)
EP (1) EP3116252B1 (zh)
JP (1) JP2017515353A (zh)
KR (1) KR101826936B1 (zh)
CN (1) CN104955038B (zh)
WO (1) WO2015144050A1 (zh)

Families Citing this family (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10524289B2 (en) * 2015-12-25 2019-12-31 Kabushiki Kaisha Toshiba Wireless communication device
CN107786972B (zh) 2016-08-31 2020-07-24 华为技术有限公司 无线局域网中建立关联的方法、终端和接入点
CN107979864B (zh) * 2016-10-25 2021-11-19 中兴通讯股份有限公司 接入点的接入方法、装置及系统
CN108886685B (zh) 2016-12-31 2021-02-09 华为技术有限公司 一种终端匹配方法、装置
US10993110B2 (en) * 2018-07-13 2021-04-27 Nvidia Corp. Connectionless fast method for configuring Wi-Fi on displayless Wi-Fi IoT device
US11582230B2 (en) 2019-05-03 2023-02-14 Zte Corporation Dynamic MAC address change mechanism for wireless communications
US11765577B2 (en) * 2019-07-12 2023-09-19 Apple Inc. Identity obscuration for a wireless station
US11438300B2 (en) 2019-10-16 2022-09-06 Raytheon Company Alternate control channel for network protocol stack
US11412073B2 (en) 2019-10-16 2022-08-09 Raytheon Company Alternate control channel for network protocol stack
EP4162667A1 (en) * 2020-06-03 2023-04-12 Raytheon Company Alternate control channel for network protocol stack
CN115665890B (zh) * 2020-07-03 2023-11-03 华为技术有限公司 多链路建立方法及通信装置
KR20230001000A (ko) 2021-06-25 2023-01-03 (주)휴온스 약물방출 특성이 개선된 엠파글리플로진 및 메트포르민 복합제제
MX2024005728A (es) * 2021-11-12 2024-05-27 Guangdong Oppo Mobile Telecommunications Corp Ltd Metodo y estacion de comunicacion.
GB2614584B (en) * 2022-01-07 2024-10-02 Canon Kk Method for changing the value of one or more privacy parameters of stations within a basic service set
JP7745761B2 (ja) * 2022-01-07 2025-09-29 キヤノン株式会社 基本サービスセット内のステーションの１つ以上のプライバシパラメータの値を変更する方法
GB2614562B (en) * 2022-01-07 2024-10-02 Canon Kk Method for changing a value of an extended unique identifier of a non-AP station associated with an AP station
GB2615576B (en) * 2022-02-11 2024-04-24 Canon Kk Method for seamlessly changing a value of an extended unique identifier of a non-AP station associated with an AP station
GB2616033B (en) * 2022-02-24 2025-06-04 Canon Kk Method for changing the MAC address of a non-AP station for a next association with an AP station
WO2023164949A1 (zh) * 2022-03-04 2023-09-07 Oppo广东移动通信有限公司 无线通信的方法和设备
US20240406906A1 (en) * 2022-06-10 2024-12-05 Apple Inc. Association Identifier Change and Obfuscation in WLAN Communication
US20240007846A1 (en) * 2022-07-01 2024-01-04 Apple Inc. Enhanced Address Changing for Wireless Networking Systems
WO2024082302A1 (zh) * 2022-10-21 2024-04-25 Oppo广东移动通信有限公司 信息更新方法、装置、设备、存储介质
WO2025008542A1 (en) * 2023-07-06 2025-01-09 Canon Kabushiki Kaisha Privacy parameter obfuscating method with multiple trust levels
GB2631557A (en) * 2023-07-06 2025-01-08 Canon Kk Privacy parameter obfuscating method with multiple trust levels
US12231397B1 (en) 2023-11-09 2025-02-18 Tp-Link Corporation Pte. Ltd. Techniques for managing a media access control address of a client device for communication with an access point
JP2025133505A (ja) * 2024-03-01 2025-09-11 株式会社Ｊｖｃケンウッド 無線通信装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7330456B2 (en) * 2003-12-19 2008-02-12 Mediatek, Inc. Method and apparatus for wireless relay within a network environment
CN102027767A (zh) * 2008-05-16 2011-04-20 日本电气株式会社 通信装置、通信方法以及通信控制程序

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7330472B2 (en) * 2001-10-26 2008-02-12 Sharp Laboratories Of America, Inc. System and method for hybrid coordination in a wireless LAN
FI113515B (fi) * 2002-01-18 2004-04-30 Nokia Corp Osoitteistus langattomissa lähiverkoissa
KR100878764B1 (ko) 2002-07-06 2009-01-14 삼성전자주식회사 사용자의 익명성보장을 위한 무선 랜 시스템 및 사용자의익명성 보장방법
KR100694105B1 (ko) * 2005-04-25 2007-03-12 삼성전자주식회사 무선 메시 망에서 이동 스테이션 정보를 배포하는 방법 및장치
US8126145B1 (en) * 2005-05-04 2012-02-28 Marvell International Ltd. Enhanced association for access points
US8559369B2 (en) * 2006-02-22 2013-10-15 Elad Barkan Wireless internet system and method
JP4347335B2 (ja) * 2006-12-18 2009-10-21 富士通株式会社 ネットワーク中継プログラム、ネットワーク中継装置、通信システム、ネットワーク中継方法
CN105309004B (zh) * 2012-01-31 2019-07-12 马维尔国际贸易有限公司 用于处理无线通信中的mac报头的方法和装置
KR101514966B1 (ko) 2012-06-28 2015-04-24 주식회사 케이티 무선랜 시스템에서 ａｉｄ 재할당 방법
AU2013360542B2 (en) * 2012-12-12 2016-07-07 Lg Electronics Inc. Method for transmitting/receiving information related to association identifier in wireless communication system and device therefor
CN104754560B (zh) 2013-12-30 2018-11-30 华为终端（东莞）有限公司 一种位置隐私保护方法、装置及系统

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7330456B2 (en) * 2003-12-19 2008-02-12 Mediatek, Inc. Method and apparatus for wireless relay within a network environment
CN102027767A (zh) * 2008-05-16 2011-04-20 日本电气株式会社 通信装置、通信方法以及通信控制程序

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HARJUBS, D.: "IEEE 802.11-14/0367r2", PRIVACY ENHANCED WIRELESS, 16 March 2013 (2013-03-16), XP068069039 *

Also Published As

Publication number Publication date
JP2017515353A (ja) 2017-06-08
CN104955038B (zh) 2019-06-11
CN104955038A (zh) 2015-09-30
EP3116252A4 (en) 2017-02-22
US20170012977A1 (en) 2017-01-12
EP3116252B1 (en) 2018-12-05
KR20160136419A (ko) 2016-11-29
KR101826936B1 (ko) 2018-02-07
US10382435B2 (en) 2019-08-13
EP3116252A1 (en) 2017-01-11

Similar Documents

Publication Publication Date Title
WO2015144050A1 (zh) 分配寻址标识的方法及接入点、站点和通信系统
CN112291780B (zh) 用于无线站点的身份混淆
CN108886685B (zh) 一种终端匹配方法、装置
KR102312670B1 (ko) 사용자 단말 간 장치 대 장치 통신을 수행하는 방법
EP3609121B1 (en) Method and device for managing digital certificate
US10631162B2 (en) Method and apparatus to perform device to device communication in wireless communication network
KR102094216B1 (ko) 이동 통신 시스템 환경에서 프락시미티 기반 서비스 단말 간 발견 및 통신을 지원하기 위한 보안 방안 및 시스템
US20200228977A1 (en) Parameter Protection Method And Device, And System
TW201703556A (zh) 網路安全架構
WO2013118096A1 (en) Method, apparatus and computer program for facilitating secure d2d discovery information
KR20140041226A (ko) 이동 통신 시스템에서 그룹 통신을 위한 보안 관리 방법 및 장치
CN108990048B (zh) 确定终端设备的标识的方法和装置
CN113545115B (zh) 一种通信方法及装置
CN115885496B (zh) 一种通信方法及相关装置
CN102045716B (zh) 一种无线局域网中端站的安全配置方法和系统
KR101789264B1 (ko) 경량화된 사물인터넷 디바이스 인증 시스템 및 방법
WO2022083448A1 (zh) 加密方法、解密方法、装置及设备
CN111050321B (zh) 一种数据处理方法、装置及存储介质
WO2015192665A1 (zh) 基于临时mac地址的接入方法、装置及系统
CN110495153A (zh) 在预关联的状态中加密数据
WO2014194818A1 (zh) 一种用于发现设备的用户的方法和用户设备
CN101588576B (zh) 一种无线通信系统中保护终端私密性的方法及系统
US20090080660A1 (en) Processorless media access control architecture for wireless communication
CN115278677B (zh) 数据检测方法、设备及存储介质
US20240276218A1 (en) Wireless communication method, station device, and access point device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15768040

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2016559311

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015768040

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015768040

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20167029538

Country of ref document: KR

Kind code of ref document: A