Patent ID: 12250741

Like reference numbers and designations in the various drawings indicate like elements.

DETAILED DESCRIPTION

The following description is directed to certain implementations for the purposes of describing innovative aspects of this disclosure. However, a person having ordinary skill in the art will readily recognize that the teachings herein can be applied in a multitude of different ways. The described implementations can be implemented in any device, system or network that is capable of transmitting and receiving radio frequency (RF) signals according to one or more of the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards, the IEEE 802.15 standards, the Bluetooth® standards as defined by the Bluetooth Special Interest Group (SIG), or the Long Term Evolution (LTE), 3G, 4G or 5G (New Radio (NR)) standards promulgated by the 3rd Generation Partnership Project (3GPP), among others. The described implementations can be implemented in any device, system or network that is capable of transmitting and receiving RF signals according to one or more of the following technologies or techniques: code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), single-carrier FDMA (SC-FDMA), single-user (SU) multiple-input multiple-output (MIMO) and multi-user (MU) MIMO. The described implementations also can be implemented using other wireless communication protocols or RF signals suitable for use in one or more of a wireless personal area network (WPAN), a wireless local area network (WLAN), a wireless wide area network (WWAN), or an internet of things (IOT) network.

A WLAN in a home, apartment, business, or other areas may include one or more WLAN devices. Each WLAN device may have one or more wireless interfaces to communicate via a wireless communication medium with another WLAN device. The wireless communication medium may include one or more wireless channels defined within a wireless frequency band (which may be referred to as a band for simplicity). An access point (AP) is a WLAN device that includes at least one wireless interface as well as a distribution system access function. A station (STA) is a WLAN device that includes at least one wireless interface to communicate with an AP or another STA. Each wireless interface may be an addressable entity that implements wireless communication protocols defined for the WLAN. Recently, the IEEE is defining techniques for multi-link communication in which a WLAN device (such as a STA) may establish concurrent communication links on more than one band or more than one channel in a single band. In some implementation, the concurrent communication links may be established using the same wireless association. The communication links may be established on different channels, frequency bands, or spatial streams, among other examples. In some implementations, a first communication link may be established on a first frequency band (such as 2.4 GHz) while the second communication link may be established on a second frequency band (such as the 5 GHz band or 6 GHz band).

Multi-link communication may enable a STA to experience a better quality of service (QoS) such as higher throughput, reliability, or redundancy, among other examples. For example, multi-link communication may enable multi-link aggregation (MLA) in which multiple communication links can be used to concurrently transmit data. Multi-link operation refers to packet-level or link-level aggregation when one or more APs communicate with a STA (or vice versa) using multiple communication links.

Multi-link communication may also enable retransmission of data using different ones of the communication links. Multi-link operation refers to the use of multiple communication links for aggregation of bandwidth, retransmission diversity, or control plane aggregation. In one example of a multi-link operation, a retransmission of a frame may use a different communication link than was used for an initial transmission of the frame. In a traditional dual connectivity model, each communication link would have a different association identifier and different temporal key for a session. However, in a multi-link operation, the same temporal key may be used for two or more communication links. Furthermore, some mechanisms for protection against replay attacks rely on a packet number (PN) as part of an encryption process. Retransmissions of a frame traditionally include the same PN as the initial transmission. Because multi-link operation typically relies on the same temporal key and the same PN for a retransmission of a frame, the security of the retransmission cannot be uniquely verified and guaranteed. Therefore, improvements to the multi-link communication protocol are needed to maintain security for multi-link operations.

Various implementations of this disclosure relate generally to multi-link operation. A first WLAN device (such as an AP) may establish one or more communication links with a second WLAN device, including at least a first communication link. The first WLAN device may determine that the second WLAN device (such as a STA) has established a second communication link with either the first WLAN device or with a third WLAN device (such as another AP) of the wireless network. When communicating with the second WLAN device, the first WLAN device may modify an encryption process so that an encryption for the initial transmission and an encryption of a retransmission will result in differently encrypted frames even though the source frame (before encryption) may contain the same data and the encryption technique may use the same temporal key, and same PN.

In some implementations, the first WLAN device may generate a nonce based on a first link identifier that identifies the first communication link. For example, unique link identifiers may distinguish each of the communication links from the other communication links. Therefore, the nonces generated for the various links would be different. Because the nonce associated with a communication link is used in the encryption process, the frames for the different communication links would be encrypted differently. The nonce generated by the first WLAN device may be sent to the second WLAN device for use in the decryption process without communicating the nonce directly over the communication link.

In some implementations, the procedure for generating the nonces may be modified to add another order of protection than was previously possible. For example, a nonce may be modified to include a link identifier and a direction identifier. The link identifier may uniquely identify each communication link that is part of a multi-link operation. The direction identifier may be used to indicate whether the frame is being transmitted upstream (from STA to AP) or downstream (from AP to STA). To maintain the same length of the original nonce, in some implementations, an address field of the nonce may be truncated to provide room for the link identifier, the direction identifier, or both. Alternatively, or additionally, the address field may be punctured and the link identifier, the direction identifier, or both, may be stored in punctured locations of the address field. Alternatively, a format of the nonce may be extended so that the link identifier, the direction identifier, or both, may be added or appended to the nonce.

In some implementations of the multi-link operation, different temporal keys and PN spaces may be established for each communication link. In some such implementations, the WLAN devices may generate nonces using traditional processes. In some such implementations, sequence number (SN) may be used to prevent replay attacks. For example, each WLAN interface of a WLAN device may maintain a separate encryption key and PN counter. The SN may be used to re-order the received frames first before examining the corresponding PN values received by the re-ordered frames. In this implementation, the PN values may be strictly increasing for each re-ordered packet. In some implementations that use a separate PN space for each communication link, retransmissions on each of the communication links may use a different set of sequential packet numbers. Alternatively, or additionally, in some implementations, a retransmission of a frame may be transmitted on only the same communication link that was used for the initial transmission of the frame.

Particular implementations of the subject matter described in this disclosure can be implemented to realize one or more of the following potential advantages. The described techniques enable improved security for multi-link communications. The security may be enhanced for multi-link operations without modifying the mathematical calculations used in existing encryption and decryption algorithms. For example, an encryption/decryption protocol based on either counter mode (CTR) with cipher-block chaining message authentication code (CBC-MAC) protocol (CCMP) or Galois/counter mode protocol (GCMP) may continue to use nonces, temporal keys, and PNs for encryption and decryption of frames. In some implementations, the enhanced security may be enabled by manipulating the structure of the nonce without changing the length of the nonce. For example, the length of the nonce may be maintained at an optimal length that supports reduced computational complexity. Thus, in some implementations, the link ID, direction ID, or both may be added to a nonce without changing the length of the nonce so that performance of the encryption/decryption protocol is maintained. Furthermore, because some implementations of the improvements are based on changes to a nonce rather than a temporal key, the same temporal key may be used for multiple communication links, which, in turn, enables fast setup, association, and session establishment for multi-link operation. Additionally, existing CCMP or GCMP algorithms may continue to be used, which may reduce complexity in implementing encryption and decryption, while the inputs to the CCMP or GCMP algorithms—particularly the nonce—may provide unique encryption results depending on which communication link is being used to transmit (or retransmit) a frame.

FIG.1shows a block diagram of an example wireless communication network100. According to some aspects, the wireless communication network100can be an example of a wireless local area network (WLAN) such as a Wi-Fi network (and will hereinafter be referred to as WLAN100). For example, the WLAN100can be a network implementing at least one of the IEEE 802.11 family of wireless communication protocol standards (such as that defined by the IEEE 802.11-2016 specification or amendments thereof including, but not limited to, 802.11ah, 802.11ad, 802.11ay, 802.11ax, 802.11az, 802.11ba and 802.11be). The WLAN100may include numerous wireless communication devices such as an access point (AP)102and multiple stations (STAs)104. While only one AP102is shown, the WLAN network100also can include multiple APs102.

Each of the STAs104also may be referred to as a mobile station (MS), a mobile device, a mobile handset, a wireless handset, an access terminal (AT), a user equipment (UE), a subscriber station (SS), or a subscriber unit, among other possibilities. The STAs104may represent various devices such as mobile phones, personal digital assistant (PDAs), other handheld devices, netbooks, notebook computers, tablet computers, laptops, display devices (for example, TVs, computer monitors, navigation systems, among others), music or other audio or stereo devices, remote control devices (“remotes”), printers, kitchen or other household appliances, key fobs (for example, for passive keyless entry and start (PKES) systems), among other possibilities.

A single AP102and an associated set of STAs104may be referred to as a basic service set (BSS), which is managed by the respective AP102.FIG.1additionally shows an example coverage area106of the AP102, which may represent a basic service area (BSA) of the WLAN100. The BSS may be identified to users by a service set identifier (SSID), as well as to other devices by a basic service set identifier (BSSID), which may be a medium access control (MAC) address of the AP102. The AP102periodically broadcasts beacon frames (“beacons”) including the BSSID to enable any STAs104within wireless range of the AP102to “associate” or re-associate with the AP102to establish a respective communication link108(hereinafter also referred to as a “Wi-Fi link”), or to maintain a communication link108, with the AP102. For example, the beacons can include an identification of a primary channel used by the respective AP102as well as a timing synchronization function for establishing or maintaining timing synchronization with the AP102. The AP102may provide access to external networks to various STAs104in the WLAN via respective communication links108.

To establish a communication link108with an AP102, each of the STAs104is configured to perform passive or active scanning operations (“scans”) on frequency channels in one or more frequency bands (for example, the 2.4 GHz, 5 GHz, 6 GHz or 60 GHz bands). To perform passive scanning, a STA104listens for beacons, which are transmitted by respective APs102at a periodic time interval referred to as the target beacon transmission time (TBTT) (measured in time units (TUs) where one TU may be equal to 1024 microseconds (μs)). To perform active scanning, a STA104generates and sequentially transmits probe requests on each channel to be scanned and listens for probe responses from APs102. Each STA104may be configured to identify or select an AP102with which to associate based on the scanning information obtained through the passive or active scans, and to perform authentication and association operations to establish a communication link108with the selected AP102. The AP102assigns an association identifier (AID) to the STA104at the culmination of the association operations, which the AP102uses to track the STA104.

As a result of the increasing ubiquity of wireless networks, a STA104may have the opportunity to select one of many BSSs within range of the STA or to select among multiple APs102that together form an extended service set (ESS) including multiple connected BSSs. An extended network station associated with the WLAN100may be connected to a wired or wireless distribution system that may allow multiple APs102to be connected in such an ESS. As such, a STA104can be covered by more than one AP102and can associate with different APs102at different times for different transmissions. Additionally, after association with an AP102, a STA104also may be configured to periodically scan its surroundings to find a more suitable AP102with which to associate. For example, a STA104that is moving relative to its associated AP102may perform a “roaming” scan to find another AP102having more desirable network characteristics such as a greater received signal strength indicator (RSSI) or a reduced traffic load.

In some cases, STAs104may form networks without APs102or other equipment other than the STAs104themselves. One example of such a network is an ad hoc network (or wireless ad hoc network). Ad hoc networks may alternatively be referred to as mesh networks or peer-to-peer (P2P) networks. In some cases, ad hoc networks may be implemented within a larger wireless network such as the WLAN100. In such implementations, while the STAs104may be capable of communicating with each other through the AP102using communication links108, STAs104also can communicate directly with each other via direct wireless links110. Additionally, two STAs104may communicate via a direct communication link110regardless of whether both STAs104are associated with and served by the same AP102. In such an ad hoc system, one or more of the STAs104may assume the role filled by the AP102in a BSS. Such a STA104may be referred to as a group owner (GO) and may coordinate transmissions within the ad hoc network. Examples of direct wireless links110include Wi-Fi Direct connections, connections established by using a Wi-Fi Tunneled Direct Link Setup (TDLS) link, and other P2P group connections.

The APs102and STAs104may function and communicate (via the respective communication links108) according to the IEEE 802.11 family of wireless communication protocol standards (such as that defined by the IEEE 802.11-2016 specification or amendments thereof including, but not limited to, 802.11ah, 802.11ad, 802.11ay, 802.11ax, 802.11az, 802.11ba and 802.11be). These standards define the WLAN radio and baseband protocols for the PHY and medium access control (MAC) layers. The APs102and STAs104transmit and receive wireless communications (hereinafter also referred to as “Wi-Fi communications”) to and from one another in the form of physical layer convergence protocol (PLCP) protocol data units (PPDUs). The APs102and STAs104in the WLAN100may transmit PPDUs over an unlicensed spectrum, which may be a portion of spectrum that includes frequency bands traditionally used by Wi-Fi technology, such as the 2.4 GHz band, the 5 GHz band, the 60 GHz band, the 3.6 GHz band, and the 900 MHz band. Some implementations of the APs102and STAs104described herein also may communicate in other frequency bands, such as the 6 GHz band, which may support both licensed and unlicensed communications. The APs102and STAs104also can be configured to communicate over other frequency bands such as shared licensed frequency bands, where multiple operators may have a license to operate in the same or overlapping frequency band or bands.

Each of the frequency bands may include multiple channels (which may be used as subchannels of a larger bandwidth channel as described below). For example, PPDUs conforming to the IEEE 802.11n, 802.11ac and 802.11ax standard amendments may be transmitted over the 2.4 and 5 GHz bands, each of which is divided into multiple 20 MHz channels. As such, these PPDUs are transmitted over a physical channel having a minimum bandwidth of 20 MHz, but larger channels can be formed through channel bonding. For example, PPDUs may be transmitted over physical channels having bandwidths of 40 MHz, 80 MHz, 160 or 320 MHz by bonding together multiple 20 MHz channels (which may be referred to as subchannels).

Each PPDU is a composite structure that includes a PHY preamble and a payload in the form of a PLCP service data unit (PSDU). The information provided in the preamble may be used by a receiving device to decode the subsequent data in the PSDU. In instances in which PPDUs are transmitted over a bonded channel, the preamble fields may be duplicated and transmitted in each of the multiple component channels. The PHY preamble may include both a first portion (or “legacy preamble”) and a second portion (or “non-legacy preamble”). The first portion may be used for packet detection, automatic gain control and channel estimation, among other uses. The first portion also may generally be used to maintain compatibility with legacy devices as well as non-legacy devices. The format of, coding of, and information provided in the second portion of the preamble is based on the particular IEEE 802.11 protocol to be used to transmit the payload.

FIG.2Ashows a pictorial diagram of an example system201that implements multi-link operation. The AP102may include multiple wireless interfaces (such as a first WLAN interface210and a second WLAN interface212). Although two WLAN interfaces are shown in the AP102, there may be a different quantity of WLAN interfaces in various implementations. The STA104also may include multiple wireless interfaces (such as a first WLAN interface242and a second WLAN interface244).

The STA104may establish multiple communication links (shown as first communication link108aand second communication link108b) with the AP102. For example, the first communication link108amay be established between the first WLAN interface242of the STA104and the first WLAN interface210of the AP102. The second communication link108bmay be established between the second WLAN interface244of the STA104and the second WLAN interface212of the AP102.

FIG.2Bshows a pictorial diagram of another example system202that implements multi-link operation. In the second example system202, the STA104may establish multiple communication links108aand108bwith non-collocated APs102aand102b, respectively. For example, the STA104may establish a first communication link108ato a WLAN interface220of the AP102ausing the first WLAN interface242of the STA104. The STA104may establish a second communication link108bto a WLAN interface222of the AP102busing the second WLAN interface244of the STA104. The APs102aand102bmay communicate with each other using a wired or wireless communication link208. For example, the non-collocated APs102aand102bmay coordinate multi-link operations for the STA104via the wired or wireless communication link208.

FIG.3Ashows a block diagram of an example WLAN device301that supports multi-link operation. The WLAN device301may be a STA (such as STA104) or an AP (such any of the APs102described herein). The WLAN device301includes a first WLAN interface310and a second WLAN interface320. In the example ofFIG.3A, the first WLAN interface310acts as a master WLAN interface for a group of WLAN interfaces that includes the first WLAN interface310and the second WLAN interface320. The second WLAN interface320may be a slave WLAN interface in the group of WLAN interfaces. A host350may operate as a relay to coordinate communication between the first WLAN interface310and the second WLAN interface320. The WLAN device301may include memory360which is accessible and used by both the first WLAN interface310and the second WLAN interface320to store or retrieve buffered frames or packets.

The first WLAN interface310may include a master MAC layer (also referred to as an upper MAC (U-MAC)312), which has a corresponding network MAC address. The first WLAN interface310also includes a lower MAC layer (L-MAC314, also referred to as a link MAC layer) and a PHY layer316. The second WLAN interface320includes a lower MAC layer (L-MAC324) and a PHY layer326. Each WLAN interface310and320may be configured to establish a communication link with one or more other WLAN devices (not shown). The U-MAC312may coordinate which lower MAC (L-MAC314or L-MAC324) will transmit or receive frames during multi-link operation. The U-MAC312also may coordinate retransmissions or acknowledgements via the L-MAC314or the L-MAC324on behalf of the WLAN device301. The frames (which also may be referred to as MAC protocol data units, or MPDUs) may include one or more MAC service data units (MSDUs). Each MSDU may include data from or to the host350. The U-MAC312may determine encryption settings, addressing fields, or other parameters for each MPDU.

FIG.3Bshows a block diagram of another example WLAN device302that supports multi-link operation. The WLAN device302may be a STA (such as STA104) or an AP (such any of the APs102described herein). The WLAN device302includes a first WLAN interface310, a second WLAN interface320, and a host350. The first WLAN interface310includes a first MAC layer315and a PHY layer316. The second WLAN interface320includes a second MAC layer325and a PHY layer326. Furthermore, the WLAN device302includes a multi-link operation layer370. In some implementations, the multi-link operation layer370may be implemented in the first WLAN interface310, the second WLAN interface320, or the host350. Collectively, the first WLAN interface310, the second WLAN interface320, and the multi-link operation layer370may be referred to as a multi-link layer entity (MLLE) or a multi-layer logical entity. The multi-link operation layer370may provide a MAC service access point (MAC-SAP) that maintains a common association context (including security settings) and a common acknowledgement scheme that is used by both the first WLAN interface310and the second WLAN interface320.

FIG.4shows an example PPDU400usable for communications between an AP102and a number of STAs104. As described above, each PPDU400includes a PHY preamble402and a PSDU404. Each PSDU404may represent (or “carry”) one or more MAC protocol data units (MPDUs)416. For example, each PSDU404may carry an aggregated MPDU (A-MPDU)406that includes an aggregation of multiple A-MPDU subframes408. Each A-MPDU subframe408may include an MPDU frame410that includes a MAC delimiter412and a MAC header414prior to the accompanying MPDU416, which comprises the data portion (“payload” or “frame body”) of the MPDU frame410. Each MPDU frame410may also include a frame check sequence (FCS) field418for error detection (for example, the FCS field may include a cyclic redundancy check (CRC)) and padding bits420. The MPDU416may carry one or more MAC service data units (MSDUs)426. For example, the MPDU416may carry an aggregated MSDU (A-MSDU)422including multiple A-MSDU subframes424. Each A-MSDU subframe424contains a corresponding MSDU430preceded by a subframe header428and in some cases followed by padding bits432.

Referring back to the MPDU frame410, the MAC delimiter412may serve as a marker of the start of the associated MPDU416and indicate the length of the associated MPDU416. The MAC header414may include a number of fields containing information that defines or indicates characteristics or attributes of data encapsulated within the MPDU416. The MAC header414includes a duration field indicating a duration extending from the end of the PPDU until at least the end of an acknowledgment (ACK) or Block ACK (BA) of the PPDU that is to be transmitted by the receiving wireless communication device. The use of the duration field serves to reserve the wireless medium for the indicated duration and enables the receiving device to establish its network allocation vector (NAV). The MAC header414also includes a number of fields indicating addresses for the data encapsulated within the MPDU416. For example, the MAC header414may include a combination of a source address, a transmitter address, a receiver address or a destination address. The MAC header414may further include a frame control field containing control information. The frame control field may specify a frame type, for example, a data frame, a control frame, or a management frame.

A WLAN may use cryptographic encapsulation mechanisms to protect data and to detect or mitigate replay attacks. Example cryptographic encapsulation mechanisms include CCMP and GCMP. These protocols use temporal keys generated for each session. In some implementations of multi-link operation described herein, the temporal key may be common for the multiple communication links.

In various implementations, the cryptographic encapsulation mechanisms utilize a unique nonce for each MPDU protected by the temporal key. The nonce is generated based in part on an address from the MAC header of the MPDU as well as a packet number (PN). The PN is sequentially incremented for each MPDU. If a receiving WLAN device determines that either a PN or the temporal key has been reused, the security status of the MPDU may be voided and the WLAN device may discard the frame.

FIG.5Ashows a block diagram of an example encryption process501according to some implementations. The example encryption process501is based on CCMP encryption. The example encryption process501may be performed by an AP (such as AP102) or a STA (such as STA104) that is transmitting an MPDU. A plaintext (unencrypted) MPDU510may be parsed to determine some of the inputs into a CTR with CBC-MAC (CCM) encryption module (which performs a CCM algorithm)540. For example, some of the fields from the MAC header522of the plaintext MPDU510may be parsed to provide to an additional authentication data (AAD) generator532for the determination of AAD. The CCM encryption module540provides integrity protection for the fields included in the AAD. A PN incrementor524may then increment a packet number514from the previous MPDU to determine the next PN that will be used to construct a nonce. Note that retransmitted MPDUs may not be modified on retransmission. Therefore, the same PN used for an initial transmission of an MPDU may be used as the PN for the retransmission of that MPDU. The PN values sequentially number each MPDU. Each WLAN device maintains a single PN counter (such as a 48-bit counter) for each secure association with another WLAN device. In some implementations, the PN is a 48-bit increasing integer, initialized to 1 when the corresponding temporal key is initialized or refreshed.

The nonce generator534may generate the CCM nonce using the PN, an address field value (A2 address) from the MAC header, and a priority value of the MPDU. The priority value may be based on a quality of service indicator or access category indicator. In some implementations, the PN from the PN incrementer524and a key identifier also may be sent to a CCMP header generator that constructs a CCMP header for the encrypted MPDU.

The CCM encryption module540uses the temporal key512, the AAD, the nonce, and MPDU data520to form the encrypted data (in the form of cipher text) and a message integrity code (MIC). The CCM encryption process may also be referred to as CCM originator processing. The MIC is a value generated by the cryptographic function. If the input data are changed, a new value cannot be correctly computed without knowledge of the cryptographic key(s) used by the cryptographic function. The MIC also may be referred to as a message authentication code. The original MAC header522, the CCMP header (if included), the encrypted data, and the MIC are combined at block542to form the encrypted MPDU550.

The GCMP encryption process (not shown) is similar to the CCMP encryption process described with reference toFIG.5A, except that the GCMP process does not use a priority value as an input to the nonce generator534.

FIG.5Bshows a structure of an MPDU550that has been encrypted using the process ofFIG.5Aaccording to some implementations. The encrypted MPDU550includes the MAC header522, the CCMP header592, the data PDU558(encrypted), the MIC552, and a frame check sequence (FCS)594. The data PDU558and the MIC552are the encrypted portion596of the encrypted MPDU550. The MAC header522and the CCMP header592(when included) provide some values (such as the A2 address in the MAC header522and the PN in the CCMP header592) which can be used by a receiving WLAN device to decrypt the encrypted portion596. In some implementations, the CCMP header592may be omitted. For example, if a frame control field of the MAC header522indicates that the encrypted MPDU550is using a first protocol version (PV1), the CCMP header592may be omitted. If the CCMP header592is omitted, the PN may be determined by a local counter. The transmitting WLAN device and the receiving WLAN device may both maintain a local counter so that they have the same PN for each MPDU. The CCMP header592may be included to initialize the local counters or to establish a new PN.

FIG.5Cshows a block diagram of an example decryption process502according to some implementations. The example decryption process502may be performed by an AP (such as AP102) or a STA (such as STA104) that is receiving an encrypted MPDU550. The MAC header522of the encrypted MPDU550is parsed to provide an AAD generator532for the determination of AAD. The unencrypted portion of the encrypted MPDU550may be parsed to determine an A2 address field554, priority value, and PN556. In some implementations, the PN556may be included in a CCMP header or other unencrypted portion of the encrypted MPDU550. Alternatively the PN556may not be included with the encrypted MPDU550and the PN556may be determined by incrementing a PN local counter (not shown) associated with the session. If the PN determined from the PN local counter is different from the PN that was used by the transmitting WLAN device, then the CCM decryption module580will fail to properly decrypt the cipher text data559. The A2 address field554, the priority value, and the PN556are passed to a nonce generator534that constructs the nonce. The MIC may be extracted from the encrypted MPDU550for use with the CCM decryption module580. The MIC may be used for CCM integrity checking by the CCM decryption module580. The CCM decryption module580performs CCM recipient processing to decrypt the cipher text data559(to recover plaintext data) using the temporal key512(retrieved from memory), the AAD, the nonce, and the MIC. The CCM recipient processing also checks the integrity of the AAD and MPDU plaintext data using the MIC552. The MAC header522and the plaintext data520may be concatenated to form a plaintext MPDU510.

The decryption processing prevents replay of MPDUs by validating that the PN in the MPDU is greater than the replay counter maintained for the session. A replay check module582compares the PN556with the previously stored packet number (PN′) value514.

FIG.6Ashows an example structure of a traditional nonce usable in an encryption or decryption process. The traditional nonce601(which is based on traditional techniques) may include nonce flags610, an A2 address segment620, and a PN660. The A2 address segment620may be populated with a 6 octet (48 bit) address, association ID (AID), or BSSID that represents a transmitting side of the MPDU. The nonce flags610may include one or more indicators (not shown), such as a priority flag, a management segment, a protocol version segment, among other examples. However, because the A2 address segment may be the same for multiple communication links, and the PN660is mandated to equal the PN (not shown) used for an initial transmission, there is a possibility of resulting in the same nonce value for the traditional nonce601. Using the same nonce value for a retransmission or for an encryption of a different set of data is a security flaw that compromises the security for subsequent transmissions or retransmissions in a multi-link operation.

FIG.6Bshows an example structure of a modified nonce602usable in an encryption or decryption process according to some implementations. The modified nonce602includes a link identifier (ID)640that uniquely identifies each communication link associated with the multi-link operation. The link ID640may be included in a first portion642of the modified nonce602. In some implementations, the modified nonce602also may include a direction ID650in a second portion652of the modified nonce602. Both the transmitting WLAN device and the receiving WLAN device may generate the same nonce because they are both aware of the Link ID640for the communication links and the Direction ID650based on their association relationship. In this example, the temporal key and the PN may be the same for retransmissions of the same frame via any of the communication links that are used for the multi-link operation.

In some implementations, the length of the modified nonce602may be the same as the length of the traditional nonce601. To make room for the first portion642and the second portion652, the A2 address segment620may be modified. For example, the A2 address segment may be truncated to form a truncated address segment630. For example, a WLAN device may reduce the A2 address segment from forty-eight bits to forty-three bits so that five bits can be used for the first and second portions642and652. In some implementations, the first portion642may be four bits and the second portion652may be one bit. A first value for the direction ID650may be represent an upstream direction and a second value for the direction ID650may represent a downstream direction, or vice versa. The link ID640may be a value that is sequentially unique for each communication link. Alternatively, the link ID640may be a random value that is verified to be unique from among all the link IDs being used for a multi-link operation. A first WLAN device may communicate a link ID640for one or more communication links at the time of association or session setup. For example, the link ID may be communicated or generated at approximately the same time that the temporal key is generated.

A WLAN device may populate the truncated address segment630with part of the A2 address segment620. For example, the part of the A2 address segment620may include the most significant bits (MSBs), the least significant bits (LSBs), a consecutive string of middle bits, or a predetermined selection of specified bits. Each WLAN device (transmitting WLAN device and receiving WLAN device) may be configured to use the same procedure for generating the truncated address segment630.

FIG.6Cshows another example structure of a modified nonce603usable in an encryption or decryption process according to some implementations. In some implementations, the length of the modified nonce603may be the same as the length of the traditional nonce601. To make room for additional nonce data (such as a link ID640, direction ID (not shown), or other nonce data), the A2 address segment may be punctured to form a punctured address segment670. For example, a WLAN device may reduce the A2 address segment from forty-eight bits to forty-three bits so that five bits can be used for the additional nonce data. A WLAN device may populate unpunctured bits of the punctured address segment670with part of the A2 address segment. For example, the part of the A2 address segment may include predetermined selection of specified bits from the A2 address. A WLAN device may populate punctured bits of the punctured address segment670with additional nonce data (such as the link ID640) as shown inFIG.6C. Each WLAN device (transmitting WLAN device and receiving WLAN device) may be configured to use the same procedure for generating the punctured address segment670.

FIG.6Dshows another example structure of a modified nonce604usable in an encryption or decryption process according to some implementations. InFIG.6D, the modified nonce604includes the nonce flags610, the A2 address segment630and the PN660as described above with reference toFIG.6A. A length of the modified nonce604is extended so that additional nonce data (such as the link ID640and the direction ID650) may be added or appended. InFIG.6D, the link ID640is added in a first portion642and the direction ID650is added in a second portion652of the modified nonce604. The first portion642and the second portion652may be added between the address segment630and the PN660. In other implementations, the first portion642, the second portion652, or both may be located in different locations of the modified nonce604, such as at the beginning or end.

FIG.7Ashows a timing diagram in which an MPDU may be retransmitted using a modified nonce in a multi-link operation according to some implementations. A first WLAN device (not shown) and a second WLAN device (not shown) may have multiple communication links108aand108b, as described with reference toFIG.2A. Alternatively, the first communication link108aand the second communication link108bmay be established between a STA and two different APs, as described with reference toFIG.2B. The WLAN devices may use a same temporal key for both of the communication links108aand108b. Similarly, the WLAN devices may use a same PN space and may maintain PN counters that are responsive to frames transmitted or received via both of the communication links108aand108b.

The first WLAN device may encrypt an MPDU to form a first frame710. The encryption may be based on the temporal key, PN, and a modified nonce that includes a first link ID that uniquely identifies the first communication link108afrom among all the communication links108aand108bused in the multi-link operation. The first WLAN device may transmit the first frame710as an initial transmission on a first communication link108a. If the second WLAN device fails to decrypt or decode the first frame710, the second WLAN device may transmit a negative acknowledgement (NACK)712back to the first WLAN device. The first WLAN device may determine to retransmit the MPDU via the second communication link108b. However, the first WLAN device may modify the nonce used for the encryption by including a second link ID that uniquely identifies the second communication link108bfrom among all the communication links108aand108bused in the multi-link operation. Thus, the first WLAN device will obtain a different encryption result for the MPDU and will transmit the different encryption result as the retransmitted first frame720. After receiving and processing the retransmitted first frame720, the second WLAN device may respond with a positive acknowledgement (ACK)722.

FIG.7Bshows a timing diagram in which an MPDU may be retransmitted using separate temporal keys and packet number counters in a multi-link operation according to some implementations. Similar toFIG.7A, a first WLAN device and a second WLAN device may have a plurality of communication links including a first communication link108aand a second communication link108b. However, different fromFIG.7A, the WLAN devices may establish different temporal keys and PN space for each communication link. For example, the first WLAN device may determine a first temporal key for the first communication link108aand may sequentially number packets based on a first PN counter that is specific to the first communication link108a. The first temporal key and first PN counter may form a first encryption configuration752for the first communication link108a. The first WLAN device may determine a second temporal key (different from the first temporal key) for the second communication link108band may sequentially number packets using a second PN counter (different from the first PN counter) that is specific to the second communication link108b. The second temporal key and second PN counter may form a second encryption configuration754for the second communication link108b. Therefore, the WLAN devices may manage different encryption configurations for each of the communication links108aand108b.

The first WLAN device may transmit a first frame710via the first communication link108a. As withFIG.7A, the second WLAN device may transmit a NACK712to indicate that the second WLAN device was unable to decode or decrypt the first frame710. The first WLAN device may transmit a retransmitted first frame720via the second communication link108b. Because the second encryption configuration754is different than the first encryption configuration752, the first WLAN device may not include a link ID or direction ID in the nonce when performing an encryption of the retransmitted first frame720. Rather, the different temporal key and PN space will suffice to create a different encryption result.

Each WLAN interface (for communication links108aand108b) of the second WLAN device has a different encryption configuration752and754including different PN counters. Therefore, the PN may be insufficient to detect packet replay or guarantee security of the encrypted MPDU. Instead, the second WLAN device may perform a SN packet replay procedure760to protect from a packet replay security breach. The SN packet replay procedure760may be performed by a master WLAN interface or at a higher layer of the second WLAN device. The second WLAN device (using the master WLAN interface or a higher layer) may re-order the frames (coming from different communication links) based on their SN. Since each communication link has its own PN space, the second WLAN device compares the received PN value of a frame only with the last PN value received from that same communication link and makes sure the PN values from the packets arrived on the same communication link are increasing. If a PN for a particular communication link is repeated or less than a previous PN for that communication link, the second WLAN device may determine that there has been a packet replay security breach. In response to the packet replay security breach, the second WLAN device may discard the transmission and may establish new temporal keys and reset the PN counter for each communication link108aand108b. Alternatively, if the PN for each communication link increase properly according to the rule (such as strictly increasing by a fixed value), the second WLAN device may determine that there is no packet replay security breach and may respond with a positive acknowledgement722.

FIG.8shows a block diagram of an example wireless communication device800. In some implementations, the wireless communication device800can be an example of a device for use in a STA such as one of the STAs104described above with reference toFIG.1. In some implementations, the wireless communication device800can be an example of a device for use in an AP such as the AP102described above with reference toFIG.1. The wireless communication device800is capable of transmitting (or outputting for transmission) and receiving wireless communications (for example, in the form of wireless packets). For example, the wireless communication device can be configured to transmit and receive packets in the form of physical layer convergence protocol (PLCP) protocol data units (PPDUs) and medium access control (MAC) protocol data units (MPDUs) conforming to an IEEE 802.11 wireless communication protocol standard, such as that defined by the IEEE 802.11-2016 specification or amendments thereof including, but not limited to, 802.11ah, 802.11ad, 802.11ay, 802.11ax, 802.11az, 802.11ba and 802.11be.

The wireless communication device800can be, or can include, a chip, system on chip (SoC), chipset, package or device that includes one or more modems802, for example, a Wi-Fi (IEEE 802.11 compliant) modem. In some implementations, the one or more modems802(collectively “the modem802”) additionally include a WWAN modem (for example, a 3GPP 4G LTE or 5G compliant modem). In some implementations, the wireless communication device800also includes one or more radios804(collectively “the radio804”). In some implementations, the wireless communication device800further includes one or more processors, processing blocks or processing elements806(collectively “the processor806”) and one or more memory blocks or elements808(collectively “the memory808”).

The modem802can include an intelligent hardware block or device such as, for example, an application-specific integrated circuit (ASIC) among other possibilities. The modem802is generally configured to implement a PHY layer. For example, the modem802is configured to modulate packets and to output the modulated packets to the radio804for transmission over the wireless medium. The modem802is similarly configured to obtain modulated packets received by the radio804and to demodulate the packets to provide demodulated packets. In addition to a modulator and a demodulator, the modem802may further include digital signal processing (DSP) circuitry, automatic gain control (AGC), a coder, a decoder, a multiplexer and a demultiplexer. For example, while in a transmission mode, data obtained from the processor806is provided to a coder, which encodes the data to provide encoded bits. The encoded bits are then mapped to points in a modulation constellation (using a selected MCS) to provide modulated symbols. The modulated symbols may then be mapped to a number NSS of spatial streams or a number NSTS of space-time streams. The modulated symbols in the respective spatial or space-time streams may then be multiplexed, transformed via an inverse fast Fourier transform (IFFT) block, and subsequently provided to the DSP circuitry for Tx windowing and filtering. The digital signals may then be provided to a digital-to-analog converter (DAC). The resultant analog signals may then be provided to a frequency upconverter, and ultimately, the radio804. In implementations involving beamforming, the modulated symbols in the respective spatial streams are precoded via a steering matrix prior to their provision to the IFFT block.

While in a reception mode, digital signals received from the radio804are provided to the DSP circuitry, which is configured to acquire a received signal, for example, by detecting the presence of the signal and estimating the initial timing and frequency offsets. The DSP circuitry is further configured to digitally condition the digital signals, for example, using channel (narrowband) filtering, analog impairment conditioning (such as correcting for I/Q imbalance), and applying digital gain to ultimately obtain a narrowband signal. The output of the DSP circuitry may then be fed to the AGC, which is configured to use information extracted from the digital signals, for example, in one or more received training fields, to determine an appropriate gain. The output of the DSP circuitry also is coupled with the demodulator, which is configured to extract modulated symbols from the signal and, for example, compute the logarithm likelihood ratios (LLRs) for each bit position of each subcarrier in each spatial stream. The demodulator is coupled with the decoder, which may be configured to process the LLRs to provide decoded bits. The decoded bits from all of the spatial streams are then fed to the demultiplexer for demultiplexing. The demultiplexed bits may then be descrambled and provided to the MAC layer (the processor806) for processing, evaluation or interpretation.

The radio804generally includes at least one radio frequency (RF) transmitter (or “transmitter chain”) and at least one RF receiver (or “receiver chain”), which may be combined into one or more transceivers. For example, the RF transmitters and receivers may include various DSP circuitry including at least one power amplifier (PA) and at least one low-noise amplifier (LNA), respectively. The RF transmitters and receivers may, in turn, be coupled to one or more antennas. For example, in some implementations, the wireless communication device800can include, or be coupled with, multiple transmit antennas (each with a corresponding transmit chain) and multiple receive antennas (each with a corresponding receive chain). The symbols output from the modem802are provided to the radio804, which then transmits the symbols via the coupled antennas. Similarly, symbols received via the antennas are obtained by the radio804, which then provides the symbols to the modem802.

The processor806can include an intelligent hardware block or device such as, for example, a processing core, a processing block, a central processing unit (CPU), a microprocessor, a microcontroller, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a programmable logic device (PLD) such as a field programmable gate array (FPGA), discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The processor806processes information received through the radio804and the modem802, and processes information to be output through the modem802and the radio804for transmission through the wireless medium. For example, the processor806may implement a control plane and MAC layer configured to perform various operations related to the generation and transmission of MPDUs, frames or packets. The MAC layer is configured to perform or facilitate the coding and decoding of frames, spatial multiplexing, space-time block coding (STBC), beamforming, and OFDMA resource allocation, among other operations or techniques. In some implementations, the processor806may generally control the modem802to cause the modem to perform various operations described above.

The memory808can include tangible storage media such as random-access memory (RAM) or read-only memory (ROM), or combinations thereof. The memory808also can store non-transitory processor- or computer-executable software (SW) code containing instructions that, when executed by the processor806, cause the processor to perform various operations described herein for wireless communication, including the generation, transmission, reception and interpretation of MPDUs, frames or packets. For example, various functions of components disclosed herein, or various blocks or steps of a method, operation, process or algorithm disclosed herein, can be implemented as one or more modules of one or more computer programs.

FIG.9Ashows a block diagram of an example AP902. For example, the AP902can be an example implementation of the AP102described with reference toFIG.1. The AP902includes a wireless communication device (WCD)910. For example, the wireless communication device910may be an example implementation of the wireless communication device800described with reference toFIG.8. The AP902also includes multiple antennas920coupled with the wireless communication device910to transmit and receive wireless communications. In some implementations, the AP902additionally includes an application processor930coupled with the wireless communication device910, and a memory940coupled with the application processor930. The AP902further includes at least one external network interface950that enables the AP902to communicate with a core network or backhaul network to gain access to external networks including the Internet. For example, the external network interface950may include one or both of a wired (for example, Ethernet) network interface and a wireless network interface (such as a WWAN interface). Ones of the aforementioned components can communicate with other ones of the components directly or indirectly, over at least one bus. The AP902further includes a housing that encompasses the wireless communication device910, the application processor930, the memory940, and at least portions of the antennas920and external network interface950.

FIG.9Bshows a block diagram of an example STA904. For example, the STA904can be an example implementation of the STA104described with reference toFIG.1. The STA904includes a wireless communication device915. For example, the wireless communication device915may be an example implementation of the wireless communication device800described with reference toFIG.8. The STA904also includes one or more antennas925coupled with the wireless communication device915to transmit and receive wireless communications. The STA904additionally includes an application processor935coupled with the wireless communication device915, and a memory945coupled with the application processor935. In some implementations, the STA904further includes a user interface (UI)955(such as a touchscreen or keypad) and a display965, which may be integrated with the UI955to form a touchscreen display. In some implementations, the STA904may further include one or more sensors975such as, for example, one or more inertial sensors, accelerometers, temperature sensors, pressure sensors, or altitude sensors. Ones of the aforementioned components can communicate with other ones of the components directly or indirectly, over at least one bus. The STA904further includes a housing that encompasses the wireless communication device915, the application processor935, the memory945, and at least portions of the antennas925, UI955, and display965.

As described above, in a multi-link operation, a retransmission of a frame may use a different communication link than that which was used for an initial transmission of the frame. In the multi-link operation, the multiple communication link may utilize the same temporal key for two or more communication links. Retransmissions of a frame typically include the same PN as the initial transmission. Because multi-link operation typically relies on the same temporal key and the same PN for a retransmission of a frame, the security of the retransmission cannot be uniquely verified and guaranteed unless a change is made to the inputs of the encryption and decryption algorithm.

Various implementations of this disclosure relate generally to multi-link operation. A first WLAN device (such as an AP) may establish one or more communication links with a second WLAN device, including at least a first communication link. The first WLAN device may determine that the second WLAN device (such as a STA) has established a second communication link with either the first WLAN device or with a third WLAN device (such as another AP) of the wireless network. When communicating with the second WLAN device, the first WLAN device may modify an encryption process so that an encryption for the initial transmission and an encryption of a retransmission will result in differently encrypted frames even though the source frame (before encryption) may contain the same data and the encryption technique may use the same temporal key, and same PN. This disclosure provides several implementations of a modified encryption process that supports multi-link operation. Examples of modifications include the use of a link identifier, a direction identifier, and a truncated address segment, among other examples. Another example modified encryption process may rely on sequence numbers for replay attack detection.

Particular implementations of the subject matter described in this disclosure can be implemented to realize one or more of the following potential advantages. The described techniques enable improved security for multi-link communications. The security may be enhanced for multi-link operations without modifying the mathematical calculations used in existing encryption and decryption algorithms. For example, an encryption/decryption protocol based on either CCMP or GCMP may continue to use nonces, temporal keys, and PNs for encryption and decryption of frames. In some implementations, the enhanced security may be enabled by manipulating the structure of the nonce without changing the length of the nonce. Furthermore, because some implementations of the improvements are based on changes to a nonce rather than a temporal key, the same temporal key may be used for multiple communication links, which, in turn, enables fast setup, association, and session establishment for multi-link operation. Additionally, existing CCMP or GCMP algorithms may continue to be used, which may reduce complexity in implementing encryption and decryption, while the inputs to the CCMP or GCMP algorithms—particularly the nonce—may provide unique encryption results depending on which communication link is being used to transmit (or retransmit) a frame.

FIG.10shows a flowchart illustrating an example process1000for wireless communication by a first WLAN device of a wireless network according to some implementations. The process1000may be performed by a wireless communication device such as the wireless communication device800described above with reference toFIG.8. In some implementations, the process1000may be performed by a wireless communication device operating as or within an AP, such as one of the APs102and902described above with reference toFIGS.1and9A, respectively. In some implementations, the process1000may be performed by a wireless communication device operating as or within a STA, such as one of the STAs104and904described above with reference toFIGS.1and9B, respectively.

In some implementations, the process1000begins in block1002with establishing one or more wireless communication links with a second WLAN device including a first wireless communication link, the first wireless communication link being associated with a first link identifier that uniquely identifies the first wireless communication link in the WLAN.

In block1004, the process1000proceeds with determining that the second WLAN device is capable of multiple simultaneous wireless communication links including the first wireless communication link;

In block1006, the process1000proceeds with preparing a first frame for transmission to the second WLAN device via the first wireless communication link,

In block1008, the process1000proceeds with generating a first nonce that includes the first link identifier based on the determination that the second WLAN device is capable of the multiple simultaneous wireless communication links.

In block1010, the process1000proceeds with encrypting the first frame using the first nonce.

In block1012, the process1000proceeds with transmitting the first frame to the second WLAN device via the first communication link.

FIG.11shows a flowchart illustrating an example process1100for receiving a wireless communication according to some implementations. The process1100may be performed by a wireless communication device such as the wireless communication device800described above with reference toFIG.8. In some implementations, the process1100may be performed by a wireless communication device operating as or within an AP, such as one of the APs112and902described above with reference toFIGS.1and9A, respectively. In some implementations, the process1100may be performed by a wireless communication device operating as or within a STA, such as one of the STAs114and904described above with reference toFIGS.1and9B, respectively.

In some implementations, the process1100begins in block1102with establishing a first wireless communication link with a second WLAN device of a wireless network, the first wireless communication link being associated with a first link identifier that uniquely identifies the first wireless communication link in the WLAN.

In block1104, the process1100proceeds with establishing at least a second wireless communication link with either the first WLAN device or a third WLAN device of the wireless network.

In block1106, the process1100proceeds with receiving a first frame from the second WLAN device via the first wireless communication link.

In block1108, the process1100proceeds with generating a first nonce that includes the first link identifier.

In block1110, the process1100proceeds with decrypting the first frame using the first nonce.

FIG.12shows a flowchart illustrating an example process1200for wireless communication according to some implementations. The process1200may be performed by a first WLAN device such as the wireless communication device800described above with reference toFIG.8. In some implementations, the process1200may be performed by a wireless communication device operating as or within an AP, such as one of the APs112and902described above with reference toFIGS.1and9A, respectively. In some implementations, the process100may be performed by a wireless communication device operating as or within a STA, such as one of the STAs114and904described above with reference toFIGS.1and9B, respectively.

In block1202, the process1200establishes, between the first WLAN device and a second WLAN device, a multi-link association that enables the first WLAN device to exchange frames with the second WLAN device via a first wireless communication link and a second wireless communication link.

In block1204, the process1200determines a temporal key for the multi-link association.

In block1206, the process1200encrypts a first MPDU based on the temporal key and a second MPDU based on the temporal key.

In block1208, the process1200prepares for transmission a first frame including the encrypted first MPDU and a second frame including the encrypted second MPDU.

In block1210, the process1200assigns a first packet number from a set of sequential packet numbers to the first frame and a second packet number from the set of sequential packet numbers to the second frame.

In block1212, the process1200transmits the first frame over the first wireless communication link and the second frame over the second wireless communication link.

FIG.13shows a flowchart illustrating an example process1300for wireless communication according to some implementations. The process1300may be performed by a first WLAN device such as the wireless communication device800described above with reference toFIG.8. In some implementations, the process1300may be performed by a wireless communication device operating as or within an AP, such as one of the APs112and902described above with reference toFIGS.1and9A, respectively. In some implementations, the process100may be performed by a wireless communication device operating as or within a STA, such as one of the STAs114and904described above with reference toFIGS.1and9B, respectively.

At block1302, the process1300establishes, between the first WLAN device and a second WLAN device, a multi-link association that enables the first WLAN device to exchange frames with the second WLAN device via the first wireless communication link and the second wireless communication link.

At block1304, the process1300determines a temporal key for the multi-link association.

At block1306, the process1300receives a first plurality of frames over the first wireless communication link and a second plurality of frames over the second wireless communication link, where each frame of the first plurality of frames and the second plurality of frames includes an encrypted MPDU and a first packet number selected from a set of sequential packet numbers.

At block1308, the process1300determines, in the first plurality of frames and the second plurality of frames, whether at least two frames include duplicate first packet numbers and whether a frame includes a first packet number that is less than a threshold number.

At block1310, the process1300encrypts the encrypted MPDU in each of the first plurality of frames and the second plurality of frames based on the temporal key for the multi-link association, in response to determining that no two frames include duplicate packet numbers and no frame includes a first packet number that is less than the threshold number.

FIG.14shows a block diagram of an example wireless communication device1400according to some implementations. In some implementations, the wireless communication device1400is configured to perform one or more of the processes described above. The wireless communication device1400may be an example implementation of the wireless communication device800described above with reference toFIG.8. For example, the wireless communication device1400can be a chip, SoC, chipset, package or device that includes at least one processor and at least one modem (for example, a Wi-Fi (IEEE 802.11) modem or a cellular modem). In some implementations, the wireless communication device1400can be a device for use in an AP, such as one of the APs102and902described above with reference toFIGS.1and9A, respectively. In some implementations, the wireless communication device1400can be a device for use in a STA, such as one of the STAs104and904described above with reference toFIGS.1and9B, respectively. In some other implementations, the wireless communication device1400can be an AP or a STA that includes such a chip, SoC, chipset, package or device as well as at least one transmitter, at least one receiver, and at least one antenna.

The wireless communication device1400includes a multi-link configuration module1402, an encryption module1404, a nonce generation module1406and a multi-link operation module1408. Portions of one or more of the modules1402,1404,1406and1408may be implemented at least in part in hardware or firmware. For example, the multi-link configuration module1402, the encryption module1404, the nonce generation module1406and the multi-link operation module1408may be implemented at least in part by a modem (such as the modem802). In some implementations, portions of some of the modules1402,1404,1406or1408may be implemented at least in part as software stored in a memory (such as the memory808). For example, portions of one or more of the modules1402,1404,1406or1408can be implemented as non-transitory instructions (or “code”) executable by a processor (such as the processor806) to perform the functions or operations of the respective module.

The multi-link configuration module1402may be configured to determine security configurations for the communication links used in a multi-link operation. For example, the security configurations may include a common temporal key and common PN counter. Alternatively, the security configurations may include different temporal keys and different PN counters for each communication link. The multi-link configuration module1402may establish one or more communication links that are part of a group of communication links used for a multi-link operation. As an example, the multi-link operation may include the concurrent use of multiple communication links to transmit MPDUs. The multi-link operation may support aggregation of multiple communication links between different WLAN interfaces (not shown) of the wireless communication device1400.

The encryption module1404may be configured to encrypt an MPDU for transmission via the communication link. The encryption may be based on the security configuration determined by the multi-link configuration module1402. Additionally, the encryption may be based on a nonce that is made up of at least part of an A2 address value, a PN, and a nonce.

The nonce generation module1406may be configured to generate a nonce for the encryption module1404. In some implementations, the nonce may include at least a first portion that is populated with a link ID. The nonce may include a second portion that is populated with a direction ID.

The multi-link operation module1408may be configured to transmit the encrypted MPDUs via the communication links. The multi-link operation module1408also may determine that multi-link aggregation is supported by the wireless communication device1400and another WLAN device.

FIG.15shows a block diagram of an example wireless communication device1500according to some implementations. In some implementations, the wireless communication device1500is configured to perform one or more of the processes described above. The wireless communication device1500may be an example implementation of the wireless communication device800described above with reference toFIG.8. For example, the wireless communication device1500can be a chip, SoC, chipset, package or device that includes at least one processor and at least one modem (for example, a Wi-Fi (IEEE 802.11) modem or a cellular modem). In some implementations, the wireless communication device1500can be a device for use in an AP, such as one of the APs102and902described above with reference toFIGS.1and9A, respectively. In some implementations, the wireless communication device1500can be a device for use in a STA, such as one of the STAs104and904described above with reference toFIGS.1and9B, respectively. In some other implementations, the wireless communication device1500can be an AP or a STA that includes such a chip, SoC, chipset, package or device as well as at least one transmitter, at least one receiver, and at least one antenna.

The wireless communication device1500includes a multi-link configuration module1504, a decryption module1506, a nonce generation module1508and a multi-link operation module1510. Portions of one or more of the modules1504,1506,1508and1510may be implemented at least in part in hardware or firmware. For example, the multi-link configuration module1504, the decryption module1506, the nonce generation module1508and the multi-link operation module1510may be implemented at least in part by a modem (such as the modem802). In some implementations, portions of some of the modules1504,1506,1508or1510may be implemented at least in part as software stored in a memory (such as the memory808). For example, portions of one or more of the modules1504,1506,1508or1510can be implemented as non-transitory instructions (or “code”) executable by a processor (such as the processor806) to perform the functions or operations of the respective module.

The multi-link configuration module1504may be configured to determine security configurations for the communication links used in a multi-link operation. For example, the security configurations may include a common temporal key and common PN counter. Alternatively, the security configurations may include different temporal keys and different PN counters for each communication link. The multi-link configuration module1504may establish one or more communication links that are part of a group of communication links used for a multi-link operation. As an example, the multi-link operation may include the concurrent use of multiple communication links to receive encrypted MPDUs. The multi-link operation may support aggregation of multiple communication links between different WLAN interfaces (not shown) of the wireless communication device1500.

The decryption module1506may be configured to decrypt an encrypted MPDU received via the communication link. The decryption may be based on the security configuration determined by the multi-link configuration module1504. Additionally, the encryption may be based on a nonce that is made up of at least part of an A2 address value, a PN, and a nonce.

The nonce generation module1508may be configured to generate a nonce for the decryption module1506. In some implementations, the nonce may include at least a first portion that is populated with a link ID. The nonce may include a second portion that is populated with a direction ID.

The multi-link operation module1510may be configured to receive the encrypted MPDUs via the communication links. The multi-link operation module1510also may determine that multi-link aggregation is supported by the wireless communication device1500and another WLAN device.

As used herein, a phrase referring to “at least one of” or “one or more of” a list of items refers to any combination of those items, including single members. For example, “at least one of: a, b, or c” is intended to cover the possibilities of: a only, b only, c only, a combination of a and b, a combination of a and c, a combination of b and c, and a combination of a and b and c.

The various illustrative components, logic, logical blocks, modules, circuits, operations and algorithm processes described in connection with the implementations disclosed herein may be implemented as electronic hardware, firmware, software, or combinations of hardware, firmware or software, including the structures disclosed in this specification and the structural equivalents thereof. The interchangeability of hardware, firmware and software has been described generally, in terms of functionality, and illustrated in the various illustrative components, blocks, modules, circuits and processes described above. Whether such functionality is implemented in hardware, firmware or software depends upon the particular application and design constraints imposed on the overall system.

Various modifications to the implementations described in this disclosure may be readily apparent to persons having ordinary skill in the art, and the generic principles defined herein may be applied to other implementations without departing from the spirit or scope of this disclosure. Thus, the claims are not intended to be limited to the implementations shown herein but are to be accorded the widest scope consistent with this disclosure, the principles and the novel features disclosed herein.

Additionally, various features that are described in this specification in the context of separate implementations also can be implemented in combination in a single implementation. Conversely, various features that are described in the context of a single implementation also can be implemented in multiple implementations separately or in any suitable subcombination. As such, although features may be described above as acting in particular combinations, and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.

Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. Further, the drawings may schematically depict one more example processes in the form of a flowchart or flow diagram. However, other operations that are not depicted can be incorporated in the example processes that are schematically illustrated. For example, one or more additional operations can be performed before, after, simultaneously, or between any of the illustrated operations. In some circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components in the implementations described above should not be understood as requiring such separation in all implementations, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.