Cryptographic security in multi-access point networks

A method for communication in a wireless local area network (WLAN) system, the method comprising:

• onboarding, authenticating, and configuring respective basic service sets (BSSs) of multiple access points in a multi-access point (multi-AP) network by a multi-AP controller, by communication between the multi-AP controller and respective multi-AP agents in the access points over a backhaul network in the WLAN system;
• generating respective cryptographic keys for the multi-AP agents by carrying out a handshaking procedure between the multi-AP controller and the multi-AP agents over the backhaul network;
• exchanging messages, having respective, successive sequence indicators, between the multi-AP controller and the multi-AP agents over the backhaul network while encrypting and authenticating the messages using the respective cryptographic keys and incorporating the respective sequence indicators as associated data in the encrypted and authenticated messages,
• wherein the sequence indicators comprise time stamps, and wherein exchanging the messages comprises incrementing the time stamps over a period of time during which the messages are transmitted;
• and
• in response to the encrypted and authenticated messages received by the respective multi-AP agents, associating and communicating over wireless fronthaul links by the access points with client stations (STAs) in the WLAN system using the respective BSSs configured by the multi-AP controller.

A wireless local area network (WLAN) system, comprising:

• a plurality of access points (APs), which are configured to associate and communicate over wireless fronthaul links with client stations (STAs) in the WLAN system using respective basic service sets (BSSs) under control of respective multi-access point (multi-AP) agents running in the access points;
• and
• a multi-access point (multi-AP) controller configured to communicate over a backhaul network in the WLAN system with the respective multi-AP agents in the access points so as to onboard, authenticate, and configure the respective BSSs of the access points to define a multi-AP network,
• wherein the multi-AP controller and multi-AP agents are configured to generate respective cryptographic keys for the multi-AP agents by carrying out a handshaking procedure between the multi-AP controller and the multi-AP agents over the backhaul network, and to exchange messages over the backhaul network while encrypting and authenticating the messages using the respective cryptographic keys, and
• wherein the multi-AP controller and multi-AP agents are configured to detect a predefined rekeying event in communications between the multi-AP controller and any given multi-AP agent, to generate a new cryptographic key for the given multi-AP agent by repeating the handshaking procedure, and to apply the new cryptographic key in encrypting and authenticating the messages following the rekeying trigger,
• wherein the multi-AP controller and multi-AP agents are configured to apply successive sequence numbers to the messages, and wherein detecting the rekeying event comprises detecting that the sequence numbers have reached a predefined limit.