Key generation for seamless roaming
AssigneeCisco Technology, Inc.
InventorsBinita GUPTA, Stephen M. ORR, Brian D. HART
Life of this patent
Estimating the term…
Abstract
A seamless mobility domain (SMD) is described where a PTK for a wireless device is pre-computed or pre-generated before the client roams from a serving AP to a target AP in the SMD. The pre-computed PTK can be distributed (i.e., pushed) to one or more target APs before the wireless device roams, or the PTK can be stored in a key stored and then retrieved from the key store by a target AP once the wireless device roams to the target AP. In another embodiment, the PMK and/or PTK keys are generated using a SMD identifier, such as a SMD MAC address or a special ID for the SMD.
Claims20
A method comprising
- establishing, by a first access point (AP) multilink device (MLD) of a seamless mobility domain (SMD), an association between the SMD and a non-AP MLD, wherein the SMD comprises the first AP MLD and a second AP MLD;
- wherein establishing the association comprises:
- authenticating the non-AP MLD, the authenticating comprising:
- generating a pairwise master key (PMK) for the SMD and non-AP MLD;
- and
- generating a pair wise transient key (PTK) for the association between the SMD and the non-AP MLD, wherein the PTK is generated using an identifier for the SMD and a MLD address of the first AP MLD;
- and
- transmitting the PTK to the second AP MLD in the SMD, wherein the PTK is usable by the second AP MLD to exchange encrypted communications with the non-AP MLD.
An access point (AP) multilink device (MLD) comprising:
- one or more memories;
- and
- one or more processors communicatively coupled to the one or more memories, wherein the one or more processors are configured to, individually or collectively, perform operations comprising:
- establishing, by the AP MLD, an association between a seamless mobility domain (SMD) and a non-AP MLD, wherein the SMD comprises the AP MLD and a second AP MLD, wherein establishing the association comprises:
- authenticating the non-AP MLD, the authenticating comprising:
- generating a pairwise master key (PMK) for the SMD and non-AP MLD;
- and
- generating a pair wise transient key (PTK) for the association between the SMD and the non-AP MLD, wherein the PTK is generated using an identifier for the SMD and a MLD address of the AP MLD;
- and
- transmitting the PTK to the second AP MLD in the SMD, wherein the PTK is usable by the second AP MLD to exchange encrypted communications with the non-AP MLD.
A non-transitory computer readable storage medium comprising instructions that when executed configure one or more processors of an access point (AP) multi-link device (MLD) to perform operations comprising:
- establishing, by the AP MLD, an association between a seamless mobility domain (SMD) and a non-AP MLD, wherein the SMD comprises the AP MLD and a second AP MLD, wherein establishing the association comprises
- authenticating the non-AP MLD, the authenticating comprising:
- generating a pairwise master key (PMK) for the SMD and non-AP MLD;
- and
- generating a pair wise transient key (PTK) for the association between the SMD and the non-AP MLD, wherein the PTK is generated using an identifier for the SMD and a MLD address of the AP MLD;
- and
- transmitting the PTK to the second AP MLD in the SMD, wherein the PTK is usable by the second AP MLD to exchange encrypted communications with the non-AP MLD.
Dependencies are inferred from the claim text.