Updating of layer-2 group key in a wireless network
According to an aspect of the present disclosure, an access point sends timing information related to updating of a group key. A wireless station communicates with the access point according to the timing information to receive an updated group key. The updated group key is thereafter used for processing of multicast packets. Due to the use of the timing information, the wireless station can operate in a power-down mode, and yet receive at least the required group keys. In one embodiment, the timing information specifies a future time instance at which the update group may be available. In an alternative embodiment, a version number is associated with each value of the group key and the version number of the currently operative group key (in the access point) is broadcast to the wireless stations.
1. A method performed in a wireless station of a wireless network, said method comprising:
operating with a first key as a group key in a first duration;
receiving from a layer-2 switch timing information related to an updated group key;
communicating with said layer-2 switch, according to said timing information, to receive a second group key as said updated group key at a first time instant;
processing multicast packets using said second group key after said first time instant.
2. The method of claim 1 , wherein said timing information comprises a future time instant at which said updated group key is expected to be available in said layer-2 switch, wherein said first time instant is after said future time instant,
wherein said wireless station operates in a power down mode for a duration before said future time instant and operates in active mode for said communicating and said processing.
3. The method of claim 2 , wherein said wireless network is according to IEEE 802.11 protocol, and said layer-2 switch is an access point (AP).
4. The method of claim 3 , wherein said future time instant is indicated in Key Data field of an EAPOL (Extensible Authentication Protocol over Local Area Networks) packet according to said IEEE 802.11 protocol.
5. The method of claim 4 , wherein said wireless station participates in a 4-way handshake with said layer-2 switch to obtain the future time instant.
6. The method of claim 1 , wherein said timing information comprises a version number of a group key currently used by said layer-2 switch,
wherein said wireless station maintains a version number of said first key,
wherein said wireless station compares said version number of said group key currently used by said layer-2 switch with said version number of said first key to identify that said updated group key is available on said layer-2 switch,
wherein said communicating is performed after said identifying.
7. The method of claim 6 , upon said identifying, said method further comprises:
dissociating and then re-associating with said layer-2 switch, wherein said communicating is performed as a part of said re-associating.
8. The method of claim 7 , wherein said version number of said group key currently used by said layer-2 switch, is received from said layer-2 switch in an information element (IE) of a field of a beacon,
wherein said communicating comprises a two-way handshake in which said second group key is received.
9. A non-transitory machine readable medium storing one or more sequences of instructions for enabling an access point (AP) to communicate multicast packets with wireless stations in a wireless network, wherein execution of said one or more instructions by one or more processors contained in said AP enables said AP to perform the actions of:
operating with a first key as a group key in a first duration;
generating a second key as an updated key for said group key;
transmitting timing information related to said updated key;
buffering said second key;
communicating with a wireless station to send said second key as said updated key at a first time instant; and
transmitting multicast packets to said wireless station encrypted with said second key after said first time instant.
10. The non-transitory machine readable medium of claim 9 , wherein said timing information comprises a future time instant at which said updated key is expected to be available in said AP, wherein said first time instant is after said future time instant,
wherein said wireless station operates in a power-down mode for a duration before said future time instant and operates in active mode for receiving said second key as said updated key.
11. The non-transitory machine readable medium of claim 10 , wherein said wireless network is according to IEEE 802.11 standards.
12. The non-transitory machine readable medium of claim 11 , wherein said future time instant is indicated in a Key Data field of an EAPOL (Extensible Authentication Protocol over Local Area Networks) packet according to said IEEE 802.11 standards.
13. The non-transitory machine readable medium of claim 9 , wherein said timing information comprises a version number of a group key currently used by said AP,
wherein said wireless station maintains a version number of said first key,
wherein said wireless station compares said version number of said group key currently used by said AP with said version number of said first key to identify that said updated key is available on said AP,
wherein said communicating is performed after said identifying.
14. The non-transitory machine readable medium of claim 13 , upon said identifying at said wireless station, said actions further comprise:
communicating with said wireless station to enable said wireless station to dissociate and then re-associate with said AP,
wherein said wireless station is de-authenticated, but not dissociated, prior to said communicating in view of said wireless station not retrieving said second key,
wherein said communicating causes said wireless station to be re-authenticated and re-associated.
15. The non-transitory machine readable medium of claim 14 , wherein said version number of said group key currently used by said AP, is transmitted to said wireless station in an information element (IE) of a field of a beacon,
wherein said communicating comprises a modified two-way handshake in which said second key is sent to said wireless station.
16. A wireless station of a wireless network, said wireless station comprising:
a processing block, a memory, and a receiver circuit,
said memory to store instructions which when retrieved and executed by said processing block causes said wireless station to perform the actions of:
operating with a first key as a group key in a first duration;
receiving, from a layer-2 switch, timing information related to an updated group key;
communicating with said layer-2 switch using said receiver circuit, according to said timing information, to receive a second group key as said updated group key at a first time instant;
processing multicast packets using said second group key after said first time instant.
17. The wireless station of claim 16 , wherein said timing information comprises a future time instant at which said updated group key is expected to be available in said layer-2 switch, wherein said first time instant is after said future time instant,
wherein said wireless station operates in a power-down mode for a duration before said future time instant and operates in active mode for said communicating and said processing,
wherein said receiver circuit is powered-OFF in said power down mode and powered-ON in said active mode.
18. The wireless station of claim 16 , wherein said wireless network is according to IEEE 802.11 protocol, and said layer-2 switch is an access point (AP).
19. The wireless station of claim 16 , wherein said timing information comprises a version number of a group key currently used by said layer-2 switch,
wherein said processing block maintains a version number of said first key,
wherein said processing block compares said version number of said group key currently used by said layer-2 switch with said version number of said first key to identify that said updated key is available on said layer-2 switch,
wherein said communicating is performed after said identifying.
20. The wireless station of claim 19 , wherein upon said identifying, said processor further performs the actions of:
dissociating and then re-associating with said layer-2 switch, wherein said communicating is performed as a part of said re-associating.