SECURING WIRELESS FRAMES WITHOUT ASSOCIATION

1 . A device, comprising:

at least one processor configured to:

establish pre-association security with an access point prior to association with the access point; and

perform protected wireless communication with the access point based on the established pre-association security without association with the access point.

2 . The device of claim 1 , wherein the at least one processor is configured to establish the pre-association security by performing a key establishment process and a key confirmation process, and

wherein the device is unassociated with the access point and the key establishment and the key confirmation process are performed prior to completion of an association process to associate with the access point.

3 . The device of claim 2 , wherein the at least one processor is configured to establish the pre-association security by:

transmitting, to the access point, a first communication frame including first key information for the key establishment process at the access point;

receiving, from the access point, a second communication frame including second key information for the key establishment process at the device and a key confirmation information of the access point for the key confirmation process at the device; and

performing the key confirmation process at the device based on the key confirmation information of the access point without the association process with the access point.

4 . The device of claim 3 , wherein the first key information includes at least one of a device public key or a device nonce, and wherein the second key information includes at least one of an access point public key or an access point nonce.

5 . The device of claim 3 , wherein the at least one processor is configured to perform the key establishment process by:

establishing a shared key of the device based on the second key information.

6 . The device of claim 5 , wherein the key confirmation information of the access point is a key confirmation element including an access point key authorization field that is based on the first key information and the second key information, and

the at least one processor is configured to perform the key confirmation process by:

deriving a confirmation key based on the shared key, the first key information, and the second key information;

generating a key verifier of the device based on the confirmation key, the first key information, and the second key information or based on a device public key; and

confirming that the access point key authorization field matches the key verifier of the device.

7 . The device of claim 6 , wherein the at least one processor is configured to perform the key confirmation process by:

generating a key authorization field of the device based on the first key information and the second key information and further based on the confirmation key or a private key of the device; and

transmitting, to the access point, a third communication frame including a key confirmation element of the device, the key confirmation element of the device including the key authorization field of the device.

8 . The device of claim 7 , wherein the third communication frame is an association frame including an association request to associate with the access point.

9 . The device of claim 7 , wherein the at least one processor is configured to establish the pre-association security by:

receiving operating channel information of the access point from the access point via the second communication frame, the operating channel information of the access point indicating a channel utilized by the access point; and

confirming that the channel utilized by the access point matches a channel utilized by the device.

10 . The device of claim 7 , wherein the at least one processor is configured to establish the pre-association security further by:

transmitting operating channel information of the device to the access point via the third communication frame, the operating channel information of the device indicating a channel utilized by the device.

11 . A method comprising:

establishing, by an access point, a pre-association security mechanism with a device prior to association with the device; and

performing protected wireless communication with the device based on the established pre-association security without the device being associated with the access point.

12 . The method of claim 11 , wherein the establishing the pre-association security comprises performing a key establishment process and a key confirmation process, and wherein the device is unassociated with the access point and the key establishment and the key confirmation process are performed prior to completion of an association process to associate the device with the access point.

13 . The method of claim 12 , wherein the establishing the pre-association security comprises:

receiving, from the device, a first communication frame including first key information for the key establishment process at the access point;

transmitting, to the device, a second communication frame including second key information for the key establishment process at the device and a key confirmation information of the access point for the key confirmation process at the device;

receiving, from the device, a third communication frame including a key information element of the device; and

performing the key confirmation process at the access point based on the key confirmation information of the device without the association process with the device.

14 . The method of claim 13 , wherein the key establishment process at the access point is performed by:

establishing a shared key of the access point based on the first key information.

15 . The method of claim 14 , wherein the key confirmation information is a key confirmation element of the device including a device key authorization field that is based on a shared key of the device, the first key information, and the second key information, and

wherein the key confirmation process is performed by:

deriving a confirmation key based on the shared key, the first key information, and the second key information;

generating a key verifier of the access point based on the confirmation key, the first key information, and the second key information or based on an access point public key; and

confirming that the device key authorization field matches the key verifier of the access point.

16 . The method of claim 15 , wherein the key confirmation is performed further by:

generating a key authorization field of the access point based on the first key information and the second key information and further based on the confirmation key or a private key of the access point; and

generating a key confirmation element of the access point that includes the key authorization field of the access point, wherein the key confirmation information of the access point is the key confirmation element.

17 . The method of claim 16 , wherein the establishing the pre-association security further comprises:

receiving operating channel information of the device from the device via the third communication frame, the operating channel information of the device indicating a channel utilized by the device; and

confirming that the channel utilized by the device matches a channel utilized by the access point.

18 . A non-transitory, processor-readable storage media encoded with instructions that, when executed by processor, cause the processor to perform a method by a device comprising:

establishing a security mechanism with an access point;

performing an association process with the access point to associate with the access point; and

performing an operating channel confirmation process based on operating channel information exchanged during the establishment of the security mechanism, wherein the operating channel confirmation process is performed during or after the association process.

19 . The processor-readable storage media of claim 18 , wherein the performing the operating channel confirmation process comprises:

confirming that a channel utilized by the access point matches a channel utilized by the device, wherein the channel utilized by the access point is indicated by the operating channel information received from the access point.

20 . The processor-readable storage media of claim 18 , wherein the security mechanism is established using at least one of a fast initial link setup (FILS), a fast basic service set (BSS) transition, a four way pairwise key handshake process, or a two way group handshake process.