Security in a multi-band wireless communication system

1. A method for securing a multi-band wireless communication system comprising:

authenticating a station (STA) multi-link device (MLD) with an Access Point (AP) MLD including communication channels that are used by the AP MLD to authenticate with the STA MLD using a group of keys negotiated in a key negotiation (KN) band, the KN band being one of a plurality of frequency bands, wherein the STA MLD comprises a plurality of STA links, the AP MLD comprises a plurality of AP links, each STA link and each corresponding AP link configured to communicate over a respective one of the plurality of AP links, and wherein authenticating the STA MLD in the KN band authenticates the STA MLD for each of the frequency bands;

encrypting a frame comprising,

incrementing a Packet Number (PN) corresponding to the frame,

configuring a Nonce with the PN and at least one address octet of a Medium Access Control (MAC) header,

configuring an Additional Authentication Data (AAD) with the at least one address octet of the MAC header, wherein the at least one address octet of the MAC header comprises a second address octet (A2) of a second frame transmitted by the STA MLD, and the A2 address octet is used to configure the Nonce, wherein the frame is transmitted by the AP MLD over a first AP link associated with a corresponding first STA link of the STA MLD and the second frame is transmitted by the STA MLD over a second STA link associated with a corresponding second AP link of a AP MLD; and

transmitting the frame between the STA MLD and the AP MLD, in a first one of the frequency bands, wherein each of a plurality of keys in the group of keys are a Group Transient Key (GTK) generated by the AP MLD, a different GTK of the plurality of GTKs is used for a respective AP link of the plurality of AP links of the AP MLD, the PN is one of a plurality of PNs and wherein a different one of the plurality of PNs is used for a respective one of the plurality of AP links.

2. The method of claim 1 wherein one key in the group of keys is a Pair-Wise Transient Key (PTK) derived from a Pair-Wise Master Key (PMK), the frame is one of plurality of unicast frames, the PTK is used for encrypting and decrypting one or more of the unicast frames for all of the frequency bands used by both the STA MLD and the AP MLD, and wherein the PN is used for all of the frequency bands.

3. The method of claim 2 wherein the at least one address octet of the MAC header comprises a second address octet (A2) of the frame received by the STA MLD, and the A2 address octet is used to configure the Nonce.

4. The method of claim 2 wherein the at least one address bit of the MAC header comprises a first address octet (A1), a second address octet (A2), a third address octet (A3) and a fourth address octet (A4) of the frame received by the STA MLD, and the A1, A2, A3 and A4 address octets are used to configure the AAD.

5. The method of claim 2 further comprising modifying the frame to form a second frame and transmitting the second frame with a modified transmitter address of the STA MLD and receiving the second frame with a modified receiver address of the AP MLD.

6. The method of claim 1 wherein the at least one address octet of the MAC header comprises an address of the frame transmitted by the AP MLD over an AP link associated with a corresponding STA link of a STA MLD.

7. The method of claim 1 wherein the at least one address octet of the MAC header comprises a first address octet (A1), a second address octet (A2), a third address octet (A3) and a fourth address octet (A4) of the frame received by the STA MLD, and the A1, A2, A3 and A4 address octets are used to configure the AAD, wherein the frame is transmitted by the AP MLD over a first AP link associated with a corresponding first STA link of a STA MLD and the second frame is transmitted by the STA MLD over a second STA link associated with a corresponding second AP link of a AP MLD.

8. The method of claim 1 further comprising modifying the frame to form a second frame and transmitting the second frame with a modified transmitter address of the STA MLD.

9. An apparatus comprising:

a station (STA) multi-link device (MLD), comprising a plurality of STA links; and

an Access Point (AP) MLD, comprising a plurality of AP links and communication channels to communicate with respective STA MLDs, each STA link and each corresponding AP link configured to communicate over a respective one of a plurality of frequency bands, wherein the AP MLD is configured to:

authenticate a STA MLD using the communication channels by negotiating a group of keys in a key negotiation (KN) band, the KN band being one frequency band of the plurality of frequency bands,

encrypt a frame comprising incrementing a Packet Number (PN) corresponding to the frame, configure a Nonce with the PN and at least one address octet of a Medium Access Control (MAC) header, and configure an Additional Authentication Data (AAD) with the at least one address octet of the MAC header, and

transmit the frame between the STA MLD and the AP MLD, in a first one of the frequency bands, wherein each of a plurality of keys in the group of keys are a Group Transient Key (GTK) generated by the AP MLD, a different one of the plurality of GTKs is used for a respective one of the plurality of AP links of the AP MLD, the PN is one of a plurality of PNs and wherein a different one of the plurality of PNs is used for a respective one of the plurality of AP links, and wherein the at least one address octet of the MAC header comprises a second address octet (A2) of a second frame transmitted by the STA MLD, and the A2 address octet is used to configure the Nonce, wherein the frame is transmitted by the AP MLD over a first AP link associated with a corresponding first STA link of a STA MLD and the second frame is transmitted by the STA MLD over a second STA link associated with a corresponding second AP link of a AP MLD.

10. The apparatus of claim 9 wherein one key in the group of keys is a Pair-Wise Transient Key (PTK) derived from a Pair-Wise Master Key (PMK), the frame is one of plurality of unicast frames, the PTK is used for encrypting and decrypting one or more of the unicast frames for all of the frequency bands used by both the STA MLD and the AP MLD, and wherein the PN is used for all of the frequency bands.

11. The apparatus of claim 10 wherein the at least one address octet of the MAC header comprises a second address octet (A2) of the frame received by the STA MLD, and the A2 address octet is used to configure the Nonce.

12. The apparatus of claim 10 wherein the at least one address octet of the MAC header comprises a first address octet (A1), a second address octet (A2), a third address octet (A3) and a fourth address octet (A4) of the frame received by the STA MLD, and the A1, A2, A3 and A4 address octets are used to configure the AAD.

13. The apparatus of claim 9 wherein the at least one address octet of the MAC header comprises a first address octet (A1), a second address octet (A2), a third address octet (A3) and a fourth address octet (A4) of the frame received by the STA MLD, and the A1, A2, A3 and A4 address octets are used to configure the AAD, wherein the frame is transmitted by the AP MLD over a first AP link associated with a corresponding first STA link of a STA MLD and the second frame is transmitted by the STA MLD over a second STA link associated with a corresponding second AP link of a AP MLD.

14. A method for securing a multi-band wireless communication system comprising:

authenticating a first station (STA) multi-link device (MLD) or a second STA MLD with an access point (AP) MLD by negotiating using a group of keys in a key negotiation (KN) band, the group of keys comprising a Pair-Wise Transient Key and a Group Transient Key, the KN band being one of a plurality of frequency bands, wherein the first STA MLD comprises a plurality of first STA links, the second STA MLD comprises a plurality of second STA links, each first STA link and each corresponding second STA link configured to communicate with the AP MLD over a respective one of the plurality of frequency bands, and wherein authenticating the first STA MLD or the second STA MLD in the KN band authenticates the first STA MLD or the second STA MLD for each of the frequency bands;

encrypting a frame comprising incrementing a Packet Number (PN) corresponding to the frame;

configuring a Nonce with the PN and at least one address octet of a Medium Access Control (MAC) header, and configure an Additional Authentication Data (AAD) with the at least one address octet of the MAC header, and

transmitting the frame between the STA MLD and the AP MLD, in a first one of the frequency bands, wherein each of a plurality of keys in the group of keys are a Group Transient Key (GTK) generated by the AP MLD, a different one of the plurality of GTKs is used for a respective one of the plurality of AP links of the AP MLD, the PN is one of a plurality of PNs and wherein a different one of the plurality of PNs is used for a respective one of the plurality of AP links, and wherein the at least one address octet of the MAC header comprises a second address octet (A2) of a second frame transmitted by the STA MLD, and the A2 address octet is used to configure the Nonce, wherein the frame is transmitted by the AP MLD over a first AP link associated with a corresponding first STA link of a STA MLD and the second frame is transmitted by the STA MLD over a second STA link associated with a corresponding second AP link of a AP MLD.

15. The method of claim 14 further comprising encrypting a frame comprising, incrementing a Packet Number (PN) corresponding to the frame, configuring a Nonce with the PN and at least one address octet of a Medium Access Control (MAC) header, and configuring an Additional Authentication Data (AAD) with the at least one address octet of the MAC header.

16. The method of claim 15 further comprising transmitting the frame between the first STA MLD and the second STA MLD, in a first one of the frequency bands.