Multiple link layer addresses for a device
A device includes a link layer configured to use a first link layer address and a second link layer address, maintain the first link layer address unchanged for a duration of an association of the device with a wireless network, and change the second link layer address from a first value to a second value during the duration.
1. A device comprising:
a link layer comprising a hardware processing circuit and configured to:
receive, in information transmitted by an access point (AP) in a wireless network, an indication that the AP supports a link layer address protection feature that provides for use of different link layer addresses,
use the different link layer addresses comprising a first link layer address and a second link layer address,
maintain the first link layer address unchanged for a duration of an association of the device with the wireless network, and
change the second link layer address from a first value to a second value during the duration.
2. The device of claim 1 , wherein the association is with the AP, and the link layer is configured to:
establish a plurality of links with respective APs of the wireless network, wherein the second link layer address is for a first link of the plurality of links, and
maintain a third link layer address for a second link of the plurality of links, wherein the third link layer address is changeable during a duration of an association by the device with another AP.
3. The device of claim 2 , wherein the first link layer address is a multi-link device (MLD) address, and the second link layer address and the third link layer address are part of a plurality of link layer addresses for respective links of the plurality of links between the device and the respective APs.
4. The device of claim 1 , wherein the first link layer address is a first Media Access Control (MAC) address, and the second link layer address is a second MAC address.
5. The device of claim 1 , wherein the link layer is configured to include the first link layer address in a data frame destined to a wired network.
6. The device of claim 1 , wherein the link layer is configured to include the first link layer address in a management frame transmitted to the AP.
7. The device of claim 1 , further comprising:
a processor configured to:
send an address resolution request to the AP, and
receive, by the device from the AP in response to the address resolution request, the first link layer address and the second link layer address.
8. The device of claim 1 , wherein the second link layer address is a randomized address.
9. The device of claim 1 , wherein the second link layer address is a cryptographic address that is independently derivable at the device and the AP.
10. The device of claim 1 , wherein the link layer is configured to tunnel a local area network (LAN) header containing the first link layer address in a payload of a data frame comprising a header containing the second link layer address.
11. The device of claim 1 , comprising:
a further layer above the link layer, the further layer configured to maintain a connection with a local area network (LAN) based on the first link layer address while the second link layer address is changed.
12. The device of claim 1 , comprising:
a security layer configured to bind a security association between the device and the AP using the second link layer address.
13. The device of claim 12 , wherein the security layer is configured to derive a pairwise master key (PMK) and a pairwise transient key (PTK) using the second link layer address, and wherein the security association is a PTK security association (PTKSA).
14. The device of claim 13 , wherein the security layer is configured to negotiate a new PTK in response to the change of the second link layer address.
15. The device of claim 1 , wherein the link layer is configured to send an indication to the AP to request information regarding whether the AP supports the link layer address protection feature.
16. The device of claim 1 , wherein the link layer is configured to perform a tunneled direct link setup (TDLS) with a peer device to establish a direct wireless link between the device and the peer device, the TDLS comprising the link layer sending an indication of support for the link layer address protection feature to the peer device.
17. The device of claim 16 , wherein the link layer is configured to send a frame, using the second link layer address, to the peer device.
18. An access point (AP) for a wireless network, comprising:
a link layer comprising a hardware processing circuit and configured to:
transmit, over the wireless network to a device, an indication of support for a link layer address protection feature that provides multiple link layer addresses, the multiple link layer addresses comprising a first link layer address to be maintained unchanged for a duration of an association between the device and the AP, and a second link layer address to be varied to different values during the duration.
19. The AP of claim 18 , wherein the link layer is configured to:
receive, from the device over the wireless network, an address resolution request, and
send, to the device in response to the address resolution request, the first link layer address and the second link layer address.
20. The AP of claim 18 , wherein the link layer is configured to:
receive, from a second device over a wired local area network (LAN), a second address resolution request, and
send, to the second device in response to the second address resolution request, a third link layer address that is maintained unchanged for a duration of an association between the second device and the AP.
21. The AP of claim 18 , wherein the link layer is configured to maintain a mapping that maps the first link layer address to the second link layer address.
22. The AP of claim 21 , wherein the link layer is configured to:
receive, from the device, a frame targeting a destination device,
translate the second link layer address in the frame to the first link layer address, and
include the first link layer address in the frame sent to the destination device.
23. The AP of claim 21 , wherein the link layer is configured to:
receive, from a source device, a frame targeting the device,
translate the first link layer address in the frame to the second link layer address, and
include the second link layer address in the frame sent to the device.
24. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a device to:
receive, in information transmitted by an access point (AP) in a wireless network, an indication that the AP supports a link layer address protection feature that provides for use of different link layer addresses;
use, at a link layer of the device, the different link layer addresses comprising a first link layer address and a second link layer address,
maintain the first link layer address unchanged for a duration of an association of the device with a wireless network, and
change the second link layer address from a first value to a second value during the duration.
25. The non-transitory machine-readable storage medium of claim 24 , wherein the second link layer address is a randomized address or a cryptographic address.