Search

EP-4115639-B1 - FAST SECURE HANDOVER

EP4115639B1EP 4115639 B1EP4115639 B1EP 4115639B1EP-4115639-B1

Inventors

  • VAN WAGENINGEN, ANDRIES
  • Polak, Piotr
  • SHARMA, SAHIL

Dates

Publication Date
20260506
Application Date
20210301

Claims (13)

  1. An end point subsystem (110) for performing a secure handover from an access point (120) currently associated with the end point subsystem (110) to another access point (120) out of a plurality of access points (120) in an optical multi-cell wireless communication network (100), the end point subsystem (110) comprising: - an optical transceiver (117) configured to perform optical wireless communication; - a controller (118) configured to secure an optical wireless communication link with the currently associated access point (120) by using a pairwise transient key to encrypt or decrypt data communicated on the link; - a shared host processor (1185), separate from the controller (118), configured to act as a first supplicant (1186) to carry out a first procedure for establishing an initial pairwise transient key with an authenticator for the end point subsystem (110) in the optical multi-cell wireless communication network (100), when the end point subsystem (110) does not have an established secure connection, wherein the first procedure is carried out via another communication technology rather than optical wireless communication; wherein the shared host processor (1185) is shared by the end point subsystem (110) and a device (101) that the end point subsystem (110) is connected to, communicatively coupled to, or partially or entirely integrated in; and the controller (118) is further configured to act as a second supplicant (1181) to prepare for a secure handover to a candidate access point (120) out of the plurality of access points (120), by carrying out a second procedure for establishing a new pairwise transient key for the end point subsystem (110) and the candidate access point (120) with the authenticator; wherein the second procedure is carried out via optical wireless communication, and the shared host processor (1185) is further configured to provide the initial pairwise transient key to the controller (118) for use as the pairwise transient key, when the end point subsystem (110) does not have a secure optical connection.
  2. The end point subsystem (110) of claim 1, wherein the optical transceiver (117) is further configured to - receive information related to the candidate access point from either the currently associated access point or the candidate access point; and - trigger the controller (118) to initiate the second procedure upon the reception of the information related to the candidate access point (120).
  3. The end point subsystem (110) of claim 2, wherein the information related to the candidate access point (120) is a downlink advertisement received from the candidate access point (120).
  4. The end point subsystem (110) of any one of previous claims, wherein the optical transceiver (117) is further configured to - compare link qualities of optical wireless communication links with the currently associated access point and the candidate access point respectively; - trigger the controller (118) to start handover to the candidate access point (120) based on the comparison on link qualities.
  5. The end point subsystem (110) of any one of previous claims, wherein the pairwise transient key between the end point subsystem (110) and the currently associated access point (120) is used in the second procedure for establishing the new pairwise transient key.
  6. The end point subsystem (110) of any one of previous claims, wherein the optical transceiver (117) and the controller (118) are comprised in a single housing (1100), which is attached to a device (101) comprising the shared host processor (1185).
  7. A system for supporting an end point subsystem (110) according to claim 1 to carry out a secure handover from an access point currently associated with the end point subsystem to another access point out of a plurality of access points (120) in an optical multi-cell wireless communication network (100), the system comprising: - the end point subsystem (110); - the plurality of access points (120), comprising the currently associated access point and the candidate access point, configured to perform optical wireless communication with the end point subsystem and to connect via a backbone connection (21) with one another and/or with a central controller (13); - an authenticator configured to carry out a first procedure with a first supplicant (1186) and a second procedure with a second supplicant (1181), and wherein the first supplicant is the shared host processor (1185) comprised in the end point subsystem (110) and the second supplicant is the controller (118), separate from the shared host processor (1185), comprised in the end point subsystem (110).
  8. The system of claim 7, wherein the authenticator is comprised in the central controller (13) connected with the plurality of access points (120) via backbone connections (21).
  9. The system of claim 7, wherein the authenticator is comprised in an access point out of the plurality of access points (120), and wherein the access point is configured to communicate with other access points out of the plurality of access points (120) via backbone connections (21).
  10. The system of claims 7-9, wherein the authenticator is further configured to provide the new pairwise transient key to the candidate access point (120).
  11. A method (700) of an end point subsystem (110) for performing a secure handover from an access point currently associated with the end point subsystem (110) to another access point out of a plurality of access points (120) in an optical multi-cell wireless communication network (100), the method (700) comprising the steps of the end point subsystem (110): - performing (S704) optical wireless communication; - securing (S705) an optical wireless communication link with the currently associated access point by using a pairwise transient key to encrypt or decrypt data communicated on the link; - acting (S701), by a shared host processor (1185) comprised in the end point subsystem (110), as a first supplicant (1186) to carry out a first procedure for establishing an initial pairwise transient key with an authenticator for the end point subsystem (110), when the end point subsystem (110) does not have an established secure connection; wherein the first procedure is carried out via another communication technology rather than optical wireless communication; - acting (S706), by a controller (118), separate from the shared host processor (1185), comprised in the end point subsystem (110), as a second supplicant (1181) to prepare for a secure handover to a candidate access point out of the plurality of access points, by carrying out a second procedure (750) for establishing a new pairwise transient key for the end point subsystem (110) and the candidate access point with the authenticator; wherein the second procedure is carried out via optical wireless communication; - providing (S703) the initial pairwise transient key from the shared host processor (1185) to the controller (118) for use as the pairwise transient key, when the end point subsystem (110) does not have a secure optical connection (S702).
  12. The method (700) of claim 11, wherein the second procedure (750) comprises the steps of the second supplicant (1181): - sending (S751) to the authenticator a request comprising at least a first nonce, a first frame counter, and a first message integrity code derived based on the pairwise transient key; - receiving (S752) from the authenticator a confirmation comprising at least a second nonce, a second frame counter, and a second message integrity code derived from the new pairwise transient key; - extracting (S753) the second nonce from the confirmation received; - deriving (S754) a local new pairwise transient key based on the second nonce extracted; - generating (S755) a local message integrity code based on the locally derived new pairwise transient key; - verifying (S756) the second frame counter and the second message integrity code against the first frame counter and the local message integrity code; - adopting (S757) the locally derived new pairwise transient key as the new pairwise transient key, upon successful verification of both the second frame counter and the second message integrity code.
  13. A computing program comprising code means which, when the program is executed by an end point subsystem (110) comprising processing means, cause the processing means to perform the method of claims 11-12.

Description

FIELD OF THE INVENTION The invention relates to the field of roaming of network devices in optical wireless networks, such as Li-Fi networks. More particularly, various methods, apparatus, systems and computer-readable media are disclosed herein related to assist a network device to have a fast handover from one access point to another in a secure manner. BACKGROUND OF THE INVENTION To enable more and more electronic devices like laptops, tablets, and smartphones to connect wirelessly to the Internet, wireless communication confronts unprecedented requirements on data rates and also link qualities, and such requirements keep on growing year over year, considering the emerging digital revolution related to Internet-of-Things (IoT). Radio frequency technology like Wi-Fi has limited spectrum capacity to embrace this revolution. In the meanwhile, light fidelity (Li-Fi) is drawing more and more attention with its intrinsic security enhancement and capability to support higher data rates over the available bandwidth in visible light, Ultraviolet (UV), and Infrared (IR) spectra. Furthermore, Li-Fi is directional and shielded by light blocking materials, which provides it with the potential to deploy a larger number of access points, as compared to Wi-Fi, in a dense area of users by spatially reusing the same bandwidth. These key advantages over the wireless radio frequency communication make Li-Fi a promising solution to mitigate the pressure on the crowded radio spectrum for IoT applications. Other benefits of Li-Fi include guaranteed bandwidth for a certain user, and the ability to function safely in areas otherwise susceptible to electromagnetic interference. Therefore, Li-Fi is a very promising technology to enable the next generation of immersive connectivity. There are several related terminologies in the area of lighting-based communication. Visible-light communication (VLC) transmits data by intensity modulating optical sources, such as light emitting diodes (LEDs) and laser diodes (LDs), faster than the persistence of the human eye. VLC is often used to embed a signal in the light emitted by an illumination source such as an everyday luminaire, e.g. room lighting or outdoor lighting, thus allowing use of the illumination from the luminaires as a carrier of information. The light may thus comprise both a visible illumination contribution for illuminating a target environment such as a room (typically the primary purpose of the light), and an embedded signal for providing information into the environment (typically considered a secondary function of the light). In such cases, the modulation may typically be performed at a high enough frequency to be beyond human perception, or at least such that any visible temporal light artefacts (e.g. flicker and/or strobe artefacts) are weak enough and at sufficiently high frequencies not to be noticeable or at least to be tolerable to humans. Thus, the embedded signal does not affect the primary illumination function, i.e., so the user only perceives the overall illumination and not the effect of the data being modulated into that illumination. The IEEE 802.15.7 visible-light communication personal area network (VPAN) standard maps the intended applications to four topologies: peer-to-peer, star, broadcast and coordinated. Optical Wireless PAN (OWPAN) is a more generic term than VPAN also allowing invisible light, such as UV and IR, for communication. Thus, Li-Fi is generally accepted as a derivative of optical wireless communications (OWC) technology, which makes use of the light spectrum in a broad scope to support bi-directional data communication. In a Li-Fi system, the signal is embedded by modulating a property of the light, typically the intensity, according to any of a variety of suitable modulation techniques. For communication at high speed, often Infrared (IR) rather than visible light communication is used. Although the ultraviolet and infrared radiation is not visible to the human eye, the technology for utilizing these regions of the spectra is the same, although variations may occur as a result of wavelength dependencies, such as in the case of refractive indices. In many instances there are advantages to using ultraviolet and/or infrared as these frequency ranges are not visible to the human eye, and more flexibility can be introduced in the system. Of course, ultraviolet quanta have higher energy levels compared to those of infrared and/or visible light, which in turn may render use of ultraviolet light undesirable in certain circumstances. Based on the modulations, the information in the light can be detected using any suitable light sensor. For example, the light sensor may be a photodiode. The light sensor may be a dedicated photocell (point detector), an array of photocells possibly with a lens, reflector, diffuser or phosphor converter (for lower speeds), or an array of photocells (pixels) and a lens for forming an image on the array. E.g., the li