Method, device and system for protecting wireless system against internal information

Abstract

A method may include storing, by operation of a first wireless device, a media access control (MAC) address of an associated device in a first memory circuit of the first wireless device, and receiving, by a wireless communication circuit, a wireless request protocol data unit (PDU). In one embodiment, a controller circuit of a first wireless device determines, by operation of a controller circuit of the first wireless device, whether a MAC address of a requesting PDU matches a stored MAC address, and in response to at least the MAC address of the requesting PDU matching the stored MAC address, ignores the requesting PDU or does not transmit buffer data corresponding to a target that matches the MAC address. The invention further discloses corresponding equipment and a system.

Description

[0001] Related Applications

[0002] This application claims priority to and the benefit of U.S. Patent Application No. 63 / 543,399, filed on October 10, 2023, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0003] The present disclosure relates generally to wireless systems, and more particularly to wireless systems that can protect themselves from attacks using internal information, such as addresses of devices that have joined the network. Background Art

[0004] Wireless systems, such as systems compatible with certain IEEE 802.11 wireless standards, may be vulnerable to attacks using the media access control (MAC) address of a station device (STA) that has associated with a basic service set (BSS) including a distribution system (DS) (i.e., a MAC stealer attack).

[0005] One type of MAC stealer attack can overwrite the security context of an associated STA ("victim" STA). In this attack, the attacker can use various methods to disconnect the victim STA from the AP, including using a deauthentication frame with management frame protection (MFP). The attacker can then connect to the AP using the victim STA MAC address. This attack does not require strict timing between attacker messages because requests from the victim STA can be resent by the endpoint (e.g., HTTP response data transmitted over TCP). An example of a security context overwrite attack is shown in Figure 16.

[0006] Referring to FIG. 16 , a system 1601 may have an access point device (AP) 1605 that may control access to the BSS. STA 1603 may join the network using an association message exchange 1609. This method may include any suitable association method and authentication / security steps, including but not limited to Passpoint, WPA-3 (including enterprise mode) issued by the Wi-Fi Alliance. This method may include a simultaneous authentication of equals (SAE) public key (SAE-PK) authentication step.

[0007] Once associated, STA 1603 may issue an HTTP request 1611 to be serviced by AP 1605. However, before HTTP request 1611 is serviced, an attacker 1608 who has the MAC address of STA 1603 may forge a deauthentication request 1608-0 to STA 1603. Attacker 1608 may then seek to connect to AP 1605 using the stolen MAC address and its own credentials 1613. AP 1605 may mistakenly overwrite 1605-0 the security context corresponding to STA 1603 with a new context established and controlled by attacker 1608. AP 1605 may then mistakenly prepare a response data frame to the HTTP request using the overwritten context and send it to the (stolen) MAC address of attacker 1605-1. In this way, the attacker may obtain downlink data for STA 1603.

[0008] Another type of MAC stealer attack is a fast reconnect attack. A fast reconnect attack can be targeted at a DS with more than one AP. Assuming that the victim STA is connected to the first AP (AP1), the attacker can connect to the second AP (AP2) using the MAC address of the victim STA. The DS can then deliver the downlink traffic (originally requested by the victim STA) to the attacker via AP2, because the DS can be configured to forward the traffic to the AP of the last authenticated MAC address. An example of a fast reconnect attack is shown in Figure 17.

[0009] 17 , system 1701 may include a DS 1705 with two APs (AP1 1705-0, AP2 1705-1). STA 1703 may associate with DP 1705 via AP1 1705-0 and perform connection and authentication steps 1715. Attacker 1708 may associate with AP2 1705-1 using a forged MAC address 1713 (i.e., the MAC address of STA 1703). In response, AP2 1705-1 may begin to associate with attacker 1708. In the example shown, this may include association and authentication, including a four-way handshake 1717. AP2 1705-1 may cache a pairwise master key (PMK) negotiated with attacker 1705-10. AP2 1705-1 may use the PMKID to track the PMK associated with the (forged) MAC 1721.

[0010] STA 1703 may issue a request 1719 to DS 1705 via AP1 1705-0. However, due to the association of attacker 1721, AP2 1705-1 may load a cached PMK (generated using the attacker's credentials) 1705-11. A four-way handshake 1723 may be performed between attacker 1706 and AP2 1705-1 to establish encryption keys. Since the attacker's association is up-to-date, DS 1705 may send a response 1725 (corresponding to request 1719) to attacker 1708 instead of STA 1703.

[0011] Any method to prevent or otherwise thwart such insider attacks can greatly contribute to the security of wireless systems. Summary of the invention

[0012] Embodiments may include methods, devices, and systems, including: by operation of a first wireless device, storing a MAC address of a device associated with a wireless network in a first memory circuit of the first wireless device, and receiving a wireless request protocol data unit (PDU) via wireless communication circuitry. By operation of controller circuitry of the first wireless device, determining whether a MAC address of the request PDU matches a stored MAC address. In response to at least the MAC address of the request PDU matching the stored MAC address, ignoring the request PDU or not sending buffered data corresponding to the matching MAC address of the request PDU. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1A is a signaling diagram illustrating a system and corresponding operations according to an embodiment.

[0014] Figure 1B yes Figure 1A Continuation of the signaling diagram.

[0015] Figure 2 is a signaling diagram illustrating a system and corresponding operations according to another embodiment.

[0016] Figure 3 is a signaling diagram illustrating a system and corresponding operations according to another embodiment.

[0017] Figure 4 is a flow chart of a method according to an embodiment.

[0018] Figure 5 is a flow chart of a method according to another embodiment.

[0019] Figure 6 is a flow chart of a method according to another embodiment.

[0020] Figure 7 is a flow chart of a method according to another embodiment.

[0021] Figure 8 is a block diagram of an apparatus according to an embodiment.

[0022] Fig. 9 is a block diagram of an apparatus according to an embodiment.

[0023] Fig.10 is a diagram illustrating a memory circuit and stored values ​​according to an embodiment.

[0024] Fig.11 is a block diagram of an apparatus according to another embodiment.

[0025] Fig.12 is a diagram showing that messages may be sent from one access control device to another access control device, according to an embodiment.

[0026] Fig.13 is a diagram of an integrated circuit device according to an embodiment.

[0027] Fig.14 is a diagram of a vehicle system according to an embodiment.

[0028] Fig.15 is a diagram illustrating a system having an Internet of Things (IoT) device according to an embodiment.

[0029] FIG. 16 is a signaling diagram illustrating the first type of insider information attack.

[0030] FIG. 17 is a signaling diagram illustrating the second type of insider information attack. DETAILED DESCRIPTION

[0031] According to an embodiment, a wireless network may be protected from an attacker with "inside" information (e.g., a device media access control (MAC) address, as just one example). According to an embodiment, a wireless device may compare a device address (e.g., a source MAC address) of an incoming request to join a network with a device address of a device already operating in the wireless network (e.g., an associated device). If the addresses match, the wireless device may ignore further requests to join the network including the matching address and / or block download data intended for transmission to the matching address, and ultimately discard such download data.

[0032] According to an embodiment, the wireless device may utilize information other than the device address to distinguish between an attacker and a valid device attempting to join the network. In some embodiments, the data to be transmitted may be scanned for the device address and higher network layer values ​​(e.g., port addresses). If the device address and higher network layer values ​​do not match the address and higher network layer values ​​of a device operating on the network, the data to be transmitted may not be sent. The higher network layer value may be a layer above the layer that provides the device address. As two of many possible examples, a (layer 2) MAC address may be a device address, and a higher layer value may be a (layer 4) port value according to the User Datagram Protocol (UDP) or the Transmission Control Protocol (TCP).

[0033] In some embodiments, the wireless device may be an access point device (AP) compatible with at least one IEEE 802.11 wireless standard. The AP may maintain a context for each station device (STA) when associated. Such a context may include a MAC address, one or more source (UDP or TCP) port values, and a timer. The timer may be reset when receiving uplink data from the STA. The AP may compare the MAC address and destination port of the downlink data with the existing context. If the MAC address and destination port do not match the MAC address and destination port of the context, the downlink data may be discarded after the timer expires.

[0034] According to an embodiment, when a wireless device receives a request to connect to a network from a device address that matches the address of an existing connected device, the wireless device may return a response to the requesting device to retry the request at a later time. The wireless device may then query the existing connected device. If a response is received from an existing connected device, further requests to add to the network by repeating the device address may be ignored.

[0035] In some embodiments, the wireless device may be an AP compatible with the IEEE 802.11 wireless standard. The AP may check the MAC address of the association request with the MAC address of the existing associated STA. It is understood that the association request may include a reassociation request. If there is a MAC address match, the AP may return an association response to retry the association request (e.g., status code 30). The AP may send a probe request to the STA (e.g., using a null QoS frame). If no acknowledgment (ACK) for the probe is received, the AP may ignore further association requests with a matching MAC address.

[0036] In some embodiments, the wireless device may be an access control device in a distributed system (DS). When the access control device receives a request to connect to a network, the access control device may request other access control devices in the network to check for devices with matching addresses. If such devices are already part of the DS, further requests to add to the network by repeating the device address may be ignored.

[0037] In some embodiments, the wireless device may be an AP in a DS that is compatible with the IEEE 802.11 wireless standard. The AP may request other APs in the DS to check whether the MAC address of the received association request matches. Such other APs may query any STA to obtain a matching MAC address, as described herein. Upon detecting an associated STA with a matching MAC address, such other APs may return a response to the requesting AP indicating the existing MAC. In response, the requesting AP may ignore further association requests with a matching MAC address.

[0038] Figure 1A and Figure 1B is a signaling diagram illustrating the operation of the system 100 according to an embodiment. The system 100 may include an access point device (AP) 102, a client device (STA) 104, and the rest of the DS 106. Figure 1A and Figure 1B Also shown is an attacker 108, who possesses the device (e.g., MAC) address of STA 104. System 100 may be operated by devices (AP 102, STA 104) sending and receiving protocol data units (PDUs) according to one or more wireless standards. In some embodiments, system 100 may be compatible with one or more IEEE 802.11 wireless standards. However, alternative embodiments may include any suitable wireless standard that includes a joining phase (e.g., association) that establishes an encryption scheme for network layer values ​​(e.g., layer 4 port identifiers) above a layer with a device address (e.g., layer 2 MAC address).

[0039] refer to Figure 1A , the operation of the system 100 will now be described. The STA 104 may perform an association operation 110 with the AP 102. Such actions may include any appropriate message exchange resulting in the STA 104 being added to the system 100. In some embodiments, the association operation 110 may include an authentication operation that may result in the STA 104 being able to encrypt portions of a datagram at a higher level network layer than the device address. In some embodiments, the device (AP 102, STA 104) may include a MAC address and encrypt higher network layer data (e.g., a port address).

[0040] After successful association, the AP 102 may generate a context corresponding to the STA 104. The context may include values ​​derived or determined during the association process, including the device address (e.g., MAC address) of the STA 104, and higher-layer network values ​​(e.g., port address). In the illustrated embodiment, the context 112 may include, but is not limited to, the STA MAC address, a source port list (Src_port_list[]), a timer, and a packet list (a list of pckts). The source port list may include source port values ​​corresponding to PDUs received from the STA 104, and may be updated when new PDUs (e.g., uplink packets) are received. The timer may be used to determine how long a PDU for transmission (e.g., a downlink packet) can be retained in a buffer before being discarded. The packet list may identify and / or locate download data (e.g., downlink data) stored in a buffer corresponding to a given MAC address.

[0041] Still refer to Figure 1A Once the STA 104 is associated with the system 100 and the AP 102 has established a context for the STA 104, requests from the STA 104 may be processed. While such requests may take any suitable form, in the illustrated embodiment, the STA 104 may send an HTTP request 104-00, which may be received by the AP 102 and forward the HTTP request 104-01 to other devices in the system 100, which may be other parts of the DS 106. Additionally, the AP 102 may update the context of the STA 104 with a source port value (e.g., adding a source port src_port_list) 114.

[0042] In response to the HTTP request 104-00 / 01, an HTTP response 106-00 may be returned to the AP 102. The AP 102 may evaluate the MAC address and higher network layer values ​​(in this embodiment, the UDP / TCP destination port) of the downloaded data. In the illustrated embodiment, the MAC address and source port values ​​match the context of the STA 104. Therefore, the HTTP response 106-01 may be forwarded to the STA 104. In some embodiments, the AP 102 may buffer the downloaded data with a MAC address that matches the MAC address of the existing context. The higher network layer values ​​may then be evaluated. If the MAC address and destination port of the HTTP response 106-00 do not match the MAC address and source port of the context, a timer for the context may be started. After the timer expires, the downloaded data may be discarded (e.g., deleted, overwritten, etc.).

[0043] Figure 1AAlso shown are operations when a device is removed (eg, disassociated) from the network. In response to a message from the AP 102 or the STA 104, the STA 104 may be removed from the network. In response, the AP 102 may delete the context associated with the STA 116.

[0044] Figure 1B FIG. 1 shows an example of an attacker 108 attempting to access data in response to the attacker 108 having the MAC address of the STA 104. Figure 1A STA 104 may issue HTTP request 104-00 / 01, such as Figure 1A However, Figure 1A Differently, the attacker 108 can forge a deauthentication message to the STA 104, causing the STA 104 to determine that it is no longer authenticated by the system 100. The attacker 108 can then use the MAC address of the STA 104 to perform an association operation 108-1 with the AP 102. Figure 1A As described above, in response to the association operation 108-1, the AP 102 may update the context 112 of the MAC address being used by the attacker 108. However, since higher network layer values ​​(e.g., source port) are encrypted, the source port of the attacker 108 will almost certainly be different from the source port of the HTTP request 104-00 / 01 from the STA 104.

[0045] When the HTTP response 106-00 corresponding to the HTTP request 104-00 / 01 of the STA 104 is received at the AP 102, the AP 102 can check the MAC address and the target port, and since these values ​​do not match the current context, the downlink data can be saved in the buffer 114-1 and a timer is started. If the timer expires, the download packet is discarded, thereby preventing the attacker 108 from receiving the data surreptitiously.

[0046] In this way, a device controlling network access (e.g., an AP) can maintain the context of connected devices, including device addresses and higher network layer values. This context can be updated with each communication received from a connected device. When download data is received that does not match the context, the data can be retained and eventually discarded.

[0047] Figure 2 is a signaling diagram illustrating the operation of the system 200 according to another embodiment. The system 200 may include a signaling diagram similar to Figure 1A / Figure 1B , and such similar items are denoted by the same reference numerals, but with a leading digit of "2" instead of "1." The operation of system 200 will now be described.

[0048] STA 204 may perform an association operation with AP 202. Such an association operation may take any form described herein or an equivalent form. Once associated, STA 204 may issue a request (eg, HTTP request 204-00 / 01) to the system to elicit response data.

[0049] In the illustrated embodiment, attacker 208 possesses the device address (e.g., MAC address) of STA 204 and uses this MAC address to request association with system 200 208-2. In response to the association request, AP 202 may determine whether the MAC address of the association request matches the MAC address of an existing associated device. Such operation may include AP 202 accessing a memory circuit to determine whether the device address matches the stored device address. If it is determined by the matching MAC address in the memory that a STA with the same MAC address is already associated, the request may be first rejected 218. In some embodiments, such rejection may include AP 202 indicating to the requesting device that it should retry the request 202-0 at a later time. In the illustrated embodiment, the system may be compatible with the IEEE 802.11 wireless standard, and AP 202 may return an association response with a status code 30, indicating that the requesting device (i.e., attacker 208) should return later and retry the association.

[0050] After determining that there is a STA with the same MAC address as the association request, the AP 202 may determine whether the STA with the same MAC address is currently active. In the illustrated embodiment, such action may include probing connected STAs (including the STA 204 having a matching MAC address) to obtain a response 220. In the illustrated embodiment, such action may include issuing a Quality of Service (QoS) null data frame 202-1. However, alternative embodiments may include any other suitable message from the AP that elicits a response including a STA device address (e.g., a MAC address).

[0051] In response to the detection by AP 202, STA 204 may return a message indicating that it is still associated with system 200. In the illustrated embodiment, such a message may be an acknowledgement (ACK) 204-1 of QoS null data frame 202-1. Based on such an acknowledgement, AP 202 may determine that the association request for the corresponding MAC address is invalid. When download data for the MAC address is received (e.g., HTTP response 206-00), AP 202 may forward such data to STA 204 (e.g., HTTP response 206-01).

[0052] If the attacker 208 retries the association request 208 - 3 using the MAC address of the STA 204 , the AP 202 may ignore such request 222 .

[0053] In this manner, an access control device of a network can determine whether a request to join the network has a device address that matches the address of a device that is already part of the network. If such a match exists, the access control device can deny the join request and determine whether the device with the matching device address is still active on the network. If the device is still active, further requests to join the network using the matching device address can be ignored.

[0054] Figure 3 is a signaling diagram illustrating the operation of the system 300 according to another embodiment. The system 300 may include Figure 1A / Figure 1B Similar items are shown with the same reference numerals, but with the leading digit being "3" instead of "1". Figure 1A / Figure 1B Differently, two APs are shown, namely AP1 302-1 and AP2 302-2. In some embodiments, AP1 302-1 may control one basic service set (BSS) and AP2 302-2 may control another BSS, both BSSs being part of the same DS 305. The operation of system 300 will now be described.

[0055] STA 304 may perform an association operation with AP2 310. Such an association operation may take any form described herein or an equivalent form. Once associated, STA 304 may issue a request 304-00 / 01 to a system intended to elicit response data.

[0056] In the illustrated embodiment, the attacker 308 possesses the device address of the STA 304 and uses this MAC address to request an association 308-2 with a different BSS (i.e., the BSS of AP1 302-1). In response to the association request, AP1 302-1 may issue a request to other APs in the network to determine if these other APs have already associated with a STA having the same device address (MAC address) 324. This request from AP1 302-1 to AP2 302-2 is shown as 304-12.

[0057] In response to the request 304-12 from AP1 302-1, AP2 302-2 may return a response 304-22 indicating that the device address indicated matches 326 the associated device (e.g., the MAC address of the attacker association request 308-2 matches the MAC address of the STA 304). Based on such a response 304-22, AP1 302-1 may determine that a device address duplication has been found and may deny the request (from the attacker 308). Such a denial may include any of the methods described herein, including but not limited to transmitting an association response 302-13 with a status code (e.g., status code 30).

[0058] After determining that there is a STA with the same MAC address as the association request, AP2 302-2 can determine whether STA 304 is currently active. Such actions can include any of the actions described herein, or equivalent actions. In the illustrated embodiment, such actions can include Figure 2 The actions described in , include detecting using the QoS null data frame 320 and receiving ACK 304-1 from STA 304.

[0059] In some embodiments, AP2 302-2 may send a message to the requesting AP 302-1 indicating that the STA with the matching device is still in the active state 304-23. AP1 302-1 may reject all further association requests with the matching device address.

[0060] In this way, upon receiving a request to join a network, the access control device can query other access devices of the network to determine whether a device already part of the network has an address that matches the requested address. If such a match exists, the access control device can deny the request to join and ignore further join requests with matching device addresses.

[0061] Although the systems and devices described herein show various methods, additional methods will now be described with reference to flow charts. Such methods may be performed by circuits of the devices and / or systems described herein.

[0062] Figure 4 4 is a flow chart of a method 430 according to an embodiment. The method 430 may be performed by an access control device that may control access to a network, including but not limited to an AP. The method 430 may include storing a MAC address 430-0 of an associated device. A request PDU 430-1 to join a network may be received via a wireless circuit. Such actions may include receiving a request PDU according to any suitable wireless standard, including but not limited to one or more IEEE 802.11 wireless standards.

[0063] If the request PDU does not include the MAC address of the associated device (N from 430-2), the method 430 may process the request according to the management criteria 430-3. If the request PDU includes the MAC address of the associated device (Y from 430-2), the method 430 may process the request as an invalid request 430-4. According to an embodiment, such actions may include, but are not limited to, ignoring the request 430-5 and / or not sending download data for the matching MAC address 430-6.

[0064] In this way, when a request to join a network is received, the MAC address of the request can be compared with the MAC addresses of devices already associated with the network. If a match is found, it can be determined that the request is invalid.

[0065] Figure 5 5 is a flow chart of a method 530 according to another embodiment. The method 530 may be performed by a device that controls access to a wireless network. In some embodiments, the method 530 may be performed by an AP to prevent attacks using internal information (e.g., MAC addresses of associated STAs). In some embodiments, the method 530 may be performed by an AP operating according to one or more IEEE 802.11 wireless standards.

[0066] Method 530 may include determining whether the STA is already associated with the network 530-0. Such actions may include completing an association procedure including establishing an encryption scheme that ensures encryption of network layers above Layer 2, including encryption of Layer 4 values ​​such as UDP and / or TCP source port values.

[0067] Method 530 may create a context 530-1 for an associated device. Such actions may include any of the actions described herein or equivalent actions. In the illustrated embodiment, the context of each associated device may include a MAC address, a source port, a timestamp, a timer duration, and an assigned buffer. The timestamp may indicate the age of the context. In some embodiments, the context may have a limited life cycle, and if a predetermined amount of time has passed since the timestamp, the context may be deleted. The timer duration may indicate the amount of time before the timer of the context expires. The operation of such a timer will be described below. The assigned buffer may indicate the location of a buffer for data corresponding to the MAC address, including but not limited to downlink data intended to be transmitted to the STA corresponding to the context.

[0068] Method 530 may determine whether an uplink data frame 530-2 having a MAC address matching the MAC address of the context is received. Such an action may include determining the source MAC address of the uplink data frame and comparing it with the MAC address of the existing context. If such an uplink data frame is received (Y from 530-2), method 530 may determine whether the context of the matching MAC address includes a source port 530-3 that matches the source port of the uplink data frame. If the source port already exists in the context (Y from 530-3), the timestamp 530-4 of the context may be updated. If the source port does not yet exist in the context (N from 530-3), method 530 may determine whether the context has the maximum number of source ports 530-6. If the context has the maximum number of source ports (Y from 530-6), the oldest source port 530-7 may be deleted from the context. In some embodiments, such an action may include deleting the source port value with the oldest timestamp. If the number of source ports is not the maximum value (N from 530-6) or the oldest source port value has been deleted 530-7, the method 530 may add the source port to the context along with the current timestamp 530-8.

[0069] The method 530 may determine whether a downlink data frame 530-9 having a MAC address that matches the MAC address of the context is received. Such an action may include determining a destination MAC address of the downlink data frame and comparing it to the MAC address of the existing context. If such a downlink data frame is received (Y from 530-9), the method 530 may determine whether the context of the matching MAC address includes a source port 530-10 that matches the destination port of the downlink data frame. If the port values ​​match (Y from 530-10), the method may release the downlink data frame for transmission 530-11. If the destination port does not match the source port (N from 530-10), a timer 530-12 may be started for the context. If a downlink data frame that does not match the context is received (N from 530-9), the method 530 may discard the downlink data frame 530-14.

[0070] The method 530 may determine whether any context timer has expired 530-13. Such an action may include comparing the timer value of the context with its timer duration (or a timer value common to all contexts). If the timer has expired (Y from 530-13), the corresponding downlink data frame may be discarded 530-14.

[0071] The method 530 may determine whether the STA has been disassociated from the network 530-15. Such actions may include any appropriate actions compatible with a given wireless standard, including but not limited to STA requesting disassociation or AP forcing disassociation. After the STA disassociates (Y in 530-15), the timer of the context may be stopped and the context may be deleted 530-16.

[0072] In this way, the MAC address and port of the downlink data can be scanned to match with the existing associated device. If there is a MAC address match but the port does not match, the downlink data can be retained and eventually discarded.

[0073] Figure 6 is a flow chart of a method 630 according to another embodiment. The method 630 may be performed by a device controlling access to a network. In some embodiments, the method may be performed by an AP to prevent attacks using a device address (MAC) of a device that is already part of the network.

[0074] The method 630 may include receiving an association request 630-0. Such an act may include receiving a wireless message to join a network according to any suitable protocol, and in the illustrated embodiment may be an association request compliant with one or more IEEE 802.11 standards.

[0075] Method 630 can determine whether a device address (e.g., a MAC address) is designated as an address that should be ignored 630-1. How to determine a device address to be ignored will be described in more detail below. If the requested device address is designated as ignored (Y from 630-1), the request can be ignored 630-2.

[0076] If the device address is not indicated to be ignored (N from 630-1), the method 630 may determine whether the device address of the association request matches the address of a device already connected to the network 630-3. In the illustrated embodiment, such action may include determining whether the source MAC address of the association request matches the MAC address of a STA already associated with the network. If there is currently no associated device with an address that matches the address of the association request (N from 630-1), the method 630 may return an association response to initiate the association process 630-4. Such action may include continuing with the appropriate process to add (or possibly not add) the requesting device to the network.

[0077] If there is an associated device with a device address that matches the device address of the association request (Y from 630-1), the method 630 can return a response to the request to resubmit the request at a later time 630-5. In some embodiments, such an action can include the AP sending an association response with a status code 30. In addition, a message can be sent to the currently associated device to elicit a response 630-6. In the illustrated embodiment, such an action can include sending a QoS null data probe to an associated STA with a MAC address that matches the association request. If a response is received from the probe message (Y from 630-7), it can be indicated that the device address is ignored 630-8. If no response is received from the probe message (N from 630-7), the method 630 can continue the association process 630-4. In some embodiments, such an action can be performed before a timeout period, or more than one association request is required.

[0078] In this way, if the association request includes a device address that matches a currently associated device, a query can be made to determine whether the currently associated device is still active. If the associated device responds, the association request can be ignored.

[0079] Figure 7 730 is a flow chart of a method 730 according to another embodiment. The method 730 may be performed by an access control device (e.g., an AP) operating in coordination with one or more other access control devices to create a larger DS. In some embodiments, the method 730 may be performed by an AP of one BSS communicating with another AP of a different BSS, where the two BSSs are part of the same DS.

[0080] The method 730 may include receiving a message 730-0 from another device requesting to check for duplicate device addresses. In some embodiments, such an action may include receiving a message 730-2 from another AP of the same system (e.g., DS) including a MAC address of an association request. The device address identified by the message may be compared 730-1 with the address of the associated device. In the illustrated embodiment, this may include determining whether the MAC matches the MAC of the associated STA. If no match is found (N from 730-1), the method 730 may send a message 730-2 to the requesting device that no match was found.

[0081] If the device address received in the message matches the address of an existing device (Y from 730-1), the method 730 may send a message to the requesting device that a matching device has been found 730-3. The method 730-4 may determine whether the matching device address is designated to be ignored 730-4. If the device address is indicated as an address to be ignored (Y from 730-4), a message may be sent to the requesting device indicating that the duplicate device address should be ignored 730-5.

[0082] If the device address is not indicated as an address to be ignored (N from 730-4), method 730 may proceed as follows. Figure 6 The method 730 continues by sending a probe message to elicit a response 730-6, and if a response is received (Y from 730-7), indicating that the device address is an address to be ignored 730-8. If no response is received (N from 730-7), the method 730 may send a message indicating a mismatch with the device address 730-2.

[0083] In this way, a device controlling access to a network can receive a request from another such device to check whether any associated devices match the device address. A message can be returned indicating whether such a matching device address has been found. Additionally, if a match is found, the device indicates that the request to join the network with such a matching device address can be ignored.

[0084] Figure 8 802.11 wireless standards. The device 840 may be an AP of the network, including an AP in a BSS compatible with one or more IEEE 802.11 wireless standards. The device 840 may include input / output (IO) circuits 832, controller circuits 834, and wireless circuits 836. The IO circuits 832 may enable the device 840 to communicate with other systems and / or users, and may include any suitable communication circuits and / or interfaces, including wired and / or wireless circuits / interfaces.

[0085] The controller circuit 834 may include any suitable circuit for performing wireless network access operations as described herein and its equivalent circuit. The controller circuit 834 may include, but is not limited to, one or more processors, custom logic circuits, programmable logic circuits, and / or machine learning post / machine learning systems. The controller circuit 834 may include a circuit for processing an association request 842 and a memory circuit 844 for storing various forms of data. The operation for processing the association request 842 may include comparing the requested device ID with an existing connected device 846. Such an action may include extracting the device ID from the association request PDU and comparing such a value with the device ID stored in the memory circuit 844. Processing the association request 842 may also include an invalid request response 848. Such an operation may include ignoring future requests from matching device ID 848-0 and / or discarding download data associated with the matching device ID (i.e., not sending such data). The memory circuit 844 may store any data suitable for the operation of the device 840, including but not limited to the device ID from the previously connected device 850.

[0086] The wireless circuit 836 may include circuits compatible with one or more standards, including public and / or private standards. In some embodiments, the wireless circuit 836 may be compatible with one or more IEEE 802.11 or related standards. The wireless circuit 836 may be connected to an antenna system 838.

[0087] In some embodiments, IO circuitry 832 , controller circuitry 834 , and wireless circuitry 836 may be part of the same integrated circuit substrate 852 .

[0088] In this manner, the wireless device may include circuitry for comparing a device ID present in a request to join a network. If such a device ID matches a device ID of a device that has previously been connected to the network, the device may ignore the request to join the network and / or discard download data associated with the matching device ID.

[0089] Fig. 9 9 is a block diagram of a device 940 according to another embodiment. In some embodiments, the device 940 may be an AP or a portion of an AP that may process association requests from STAs to join a network. The device 940 may include a controller circuit 934, a Wi-Fi circuit 936, and optionally other wireless circuits 960 and a bridge circuit 958 interconnected via a backplane and / or bus 956.

[0090] The controller circuit 934 may include a memory circuit 944 and a processor circuit 954. The memory circuit 944 may include any suitable memory circuit, including non-volatile memory, volatile memory, and / or a combination thereof. In some embodiments, the memory circuit 944 may include a memory circuit that is part of the device 940 and / or a memory circuit that is external to the device 940 but accessible by the processor circuit according to a wired or wireless protocol.

[0091] The memory circuit 944 may store data for enabling various operations of the wireless device 940, including data for the association context 950, buffers for downlink data and uplink data for the STA 962, and code (e.g., firmware) 964 that can be executed by the processor circuit 954 to provide various processor circuit operations described herein. The data for the association context 950 may be created after the STA successfully associates, as described in the embodiments of this document. In some embodiments, the association context 950 for each associated STA may include a MAC address, higher network layer values ​​(e.g., source port), and other information.

[0092] The processor circuit 954 may execute code 964 stored in the memory circuit 944 to provide various functions to the device 940. The operations provided by the processor circuit 954 may include, but are not limited to, creating a STA context 966, uplink data frame processing 968, downlink data frame processing 970, and disassociation processing 972. Creating the STA context 966 may include the processing circuit storing the context data in the memory circuit 944 (as described herein) or equivalent operations. Such actions may include decrypting portions of a PDU received from a STA to derive other information.

[0093] Uplink data frame processing 968 may include updating a context in response to receiving an uplink data frame 974. Such operations may include updating context values ​​stored in memory circuit 944. In some embodiments, such operations may update a value corresponding to a higher network layer value than the device ID (e.g., a layer 4 source port) 974-0 and update a timestamp value 974-1.

[0094] Downlink data frame processing 970 may include scanning downlink data frames 970-0, executing timers 970-1, and controlling buffers 970-2. Scanning downlink data frames 970-0 may include scanning network layer values ​​higher than the device ID (e.g., a layer 4 destination port). If the device ID (e.g., a MAC address) matches the ID of the context, but the higher layer value of the downlink data frame does not match the higher layer value of the same context (e.g., the downlink destination port does not match the context source port), then timer 970-1 may be activated for the context. Buffer control 970-2 may include buffering downlink data frames for the context (e.g., an associated device) and discarding such downlink data frames if the corresponding timer expires (e.g., a predetermined limit is reached).

[0095] The disassociation process 972 may process a disassociation request from an associated device. Such operations may include, upon successful disassociation of a device, discarding any downlink data frames 972-0 of the disassociated device, stopping any corresponding timers 972-1, and removing (e.g., deleting) the context 972-2 of the disassociated device.

[0096] The wireless circuit 936 can provide wireless communications compatible with one or more wireless standards. In the illustrated embodiment, the wireless circuit can be compatible with one or more IEEE 802.11 wireless standards. The wireless circuit 936 can include a MAC layer circuit 936-0, a physical layer (PHY) circuit 936-1, and an RF circuit 936-2. Such circuits (936-0, 936-1, 936-2) can be compatible with one or more IEEE 802.11 wireless standards at any suitable frequency band, including but not limited to 2.4 GHz, 5 GHz, and / or 6 GHz frequency bands.

[0097] IO circuitry 932 may input or output signals from a source external to the device in any suitable manner, thereby enabling control of device 940. In some embodiments, IO circuitry 932 may include serial communication circuitry, including but not limited to interfaces compatible with a serial digital interface (SDI), a universal serial bus (USB), a universal asynchronous receiver transmitter (UART), I2C, or I2S.

[0098] The bridge interface circuit 958 may enable communication between the wireless circuit 936 and other wireless circuits 960. In some embodiments, such communication may control which wireless circuit (936 or 960) controls the shared medium (eg, the 2.4 GHz band).

[0099] Other wireless circuits 960 may be one or more wireless circuits compatible with standards other than IEEE wireless standards, including but not limited to one or more BT standards, one or more IEEE 802.15.4 or related standards, and / or one or more cellular network standards.

[0100] Device 940 may operate in conjunction with an antenna system 938 having one or more antennas compatible with one or more radios, including antennas of other radios 960 , if included.

[0101] In some embodiments, IO circuitry 932 , controller portion 934 , and wireless circuitry 936 may be formed from the same integrated circuit substrate 952 .

[0102] In this manner, the wireless device can scan downlink data for device (e.g., MAC) addresses and higher layer values ​​(e.g., destination port), and then compare these values ​​to data stored for each device associated with the network. If the device values ​​match but the higher layer values ​​do not match, the downlink data can be retained (e.g., not sent) and ultimately discarded. If the device values ​​and higher layer values ​​match the values ​​of the context, the downlink data can be sent. In response to the uplink data, the context data of the device can be updated (e.g., the source port is updated).

[0103] Fig.10 is a diagram of a memory circuit 1044 according to an embodiment. The memory circuit 1044 may be Figure 8 (844) and / or Fig. 9 (944) is an implementation of a memory circuit shown in Figure 1044. The memory circuit 1044 can store association contexts 1050 and include a buffer 1062 corresponding to each such context. The association context 1050 can include data values ​​for each device associated with the network. In the illustrated embodiment, context data sets for different associated devices are shown as 1050-0 to 1050-i. Each context data set (1050-0 to 1050-i) can include a MAC address (MAC Add0 to MAC Addi), one or more source port addresses (source_port_xx, where xx corresponds to a different source port), a timestamp value (timestamp_0 to timestamp_i), a timer value (timer_0 to timer_i), and a buffer address (buffer_ADD0 to buffer_ADDi).

[0104] Each device context may have one or more source port values ​​(source_port_xx). In some embodiments, multiple source port values ​​may be sorted based on the time (e.g., timestamp) of storage. In some embodiments, each context may have a maximum number of source port values. When a context has such a maximum number of source port values, the oldest source port value may be discarded when a new source port value is to be added. Alternative embodiments may include different values ​​at a higher network layer (e.g., higher than layer 2) than the MAC address.

[0105] The timer values ​​(timer_0 to timer_i) can determine how long the downlink data can be stored in the buffer in response to a context mismatch. In some embodiments, each downlink data set (e.g., a data frame for transmission to a STA) can be scanned to obtain a MAC target address and a target port value. These values ​​can be compared with the MAC address and source port values ​​of each context. If there is a MAC address match, but the target-source port does not match, a timer can be started for the downlink data. If the timer expires, the downlink data can be discarded (e.g., overwritten, erased, determining that the link / pointer value is no longer valid).

[0106] The buffer addresses (buffer_ADD0 to buffer_ADDi) may indicate where the downlink data corresponding to the MAC addresses of the contexts (1050-0 to 1050-i) is stored. These values ​​may take any suitable form, including but not limited to a physical address, a logical address, a pointer, or the beginning of a linked list.

[0107] Buffer 1062 may include a storage location for downlink data corresponding to at least the MAC address of each context (1050-0 to 1050-i). In the illustrated embodiment, buffer 1062 may include a storage device for buffering data of uplink data frames (1062-00 to 1062-i0) and downlink data frames (1062-01 to 1062-i1). The received uplink data frames (1062-00 to 1062-i0) may be scanned to find the source MAC address (e.g., 1074) and the source port (e.g., 1076). Such actions may include a processor or an equivalent circuit reading a predetermined position in the buffer. If the source MAC address (e.g., 1074) of the uplink data frame (1062-00 to 1062-i0) matches the source MAC address of the context (1050-0 to 1050-i), the source port value may be compared. If these source port values ​​match, the timestamp value of the context may be updated. If these source port values ​​do not match, the source port value of the context may be updated.

[0108] The downlink data frame (1062-01 to 1062-i1) may be scanned to obtain a destination MAC address (e.g., 1075) and a destination port (e.g., 1077). If the destination MAC address (e.g., 1075) of the downlink data frame (1062-01 to 1062-i1) matches the destination MAC address of the context (1050-0 to 1050-i), the destination port value 1077 may be compared with the source port value (source_port XX) of the corresponding context. If these port values ​​do not match, a timer may be started. In some embodiments, such a timer may be based on a timer value (timer_0 to timer_i) of the corresponding context (1050-0 to 1050-i).

[0109] In this way, when associating with the network, a context can be established for the STA. Such context can include a MAC address and a source port address. When an uplink data frame from the associated STA is received, the source port value of the context can be updated. When the downlink data frame of the associated STA is ready, the destination port of the downlink data frame can be compared with the source port value of the corresponding context. If these values ​​do not match, the downlink data frame may not be sent and can be discarded after the timer expires.

[0110] Fig.11 is a block diagram of a device 1140 according to another embodiment. The device 1140 may include a Fig. 9 , such similar items are referred to by the same reference numerals, but with a leading digit of "11" instead of "9". The memory circuit 1144 may store a device (MAC) address 1144-0 of an associated device (e.g., a STA). In the illustrated embodiment, the memory circuit 1144 may store a device address 1144-1 and a code 1164 of a device that has been determined to be ignored.

[0111] The processor circuit 1154 processes the association request 1180 and optionally processes the check request 1182 from other APs. Processing the association request 1180 may include comparing the device address of the requesting device with the device address of the already associated device (e.g., comparing the request source MAC address with the associated device MAC address) 1180-0. If the requesting device address matches the address of the existing associated device, the processor circuit 1154 may perform various operations 1180-1, 1180-2, and 1180-3. Operation 1180-1 may include returning an association response indicating that the device should try again later. In some embodiments, this may include an association response compatible with one or more IEEE 802.11 wireless standards, the association response including a status code 30. Operation 1180-2 may include generating a probe request directed to an associated device with a matching device address. Such an action may query to determine whether the associated device is still active on the network. If a response to the probe is received indicating that the associated device with the matching device address is still active, the operation may include assigning the requesting device address to an ignore list 1180-3.

[0112] Alternatively, the device 1140 may operate in a distributed system to receive a check request 1182 from another access device (e.g., an AP). Such operations may include analyzing a data frame received from a verified / authenticated AP and deriving a device address from such a request. If one of the stored device addresses 1044-0 matches an address included in a request from another access device, the operation may include returning a response 1182-0 that the device address corresponds to the associated device. If none of the stored device addresses 1044-0 matches an address included in the request, a response 1182-1 indicating that there is no such match may be returned.

[0113] In this way, the wireless device can compare the device address in the request to the address of the device already associated for association. If there is such a match, the wireless device can return a response to retry the association request. If an associated device with a matching address is still active on the network, the wireless device can ignore future association requests using such a device address.

[0114] Fig.12 1 is a diagram of a message 1283 that may be sent between two network access devices to check for duplicate device addresses. In the illustrated embodiment, the message 1283 may include a source address 1284-1 of the AP requesting the check, and a destination address 1284-0 of the AP intended to receive the message. The payload 1286 of the message may include the device address (e.g., MAC address) to be checked (i.e., to determine if the device address matches the address of an already associated device).

[0115] In this manner, AP-to-AP communications may include a request to check for a MAC address that matches the MAC address of the STA that issued the association request.

[0116] While embodiments may include systems and devices having various interconnected components, embodiments may also include a single device having the ability to protect a wireless network from attacks that exploit the device address of a device already associated with the network. Fig.13 An example of a packaged single-chip wireless device 1340 according to an embodiment is shown. Such a device 1340 may include circuits and equivalent circuits for performing device address checking operations as described herein. In some embodiments, the device 1340 may include circuits and equivalent circuits as described herein. Figures 8 to 11 The circuits shown in any of those shown in .

[0117] However, it should be understood that devices according to embodiments may include any other suitable integrated circuit packaging type, as well as directly bonding the device chip to a circuit board or substrate.

[0118] In this manner, a wireless device that is protected against insider attacks may be included in a single integrated circuit device.

[0119] While embodiments may find broad application in a variety of wireless systems, vehicle systems may benefit from resistance to insider information attacks as described herein. Fig.14 A motor vehicle system 1488 is shown according to an embodiment. The motor vehicle system 1488 may include one or more subsystems 1488-0 (eg, an in-vehicle infotainment system) which may include a wireless device 1440 in any form described herein or an equivalent form.

[0120] In this manner, a vehicle may include a vehicle wireless system that may be protected from insider attacks utilizing addresses of devices already associated with the vehicle wireless system.

[0121] Fig.15 A system 1500 according to another embodiment is shown. The system 1500 may include two or more APs 1540-0, 1540-1 and multiple STAs 1504-0 to 1504-5. The APs 1540-0 / 1 and / or the STAs (1504-0 to 1504-5) may include devices as described herein and / or circuits for performing various methods described herein.

[0122] APs 1540-0 / 1 may communicate with each other via connection 1590, which may be wireless or wired. Through such connection 1590, AP 1540-0 / 1 may request to check whether MAC address 1504-12 matches. Such a request may take any form described herein. AP 1540-0 / 1 may store context 1550 of associated STAs, as described herein or equivalent.

[0123] In some embodiments, STA (1504-0 to 1504-5) can be part of an IoT type device, including but not limited to medical device 1504-0 / 1504-1, instrument device 1504-2, security device 1504-3 / 1504-4, or lighting device 1504-5. However, such wireless devices are provided only as examples, and any suitable wireless device can benefit from the faster and / or lower power reconnection operation described herein or an equivalent. STA (1508-0 to 1508-5) can be associated with the network through AP1540-0. Although system 1500 can be compatible with IEEE 802.11 wireless networks, alternative embodiments can include any other suitable standards / protocols.

[0124] Along these same lines, system 1500 may include a variety of interconnected networks, including piconets, PANs, LANs, WANs (both private and public), and the Internet.

[0125] In this way, a network with IoT type devices can detect attacks using the device addresses of devices already associated with the network.

[0126] Embodiments may include methods, devices, and systems, including, by operation of a first wireless device, storing a MAC address of an associated device in a first memory circuit of the first wireless device, and receiving a wireless request protocol data unit (PDU) via wireless communication circuitry. By operation of controller circuitry of the first wireless device, determining whether a MAC address of the request PDU matches a stored MAC address. In response to at least the MAC address of the request PDU matching the stored MAC address, ignoring the request PDU or not sending buffered data corresponding to a target with the matching MAC address.

[0127] Embodiments may include methods, devices, and systems having memory circuitry configured to store at least a MAC address of an associated device; wireless circuitry configured to receive and send wireless messages according to at least one wireless standard, including receiving a request PDU; and controller circuitry. The controller circuitry may be configured to determine whether a MAC address of the request PDU matches a MAC address of the associated device stored in the memory circuitry, and in response to at least the MAC address of the request PDU matching the stored MAC address, ignore the request PDU or do not send buffered data for a destination having a matching MAC address.

[0128] Embodiments may include methods, devices, and systems having a wireless device configured to receive and send wireless messages according to at least one wireless communication standard, including receiving a request PDU. The wireless device may also be configured to store at least a MAC address of a device associated with the wireless device; determine whether the MAC address of the request PDU matches the MAC address of the associated device, and in response to at least the MAC address of the request PDU matching the stored MAC address, ignore the request PDU or do not send buffered data for a target with the matching MAC address. A first antenna system compatible with at least one wireless communication standard.

[0129] Methods, devices, and systems according to embodiments may include a request PDU that is compatible with at least one IEEE 802.11 wireless standard.

[0130] Methods, devices, and systems according to embodiments may include storing first additional information corresponding to each stored MAC address of an associated device. In response to the disassociation of the associated device, the MAC address and the first additional information corresponding to the disassociated device may be deleted. By operation of the controller circuit, a MAC address and second additional information may be determined for buffered data to be transmitted from the first wireless device. In response to the second additional information of the buffered data not matching the first information corresponding to the matching MAC address, the buffered data may not be sent. The first additional information and the second additional information may be fields corresponding to a network layer at a higher level than the MAC address.

[0131] Methods, devices and systems according to embodiments may include: first additional information including a layer 4 source port value, and second additional information including a layer 4 destination port value.

[0132] The method, device and system according to the embodiment may include maintaining a context for each associated device. Each context includes a MAC address, first additional information, a timer and a buffer location of buffered data. In response to the disassociation of the device, the context of the disassociated device may be deleted from the first memory circuit.

[0133] Methods, devices, and systems according to embodiments may include a request PDU including an association request. In response to at least the MAC address of the request PDU matching a stored MAC address, a response may be returned to the device that issued the request PDU to retry the association at a later time, and a probe request with a target MAC address corresponding to the matching MAC address may be issued. In response to receiving an acknowledgment of the probe request, further association requests for the matching MAC address may be ignored. In response to not receiving an acknowledgment of the probe request, future association requests for the matching MAC address may be processed.

[0134] Methods, devices and systems according to embodiments may include, in response to a MAC address of the request PDU not matching any stored MAC addresses, processing the request PDU.

[0135] Methods, devices, and systems according to embodiments may include a first wireless device that is part of a distributed system having at least a second wireless device. In response to a MAC address of a request PDU not matching any stored MAC addresses, a request may be sent to at least the second wireless device to check whether other devices associated with the second wireless device have a MAC address that matches the MAC address of the request PDU. In response to determining that one of the other associated devices has a matching MAC address, further association requests for the matching MAC address may be ignored. In response to determining that none of the other associated devices have a matching MAC address, future association requests for the matching MAC address may be processed.

[0136] The method, device and system according to the embodiment may include, by operation of at least the second wireless device, storing the MAC addresses of the other associated devices in a second memory circuit of the second wireless device and receiving a request to check for other associated devices that match the MAC address of the request PDU. In response to the MAC address of the request PDU matching the MAC address of at least one of the other associated devices, a response may be returned to the first wireless device indicating that one of the other associated devices has a matching MAC address.

[0137] The method, device and system according to the embodiment may include a memory circuit further configured to store additional information corresponding to the MAC address of each associated device and include at least one buffer configured to store download data for transmission from the device. The controller circuit may be further configured to scan the download data in the at least one buffer to obtain the MAC address value and the additional information. In response to determining that the stored download data includes the MAC address of the associated device but does not include the corresponding additional information, the download data from the buffer may not be sent.

[0138] The method, device and system according to the embodiment may include additional information corresponding to the MAC address of each associated device, the additional information including a source port address according to the layer 4 protocol. The additional information of the downloaded data may include a destination port address according to the layer 4 protocol.

[0139] The method, device and system according to an embodiment may include a controller circuit configured to maintain a context for each associated device. The context for each associated device may include a MAC address of the associated device, at least one source port address,

[0140] timer, and the address of a buffer in a memory circuit.

[0141] Methods, devices and systems according to embodiments may include a controller circuit configured to, in response to disassociation of one of the associated devices, delete a MAC address of the disassociated device from the memory circuit.

[0142] Methods, devices, and systems according to embodiments may include a request PDU that is an association request (which may include a reassociation request). The controller circuit may be configured to generate an association response in response to an association request having a MAC address that matches the MAC address of the association device, requesting that the association request be resent at a later time. The controller circuit may also generate a message addressed to the association device having the matching MAC address. In response to receiving the message from the association device, subsequent association requests having the matching MAC address may be ignored. The wireless circuit may be configured to send the association response and the message and receive a response to the message.

[0143] Methods, devices and systems according to embodiments may include a controller circuit configured to start a timer in response to the wireless circuitry sending a message. In response to the timer exceeding a predetermined value, the controller circuit may indicate that a subsequent association request may be processed.

[0144] Methods, devices, and systems according to embodiments may include a wireless device further configured to store additional information corresponding to a MAC address of each associated device and to store download data for transmission from the wireless device, scan the download data in at least one buffer to obtain a MAC address value and the additional information, and in response to determining that the stored download data includes the MAC address of the associated device but does not include the corresponding additional information, not send the download data.

[0145] Methods, devices, and systems according to embodiments may include a request PDU including an association request. The wireless device may be a first AP compatible with at least one IEEE 802.11 wireless standard, and may be configured to, in response to at least the MAC address of the request PDU matching a stored MAC address, send a MAC check request to a second AP including the MAC address of the request PDU. In response to receiving a first type response from the second AP, send a response requesting to resend the association request later. In response to receiving a second type response from the second AP and the MAC address of the request PDU not matching the stored MAC address, process the association request.

[0146] The method, device, and system according to the embodiment may include a second AP configured to, in response to receiving a check request from the first AP, determine whether a MAC address of a request PDU received by the first AP matches a MAC address of any device associated with the second AP. In response to at least the MAC address of the request PDU matching a device associated with the second AP, send a first type response to the first AP. In response to at least the MAC address of the request PDU not matching a device associated with the second AP, send a second type response to the first AP.

[0147] It should be understood that references to "one embodiment" or "an embodiment" in this specification mean that the specific features, structures, or characteristics described in conjunction with the embodiment are included in at least one embodiment of the present invention. Therefore, it is emphasized that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various parts of this specification do not necessarily all refer to the same embodiment. In addition, specific features, structures, or characteristics can be combined in one or more embodiments of the present invention as needed.

[0148] Similarly, it should be understood that in the foregoing description of exemplary embodiments of the present invention, various features of the present invention are sometimes combined in a single embodiment, figure, or description thereof, with the purpose of simplifying the disclosure and helping to understand one or more of the various inventive aspects. However, this disclosure method should not be interpreted as reflecting the intention that the claims require more features than those explicitly stated in each claim. Rather, the creative aspects lie in less than all the features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, and each claim independently serves as a separate embodiment of the present invention.

[0149] Although the present invention has been described with reference to illustrative embodiments, this description is not intended to be interpreted in a limiting sense. Various modifications and combinations of the illustrative embodiments and other embodiments of the present invention will be apparent to those skilled in the art after reference to the description. Therefore, the appended claims are intended to cover any such modifications or embodiments.

Claims

1. A method comprising: The first wireless device performs the following operations: storing a media access control (MAC) address for a device associated with a wireless network in a first memory circuit of the first wireless device, receiving a wireless request protocol data unit (PDU) via the wireless communication circuit, The controller circuit of the first wireless device performs the following operations: determining whether the MAC address of the request PDU matches a stored MAC address, and In response to at least the MAC address of the request PDU matching the stored MAC address, ignoring the request PDU or not sending the buffered data corresponding to the matching MAC address of the request PDU.

2. The method according to claim 1, wherein: The request PDU is compatible with at least one IEEE 802.11 wireless standard.

3. The method according to claim 1, further comprising: storing first additional information corresponding to each stored MAC address of each associated device; In response to the disassociation of one of the associated devices, deleting the MAC address and the first additional information corresponding to the disassociated device; The controller circuit performs the following operations: determining a MAC address and second additional information for buffered data to be transmitted from the first wireless device, and In response to the second additional information of the buffered data not matching the first information corresponding to the matched MAC address, the buffered data is not sent, wherein, The first additional information and the second additional information are fields corresponding to a network layer at a higher level than the MAC address.

4. The method according to claim 3, wherein: The first additional information includes a layer 4 source port value; and The second additional information includes a layer-4 destination port value.

5. The method according to claim 3, further comprising: Maintain a context for each associated device, each context includes: MAC address, first additional information, a timer, and a buffer location for buffering data; and In response to disassociation of a device, the context for the disassociated device is deleted from the first memory circuit.

6. The method according to claim 1, further comprising: The request PDU includes an association request; In response to at least the MAC address of the request PDU matching a stored MAC address, Return a response to the device that issued the request PDU so that the association can be retried at a later time, issuing a probe request having a target MAC address corresponding to the matched MAC address, In response to receiving an acknowledgement to the probe request, ignoring further association requests for the matching MAC address, and In response to not receiving an acknowledgement to the probe request, future association requests for the matching MAC address are processed.

7. The method according to claim 1, further comprising: In response to the MAC address of the request PDU not matching any of the stored MAC addresses, processing the request PDU.

8. The method according to claim 1, further comprising: The first wireless device is part of a distributed system having at least a second wireless device; In response to the MAC address of the request PDU not matching any of the stored MAC addresses, sending a request to at least the second wireless device to check whether other devices associated with the second wireless device have a MAC address that matches the MAC address of the request PDU, and In response to determining that one of the other associated devices has a matching MAC address, ignoring further association requests for the matching MAC address, and In response to determining that none of the other associated devices have a matching MAC address, future association requests for the matching MAC address are processed.

9. The method according to claim 8, further comprising: At least the second wireless device performs the following operations: storing a MAC address for the other device associated with the second wireless device, receiving the request to check for other devices associated with the second wireless device, In response to the MAC address of the request PDU matching a MAC address of at least one of the other associated devices, returning a response to the first wireless device indicating that one of the other associated devices has a matching MAC address.

10. A device comprising: a memory circuit configured to store at least a media access control (MAC) address for an associated device; wireless circuitry configured to receive and send wireless messages according to at least one wireless standard, including receiving a request protocol data unit (PDU); as well as A controller circuit is configured to: determining whether the MAC address of the request PDU matches the MAC address stored in the memory circuit, and In response to at least the MAC address of the request PDU matching a stored MAC address, ignoring the request PDU or not sending buffered data for a target having a matching MAC address.

11. The apparatus of claim 10, wherein: The memory circuit is further configured to store additional information corresponding to the MAC address of each associated device and includes at least one buffer configured to store download data for transmission from the device; as well as The controller circuit is also configured to: scanning the downloaded data in the at least one buffer for MAC address values ​​and additional information, and In response to determining that the stored download data includes the MAC address of the associated device but does not include corresponding additional information, the download data is not sent from the buffer.

12. The apparatus of claim 11, wherein: The additional information corresponding to the MAC address of each associated device includes a source port address according to a layer 4 protocol; as well as The additional information for the download data includes a destination port address according to the fourth layer protocol.

13. The apparatus of claim 10, wherein: The controller circuit is configured to maintain a context for each associated device, the context for each associated device comprising: For the MAC address of the associated device, At least one source port address, timer, and An address for a buffer in the memory circuit.

14. The apparatus of claim 10, wherein: The controller circuit is configured to, in response to disassociation of one of the associated devices, delete the MAC address for the disassociated device from the memory circuit.

15. The apparatus of claim 10, wherein: The request PDU includes an association request; The controller circuit is configured to, generating, in response to the association request having a MAC address that matches the MAC address of an association device, an association response requesting that the association request be resent at a later time, generating a message addressed to the associated device having the matching MAC address, and responsive to receiving a response to the message from the association device, ignoring subsequent association requests having the matching MAC address; and The wireless circuitry is configured to send the association response and a message and to receive the response to the message.

16. The apparatus of claim 15, wherein: The controller circuit is configured to: responsive to the message being sent by the wireless circuitry, starting a timer, and In response to the timer exceeding a predetermined value, it is indicated that a subsequent association request can be processed.

17. A system comprising: A wireless device configured to: receiving and sending wireless messages according to at least one wireless communication standard, including receiving a request protocol data unit (PDU); storing at least a media access control (MAC) address for a device associated with the wireless device; determining whether the MAC address of the request PDU matches the MAC address of an associated device, and responsive to at least the MAC address of the request PDU matching a stored MAC address, ignoring the request PDU or not sending buffered data for a target having a matching MAC address; as well as A first antenna system is compatible with the at least one wireless communication standard.

18. The system of claim 17, wherein: The wireless device is further configured to: storing additional information corresponding to the MAC address of each associated device and storing download data for transmission from the wireless device, scanning the downloaded data for MAC address values ​​and additional information, and In response to determining that the stored download data includes the MAC address of the associated device but does not include corresponding additional information, the download data is not sent.

19. The system of claim 17, further comprising: The request PDU includes an association request; and The wireless device includes a first access point device (AP) compatible with at least one IEEE 802.11 wireless standard, and the wireless device is configured to, In response to at least the MAC address of the request PDU matching the stored MAC address, sending a MAC check request to a second AP, the MAC check request including the MAC address of the request PDU, in response to receiving a first type response from the second AP, sending a response requesting resending the association request at a later time, and In response to receiving a second type response from the second AP and the MAC address of the request PDU not matching a stored MAC address, processing the association request.

20. The system of claim 19, further comprising: The second AP is configured as: In response to receiving the check request, determining whether the MAC address of the request PDU matches the MAC address of another device associated with the second AP, In response to at least the MAC address of the request PDU matching another device associated with the second AP, sending the first type response, and In response to at least the MAC address of the request PDU not matching a device associated with the second AP, sending the second type response.

Images