METHOD, DEVICES AND SYSTEMS FOR SECURING WIRELESS SYSTEMS AGAINST INSIDER INFORMATION ATTACKS

Abstract

A method may involve, by operating a first wireless device, storing media access control (MAC) addresses for associated devices in first memory circuits of the first wireless device and receiving a wireless request protocol data unit (PDU) via wireless communication circuits. By operating controller circuits of the first wireless device, the method may determine whether the MAC address of the requesting PDU matches a stored MAC address and, in response to at least the MAC address of the requesting PDU matching a stored MAC address, ignore the requesting PDU or not transmit buffered data corresponding to a destination of the matching MAC address. Corresponding devices and systems are also disclosed.

Description

RELATED APPLICATIONSThe present application claims priority to and benefit of U.S. Patent Application No. 63 / 543,399, filed Oct. 10, 2023, the contents of which are incorporated herein by reference in their entirety.TECHNICAL FIELDThe present disclosure relates generally to wireless systems, and more particularly to wireless systems that can protect themselves from attacks that use insider information, such as the addresses of devices that have already joined the network.BACKGROUNDWireless systems, such as systems compatible with some IEEE 802.11 wireless standards, may be vulnerable to attacks using the media access control (MAC) address of a station device (STA) already associated with a base service set (BSS), including a distributed system (DS) BSS (i.e., a MAC Steeler attack).One type of MAC Steeler attack may override a security context of an associated STA (the "victim" STA). In such an attack, an attacker may separate a victim STA from an AP using a variety of methods, including a management frame protection deauthentication frame (MFP). The attacker may then associate with the AP using the victim STA MAC address. Such an attack does not need close timing between attacker messages, as a request from a victim STA could be retransmitted by an endpoint (e.g., HTTP response data by TCP transmission). An example of a security context override attack is shown in Figure 16.Referring to FIG. 16, a system 1601 may include an access point device (AP) 1605 that can control access to a BSS. A STA 1603 may join a network using an exchange of association messages 1609. Such a method may include any suitable association methods and authentication / security steps, including, but not limited to, passpoint published by Wi-Fi Alliance WPA-3 (including enterprise mode). Such methods may include simultaneous authentication of Equals (SAE) public key (SAE-PK) authentication steps.Once associated, a STA 1603 may issue HTTP requests 1611 for servicing by the AP 1605. However, before the HTTP request 1611 can be served, an attacker 1608 owned by the MAC address of the STA 1603 can mimic a deauthentication request 1608-0 addressed to the STA 1603. An attacker 1608 may then search for a connection with the AP 1605 using the illegally-assigned MAC address and its own login information 1613. The AP 1605 may erroneously overwrite 1605-0 the security context corresponding to the STA 1603 with a new context created and controlled by the attacker 1608. An AP 1605 may then incorrectly prepare a response frame to the HTTP request using the overwritten context and send it to the attacker 1605-1 MAC address (illegally appropriate). In this way, the attacker can acquire downlink data destined for the STA 1603.Another type of MAC Steeler attack is a fast re-connect attack. A fast re-connect attack may be directed to a DS having more than one AP. Assuming a victim STA is connected to a first AP (AP1), an attacker can connect to a second AP (AP2) using the victim STA's MAC address. The DS may then deliver downlink traffic (originally requested by the victim STA) to the attacker via the AP2, as a DS may be configured to forward traffic to the AP with which the MAC address was last authenticated. An example of a fast reconnection attack is shown in Figure 17.Referring to FIG. 17, a system 1701 may include a DS 1705 with two APs (AP1 1705-0, AP2 1705-1). A STA 1703 may associate with DP 1705 via AP1 1705-0 with connection and authentication steps 1715. An attacker 1708 may associate with the AP2 1705-1 using a simulated MAC address 1713 (i.e., MAC address of the STA 1703). In response, AP2 1705-1 may begin to associate with attacker 1708. In the example shown, this may include association and authentication, including a four-way handshake 1717. The AP2 1705-1 may cache a paired master key (PMK) negotiated with the attacker 1705-10. The AP2 1705-1 may use the PMKID to further track the PMK associated with the (simulated) MAC 1721.The STA 1703 may issue a request 1719 to the DS 1705 via the AP1 1705-0. However, due to the association by attacker 1721, AP2 1705-1 may load the cached PMK (generated with the attacker's login information) 1705-11. A four-way handshake may be performed 1723 between attacker 1706 and AP2 1705-1 to create encryption keys. Since the attacker's association is the newest, the DS 1705 may transmit a response 1725 (corresponding to the request 1719) to the attacker 1708, and not to the STA 1703.Any way to prevent or otherwise override such insider information attacks could significantly contribute to the security of wireless systems.SUMMARYEmbodiments may include methods, devices, and systems that, by operating a first wireless device, include storing MAC addresses for devices associated with a wireless network in first storage circuits of the first wireless device and receiving a wireless request protocol data unit (PDU) via wireless communication circuits. By operating controller circuitry of the first wireless device, determine whether the MAC address of the request PDU matches a stored MAC address. In response to at least the MAC address of the request PDU matching a stored MAC address, ignoring the request PDU or not transmitting buffered data corresponding to the matching MAC address of the request PDU.BRIEF DESCRIPTION OF THE FIGURESFIG. 1A is a signaling diagram illustrating a system and corresponding operations according to an embodiment. Figure 1B is a continuation of the signaling diagram of Figure 1A. FIG. 2 is a signaling diagram illustrating a system and corresponding operations according to another embodiment. FIG. 3 is a signaling diagram illustrating a system and corresponding operations according to another embodiment. FIG. 4 is a flow diagram of a method according to an embodiment. FIG. 5 is a flow diagram of a method according to another embodiment. FIG. 6 is a flow diagram of a method according to another embodiment. FIG. 7 is a flow diagram of a method according to another embodiment. FIG. 8 is a block diagram of an apparatus according to an embodiment. FIG. 9 is a block diagram of an apparatus according to an embodiment. FIG. 10 is a diagram showing memory circuits and stored values according to an embodiment. FIG. 11 is a block diagram of an apparatus according to another embodiment. FIG. 12 is a diagram illustrating a message that may be transmitted from one access control device to another, according to an embodiment. FIG. 13 is a diagram of an integrated circuit device according to an embodiment. FIG. 14 is a diagram of a vehicle system according to an embodiment. FIG. 15 is a diagram illustrating a system including Internet of Things (IoT) devices according to an embodiment. FIG. 16 is a signaling diagram showing an insider information attack of a first type. FIG. 17 is a signaling diagram showing an insider information attack of a second type.DETAILED DESCRIPTIONAccording to embodiments, a wireless network may be protected from attackers having "insider" information, such as a device's media access control (MAC) address, just to name an example. According to embodiments, a wireless device may compare a device address (e.g., source MAC address) of an incoming request to join a network with that of devices already operating in the wireless network (e.g., associated devices). If there is an address match, the wireless device may ignore further requests to join the network that include the matched address and / or retain download data scheduled for transmission to the matched address and eventually drop such download data.According to embodiments, a wireless device may use information in addition to a device address to distinguish an attacker from a valid device attempting to join a network. In some embodiments, data scheduled for transmission may be scanned towards a device address and a higher network layer value (e.g., port address). If the device address and the higher network layer value do not match those of a device operating in the network, the data scheduled for transmission is not transmitted. Values of a higher network layer may be layers above those providing the device address. As only two of many possible examples, a (layer two) MAC address may be a device address, while a higher layer value may be a (layer four) port value according to a user datagram protocol (UPD) or a transmission control protocol (TCP).In some embodiments, a wireless device may be an access point device (AP) compatible with at least one IEEE 802.11 wireless standard. An AP, when associated, may maintain a context for each station device (STA). Such a context may include a MAC address, one or more source port (UDP or TCP port) values, and a timer. The timer may be reset upon receipt of uplink data from a STA. The AP may compare a MAC address and a destination port for downlink data with existing contexts. If the MAC address and the destination port do not match those of a context, the downlink data may be discarded after a timer expires.According to embodiments, when a wireless device receives a request to connect to a network from a device address that matches that of an existing connected device, the wireless device may return a response to the requesting device to retry the request at a later time. The wireless device may then query the existing connected device. When a response is received from the existing connected device, other requests to be added to the network by the duplicated device address may be ignored.In some embodiments, a wireless device may be an AP compatible with an IEEE 802.11 wireless standard. The AP may check the MAC address of an association request for the existing associated STAs. It is understood that association requests may include reassociation requests. If a MAC address match exists, the AP may return an association response to retry the association request (e.g., status code 30). The AP may transmit a probe request (e.g., with a zero QoS frame) to the STA. If no ACK of the probe is received, the AP may ignore further association requests with the matching MAC address.In some embodiments, a wireless device may be a distributed system (DS) access control device. When the access control device receives a request to connect to a network, the access control device may request other access control devices in the network to check for devices having a matching address. If such devices are already part of the DS, further requests to be added to the network by the duplicated device address may be ignored.In some embodiments, a wireless device may be an AP in a DS compatible with an IEEE 802.11 wireless standard. The AP may request other APs in the DS to check for a match in the MAC address of a received association request. Such other APs may poll all STAs for matching MAC addresses, as described herein. Upon detecting an associated STA with the matching MAC address, such other APs may return a response to the requesting AP indicating an existing MAC. In response, the requesting AP may ignore further association requests with the matching MAC address.FIGS. 1A and 1B are signaling diagrams illustrating operations of a system 100, according to an embodiment. A system 100 may include an access point device (AP) 102, a client device (STA) 104, and remaining portions of a DS 106. FIGS. 1A and 1B also show an attacker 108 owning a device address (e.g., MAC address) of the STA 104. A system 100 may operate by devices (AP 102, STA 104) transmitting and receiving protocol data units (PDU) according to one or more wireless standards. In some embodiments, a system 100 may be compatible with one or more IEEE 802.11 wireless standards. However, alternative embodiments may include any suitable wireless standards that include a join level (e.g., association) that creates an encryption scheme for network layer values (e.g., layer four-port identifiers) over the layer with a device address (e.g., layer two MAC address).Referring now to FIG. 1A, operations of a system 100 will be described. A STA 104 may perform an association operation 110 with the AP 102. Such action may include any suitable exchange of messages that results in the STA 104 being added to the system 100. In some embodiments, the association operation 110 may include an authentication operation that may result in the STA 104 being able to encrypt portions of datagrams that are at a network layer higher than a device address. In some embodiments, devices (AP 102, STA 104) may include MAC addresses and encrypt data (e.g., port addresses) of higher network layers.Upon successful association, the AP 102 may generate a context corresponding to the STA 104. A context may include values derived or determined in the association process, including a device address of the STA 104 (e.g., MAC address) as well as higher layer network values (e.g., port addresses). In the embodiment shown, a context 112 may include, but is not limited to, a STA MAC address, a source port list (Src_port_list[ ]), a timer, and a list of packets (list of pckts). A source port list may include source port values corresponding to PDUs received from the STA 104 and may be updated as new PDUs (e.g., uplink packets) are received. A timer may be used to determine how long a PDU for transmission (e.g., downlink packet) may be held in a buffer before being discarded. A list of packets may identify and / or locate data held in a buffer for download (e.g., downlink data) corresponding to a given MAC address.With continued reference to FIG. 1A, once the STA 104 is associated with the system 100 and the AP 102 has created a context for the STA 104, requests may be processed by the STA 104. While such requests may take any suitable form, in the embodiment shown, STA 104 may transmit an HTTP request 104- 00 that may be received by AP 102 and forwarded 104- 01 to other devices in system 100, which may be other portions of a DS 106. Additionally, the AP 102 may update a context for the STA 104 with a source port value (e.g., add the source port src_port_list) 114.In response to the HTTP request 104- 00 / 01, an HTTP response 106- 00 may be returned to the AP 102. The AP 102 may evaluate the download data for a MAC address and a higher network layer value (a UDP / TCP destination port in this embodiment). In the embodiment shown, the MAC address and source port value match the context for STA 104. Accordingly, the HTTP response 106- 01 may be forwarded to the STA 104. In some embodiments, an AP 102 may buffer download data having a MAC address that matches that of an existing context. Values of a higher network layer can then be evaluated. If a MAC address and a destination port of the HTTP response 106- 00 do not match a MAC address and a source port for a context, a timer for the context may be started. After the timer expires, download data may be discarded (e.g., deleted, overwritten, etc.).FIG. 1A also illustrates operations when a device is removed (e.g., disconnected) from the network. In response to a message from the AP 102 or STA 104, the STA 104 may be removed from the network. In response, the AP 102 may delete the context associated with the STA 116.FIG. 1B illustrates operations of the system 100 of FIG. 1A in response to an attempt to access data by an attacker 108 owning the MAC address for the STA 104. The STA 104 may issue an HTTP request 104- 00 / 01 as described for FIG. 1A. However, unlike FIG. 1A, attacker 108 may mimic a deauthentication message to STA 104, causing STA 104 to determine that it is no longer authenticated to system 100. Attacker 108 may then perform an association operation 108- 1 with AP 102 using the MAC address of STA 104. As described for FIG. 1A, in response to the association operation 108- 1, the AP 102 may update a context 112 for the MAC address used by the attacker 108. However, since values of a higher network layer (e.g., a source port) are encrypted, a source port of attacker 108 is almost certainly different from that of HTTP request 104- 00 / 01 from STA 104.When an HTTP response 106- 00 corresponding to the HTTP request 104- 00 / 01 by the STA 104 is received at the AP 102, the AP 102 may check the MAC address and the destination port, and since such values do not match the current context, the downlink data may be held in the buffer 114- 1 and the timer may be started. When the timer expires, the download packet is discarded, preventing attacker 108 from illegally receiving the data.In this way, a device that controls access to a network, such as an AP, may maintain context on connected devices that includes a device address and higher network layer values. Such contexts may be updated with each received communication from connected devices. If download data is received that does not match a context, the data may be held and eventually discarded.FIG. 2 is a signaling diagram illustrating operations of a system 200 according to another embodiment. A system 200 may include elements such as those of FIGS. 1A / B, and such similar elements are shown with the same reference numerals, but with the leading digit being a "2" instead of a "1.". Operations of the system 200 will be described below.A STA 204 may perform an association operation with the AP 202. Such an association operation may take the form of any of the ones described herein or equivalents thereof. Once associated, the STA 204 may issue requests (e.g., HTTP requests 204- 00 / 01) to a system that elicit response data.In the embodiment shown, attacker 208 is in possession of the device address (e.g., MAC address) of STA 204 and requests an association 208- 2 with system 200 using such a MAC address. In response to the association request, the AP 202 may determine whether the MAC address of the association request matches that of an existing associated device. Such an operation may include the AP 202 accessing memory circuitry to determine whether the device address matches a stored device address. If it is determined that a STA is already associated with the same MAC address, by a matching MAC address in memory, the request may be rejected 218 immediately at the beginning. In some embodiments, such rejection may include the AP 202 indicating to the requesting device that it should retry the request at a later time 202- 0. In the embodiment shown, a system may be compatible with an IEEE 802.11 wireless standard, and the AP 202 may return an association response with a status code 30 indicating that the requesting device (i.e., attacker 208) should return later and retry the association.Upon determining that a STA having a same MAC address exists as an association request, the AP 202 may determine whether a STA having the same MAC address is currently active. In the embodiment shown, such an action may include probing connected STAs (including STA 204 having the matching MAC address) in response to a response 220. In the embodiment shown, such an action may include outputting a quality of service (QoS) null data frame 202- 1. However, alternative embodiments may include any other suitable message from an AP that elicits a response that includes a STA device address (e.g., MAC address).In response to probing by the AP 202, the STA 204 may return a message indicating that it is still associated with the system 200. In the embodiment shown, such a message may be an acknowledgement (ACK) 204- 1 of the QoS null data frame 202- 1. From such an acknowledgement, the AP 202 may determine that association requests for the corresponding MAC address are not valid. When download data for the MAC address is received (e.g., HTTP response 206-00), AP 202 may forward such data to STA 204 (e.g., HTTP response 206-01).When attacker 208 re-attempts an association request 208- 3 using the MAC address of STA 204, AP 202 may ignore such request 222.In this way, a network access control device may determine whether a request to join the network has a device address that matches that of a device that is already part of the network. If such a match exists, an access control device may reject the request to join the network and determine whether the device with the matching device address in the network is still active. If the device is still active, further requests to join the network using the matching device address may be ignored.FIG. 3 is a signaling diagram illustrating operations of a system 300 according to another embodiment. A system 300 may include elements such as those of FIGS. 1A / B, and such similar elements are shown with the same reference numerals, but with the leading digit being a "3" instead of a "1.". However, in contrast to FIGS. 1A / B, two APs are shown, AP1 302-1 and AP2 302-2. In some embodiments, AP1 302-1 may control a basic service set (BSS), while AP2 302-2 may control another BSS, where the two BSSs are part of a same DS 305. Operations of the system 300 will be described below.A STA 304 may perform an association operation with the AP 2 310. Such an association operation may take the form of any of the ones described herein or equivalents thereof. Once associated, STA 304 may issue requests 304- 00 / 01 to a system intended to invoke response data.In the embodiment shown, attacker 308 is in possession of the device address of STA 304 and requests an association 308- 2 with another BSS (i.e., that of AP1 302- 1) using such a MAC address. In response to the association request, the AP1 302- 1 may make a request to other APs in the network to determine whether such other APs are already associated with a STA having the same device (MAC) address 324. Such a request from AP1 302-1 to AP2 302-2 is shown as 304-12.In response to request 304- 12 from AP 1 302- 1, AP 2 302- 2 may return a response 304- 22 that the indicated device address matches an associated device 326 (e.g., that the MAC address of attacker association request 308- 2 matches that of STA 304). From such a response 304- 22, the AP 1 302- 1 may determine that a device address duplicate has been found and reject the request (from the attacker 308). Such rejection may include any of those described herein, including, but not limited to, transmission of an association response with a status code (e.g., status code 30) 302- 13.Upon determining that a STA with a same MAC address exists as an association request, the AP2 302-2 may determine whether the STA 304 is currently active. Such actions may include any of those described herein or equivalents thereof. In the embodiment shown, such action may include those described in FIG. 2, including probing with the QoS null data frame 320 and receiving an ACK 304- 1 from the STA 304.In some embodiments, AP2 302-2 may send a message to requesting AP 302-1 indicating that a STA with a matching device is still active 304-23. The AP1 302-1 may reject all other association requests with the matching device address.In this way, upon receiving a request to join a network, an access control device may query other access devices of the network to determine whether a device that is already part of the network has an address that matches that of the request. If such a match exists, an access control device may reject the request to join the network and ignore further join requests having the matching device address.While the systems and devices described herein depict various methods, additional methods will now be described with reference to flowcharts. Such methods may be performed by circuitry of devices and / or systems described herein.FIG. 4 is a flow diagram of a method 430, according to an embodiment. A method 430 may be performed by an access control device that may control access to a network including, but not limited to, an AP. A method 430 may include storing MAC addresses of associated devices 430- 0. A request PDU to join a network may be received via wireless circuits 430- 1. Such action may include receiving a request PDU according to any suitable wireless standard, including, but not limited to, one or more IEEE 802.11 wireless standards.If a request PDU does not include an associated device MAC address (N at 430-2), a method 430 may process 430-3 the request according to the relevant standard. If a request PDU includes an associated device MAC address (Y at 430-2), a method 430 may process 430-4 the request as an invalid request. According to embodiments, such actions may include, but are not limited to, ignoring request 430- 5 and / or not transmitting download data that targets 430- 6 to the matching MAC address.In this way, when a request to join a network is received, a MAC address of the request may be compared to MAC addresses of devices already associated with the network. If a match is found, it may be determined that the request is invalid.FIG. 5 is a flow diagram of a method 530 according to another embodiment. A method 530 may be performed by a device that controls access to a wireless network. In some embodiments, a method 530 may be performed by an AP to prevent attacks using insider information (e.g., a MAC address of an associated STA). In some embodiments, a method 530 may be performed by an AP operating in accordance with one or more IEEE 802.11 wireless standards.A method 530 may include determining whether a STA has been associated with the network 530- 0. Such action may comprise completing an association procedure comprising creating an encryption scheme that ensures encryption of network layers over layer 2, including encryption of layer 4 values such as UDP and / or TCP source port values.A method 530 may create a context for the associated device 530- 1. Such action may include any of the ones described herein or equivalents thereof. In the embodiment shown, a context for each associated device may include a MAC address, a source port, a timestamp, a timer duration, and one or more allocated buffers. A timestamp may indicate an age of the context. In some embodiments, contexts may have limited lifetimes, and when a predetermined amount of time has elapsed since the timestamp, the context may be deleted. A timer duration may indicate a duration of time before a timer expires for the context. The operation of such timers will be described below. One or more allocated buffers may indicate a location of a buffer for data corresponding to the MAC address, including, but not limited to, downlink data intended for transmission to a STA corresponding to the context.A method 530 may determine whether an uplink data frame having a MAC address matching that of a context 530- 2 is received. Such action may include determining a source MAC address for the uplink data frame and comparing it to MAC addresses of existing contexts. When such an uplink data frame is received (Y at 530-2), a method 530 may determine whether the context of the matching MAC address includes a source port that matches that of the uplink data frame 530-3. If the source port is already present in the context (Y at 530-3), a timestamp for the context may be updated 530-4. If the source port is not already present in the context (N at 530-3), a method 530 may determine whether the context has a maximum number of source ports 530-6. If a context has a maximum number of source ports (Y at 530-6), an oldest source port may be deleted 530-7 from the context. In some embodiments, such an action may include deleting a source port value with the oldest timestamp. If a number of source ports is not a maximum (N at 530-6) or an oldest source port value has been deleted 530-7, a method 530 may add 530-8 the source port to the context along with a current timestamp.A method 530 may determine whether a downlink data frame having a MAC address matching that of a context 530- 9 is received. Such action may include determining a destination MAC address for the downlink data frame and comparing it to MAC addresses of existing contexts. When such a downlink data frame is received (Y at 530-9), a method 530 may determine whether the context of the matching MAC address includes a source port that matches a destination port of the downlink data frame 530-10. If the port values match (Y at 530-10), a method may enable 530-11 the downlink data frame for transmission. If a destination port does not match a source port (N at 530-10), a context timer may be started 530-12. If a downlink data frame that does not match a context is received (N at 530-9), a method 530 may discard 530-14 the downlink data frame.A method 530 may determine whether any context timers have expired 530- 13. Such action may include comparing a timer value for a context to its timer duration (or a timer value common to all contexts). If a timer has expired (Y at 530-13), the corresponding downlink data frames may be discarded 530-14.A method 530 may determine whether a STA has been disconnected 530- 15 from the network. Such action may include any suitable action compatible with a given wireless standard, including, but not limited to, a STA requesting disconnection or an AP forcing disconnection. After a STA is disconnected (J at 530-15), the timer for the context may be stopped and the context may be cleared 530-16.In this way, a MAC address and a MAC port for downlink data may be scanned upon a match with an existing associated device. If there is a MAC address match but a port mismatch, the downlink data may be retained and eventually discarded.FIG. 6 is a flow diagram of a method 630 according to another embodiment. A method 630 may be performed by a device that controls access to a network. In some embodiments, a method may be performed by an AP to prevent attacks using the device address (MAC) of a device that is already part of the network.A method 630 may include receiving an association request 630- 0. Such action may include receiving a wireless message to join a network according to any suitable protocol, and in the embodiment shown may be an association request compatible with one or more IEEE 802.11 standards.A method 630 may determine whether a device address (e.g., MAC address) is identified as an address that should be ignored 630- 1. How determines that device addresses are ignored is described in more detail below. If a device address of a request is marked as ignored (Y at 630-1), the request may be ignored 630-2.If a device address is not indicated as ignored (N at 630- 1), a method 630 may determine whether a device address of the association request matches that of a device already connected to the network 630- 3. In the embodiment shown, such an action may include determining whether a source MAC address of an association request matches the MAC address of a STA already associated with the network. If there is no currently associated device with an address matching that of the association request (N at 630-1), a method 630 may return an association response to initiate an association process 630-4. Such action may include proceeding with the appropriate process to add (or possibly not add) the requesting device to the network.If there is an associated device having a device address that matches that of the association request (Y at 630-1), a method 630 may return a response to the request to re-submit 630-5 the request at a later time. In some embodiments, such action may include an AP transmitting an association response with a status code 30. Additionally, messages may be sent to currently associated devices to elicit a response 630- 6. In the embodiment shown, such an action may include sending a QoS null data probe to the associated STA having a MAC address that matches the association request. If a response to a probe message is received (Y at 630-7), the device address may be indicated to be ignored 630-8. If a probe message response is not received (N at 630-7), a method 630 may proceed 630-4 with an association process. In some embodiments, such action may be preceded by a timeout period or may require more than one association request.In this way, if an association request includes a device address that matches a currently associated device, a query may be made to determine whether the currently associated device is still active. If the associated device responds, the association request may be ignored.FIG. 7 is a flow diagram of a method 730 according to another embodiment. A method 730 may be performed by an access control device (e.g., an AP) operating in conjunction with one or more other access control devices to create a larger DS. In some embodiments, a method 730 may be performed by an AP of a BSS in communication with another AP of another BSS, wherein the two BSSs are part of a same DS.A method 730 may include receiving a message from another device requesting a check for a duplicated device address 730- 0. In some embodiments, such an action may include receiving a message from another AP of a same system (e.g., DS) that includes a MAC address of an association request. A device address identified by the message may be compared to those of associated devices 730- 1. In the embodiment shown, this may include determining whether a MAC matches that of an associated STA. If a match is not found (N at 730-1), a method 730 may transmit a message to the requesting device that a match was not found 730-2.If a device address received in the message matches that of an existing device (Y at 730-1), a method 730 may transmit a message to the requesting device that a matching device was found 730-3. A method 730- 4 may determine whether a matching device address is marked as ignored 730- 4. If the device address is indicated as being ignored (Y at 730-4), a message may be transmitted to the requesting device that the duplicated device address should be ignored 730-5.If the device address is not indicated as being ignored (N at 730-4), a method 730 may continue as shown in FIG. 6: sending probe messages to invoke 730-6 a response, and if a response is received (Y at 730-7), indicating the device address as being ignored 730-8. If no response is received (N at 730-7), a method 730 may transmit a message indicating no match to a device address 730-2.In this manner, a device that controls access to a network may receive a request from another such device to check whether any associated devices match a device address. A message may be returned indicating whether such a matching device address has been found. In addition, if a match is found, the device may indicate that requests to join the network with such a matching device address may be ignored.FIG. 8 is a block diagram of a wireless device 840 according to an embodiment. A wireless device 840 may control access to a network. In some embodiments, a device 840 may be an AP of a network, including an AP in a BSS compatible with one or more IEEE 802.11 wireless standards. A device 840 may include input / output (I / O) circuits 832, control circuits 834, and wireless circuits 836. IO circuits 832 may enable a device 840 to communicate with other systems and / or a user, and may include any suitable communication circuits and / or interfaces, including wired and / or wireless circuits / interfaces.Controller circuitry 834 may include any suitable circuitry for performing wireless network access operations as described herein and equivalents thereof. Controller circuitry 834 may include, but is not limited to, one or more processors, custom logic circuitry, programmable logic circuitry, and / or machine-learned / learning systems. Controller circuitry 834 may include circuitry for processing association requests 842, as well as memory circuitry 844 for storing various forms of data. Operations for processing an association request 842 may include comparing a device ID of a request to existing connected devices 846. Such action may include extracting a device ID from an association request PDU and comparing such value to device IDs stored in memory circuitry 844. Processing an association request 842 may also include an invalid request response 848. Such operations may include ignoring future requests from a matching device ID 848-0 and / or discarding download data that pertains to a matching device ID (i.e., not transmitting such data). Memory circuitry 844 may store any suitable data for operations of a device 840, including, but not limited to, device IDs of previously connected devices 850.Wireless circuitry 836 may include circuitry compatible with one or more standards, including public and / or private standards. In some embodiments, wireless circuitry 836 may be compatible with one or more IEEE 802.11 or related standards. Wireless circuitry 836 may be connected to an antenna system 838.In some embodiments, IO circuits 832, controller circuits 834, and wireless circuits 836 may be part of a same integrated circuit substrate 852.In this way, a wireless device may include circuitry for comparing a device ID present in a request to join a network. If such a device ID matches that of a device that previously established a connection to the network, the device may ignore the request to join the network and / or discard download data associated with the matching device ID.FIG. 9 is a block diagram of a device 940 according to another embodiment. In some embodiments, a device 940 may be an AP or part of an AP that can process association requests by STAs to join a network. A device 940 may include controller circuitry 934, Wi-Fi circuitry 936, and optionally other wireless circuitry 960 and bridge circuitry 958, interconnected via a backplane and / or bus 956.A controller circuit 934 may include memory circuits 944 and processor circuits 954. Memory circuits 944 may include any suitable memory circuits, including non-volatile memory, volatile memory, and / or combinations thereof. In some embodiments, memory circuitry 944 may include memory circuitry that is part of device 940 and / or memory circuitry external to device 940 but that may be accessed by processor circuitry according to a wired or wireless protocol.Memory circuitry 944 may store data to enable the various operations of the wireless device 940, including data for association contexts 950, buffers for downlink data and uplink data for STAs 962, and code (e.g., firmware) 964 executable by processor circuitry 954 to provide the various processor circuitry operations described herein. Data for association contexts 950 may be created upon successful association by a STA, as described herein for embodiments. In some embodiments, an association context 950 for each associated STA may include a MAC address, a higher network layer value (e.g., a source port), and other information.Processor circuits 954 may execute code 964 stored in memory circuits 944 to provide various functions to device 940. Operations provided by processor circuitry 954 may include, but are not limited to, creating STA contexts 966, uplink data frame processing 968, downlink data frame processing 970, and separation processing 972. Creating STA contexts 966 may include processing circuitry that stores context data in memory circuitry 944 as described herein or equivalents thereof. Such action may include decrypting portions of a PDU received from a STA to derive the other information.The uplink data frame processing 968 may include updating a context in response to receiving an uplink data frame 974. Such operations may include updating context values stored in memory circuits 944. In some embodiments, such operations may update a value corresponding to a value of a higher network layer than a device ID (e.g., a layer 4 source port) 974-0, as well as update a timestamp value 974-1.Downlink data frame processing 970 may include scanning downlink data frames 970- 0, executing timers 970- 1, and controlling buffers 970- 2. Scanning downlink data frames 970- 0 may include scanning for network layer values at a higher than a device ID (e.g., a target port of layer 4). A timer 970- 1 may be activated for a context if a device ID (e.g., a MAC address) matches that of a context, but a higher layer value for the downlink data frame does not match that of the same context (e.g., a downlink destination port does not match a context source port). The buffer controller 970- 2 may include buffering downlink data frames for contexts (e.g., associated devices) and discarding such downlink data frames if a corresponding timer expires (e.g., reaches a predetermined limit).The separation processing 972 may process separation requests from associated devices. Such operations may include, upon successful device isolation, discarding downlink data frames for the separated device 972-0, stopping a corresponding timer 972-1, and removing (e.g., deleting) context 972-2 for the separated device.Wireless circuitry 936 may provide wireless communications compatible with one or more wireless standards. In the embodiment shown, wireless circuitry may be compatible with one or more IEEE 802.11 wireless standards. Wireless circuitry 936 may include MAC layer circuitry 936-0, physical layer (PHY) circuitry 936-1, and RF circuitry 936-2. Such circuits (936-0, -1, -2) may be compatible with one or more IEEE 802.11 wireless standards on any suitable band, including, but not limited to, the 2.4 GHz, 5 GHz, and / or 6 GHz band.IO circuits 932 may input or output signals that may enable control of a device 940 from sources external to the device in any suitable manner. In some embodiments, IO circuits 932 may include serial communication circuits including, but not limited to, interfaces compatible with a serial digital interface (SDI), a universal serial bus (USB), a universal asynchronous receiver transmitter (UART), I2C, or I2S.Bridge interface circuits 958 may enable communications between wireless circuits 936 and other wireless circuits 960. In some embodiments, such communications may control which wireless circuits (936 or 960) control a shared medium (e.g., 2.4 GHz band).Other wireless circuitry 960 may be one or more wireless circuitry compatible with a standard other than an IEEE wireless standard, including, but not limited to, one or more BT standards, one or more IEEE 802.15.4 or related standards, and / or one or more cellular network standards.A device 940 may operate in conjunction with an antenna system 938 having one or more antennas compatible with one or more wireless, including that of another wireless subsection 960, if included.In some embodiments, IO circuits 932, controller subsection 934, and wireless circuits 936 may be formed with a same integrated circuit substrate 952.In this way, a wireless device may scan downlink data for a device address (e.g., MAC address) and a higher layer value (e.g., destination port), and then compare such values to data stored for each device associated with a network. If a device value matches, but a higher layer value does not, the downlink data may be retained (e.g., not transmitted) and eventually discarded. When a device value and a higher layer value match with that of a context, the downlink data may be transmitted. In response to uplink data, context data for a device may be updated (e.g., the source port may be updated).FIG. 10 is a diagram of memory circuits 1044 according to an embodiment. The memory circuits 1044 may be an implementation of that shown in FIG. 8 ( 844) and / or FIG. 9 ( 944). The memory circuitry 1044 may store association contexts 1050 and include buffers 1062 corresponding to each such context. The association contexts 1050 may include data values for each device associated with a network. In the embodiment shown, context records for different associated devices are shown as 1050- 0 through 1050- i. Each context record (1050-0 through -i) may include a MAC address (MAC Add0 through MAC Adddi), one or more source port addresses (source_port_xx, where xx corresponds to a different source port), a timestamp value (timestamp_0 through timestamp_i), a timer value (timer_0 through time_i), and a buffer address (buffer_ADD0 through buffer_ADDi).There may be one or more source port values (source_port_xx) per device context. In some embodiments, multiple source port values may be ordered based on the stored time (e.g., time stamps). In some embodiments, there may be a maximum number of source port values per context. If a context has such a maximum number of source port values, then if a new source port value is to be added, the oldest source port value may be discarded. Alternative embodiments may include a different value at a higher network layer than a MAC address (e.g., higher than layer 2).A timer value (timer_0 to i) may determine how long downlink data may be stored in a buffer in response to a context mismatch. In some embodiments, each downlink data set (e.g., data frames for transmission to a STA) may be scanned for a MAC destination address and a MAC destination port value. Such values may be compared to MAC addresses and source port values for each context. However, if there is a MAC address match but also a destination source port mismatch, a timer for the downlink data may be started. When the timer expires, the downlink data may be discarded (e.g., overwritten, deleted, the link / pointer value is determined to be no longer valid).Buffer addresses (buffer_ADD0 to ADDi) may indicate where downlink data corresponding to the MAC address of the context (1050-0 to i) is stored. Such values may take any suitable form including, but not limited to, a physical address, a logical address, a pointer, or a linked list start.Buffers 1062 may include storage locations for at least downlink data corresponding to the MAC address of each context (1050-0 through -i). In the embodiment shown, buffers 1062 may include memory for buffering data for uplink data frames (1062-00 through -i0) and downlink data frames (1062-01 through -i1). Received uplink data frames (1062-00 through -i0) may be scanned towards a source MAC address (e.g., 1074) and a source port (e.g., 1076). Such action may include processor or equivalent circuitry that reads predetermined locations in a buffer. If a source MAC address (e.g., 1074) of an uplink data frame (1062-00 through -i0) matches that of a context (1050-0 through -i), the source port values may be compared. If such source port values match, a timestamp value for the context may be updated. If such source port values do not match, a source port value for the context may be updated.Downlink data frames (1062-01 through -i1) may be scanned towards a destination MAC address (e.g., 1075) and a destination port (e.g., 1077). When a destination MAC address (e.g., 1075) of a downlink data frame (1062-01 through -i1) matches that of a context (1050-0 through -i), the destination port value 1077 may be compared to a source port value (source_port XX) of the corresponding context. If such port values do not match, a timer may be started. In some embodiments, such a timer may be based on a timer value (timer_0 to -i) of the corresponding context (1050-0 to -i).In this way, upon association with a network, a context for STAs may be created. Such contexts may include a MAC address and a source port address. When an uplink data frame is received from an associated STA, a source port value of the context may be updated. When a downlink data frame is ready for an associated STA, a destination port of the downlink data frame may be compared to the source port value of the corresponding context. If such values do not match, the downlink data frame may not be transmitted and may be discarded after a timer expires.FIG. 11 is a block diagram of an apparatus 1140 according to another embodiment. A device 1140 may comprise elements such as those of Figure 9, such similar elements being referenced by the same reference number, but with the leading digits being "11" instead of "9". Memory circuitry 1144 may store device (MAC) addresses of associated devices (e.g., STAs) 1144-0. In the embodiment shown, memory circuits 1144 may store device addresses of devices determined to be ignored 1144-1 and code 1164.Processor circuitry 1154 processes association requests 1180 and optionally processes probe requests from other APs 1182. Processing association requests 1180 may include comparing a device address of a requesting device to device addresses of already associated devices (e.g., comparing the request source MAC address to associated device MAC addresses) 1180- 0. If a requesting device address matches that of an existing associated device, processor circuitry 1154 may perform various operations 1180- 1, 1180- 2, and 1180- 3. Operation 1180- 1 may include returning an association response indicating that a device should retry later. In some embodiments, this may include an association response compatible with one or more IEEE 802.11 wireless standards including a status code 30. Operation 1180- 2 may include generating a probe request directed to the associated device with a matching device address. Such action may query to determine whether the associated device is still active in the network. When a response to a probe is received indicating that the associated device with a matching device address is still active, the operations may include assigning the request device address to an ignoring list 1180- 3.Optionally, a device 1140 may operate in a distributed system that receives verification requests from other access devices (e.g., APs) 1182. Such operations may include analyzing received data frames from a validated / authenticated AP and deriving a device address from such a request. If one of the stored device addresses 1044-0 matches that included in the request from another access device, the operations may include returning a response that the device address corresponds to an associated device 1182-0. If none of the stored device addresses 1044-0 match that included in the request, a response indicating no such match 1182-1 may be returned.In this way, a wireless device may compare a device address in a request for association with those of already associated devices. If such a match exists, the wireless device may return a response to retry the association request. If an associated device with a matching address in the network is still active, the wireless device may ignore future association requests using such a device address.Figure 12 is a diagram of a message 1283 that can be transmitted between two network access devices to check for a duplicated device address. In the embodiment shown, a message 1283 may include (a) source address(s) 1284-1 of an AP requesting a test, as well as the destination address(s) 1284-0 of the AP intended to receive the message. A payload 1286 of the message may include the device address (e.g., MAC address) to be checked (i.e., determine whether the device address matches that of an already associated device).In this manner, AP-to-AP communications may include a request to check for a MAC address that matches that of a STA making an association request.Although embodiments may include systems and devices with various interconnected components, embodiments may also include unitary devices having the ability to protect wireless networks from attacks that utilize a device address of a device already associated with the network. FIG. 13 illustrates an example of a single chip wireless package device 1340, according to an embodiment. Such a device 1340 may include circuitry for performing device address checking operations as described herein and equivalents thereof. In some embodiments, a device 1340 may include circuits such as those shown in any of the FIGS. 8-11.However, it is understood that a device according to embodiments may include any other suitable integrated circuit package type as well as directly bonding a device chip to a circuit board or substrate.In this way, a wireless device that can protect from insider attacks may be included in a single integrated circuit device.While embodiments may have broad application in various wireless systems, vehicle systems may benefit from resistance to insider information attacks as described herein. FIG. 14 shows a motor vehicle system 1488, according to one embodiment. An automotive system 1488 may include one or more subsystems 1488-0 (e.g., an in-vehicle infotainment system), which may include a wireless device 1440 in the form of any of the described herein or equivalents thereof.In this way, vehicles may include a vehicle wireless system that may prevent insider information attacks that utilize addresses of devices already associated with the vehicle wireless system.FIG. 15 shows a system 1500 according to another embodiment. A system 1500 may include two or more APs 1540-0, 1540-1, as well as a number of STAs 1504-0 through 1504-5. APs 1540-0 / 1 and / or STAs (1504-0 through -5) may include devices as described herein and / or circuitry for carrying out the various methods described herein.APs 1540-0 / 1 may be in communication with each other over a connection 1590 that may be wireless or wired. Via such a link 1590, APs 1540-0 / 1 may request checks for matching MAC addresses 1504-12. Such requirements may take the form of any of those described herein. The APs 1540-0 / 1 may store contexts 1550 for associated STAs as described herein or equivalents thereof.In some embodiments, the STAs (1504-0 through -5) may be part of IoT devices including, but not limited to, medical devices 1504-0 / 1, instrumentation devices 1504-2, security devices 1504-3 / 4, or lighting devices 1504-5. However, such wireless devices are provided as an example, and any suitable wireless device may benefit from faster and / or lower performance reconnection operations as described herein, or equivalents thereof. The STAs (1508-0 through -5) may be associated with a network via the AP 1540-0. While a system 1500 may be compatible with an IEEE 802.11 wireless network, alternative embodiments may include any other suitable standard / protocol.Along these same lines, a system 1500 may include various interconnected networks, including pico-networks, PANs, LANs, WANs, both private and public, as well as the Internet.In this way, networks with IoT devices may detect attacks that use device addresses of devices already associated with the network.Embodiments may include methods, devices, and systems that, by operating a first wireless device, include storing MAC addresses for associated devices in first memory circuits of the first wireless device and receiving a wireless request protocol data unit (PDU) via wireless communication circuits. By operating controller circuitry of the first wireless device, determine whether the MAC address of the request PDU matches a stored MAC address. In response to at least the MAC address of the request PDU matching a stored MAC address, ignoring the request PDU or not transmitting buffered data corresponding to a destination of the matching MAC address.Embodiments may include methods, devices, and systems having memory circuitry configured to store at least MAC addresses for associated devices, wireless circuitry configured to receive and transmit wireless messages according to at least one wireless standard, including receiving a request PDU, and controller circuitry. Controller circuitry may be configured to determine whether a MAC address of the request PDU matches the MAC address of an associated device stored in the memory circuitry, and in response to at least the MAC address of the request PDU matching a stored MAC address, ignore the request PDU or not transmit buffered data having a destination of the matched MAC address.Embodiments may include methods, devices, and systems having a wireless device configured to receive and transmit wireless messages according to at least one wireless communication standard, including receiving a request PDU. The wireless device may also be configured to store at least MAC addresses for devices associated with the wireless device; determine whether a MAC address of the request PDU matches the MAC address of an associated device, and in response to at least the MAC address of the request PDU matching a stored MAC address, ignore the request PDU or not transmit buffered data that includes a destination of the matched MAC address. A first antenna system compatible with the at least one wireless communication standard.Methods, devices, and systems according to embodiments may include a request PDU compatible with at least one IEEE 802.11 wireless standard.Methods, devices, and systems according to embodiments may include storing first additional information corresponding to each stored MAC address for an associated device. In response to a disconnection of an associated device, the MAC address and first additional information corresponding to the disconnected device may be deleted. Through operation of the controller circuitry, a MAC address and second additional buffered data information may be determined for transmission from the first wireless device. In response to the second additional information of the buffered data not matching the first information corresponding to the matching MAC addresses, the buffered data may not be transmitted. The first and second additional information may be fields corresponding to a network layer of a higher level than the MAC address.Methods, devices, and systems according to embodiments may include first additional information including a layer four source port value and second additional information including a layer four destination port value.Methods, devices, and systems according to embodiments may include maintaining a context for each associated device. Each context includes a MAC address, first additional information, a timer, and a buffered data buffer location. In response to a device disconnect, clearing a context for the disconnected device from the first memory circuits may be cleared.Methods, devices, and systems according to embodiments may include a request PDU including an association request. In response to at least one MAC address of the request PDU matching a stored MAC address, a response may be returned to a device issuing the request PDU to retry the association at a later time and a probe request may be issued with a destination MAC address corresponding to the matching MAC address. In response to receiving an acknowledgement of the probe request, further association requests for the matching MAC address may be ignored. In response to not receiving an acknowledgement of the probe request, future association requests for the matching MAC address may be processed.Methods, devices, and systems according to embodiments may include processing the request PDU in response to a MAC address of a request PDU not matching any of the stored MAC addresses.Methods, devices, and systems according to embodiments may include a first wireless device that is part of a distributed system having at least one second wireless device. In response to the MAC address of the request PDU not matching any of the stored MAC addresses, a request may be transmitted to at least the second wireless device to check for other devices associated with the second wireless device having a MAC address matching that of the request PDU. In response to determining that one of the other associated devices has a matching MAC address, further association requests for the matching MAC address may be ignored. In response to determining that none of the other associated devices have a matching MAC address, future association requests for the matching MAC address may be processed.Methods, devices, and systems according to embodiments may include, by operating at least the second wireless device, storing MAC addresses for the other associated devices in second memory circuits of the second wireless device and receiving the request to check for other associated devices that match the MAC address of the request PDU. In response to the MAC address of the request PDU matching a MAC address of at least one of the other associated devices, a response may be returned to the first wireless device indicating that one of the other associated devices has a matching MAC address.Methods, devices, and systems according to embodiments may include memory circuitry further configured to store additional information corresponding to the MAC address of each associated device and at least one buffer configured to store download data for transmission from the device. Controller circuitry may be further configured to scan the download data in the at least one buffer for MAC address values and additional information. In response to determining that stored download data includes the MAC address of an associated device, but not the corresponding additional information, the download data may not be transmitted from the buffer.Methods, devices, and systems according to embodiments may include additional information corresponding to the MAC address of each associated device, including a source port address according to a layer four protocol. Additional information for the download data may include a destination port address according to the layer four protocol.Methods, devices, and systems according to embodiments may include controller circuitry configured to maintain a context for each associated device. The context for each associated device may include the MAC address for the associated device, at least one source port address, a timer, and an address for a buffer in the memory circuits.Methods, devices, and systems according to embodiments may include controller circuitry configured to, in response to the disconnection of one of the associated devices, delete the MAC address for the disconnected device from the memory circuitry.Methods, devices, and systems according to embodiments may include a request PDU that is an association request (which may include a reassociation request). Controller circuitry may be configured to generate an association response in response to the association request having a MAC address that matches that of an associated device requesting that the association request be retransmitted at a later time. Controller circuitry may also generate a message addressed to the associated device having the matching MAC address. In response to receiving the message from the associated device, a subsequent association request having the matching MAC address may be ignored. Wireless circuitry may be configured to transmit the association response and the message and receive the response to the message.Methods, devices, and systems according to embodiments may include controller circuitry configured to start a timer in response to the message being transmitted by the wireless circuitry. In response to the timer exceeding a predetermined value, controller circuitry may indicate that a subsequent association request may be processed.Methods, devices, and systems according to embodiments may include a wireless device being further configured to store additional information corresponding to the MAC address of each associated device and store download data for transmission from the wireless device, scan the download data in the at least one buffer for MAC address values and additional information, and in response to determining that stored download data includes the MAC address of an associated device but not the corresponding additional information, not transmit the download data.Methods, devices, and systems according to embodiments may include a request PDU including an association request. A wireless device may be a first AP compatible with at least one IEEE 802.11 wireless standard and may be configured to transmit a MAC probe request to a second AP comprising the MAC address of the request PDU in response to at least the MAC address of the request PDU matching the stored MAC address. In response to receiving a response of a first type from the second AP, transmit a response requesting retransmission of the association request at a later time. In response to receiving a response of a second type from the second AP and failing to match the MAC address of the request PDU with a stored MAC address, processing the association request.Methods, devices, and systems according to embodiments may include a second AP configured to determine, in response to receiving a probe request from a first AP, whether the MAC address of a request PDU received by the first AP matches the MAC address of any device associated with the second AP. In response to at least the MAC address of the request PDU matching a device associated with the second AP, transmitting the response of the first type to the first AP. In response to at least the MAC address of the request PDU not matching a device associated with the second AP, transmitting the response of the second type to the first AP.It should be understood that reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Therefore, it is emphasized and understood that two or more references to "one embodiment" or "an alternative embodiment" in various portions of this specification do not necessarily all refer to the same embodiment. Further, the respective features, structures, or characteristics may be combined as appropriate as in one or more embodiments of the invention.Likewise, it should be understood that in the foregoing description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in order to rationalize the disclosure while aiding in the understanding of one or more of the various inventive aspects. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claims require more features than are expressly recited in each claim. Rather, inventive aspects lie in less than all features of a single embodiment disclosed above. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.Although this invention has been described with reference to illustrative embodiments, this description is not intended to be construed in a limiting sense. Various modifications and combinations of the illustrative embodiments, as well as other embodiments of the invention, will become apparent to those skilled in the art upon reference to the specification. It is therefore intended that the appended claims extend to such modifications or embodiments.References included in the specificationThis list of documents cited by the applicant has been produced in an automated manner and is only included for the better information of the reader. The list is not part of the German patent application or utility model application. The DPMA does not take any adhesion for any faults or omissions.Patent Literature citedUS 63 / 543,399

[0001]

Claims

A method, comprising: by operation of a first wireless device: storing media access control (MAC) addresses for devices associated with a wireless network in first storage circuits of the first wireless device; receiving a wireless request protocol data unit (PDU) via wireless communication circuits; by operation of controller circuits of the first wireless device, determining whether the MAC address of the request PDU matches a stored MAC address; and in response to at least the MAC address of the request PDU matching a stored MAC address, ignoring the request PDU or not transmitting buffered data, which correspond to the matching MAC address of the request PDU.The method of claim 1, wherein the request PDU is compatible with at least one IEEE 802.11 wireless standard.The method of claim 1, further comprising: storing first additional information corresponding to each stored MAC address of each associated device; responsive to a disconnection of one of the associated devices, deleting the MAC address and first additional information corresponding to the disconnected device; through operation of the controller circuitry, determining a MAC address and second additional buffered data information for transmission from the first wireless device, and responsive to the second additional buffered data information not matching the first information corresponding to the matching MAC addresses, not transmitting buffered data, wherein the first and second additional information are fields corresponding to a network layer of a higher level than the MAC address.The method of claim 3, wherein: the first additional information includes a source port value of layer four; and the second additional information includes a destination port value of layer four.The method of claim 3, further comprising: maintaining a context for each associated device, each context comprising: a MAC address, first additional information, a timer, and a buffered data buffer location; and in response to a device disconnection, deleting the context for the disconnected device from the first memory circuits.The method of claim 1, further comprising: the request PDU including an association request; responsive to at least the MAC address of the request PDU matching a stored MAC address, returning a response to a device issuing the request PDU to retry the association at a later time, issuing a probe request having a destination MAC address corresponding to the matching MAC address responsive to receiving an acknowledgement of the probe request, ignoring further association requests for the matching MAC address, and responsive to not receiving an acknowledgement of the probe request, processing a future association request for the matching MAC address.The method of claim 1, further comprising, in response to the MAC address of the request PDU not matching any of the stored MAC addresses, processing the request PDU.The method of claim 1, further comprising: the first wireless device is part of a distributed system having at least one second wireless device, responsive to the MAC address of the request PDU matching any of the stored MAC addresses, transmitting a request to at least the second wireless device to check for other devices associated with the second wireless device having a MAC address matching that of the request PDU, and responsive to determining that one of the other associated devices has a matching MAC address, ignoring further association requests for the matching MAC address, and responsive to determining that none of the other associated devices has a matching MAC address, Processing future association requests for the matching MAC address.The method of claim 8, further comprising: by operating at least the second wireless device, storing MAC addresses for the other devices associated with the second wireless device, receiving the request to check for other devices associated with the second wireless device in response to the MAC address of the request PDU matching a MAC address of at least one of the other associated devices, returning a response to the first wireless device indicating that one of the other associated devices has a matching MAC address.An apparatus, comprising: storage circuitry configured to store at least media access control (MAC) addresses for associated devices; wireless circuitry configured to receive and transmit wireless messages according to at least one wireless standard, including receiving a request protocol data unit (PDU); Controller circuitry configured to: determine whether a MAC address of the request PDU matches the MAC address stored in the memory circuitry; and in response to at least the MAC address of the request PDU matching a stored MAC address, ignore the request PDU or not transmit buffered data having a destination of the matched MAC address.The apparatus of claim 10, wherein: the memory circuitry is further configured to store additional information corresponding to the MAC address of each associated device and comprises at least one buffer configured to store download data for transmission from the device; and the controller circuitry is further configured to: scan the download data in the at least one buffer for MAC address values and additional information, and in response to determining that stored download data comprises the MAC address of an associated device but does not comprise the corresponding additional information, not transmit the download data from the buffer.The apparatus of claim 11, wherein: the additional information corresponding to the MAC address of each associated device includes a source port address according to a layer four protocol; and the additional information for the download data includes a destination port address according to the layer four protocol.The apparatus of claim 10, wherein: the controller circuitry is configured to maintain a context for each associated device, the context for each associated device comprising: the MAC address for the associated device, at least one source port address, a timer, and an address for a buffer in the memory circuitry.The apparatus of claim 10, wherein: the controller circuitry is configured to delete the MAC address for the separated device from the memory circuitry in response to the disconnection of one of the associated devices.The apparatus of claim 10, wherein: the request PDU includes an association request; the controller circuitry is configured to: in response to the association request having a MAC address matching that of an associated device, generate an association response requesting that the association request be retransmitted at a later time, generate a message addressed to the associated device having the matching MAC address, and in response to receiving a response to the message from the associated device, ignore a subsequent association request having the matching MAC address; and the wireless circuitry is configured to transmit the association response and the message and receive the response to the message.The apparatus of claim 15, wherein: the controller circuitry is configured to: in response to the message being transmitted by the wireless circuitry, start a timer, and in response to the timer exceeding a predetermined value, indicate that a subsequent association request can be processed.A system, comprising: a wireless device configured to: receive and transmit wireless messages according to at least one wireless communication standard, including receiving a request protocol data unit (PDU); store at least media access control (MAC) addresses for devices associated with the wireless device; determine whether a MAC address of the request PDU matches the MAC address of an associated device, and in response to at least the MAC address of the request PDU matching a stored MAC address, ignore the request PDU or untransmit buffered data having a destination of the matched MAC address; and a first antenna system compatible with the at least one wireless communication standard.The system of claim 17, wherein: the wireless device is further configured to: store additional information corresponding to the MAC address of each associated device, and store download data for transmission from the wireless device, scan the download data for MAC address values and additional information, and in response to determining that stored download data comprises the MAC address of an associated device but does not comprise the corresponding additional information, not transmit the download data.The system of claim 17, further comprising: the request PDU comprises an association request; and the wireless device comprises a first access point device (AP) compatible with at least one IEEE 802.11 wireless standard, and is configured to: in response to at least the MAC address of the request PDU matching the stored MAC address, transmit a MAC probe request to a second AP, wherein the probe request comprises the MAC address of the request PDU, in response to receiving a response of a first type from the second AP, transmit a response requesting retransmission of the association request at a later time, and in response to receiving a response of a second type from the second AP and the MAC address of the request PDU not matching a stored MAC address, processing the association request.The system of claim 19, further comprising: the second AP configured to: in response to receiving the probe request, determine whether the MAC address of the request PDU matches the MAC address of another device associated with the second AP, in response to at least the MAC address of the request PDU matching another device associated with the second AP, transmit the response of the first type, and in response to at least the MAC address of the request PDU not matching a device associated with the second AP, transmit the response of the second type.

Images