Protection against mac header and control frame replay attack in wireless communications
Patent Information
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- MEDIATEK INC
- Filing Date
- 2024-08-09
- Publication Date
- 2026-06-17
AI Technical Summary
Current wireless communication systems lack effective protection mechanisms against MAC header and control frame replay attacks, which can compromise the integrity of data transmission.
The proposed solution involves using a partial timing synchronization function (TSF) timestamp as the value of the packet number (PN) for MAC header and control frame protection. This approach ensures that the recipient can determine whether the PN is incremented, thereby preventing replay attacks.
By utilizing a partial TSF timestamp as the PN, the system effectively prevents MAC header and control frame replay attacks, ensuring the reliability and security of wireless communication data transmission.
Smart Images

Figure CN2024111180_13022025_PF_FP_ABST
Abstract
Description
PROTECTION AGAINST MAC HEADER AND CONTROL FRAME REPLAY ATTACK IN WIRELESS COMMUNICATIONS
[0001] CROSS REFERENCE TO RELATED PATENT APPLICATION
[0002] The present disclosure is part of a non-provisional patent application claiming the priority benefit of U.S. Provisional Patent Application No. 63 / 518,570, filed 10 August 2023, the content of which being incorporated by reference in its entirety.TECHNICAL FIELD
[0003] The present disclosure is generally related to wireless communications and, more particularly, to protection against medium access control (MAC) header and control frame replay attacks in wireless communications.BACKGROUND
[0004] Unless otherwise indicated herein, approaches described in this section are not prior art to the claims listed below and are not admitted as prior art by inclusion in this section.
[0005] In wireless communications, such as Wi-Fi (or WiFi) and wireless local area networks (WLANs) in accordance with one or more Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards, protection against MAC header replay attacks may involve MAC header integrity check and / or MAC header replay detection. A packet number (PN) is typically utilized in the replay detection of a MAC protocol data unit (MPDU) . Specifically, the PN is incremented by a positive number (e.g., 1) for each MPDU. That is, the PN is incremented in steps of 1 for constituent MPDUs of fragmented MAC session data units (MSDUs) , aggregated MSDUs (A-MSDUs) and MAC management protocol data units (MMPDUs) . For protocol version 0 (PV0) MPDUs, the PN is not to be repeated for a series of encrypted MPDUs using the same temporal key. For the same temporal key, the PN is incremented by a positive number (e.g., 1) for all transmitted MPDUs, and the PN used for the MAC header protection is not repeated for another MAC header protection. However, it is possible that a recipient might not be able to determine whether or not a PN is incremented. Therefore, there is a need for a solution of a protection mechanism against MAC header and control frame replay attacks in wireless communications.SUMMARY
[0006] The following summary is illustrative only and is not intended to be limiting in any way. That is, the following summary is provided to introduce concepts, highlights, benefits and advantages of the novel and non-obvious techniques described herein. Select implementations are further described below in the detailed description. Thus, the following summary is not intended to identify essential features of the claimed subject matter, nor is it intended for use in determining the scope of the claimed subject matter.
[0007] An objective of the present disclosure is to provide schemes, concepts, designs, techniques, methods and apparatuses pertaining to a protection mechanism against MAC header and control frame replay attacks in wireless communications. It is believed that implementations of the proposed schemes may address or otherwise alleviate aforementioned issues.
[0008] In one aspect, a method may involve a sender generating a frame containing a PN with a value being set to a timing value. The method may also involve the sender transmitting the frame.
[0009] In another aspect, a method may involve a recipient receiving a frame containing a PN with a value being set to a timing value. The method may also involve the recipient transmitting an acknowledgement (ACK) responsive to receiving the frame.
[0010] In yet another aspect, an apparatus may include a transceiver configured to communicate wirelessly and a processor coupled to the transceiver. The processor may generate a frame containing a PN with a value being set to a timing value. The processor may also transmit the frame.
[0011] It is noteworthy that, although description provided herein may be in the context of certain radio access technologies, networks and network topologies such as, Wi-Fi, the proposed concepts, schemes and any variation (s) / derivative (s) thereof may be implemented in, for and by other types of radio access technologies, networks and network topologies such as, for example and without limitation, Bluetooth, ZigBee, 5th Generation (5G) / New Radio (NR) , Long-Term Evolution (LTE) , LTE-Advanced, LTE-Advanced Pro, Internet-of-Things (IoT) , Industrial IoT (IIoT) and narrowband IoT (NB-IoT) . Thus, the scope of the present disclosure is not limited to the examples described herein.BRIEF DESCRIPTION OF THE DRAWINGS
[0012] The accompanying drawings are included to provide a further understanding of the disclosure and are incorporated in and constitute a part of the present disclosure. The drawings illustrate implementations of the disclosure and, together with the description, serve to explain the principles of the disclosure. It is appreciable that the drawings are not necessarily in scale as some components may be shown to be out of proportion than the size in actual implementation to clearly illustrate the concept of the present disclosure.
[0013] FIG. 1 is a diagram of an example network environment in which various solutions and schemes in accordance with the present disclosure may be implemented.
[0014] FIG. 2 is a diagram of an example scenario in accordance with the present disclosure.
[0015] FIG. 3 is a diagram of an example scenario under a proposed scheme in accordance with the present disclosure.
[0016] FIG. 4 is a block diagram of an example communication system under a proposed scheme in accordance with the present disclosure.
[0017] FIG. 5 is a flowchart of an example process under a proposed scheme in accordance with the present disclosure.
[0018] FIG. 6 is a flowchart of an example process under a proposed scheme in accordance with the present disclosure.
[0019] DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
[0020] Detailed embodiments and implementations of the claimed subject matters are disclosed herein. However, it shall be understood that the disclosed embodiments and implementations are merely illustrative of the claimed subject matters which may be embodied in various forms. The present disclosure may, however, be embodied in many different forms and should not be construed as limited to the exemplary embodiments and implementations set forth herein. Rather, these exemplary embodiments and implementations are provided so that description of the present disclosure is thorough and complete and will fully convey the scope of the present disclosure to those skilled in the art. In the description below, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the presented embodiments and implementations.
[0021] Overview
[0022] Implementations in accordance with the present disclosure relate to various techniques, methods, schemes and / or solutions pertaining to protection mechanism against MAC header and control frame replay attacks in wireless communications. According to the present disclosure, a number of possible solutions may be implemented separately or jointly. That is, although these possible solutions may be described below separately, two or more of these possible solutions may be implemented in one combination or another.
[0023] FIG. 1 illustrates an example network environment 100 in which various solutions and schemes in accordance with the present disclosure may be implemented. FIG. 2 ~ FIG. 6 illustrate examples of implementation of various proposed schemes in network environment 100 in accordance with the present disclosure. The following description of various proposed schemes is provided with reference to FIG. 1 ~ FIG. 6.
[0024] Referring to FIG. 1, network environment 100 may involve at least a communication entity 110 communicating wirelessly with a communication entity 120. Either of communication entity 110 and communication entity 120 may function as an access point (AP) station (STA) or, alternatively, a non-AP STA. In some cases, communication entity 110 (herein interchangeably referred to as “STA 110” ) and communication entity 120 (herein interchangeably referred to as “STA 120” ) may be associated with a basic service set (BSS) in accordance with one or more IEEE 802.11 standards (e.g., IEEE 802.11be and / or future-developed standards such as IEEE 802.11bn) . Each of communication entity 110 and communication entity 120 may be configured to communicate with each other by utilizing the protection mechanism against MAC header and control frame replay attacks in accordance with various proposed schemes described below. That is, either or both of communication entity 110 and communication entity 120 may function as a “user” in the proposed schemes and examples described below. It is noteworthy that, while the various proposed schemes may be individually or separately described below, in actual implementations some or all of the proposed schemes may be utilized or otherwise implemented jointly. Of course, each of the proposed schemes may be utilized or otherwise implemented individually or separately.
[0025] FIG. 2 illustrates an example scenario 200 of a mechanism for protection against MAC header replay attacks. In scenario 200, for the same temporal key, the PN is incremented by a positive number (e.g., 1) for all transmitted MPDUs. The PN used for the MAC header protection is not to be repeated for another MAC header protection. Referring to FIG. 2, a sender (e.g., STA 110) may initially transmit an MPDU with the MAC header (of data and management frames) containing certain information. For instance, the information may indicate the power management mode (PM) , sequence number (SEQ) and PN (e.g., PM = 1, SEQU = 1, and PN = 1) . The encrypted MSDU of the MPDU may contain another PN (e.g., PN = 10) which is unrelated to the PN contained in the MAC header. When no acknowledgement (ACK) is received from the intended recipient (e.g., STA 120) by the sender, the sender may transmit another MPDU with the PN in the MAC header incremented by 1 (e.g., PN = 2) while the PM this time may be set to another value (e.g., PM = 0) different than that contained in the initial MAC header. In case of a replay attack, the attacker may change the power management mode of the victim STA (e.g., STA 120) by choosing one of the sets of information indicated in the MAC headers of the multiple MPDUs transmitted by the sender (e.g., [PM = 1, SEQ = 1, PN = 1] or [PM = 0, SEQ = 1, PN =2] ) .
[0026] FIG. 3 illustrates an example scenario 300 under a proposed scheme of protection against MAC header and control frame replay attacks in accordance with the present disclosure. Under the proposed scheme, a partial timing synchronization function (TSF) timestamp may be utilized as the value of PN for protection against MAC header and control frame replay attacks. For the same temporal key, the recipient may be capable to determine whether the PN is incremented, and the recipient does not repeat with that of another MAC header protection.
[0027] Referring to FIG. 3, a sender (e.g., STA 110) may initially transmit an MPDU with the MAC header (of data and management frames) containing certain information, which may indicate the PM, SEQ and PN (e.g., PM = 1, SEQU = 1, and PN = TSF1) . The encrypted MSDU of the MPDU may contain another PN (e.g., PN = 10) which is unrelated to the PN contained in the MAC header. When no ACK is received from the intended recipient (e.g., STA 120) by the sender, the sender may transmit another MPDU with the PN in the MAC header set to another TSF timestamp value (e.g., PN = TSF2) while the PM this time may be set to another value (e.g., PM = 0) different than that contained in the initial MAC header. In case of a replay attack, the attacker may not be able to generate the valid message integrity code (MIC) with the PN equal to yet another TSF timestamp value (e.g., PN = TSF3) . As such, the replay attack may be effectively avoided or otherwise thwarted.
[0028] It is noteworthy that, although issues and examples described herein may be in the context of MAC headers, control frames may also have a similar replay attack issue. Accordingly, under the proposed scheme, a partial TSF timestamp may also be used as the PN for control frame protection against replay attacks, in addition to MAC header protection of data and management frames.
[0029] Illustrative Implementations
[0030] FIG. 4 illustrates an example system 400 having at least an example apparatus 410 and an example apparatus 420 in accordance with an implementation of the present disclosure. Each of apparatus 410 and apparatus 420 may perform various functions to implement schemes, techniques, processes and methods described herein pertaining to a protection mechanism against MAC header and control frame replay attacks in wireless communications, including the various schemes described above with respect to various proposed designs, concepts, schemes, systems and methods described above as well as processes described below. For instance, apparatus 410 may be an example implementation of a sender (e.g., STA 110) , and apparatus 420 may be an example implementation of a recipient (e.g., STA 120) .
[0031] Each of apparatus 410 and apparatus 420 may be a part of an electronic apparatus, which may be a STA or an AP, such as a portable or mobile apparatus, a wearable apparatus, a wireless communication apparatus or a computing apparatus. For instance, each of apparatus 410 and apparatus 420 may be implemented in a smartphone, a smart watch, a personal digital assistant, a digital camera, or a computing equipment such as a tablet computer, a laptop computer or a notebook computer. Each of apparatus 410 and apparatus 420 may also be a part of a machine type apparatus, which may be an IoT apparatus such as an immobile or a stationary apparatus, a home apparatus, a wire communication apparatus or a computing apparatus. For instance, each of apparatus 410 and apparatus 420 may be implemented in a smart thermostat, a smart fridge, a smart door lock, a wireless speaker or a home control center. When implemented in or as a network apparatus, apparatus 410 and / or apparatus 420 may be implemented in a network node, such as an AP in a WLAN.
[0032] In some implementations, each of apparatus 410 and apparatus 420 may be implemented in the form of one or more integrated-circuit (IC) chips such as, for example and without limitation, one or more single-core processors, one or more multi-core processors, one or more reduced-instruction set computing (RISC) processors, or one or more complex-instruction-set-computing (CISC) processors. In the various schemes described above, each of apparatus 410 and apparatus 420 may be implemented in or as a STA or an AP. Each of apparatus 410 and apparatus 420 may include at least some of those components shown in FIG. 4 such as a processor 412 and a processor 422, respectively, for example. Each of apparatus 410 and apparatus 420 may further include one or more other components not pertinent to the proposed scheme of the present disclosure (e.g., internal power supply, display device and / or user interface device) , and, thus, such component (s) of apparatus 410 and apparatus 420 are neither shown in FIG. 4 nor described below in the interest of simplicity and brevity.
[0033] In one aspect, each of processor 412 and processor 422 may be implemented in the form of one or more single-core processors, one or more multi-core processors, one or more RISC processors or one or more CISC processors. That is, even though a singular term “aprocessor” is used herein to refer to processor 412 and processor 422, each of processor 412 and processor 422 may include multiple processors in some implementations and a single processor in other implementations in accordance with the present disclosure. In another aspect, each of processor 412 and processor 422 may be implemented in the form of hardware (and, optionally, firmware) with electronic components including, for example and without limitation, one or more transistors, one or more diodes, one or more capacitors, one or more resistors, one or more inductors, one or more memristors and / or one or more varactors that are configured and arranged to achieve specific purposes in accordance with the present disclosure. In other words, in at least some implementations, each of processor 412 and processor 422 is a special-purpose machine specifically designed, arranged and configured to perform specific tasks including those pertaining to a protection mechanism against MAC header and control frame replay attacks in wireless communications in accordance with various implementations of the present disclosure. For instance, each of processor 412 and processor 422 may be configured with hardware components, or circuitry, implementing one, some or all of the examples described and illustrated herein.
[0034] In some implementations, apparatus 410 may also include a transceiver 416 coupled to processor 412. Transceiver 416 may be capable of wirelessly transmitting and receiving data. In some implementations, apparatus 420 may also include a transceiver 426 coupled to processor 422. Transceiver 426 may include a transceiver capable of wirelessly transmitting and receiving data.
[0035] In some implementations, apparatus 410 may further include a memory 414 coupled to processor 412 and capable of being accessed by processor 412 and storing data therein. In some implementations, apparatus 420 may further include a memory 424 coupled to processor 422 and capable of being accessed by processor 422 and storing data therein. Each of memory 414 and memory 424 may include a type of random-access memory (RAM) such as dynamic RAM (DRAM) , static RAM (SRAM) , thyristor RAM (T-RAM) and / or zero-capacitor RAM (Z-RAM) . Alternatively, or additionally, each of memory 414 and memory 424 may include a type of read-only memory (ROM) such as mask ROM, programmable ROM (PROM) , erasable programmable ROM (EPROM) and / or electrically erasable programmable ROM (EEPROM) . Alternatively, or additionally, each of memory 414 and memory 424 may include a type of non-volatile random-access memory (NVRAM) such as flash memory, solid-state memory, ferroelectric RAM (FeRAM) , magnetoresistive RAM (MRAM) and / or phase-change memory.
[0036] Each of apparatus 410 and apparatus 420 may be a communication entity capable of communicating with each other using various proposed schemes in accordance with the present disclosure. For illustrative purposes and without limitation, a description of capabilities of apparatus 410, as a sender (e.g., STA 110) , and apparatus 420, as a recipient (e.g., STA 120) , is provided below in the context of example processes 500 and 600. It is noteworthy that, although the example implementations described below are provided in the context of WLAN, the same may be implemented in other types of networks. Thus, although the following description of example implementations pertains to a scenario in which apparatus 410 functions as a transmitting device and apparatus 420 functions as a receiving device, the same is also applicable to another scenario in which apparatus 410 functions as a receiving device and apparatus 420 functions as a transmitting device.
[0037] Illustrative Processes
[0038] FIG. 5 illustrates an example process 500 in accordance with an implementation of the present disclosure. Process 500 may represent an aspect of implementing various proposed designs, concepts, schemes, systems and methods described above. More specifically, process 500 may represent an aspect of the proposed concepts and schemes pertaining to a protection mechanism against MAC header and control frame replay attacks in wireless communications in accordance with the present disclosure. Process 500 may include one or more operations, actions, or functions as illustrated by one or more of blocks 510 and 520. Although illustrated as discrete blocks, various blocks of process 500 may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation. Moreover, the blocks / sub-blocks of process 500 may be executed in the order shown in FIG. 5 or, alternatively, in a different order. Furthermore, one or more of the blocks / sub-blocks of process 500 may be executed repeatedly or iteratively. Process 500 may be implemented by or in apparatus 410 and apparatus 420 as well as any variations thereof. Solely for illustrative purposes and without limiting the scope, process 500 is described below in the context of apparatus 410 as a sender (e.g., STA 110) and apparatus 420 as a recipient (e.g., STA 120) of a wireless network in accordance with one or more of IEEE 802.11 standards. Process 500 may begin at block 510.
[0039] At 510, process 500 may involve processor 412 of apparatus 410 generating a frame containing a PN with a value being set to a timing value. Process 500 may proceed from 510 to 520.
[0040] At 520, process 500 may involve processor 412 transmitting, via transceiver 416, the frame (e.g., to apparatus 420 as an intended recipient) .
[0041] In some implementations, in response to not receiving an ACK from the intended recipient of the frame, process 500 may involve processor 412 performing additional operations. For instance, process 500 may involve processor 412 generating a second frame containing another PN with a value being set to a different timing value. Moreover, process 500 may involve processor 412 transmitting, via transceiver 416, the second frame (e.g., to apparatus 420 as the intended recipient) .
[0042] In some implementations, the timing value may include a value of a partial TSF timestamp.
[0043] In some implementations, in generating the frame, process 500 may involve processor 412 generating a MAC header of a data frame or management frame. Alternatively, or additionally, in generating the frame, process 500 may involve processor 412 generating a control frame.
[0044] FIG. 6 illustrates an example process 600 in accordance with an implementation of the present disclosure. Process 600 may represent an aspect of implementing various proposed designs, concepts, schemes, systems and methods described above. More specifically, process 600 may represent an aspect of the proposed concepts and schemes pertaining to a protection mechanism against MAC header and control frame replay attacks in wireless communications in accordance with the present disclosure. Process 600 may include one or more operations, actions, or functions as illustrated by one or more of blocks 610 and 620. Although illustrated as discrete blocks, various blocks of process 600 may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation. Moreover, the blocks / sub-blocks of process 600 may be executed in the order shown in FIG. 6 or, alternatively, in a different order. Furthermore, one or more of the blocks / sub-blocks of process 600 may be executed repeatedly or iteratively. Process 600 may be implemented by or in apparatus 410 and apparatus 420 as well as any variations thereof. Solely for illustrative purposes and without limiting the scope, process 600 is described below in the context of apparatus 410 as a sender (e.g., STA 110) and apparatus 420 as a recipient (e.g., STA 120) of a wireless network in accordance with one or more of IEEE 802.11 standards. Process 600 may begin at block 610.
[0045] At 610, process 600 may involve processor 422 of apparatus 420 receiving, via transceiver 426, a frame (e.g., from apparatus 410 as a sender) containing a PN with a value being set to a timing value. Process 600 may proceed from 610 to 620.
[0046] At 620, process 600 may involve processor 422, responsive to receiving the frame, transmitting, via transceiver 426, an ACK (e.g., to apparatus 410) .
[0047] In some implementations, process 600 may involve processor 422 performing additional operations. For instance, process 600 may involve processor 422 receiving, via transceiver 426, a second frame containing another PN with a value being set to a different timing value. Furthermore, process 600 may involve processor 422 transmitting, via transceiver 426, another ACK in response to receiving the second frame.
[0048] In some implementations, the timing value may include a value of a partial TSF timestamp.
[0049] In some implementations, in receiving the frame, process 600 may involve processor 422 receiving a MAC header of a data frame or management frame. Alternatively, or additionally, in receiving the frame, process 600 may involve processor 422 receiving a control frame.
[0050] Additional Notes
[0051] The herein-described subject matter sometimes illustrates different components contained within, or connected with, different other components. It is to be understood that such depicted architectures are merely examples, and that in fact many other architectures can be implemented which achieve the same functionality. In a conceptual sense, any arrangement of components to achieve the same functionality is effectively "associated" such that the desired functionality is achieved. Hence, any two components herein combined to achieve a particular functionality can be seen as "associated with" each other such that the desired functionality is achieved, irrespective of architectures or intermedial components. Likewise, any two components so associated can also be viewed as being "operably connected" , or "operably coupled" , to each other to achieve the desired functionality, and any two components capable of being so associated can also be viewed as being "operably couplable" , to each other to achieve the desired functionality. Specific examples of operably couplable include but are not limited to physically mateable and / or physically interacting components and / or wirelessly interactable and / or wirelessly interacting components and / or logically interacting and / or logically interactable components.
[0052] Further, with respect to the use of substantially any plural and / or singular terms herein, those having skill in the art can translate from the plural to the singular and / or from the singular to the plural as is appropriate to the context and / or application. The various singular / plural permutations may be expressly set forth herein for sake of clarity.
[0053] Moreover, it will be understood by those skilled in the art that, in general, terms used herein, and especially in the appended claims, e.g., bodies of the appended claims, are generally intended as “open” terms, e.g., the term “including” should be interpreted as “including but not limited to, ” the term “having” should be interpreted as “having at least, ” the term “includes” should be interpreted as “includes but is not limited to, ” etc. It will be further understood by those within the art that if a specific number of an introduced claim recitation is intended, such an intent will be explicitly recited in the claim, and in the absence of such recitation no such intent is present. For example, as an aid to understanding, the following appended claims may contain usage of the introductory phrases "at least one" and "one or more" to introduce claim recitations. However, the use of such phrases should not be construed to imply that the introduction of a claim recitation by the indefinite articles "a" or "an" limits any particular claim containing such introduced claim recitation to implementations containing only one such recitation, even when the same claim includes the introductory phrases "one or more" or "at least one" and indefinite articles such as "a" or "an, " e.g., “a” and / or “an” should be interpreted to mean “at least one” or “one or more; ” the same holds true for the use of definite articles used to introduce claim recitations. In addition, even if a specific number of an introduced claim recitation is explicitly recited, those skilled in the art will recognize that such recitation should be interpreted to mean at least the recited number, e.g., the bare recitation of "two recitations, " without other modifiers, means at least two recitations, or two or more recitations. Furthermore, in those instances where a convention analogous to “at least one of A, B, and C, etc. ” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention, e.g., “a system having at least one of A, B, and C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc. In those instances where a convention analogous to “at least one of A, B, or C, etc. ” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention, e.g., “a system having at least one of A, B, or C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc. It will be further understood by those within the art that virtually any disjunctive word and / or phrase presenting two or more alternative terms, whether in the description, claims, or drawings, should be understood to contemplate the possibilities of including one of the terms, either of the terms, or both terms. For example, the phrase “A or B” will be understood to include the possibilities of “A” or “B” or “A and B. ”
[0054] From the foregoing, it will be appreciated that various implementations of the present disclosure have been described herein for purposes of illustration, and that various modifications may be made without departing from the scope and spirit of the present disclosure. Accordingly, the various implementations disclosed herein are not intended to be limiting, with the true scope and spirit being indicated by the following claims.
Claims
1.A method, comprising:generating, by a processor of an apparatus, a frame containing a packet number (PN) with a value being set to a timing value; andtransmitting, by the processor, the frame.2.The method of Claim 1, further comprising, responsive to not receiving an acknowledgement (ACK) from an intended recipient of the frame:generating, by the processor, a second frame containing another PN with a value being set to a different timing value; andtransmitting, by the processor, the second frame.3.The method of Claim 1, wherein the timing value comprises a value of a partial timing synchronization function (TSF) timestamp.4.The method of Claim 1, wherein the generating of the frame comprises generating a medium access control (MAC) header of a data frame or management frame.5.The method of Claim 1, wherein the generating of the frame comprises generating a control frame.6.A method, comprising:receiving, by a processor of an apparatus, a frame containing a packet number (PN) with a value being set to a timing value; andtransmitting, by the processor, an acknowledgement (ACK) responsive to receiving the frame.7.The method of Claim 6, further comprising:receiving, by the processor, a second frame containing another PN with a value being set to a different timing value; andtransmitting, by the processor, another ACK responsive to receiving the second frame.8.The method of Claim 6, wherein the timing value comprises a value of a partial timing synchronization function (TSF) timestamp.9.The method of Claim 6, wherein the receiving of the frame comprises receiving a medium access control (MAC) header of a data frame or management frame.10.The method of Claim 6, wherein the receiving of the frame comprises receiving a control frame.11.An apparatus implementable in a sharing access point (AP) of a multi-AP system, comprising:a transceiver configured to transmit and receive wirelessly; anda processor coupled to the transceiver and configured to perform operations comprising:generating a frame containing a packet number (PN) with a value being set to a timing value; andtransmitting, via the transceiver, the frame.12.The apparatus of Claim 11, wherein, responsive to not receiving an acknowledgement (ACK) from an intended recipient of the frame, the processor is further configured to perform operations comprising:generating a second frame containing another PN with a value being set to a different timing value; andtransmitting, via the transceiver, the second frame.13.The apparatus of Claim 11, wherein the timing value comprises a value of a partial timing synchronization function (TSF) timestamp.14.The apparatus of Claim 11, wherein the generating of the frame comprises generating a medium access control (MAC) header of a data frame or management frame.15.The apparatus of Claim 11, wherein the generating of the frame comprises generating a control frame.