Access Point DOS Detection via Probe Packet Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication networks are vulnerable to spurious de-authentication/disassociation frames, which can lead to Denial of Service (DOS) attacks, especially during the security association establishment process between access points and client devices, even with encryption standards like 802.11w, as attackers can spoof client addresses to generate invalid frames.
Innovation Solution
The method involves determining the state of security association establishment and sending a probe packet to client devices in non-Protected Management Frames (PMF) settings to differentiate between valid and spoofed de-authentication/disassociation frames, maintaining connections with responsive clients and terminating them with non-responsive ones, thereby detecting and mitigating DOS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the access point terminates connections upon receiving de-authentication/disassociation frames, then connection security is improved, but false termination of valid connections occurs due to spoofed frames
Solution Approach 1:
The system performs preliminary verification by checking the security association state before terminating connections. It determines whether a security association is established between the AP and client device, and only terminates connections when the security association is complete and verified, preventing false termination of valid connections while maintaining security against spoofed frames
Solution Approach 2:
The system sends probe packets to client devices as feedback verification before terminating connections. When a de-authentication/disassociation frame is received, the AP sends a probe packet to the client device to confirm its presence and legitimacy. If the client device responds, the connection is maintained; if no response is received, the connection is terminated, ensuring accurate verification of connection status
2Object-affected harmful factors
If the access point maintains all connections upon receiving de-authentication/disassociation frames, then false disconnections are prevented, but DOS attacks cannot be mitigated
Solution Approach 1:
The system uses probe packets as feedback mechanism to verify connection legitimacy. When a de-authentication/disassociation frame is received, the AP sends a probe packet to the client device. If the client device responds, indicating it is still active, the connection is maintained. If no response is received, suggesting the client has legitimately disconnected or is compromised, the connection is terminated. This feedback loop enables both prevention of false disconnections and mitigation of DOS attacks
Solution Approach 2:
The system performs preliminary verification through probe packets before making connection termination decisions. By checking the security association state and sending verification probe packets in advance, the system determines whether to maintain or terminate connections, enabling both false disconnection prevention and DOS attack mitigation through accurate verification
Data Source
AI summary
A method for processing a denial of service (DOS) includes: receiving a de-authentication/disassociation (D/D) frame by an access point (AP), determining by the AP a state of security association establishment between the AP and a client device, maintaining a connection between the AP and the client device if the security association is incomplete, sending a probe packet from the AP to the client device if security association is complete and the connection between the AP and the client device is in a non-PMF (protected management frames) setting, maintaining the connection if the client device responds to the probe packet, and terminating the connection if the client device does not respond to the probe packet.