AP MLD Link Control for Spoofed-Station Detection
Solution Overview
Problem
Existing WLAN systems face challenges in accurately distinguishing between legitimate and attacker stations due to the use of spoofed MAC addresses, leading to potential security breaches during association and reassociation processes.
Innovation Solution
The AP MLD employs a link control method that transmits a status code based on conditions related to affiliated Non-AP STAs and their associations with other APs, enabling accurate differentiation between legitimate and attacker stations by considering both MLD and STA level associations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the AP MLD uses MAC address for station identification during association, then the association process is simple and fast, but attackers can spoof MAC addresses to establish unauthorized associations
Solution Approach 1:
The patent segments the station identification process into two levels: MLD-level identification using MAC addresses for fast association, and STA-level identification using unique STA identifiers for security verification. This segmentation allows the system to maintain fast association at the MLD level while ensuring security through additional verification at the STA level, resolving the contradiction between association speed and security.
Solution Approach 2:
The patent implements preliminary action by having Non-AP STAs pre-configure unique STA identifiers that are distinct from their MAC addresses. These identifiers are prepared in advance and used during the association process to verify the legitimacy of each STA. This preliminary preparation enables the AP MLD to perform security verification without delaying the association process, thus maintaining both speed and security.
2Adaptability or versatility
If the AP MLD allows multiple Non-AP STAs to associate with different affiliated APs, then the network coverage and flexibility are improved, but the complexity of managing and securing multiple associations increases
Solution Approach 1:
The patent applies segmentation by separating the management of MLD-level associations from STA-level associations. Each affiliated AP manages STA-level associations independently using unique STA identifiers, while the AP MLD coordinates MLD-level associations. This segmentation reduces the complexity of managing multiple associations across different APs while maintaining network flexibility.
Solution Approach 2:
The patent implements feedback mechanisms where the AP MLD receives association status information from affiliated APs and uses this feedback to coordinate multi-link reconfiguration requests. This feedback loop enables the system to manage complex multi-AP associations efficiently by continuously monitoring and adjusting association states, thereby reducing management complexity while preserving adaptability.
3Reliability
If the AP MLD performs security verification for each association request, then security is improved, but the processing time and computational overhead increase
Solution Approach 1:
The patent uses preliminary action by pre-configuring unique STA identifiers that are easily verifiable. During association requests, the AP MLD performs quick verification by checking these pre-configured identifiers against the requesting STA's identifier. This preliminary preparation enables fast security verification without significant processing time or computational overhead, thus improving security while minimizing time loss.
Solution Approach 2:
The patent applies parameter changes by using unique STA identifiers as an alternative parameter for security verification instead of complex cryptographic checks. These identifiers are designed to be simple yet unique, allowing the AP MLD to perform security verification by comparing parameter values rather than executing computationally intensive algorithms, thereby reducing verification time while maintaining security.
Data Source
AI summary
A link control method and an AP MLD are provided. The method includes: when an AP MLD receives a multi-link reconfiguration request frame from a first Non-AP STA affiliated with a first Non-AP MLD through a first AP affiliated with the AP MLD and a first address of at least one second Non-AP STA among Non-AP STAs affiliated with the first Non-AP MLD satisfies a first condition and/or a second condition, the AP MLD transmits a first status code. The first condition is related to at least one third Non-AP STA among Non-AP STAs affiliated with a second Non-AP MLD associated with the AP MLD. The second condition is related to fourth Non-AP STA(s) associated with a second AP affiliated with the AP MLD.