Authenticated Encryption Wrapper Circuit for Wi-Fi Management Frames
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Wi-Fi protocol lacks a seamless mechanism to switch between data encryption and management frame protection modes, necessitating additional functionality for authenticated encryption algorithms to handle both data encryption and authentication, especially when replacing AES.
Innovation Solution
Implementing a circuit that functions in both data encryption and authentication mode, as well as authentication only mode, using an authentication control flag to manage operations and ensure compatibility with Wi-Fi protocol requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate authentication-only circuit is implemented, then management frame protection is ensured, but device complexity increases
Solution Approach 1:
The encryption circuit is designed to perform multiple functions: it can operate in data encryption mode for encrypted data transmission and in authentication mode for management frame protection. The circuit includes mode selection logic that switches between these functions based on the operating mode signal, eliminating the need for separate dedicated circuits for each function.
Solution Approach 2:
The patent combines the data encryption function and management frame authentication function into a single integrated encryption circuit. The circuit processes both encrypted data packets and management frames through the same encryption engine, using mode selection logic to determine the appropriate operation mode, thereby reducing overall device complexity while maintaining both security functions.
2Reliability
If AES is replaced with authenticated encryption algorithms, then replay and integrity protection is enhanced, but compatibility with existing Wi-Fi protocols requires additional functionality
Solution Approach 1:
The encryption circuit incorporates dynamic mode selection capability, allowing it to switch between data encryption mode and authentication mode based on the type of data being processed. The circuit responds to mode selection signals that determine whether to process encrypted data or management frames, providing adaptability to different protocol requirements while maintaining replay and integrity protection.
Solution Approach 2:
The authenticated encryption circuit is designed to support both data encryption and management frame authentication functions within a single algorithm framework. The circuit includes logic to handle both modes of operation, ensuring compatibility with existing Wi-Fi protocols while providing enhanced security features of authenticated encryption algorithms.
Data Source
AI summary
Authenticated encryption algorithms may function in both a data encryption and authentication operational mode as well as an authentication only operational mode. A first circuit may generate encrypted data and generate a first authentication tag. The first circuit may output for transmission as part of an MPDU, the first authentication tag and either the encrypted data or plaintext data based a control flag. A receiver device may receive the MPDU and a second encryption circuit of the receiver device may receive the first authentication tag and, based on a control flag, receive either the plaintext data or the encrypted data and from the MPDU and generate a second authentication tag by encrypting the plaintext data or decrypting the encrypted data depending on which is received. The second circuit may verify that management frames of the MPDU are valid/have not been tampered with if the first and second authentication tags match.