Securing LTF Sequence Generation via Encrypted Management Frames
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IEEE 802.11 Fine Timing Measurement (FTM) protocols lack security protection against spoofing attacks, particularly in the generation and transmission of long training field (LTF) sequences, as they do not incorporate message integrity checks (MIC) in null data packet announcements (NDPA) and trigger frames, leading to potential format changes and increased system complexity.
Innovation Solution
The implementation of a protected management frames (PMF) scheme that encrypts location management report (LMR) frames and initial FTM frames, using counter mode cipher block chaining message authentication code protocol (CCMP) to securely generate and transmit LTF sequences by including measurement identifiers and initialization vectors, ensuring both parties use the same sequence and preventing exposure to eavesdroppers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an MIC code is attached to the NDPA or trigger frame to protect the sounding signal format, then security against spoofing attacks is improved, but the format of the NDPA or trigger frame changes and device complexity increases
Solution Approach 1:
The patent divides the protection mechanism into separate components: the sounding signal indication (SSI) is extracted and transmitted independently in a dedicated field within the NDPA or trigger frame, while the actual sounding signal is transmitted separately. This segmentation allows the indication to be protected without requiring MIC attachment to the entire frame structure, thus improving security while maintaining format simplicity.
Solution Approach 2:
The patent introduces an intermediary mechanism where the sounding signal indication serves as a separate entity that references the actual sounding signal. By protecting the indication (which points to the sounding signal format) rather than embedding MIC directly in the frame, the system achieves security protection without modifying the fundamental frame format, reducing the complexity increase that would result from direct MIC attachment.
2Reliability
If encryption is implemented for LTF sequence generation to prevent spoofing, then security is improved, but critical path constraints during decryption increase and system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-generating and pre-transmitting the sounding signal indication (SSI) in the NDPA or trigger frame before the actual sounding signal transmission. The receiving device can prepare for decryption and validation in advance by receiving and processing the SSI beforehand, which reduces the critical path duration during the actual decryption process by eliminating last-minute computation delays.
Solution Approach 2:
The patent extracts the essential security-critical information (sounding signal indication) from the main data flow and handles it separately. By taking out the SSI and transmitting it independently with its own protection mechanism, the system allows the main sounding signal transmission to proceed without being blocked by complex decryption operations, thus reducing critical path constraints while maintaining security.
Data Source
AI summary
The disclosure provides some embodiments for securing long training field (LTF) sequence. A responding station (RSTA) configures a location management report (LMR) frame. The LMR frame is configured to include an LMR in respect of a previous measurement, and data to be used to generate a null data packet (NDP) for a current measurement that is to be performed following the previous measurement. The RSTA further encrypts the LMR frame using protected management frames (PMF) scheme, and transmits the encrypted LMR frame to an initiating station (ISTA) for generating an LTF sequence for the current measurement. In response to receiving an NDP announcement (NDPA) and an NDP for the current measurement from the ISTA, the RSTA generates an NDP for the current measurement based on the NDPA and the data using CCMP, and transmits the NDP to the ISTA.