Access Point Frame Failure Counter for DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless local area networks (WLANs) face performance degradation and resource starvation due to denial of service (DoS) attacks, where malicious stations transmit block acknowledgment frames with invalid starting sequence numbers, causing access points to repeatedly retry frames and increase channel busy time, leading to reduced throughput and resource allocation issues for other stations.
Innovation Solution
Implementing a frame failure counter in access points to track invalid starting sequence number (SEN) frames, triggering deauthentication of malicious stations once a threshold is reached, and using block acknowledgment requests to differentiate between valid and invalid frames, thereby preventing continued DoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access points continuously retry transmitting frames to stations that send block acknowledgment frames with invalid starting sequence numbers, then the stations maintain connection to the network, but channel busy time increases and network throughput decreases
Solution Approach 1:
The patent implements a frame counter that preemptively counts block acknowledgment frames with invalid starting sequence numbers before the channel becomes completely saturated. When the counter reaches a threshold, the access point proactively disconnects the malicious station, preventing further degradation of channel busy time and network throughput while maintaining connection for legitimate stations
2Reliability
If access points retry frame transmissions repeatedly in response to invalid block acknowledgment frames, then connection reliability is maintained, but resource allocation for other stations deteriorates
Solution Approach 1:
The patent employs a feedback mechanism where the frame counter monitors incoming block acknowledgment frames and provides information about invalid SEN patterns. This feedback loop enables the access point to adjust its behavior by disconnecting stations that exhibit malicious patterns, thereby preserving network resources for legitimate stations while maintaining reliable transmission for those stations
3Ease of operation
If access points process and respond to every block acknowledgment frame, then protocol compliance is maintained, but processing overhead and channel busy time increase
Solution Approach 1:
The frame counter performs preliminary analysis of block acknowledgment frames by examining starting sequence numbers before full protocol processing occurs. This preliminary action identifies invalid patterns early, allowing the system to bypass extensive processing for malicious frames and quickly disconnect offending stations, thereby reducing channel busy time while maintaining protocol compliance for legitimate traffic
Data Source
AI summary
An apparatus may comprise a processing resource operatively coupled to a memory resource and a frame determination component operatively coupled to the processing resource and the memory resource. The frame determination component may cause a counter corresponding to a particular station associated to the apparatus to be stored in the memory resource, the counter to be incremented in response to receipt of a transmission frame containing an invalid starting sequence number (SEN) and a deauthentication frame to be transmitted in response to receipt of a threshold number of transmission frames containing the invalid.