Multi-Link Group Frame Replay Protection for Dozing MLDs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless protocols for Multiple-Link Devices (MLDs) are vulnerable to replay attacks, especially when protected by Group Temporal Keys (GTK) or Robust Security Network Elements (RSNE), and face issues with Target Beacon Transmission Time (TBTT) information and Quiet Channel elements, leading to security breaches and network inefficiencies.
Innovation Solution
Implementing enhanced protocols for MLDs that include synchronized packet identifier updates across multiple links, triggered TXOP sharing, and using reference time stamps for association/reassociation requests to enhance security and network utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If a non-AP MLD enters dozing state on a specific link to save energy, then energy consumption is reduced, but the device cannot receive group addressed/broadcast frames on that link and becomes vulnerable to replay attacks
Solution Approach 1:
The AP MLD performs preliminary actions by sending signaling messages containing packet identifiers (PN, IPN, or BIPN) of group addressed/broadcast frames before the non-AP MLD enters dozing state or switches links. This allows the non-AP MLD to obtain advance information about frame identifiers that will be transmitted on other links, enabling it to verify frame freshness and detect replay attacks even when not actively monitoring those links.
2Reliability
If the non-AP MLD monitors all links continuously to maintain security, then security against replay attacks is maintained, but energy consumption increases
Solution Approach 1:
The AP MLD acts as an intermediary by collecting and forwarding packet identifier information from multiple links through signaling messages. Instead of requiring the non-AP MLD to actively monitor all links simultaneously, the AP MLD mediates the information flow by advertising PN/IPN/BIPN values on monitored links, allowing the non-AP MLD to maintain security with reduced monitoring activity and lower energy consumption.
3Reliability
If the AP MLD sends signaling messages advertising packet identifiers on multiple links, then replay attack protection is enhanced, but protocol complexity increases
Solution Approach 1:
The signaling message mechanism serves multiple functions simultaneously: it advertises packet identifiers for replay protection, provides synchronization information for link switching, and enables the non-AP MLD to update its replay counters. This multi-functionality reduces the need for separate dedicated mechanisms, thereby limiting the increase in protocol complexity while achieving enhanced replay attack protection across multiple links.
Data Source
AI summary
Enhanced wireless protocols are described for stations (STAs) which are associated with Multiple-Link Devices (MLD). One embodiment describes overcoming replay attacks (with or without a modified Sequence Number (SN) even when protected by a Group Temporal Key (GTK) or similar. Other embodiments describe MLP operating enhancements associated with utilizing a Robust Security Network Element (RSNE), or NSTR Mobile AP MLD, or Target Beacon Transmission Time (TBTT) Information fields with Reduced Neighbor Reports (RNR), or Quiet Channel elements in an Association/Reassociation, or that use PPDU end alignment are all subject to specific shortcomings when applied to MLDs.