Wireless Intrusion Prevention Using OUI Checks for Random MAC Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless networks face challenges in reliably blocking harmful wireless traffic, particularly from stations with random MAC addresses, which can lead to unauthorized access and network intrusion.
Innovation Solution
A wireless intrusion prevention system (WIPS) that monitors wireless frames, compares MAC addresses with Organizationally Unique Identifiers (OUIs), and controls access based on blocking policies to block stations with random MAC addresses while allowing access to those with unique or registered MAC addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MAC address filtering is used to block unauthorized stations, then network security is improved, but stations with random MAC addresses cannot be reliably identified and blocked
Solution Approach 1:
The patent segments the MAC address into two parts: the OUI (Organizationally Unique Identifier) portion and the device-specific portion. By comparing only the OUI portion against a database of registered OUIs, the system can identify whether a station is authorized without being affected by randomization in the device-specific portion of the MAC address.
Solution Approach 2:
The patent introduces an OUI database as an intermediary component between the MAC address filtering mechanism and the authorization verification process. This database stores registered OUIs and serves as a reference for determining whether a station is authorized, enabling reliable identification despite MAC address randomization.
2Reliability
If all MAC addresses are blocked by default, then network security is improved, but legitimate stations with unique MAC addresses are also blocked
Solution Approach 1:
Instead of blocking all MAC addresses by default and allowing only whitelisted ones, the patent inverts the approach by blocking all OUIs by default and allowing only registered OUIs. This inversion maintains security while simplifying the management of legitimate stations, as their OUIs can be registered once and then automatically recognized.
3Measurement precision
If MAC address comparison is performed for each access request, then authorization accuracy is improved, but processing time increases
Solution Approach 1:
The patent extracts only the OUI portion (first 24 bits) from the complete MAC address for comparison purposes. This extraction reduces the amount of data that needs to be processed and compared against the database, significantly reducing processing time while maintaining authorization accuracy since the OUI uniquely identifies the manufacturer or organization.
Data Source
AI summary
The present disclosure relates to an electronic device, and a wireless intrusion prevention system according to the present disclosure may include a sensing device and a controller. The sensing device may be configured to monitor a wireless frame transmitted/received between an access point (AP) and a plurality of stations over a wireless network and generate frame analysis information based on the wireless frame. The controller may be configured to compare manufacturer identification information including Organizationally Unique Identifiers (OUIs) with Media Access Control (MAC) addresses of respective stations included in the frame analysis information, determine a target station having a random MAC address among the plurality of stations based on a result of the comparison, and control access to the access point by the target station based on a blocking policy.