PPDU Control Frame Protection Against Forgery and Replay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems lack effective methods to protect control frames from attacks, particularly those that impersonate access points to occupy air interfaces and consume power, necessitating a solution to carry protection information within control frames.
Innovation Solution
The implementation of a physical layer protocol data unit (PPDU) that includes control frames with user information fields carrying protection information, such as key identifiers, packet numbers, and message integrity codes, allowing devices to identify and verify the authenticity of control frames.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control frame protection information is carried in the control frame, then control frame security against attacks is improved, but device complexity increases
Solution Approach 1:
The control frame is segmented into multiple user information fields, with specific fields (indicated by association identifier) carrying protection information such as MIC and PN while other fields carry normal user data. This segmentation allows protection functionality to be integrated without requiring complete redesign of the control frame structure.
Solution Approach 2:
Existing user information fields in the control frame are made multi-functional by using the association identifier to indicate whether a field carries protection information or normal user information. This allows the same field structure to serve dual purposes, reducing the need for additional dedicated protection fields and minimizing complexity increase.
2Reliability
If protection information is added to control frames, then reliability against forgery attacks is improved, but transmission overhead increases
Solution Approach 1:
Protection information (MIC, PN, key identifier) is merged into existing user information fields of the control frame rather than being transmitted as separate dedicated fields. By reusing the association identifier field to indicate protection information presence, the patent combines protection functionality with existing data structures, thereby reducing additional transmission overhead.
3Reliability
If control frame protection mechanism is implemented, then resistance to replay attacks is improved, but processing complexity increases
Solution Approach 1:
The packet number (PN) field is used as a preliminary countermeasure against replay attacks. By sequentially numbering packets and comparing received PN values against expected values, the system can preemptively identify and reject replayed packets before they cause harm, simplifying the overall attack prevention mechanism.
Solution Approach 2:
The verification process provides feedback by comparing received protection information (MIC, PN) against locally generated values. This feedback mechanism enables receiving devices to automatically authenticate control frames and reject forged or replayed frames without complex manual intervention, maintaining processing efficiency.
Data Source
AI summary
This application provides a communication method and a communication apparatus. This application may be applied to a wireless local area network system that supports 802.11 series protocols, for example, a next-generation Wi-Fi protocol of IEEE 802.11ax like 802.11be, Wi-Fi 7, or EHT, and a next generation of 802.11be like Wi-Fi 8 or UHR. In the method, a first user information field in a control frame carries control frame protection information. An association identifier in the first user information field indicates that the first user information field carries the control frame protection information. The method specifies a control frame protection mechanism, and can effectively prevent attacks on control frames.