Protected Block Acknowledgment Mechanism for Wireless Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless communication networks face challenges in protecting messages from attacks such as fake block acknowledgment requests, fake data frames, and replaying genuine data frames with modified sequence numbers, which can disrupt valid frame delivery and impact system performance.
Innovation Solution
The proposed solution involves generating and transmitting protected frames that indicate an updated starting sequence number for a block acknowledgment window, using additional authentication data to encrypt medium access control (MAC) Protocol Data Units (MPDUs), and maintaining bitmaps to track successfully received MPDUs, thereby enhancing security against malicious attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If unprotected block acknowledgment requests are used, then device complexity is reduced, but security against malicious attacks deteriorates
Solution Approach 1:
The patent applies preliminary action by establishing a protected BA agreement before actual data transmission. The protecting BA agreement includes pre-shared security parameters (PMK, KCK, KEK) that are set up in advance through authentication procedures. This allows the system to quickly verify and reject fake BAR frames during operation without complex real-time analysis, resolving the contradiction by preparing security measures beforehand.
Solution Approach 2:
The patent introduces an intermediary mechanism - the protecting BA agreement - that acts as a mediator between the transmitting and receiving devices. This agreement serves as a trusted reference that both parties use to verify the authenticity of block acknowledgment requests. The intermediary contains security parameters that enable mutual verification, simplifying the security check process while maintaining high reliability.
2Speed
If unprotected data frames are transmitted, then transmission speed is improved, but vulnerability to replay attacks with modified sequence numbers worsens
Solution Approach 1:
The patent employs sequence numbers as disposable, short-lived security objects. Each data frame receives a unique sequence number that is used once for authentication and then discarded. The receiving device maintains a bitmap tracking received sequence numbers, which is periodically cleared and reset. This approach provides effective replay protection through simple, lightweight mechanisms that do not significantly impact transmission speed.
Solution Approach 2:
The patent changes the parameter of sequence number protection by applying different encryption keys (TKIP or CCMP) to encrypt sequence numbers based on the security capability negotiation between devices. This parameter change allows the system to adapt the level of protection - using stronger encryption when needed and faster modes when security requirements are lower, thus balancing speed and security against replay attacks.
3Reliability
If additional authentication data is applied to encrypt MPDUs, then security against fake data frames is improved, but processing complexity increases
Solution Approach 1:
The patent achieves universality by designing the protected BA agreement mechanism to serve multiple security functions simultaneously. The same agreement and security parameters (PMK, KCK, KEK, PTK) are used for: (1) protecting block acknowledgment requests, (2) encrypting data frames with AAD, and (3) verifying sequence number authenticity. This multi-functionality reduces overall system complexity by reusing the same security infrastructure across different protection needs rather than implementing separate mechanisms for each function.
Data Source
AI summary
Certain aspects of the present disclosure provide a method for wireless communications at a first wireless device. The method generally includes generating a protected frame that indicates: 1) an updated starting sequence number (SSN) of a block acknowledgment (BA) window and 2) an intended purpose of the protected frame as a request to update a BA window with the updated SSN; outputting, for transmission to a second wireless device that the first wireless device has established a protected block acknowledgment (BA) agreement with, the protected frame; generating multiple medium access control (MAC) Protocol Data Units (MPDUs) with SNs within the updated BA window; and outputting, for transmission to the second wireless device, the multiple MPDUs.