Response Frame MIC Binding for Replay Attack Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing wireless communication protocols, such as IEEE 802.11, are vulnerable to replay attacks due to the use of header packet number (HDR PN) for integrity protection, which can lead to desynchronization and vulnerabilities in data transmission.

Innovation Solution

Incorporating values of the soliciting frame, including static fields and/or HDR PN, into the message integrity check (MIC) of the response frame to verify both the integrity and receipt of the soliciting frame, thereby preventing replay attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If HDR PN is used for integrity protection in response frames, then data transmission security is improved, but replay attacks can still occur causing desynchronization between devices

Engineering Contradiction:

Improvedata transmission securityVSAvoidreplay attacks and desynchronization

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by incorporating the soliciting frame's values (including HDR PN and static fields) into the MIC calculation of the response frame before transmission. This pre-binding of the soliciting frame parameters to the response frame's integrity check prevents replay attacks, as an attacker cannot successfully replay a response frame without knowing the original soliciting frame's values that were used to generate the MIC.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses the MIC as an intermediary mechanism that connects and verifies both the soliciting frame and response frame. By including values from the soliciting frame in the MIC calculation, the MIC acts as a mediator that ensures the response frame is properly linked to its corresponding soliciting frame, preventing desynchronization and replay attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Device complexity

If MIC is calculated only using response frame values, then calculation complexity is reduced, but the soliciting frame receipt cannot be verified

Engineering Contradiction:

ImproveMIC calculation complexityVSAvoidsoliciting frame receipt verification

Core Design Contradiction:

Device complexityVSLoss of information

Solution Approach 1:

The patent merges the verification of soliciting frame receipt with the integrity check of the response frame by incorporating values from both frames into a single MIC calculation. This combining approach allows the system to verify both the soliciting frame was received and the response frame is intact, without requiring separate verification mechanisms, thus avoiding excessive complexity while maintaining comprehensive verification.

Inventive Principle:

Principle #5Merging (Combining)

3Reliability

If static fields and HDR PN are included in MIC calculation, then replay attack prevention is improved, but processing overhead increases

Engineering Contradiction:

Improvereplay attack preventionVSAvoidprocessing overhead

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts only the essential values from the soliciting frame (specifically static fields and HDR PN) that are needed for replay attack prevention, rather than including all frame data in the MIC calculation. This selective extraction provides sufficient security against replay attacks while minimizing the processing overhead associated with calculating and verifying the MIC.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS20260005800A1Incorporating a soliciting frame signature into a message integrity check (MIC) of a response frame

Publication Date: 2026.01.01 APPLE INC

AI summary

Disclosed are methods, systems, and computer-readable medium to perform operations including: receiving a soliciting frame from a device; generating a response frame including a message integrity check (MIC), where the MIC is determined based at least in part on one or more values of the soliciting frame; and transmitting the response frame to the device.