Shared PTK Roaming Replay Detection at Target APs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The shared PTK architecture in IEEE 802.11 UHR/11bn is vulnerable to replay attacks during seamless roaming, leading to unwanted roaming events, unnecessary context transfers, and denial-of-service conditions due to the inability of target APs to verify the freshness of roaming requests.
Innovation Solution
Implementing replay detection mechanisms at the target AP, including per-STA PN caching, TSF-based validation, RR SN tracking, and deferred PN verification, to assess the validity of roaming requests before initiating context transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If replay detection mechanisms are implemented at the target AP, then security against replay attacks is improved, but device complexity increases
Solution Approach 1:
The patent implements replay detection mechanisms before processing roaming requests. The target AP maintains cached packet numbers (PNs) and sequence numbers (SNs) from previous interactions with stations, allowing it to pre-validate incoming roaming requests against these cached values. This preliminary validation prevents replayed requests from being processed, enhancing security while keeping the complexity manageable through efficient caching and comparison operations.
2Reliability
If per-STA PN caching is implemented, then replay attack detection capability is improved, but memory usage increases
Solution Approach 1:
The patent implements per-STA (per-station) PN caching, where each station's packet numbers are cached separately with associated identifiers. This localized caching approach stores only the necessary PN values for individual stations that have previously roamed or communicated with the AP, rather than maintaining global state for all stations. The cached data includes station identifiers and their corresponding PN values, enabling targeted replay detection while minimizing memory consumption by only storing relevant per-station information.
3Reliability
If replay validation is performed for every roaming request, then security is improved, but processing time increases
Solution Approach 1:
The patent performs selective replay validation by comparing incoming roaming requests against cached PN and SN values. The validation checks whether the requested PN or SN exceeds the cached values, providing a lightweight verification mechanism. This partial validation approach focuses only on the critical security check (whether the request is a replay) without performing full authentication or context verification on every request, thus maintaining security while minimizing processing overhead and enabling fast roaming.
Data Source
AI summary
The present disclosure provides techniques for mitigating replay attacks during roaming with a shared pairwise transient key (PTK). A first access point (AP) receives a first roaming request from a station (STA), where the first roaming request comprises a first packet number (PN). In response to determining that the first PN is less than or equal to a last known PN maintained by the first AP, the first AP discards the roaming request.