Spoofed Channel Switch Announcement for Wireless Intrusion Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing wireless intrusion prevention systems (WIPS) are unable to disrupt undesired wireless connections to unauthorized access points due to Management Frame Protection (MFP) encryption, which renders Deauthentication management frames ineffective.

Innovation Solution

Implementing a wireless intrusion prevention system that uses spoofed channel switch announcements (CSA) and extended channel switch announcements (eCSA) in management frames to direct clients to switch to a new channel, effectively disconnecting them from unauthorized access points.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If Deauthentication management frames are used to disrupt unauthorized wireless connections, then wireless intrusion prevention is achieved, but the method becomes ineffective due to Management Frame Protection encryption

Engineering Contradiction:

Improveintrusion prevention effectivenessVSAvoidcompatibility with MFP encryption

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

Instead of using Deauthentication frames to disconnect clients, the patent inverts the approach by using Channel Switch Announcement frames to force clients to switch to a different channel, thereby achieving disconnection from unauthorized access points through a different mechanism that is not blocked by MFP encryption

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent changes the type of management frame used from Deauthentication to Channel Switch Announcement, altering the parameter of frame type to bypass the encryption barrier while maintaining the goal of disrupting unauthorized connections

Inventive Principle:

Principle #35Parameter changes

2Reliability

If Management Frame Protection is implemented to secure wireless communications, then security is improved, but the ability to disrupt unauthorized connections using traditional methods is lost

Engineering Contradiction:

Improvewireless securityVSAvoidintrusion disruption capability

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent uses Channel Switch Announcement frames as an intermediary mechanism that can operate within the MFP-protected environment to achieve the desired effect of disconnecting clients from unauthorized access points without directly confronting the encryption barrier

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If spoofed channel switch announcements are used to disconnect clients from unauthorized access points, then intrusion prevention is achieved, but device complexity increases

Engineering Contradiction:

Improveconnection securityVSAvoidWIPS system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent creates a spoofed copy of the Channel Switch Announcement frame that mimics the format and structure of legitimate CSA frames, allowing the WIPS system to inject fraudulent channel switch information to clients without requiring complex custom protocol development

Inventive Principle:

Principle #26Copying

Data Source

PatentUS12317083B2Wireless intrusion prevention using channel switch announcement

Publication Date: 2025.05.27 ARISTA NETWORKS INC

AI summary

A method of operating an access point in a wireless network is provided. The method can include detecting that a client in the wireless network is connecting to, connected to, or communicating with an unauthorized access point. The method can further include using the access point to send a spoofed management frame impersonating the unauthorized access point to the client in response to detecting that the client is connected to or communicating with the unauthorized access point. The spoofed management frame can include a channel switch announcement information element and/or an extended channel switch announcement information element directing the client to switch to a new channel so that the client disconnects from the unauthorized access point.