Wi-Fi Control Frame Security via Selective MIC Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing demand for Wi-Fi communication in high-density deployment scenarios, particularly with the introduction of IEEE 802.11ax, highlights the need for effective protection of control frames like trigger frames to prevent network attacks, as they lack robust security measures, making them vulnerable to hacker exploitation.
Innovation Solution
A control frame processing method that includes receiving and parsing control frames with a check field containing a random value and MIC check value, decrypting using a data key, calculating a local MIC check value, and verifying its consistency to perform appropriate operations, ensuring the security of the network by protecting these frames from unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If control frames are transmitted without encryption to maintain compatibility and simplicity, then ease of operation and device complexity are improved, but network security deteriorates as hackers can exploit these frames for attacks
Solution Approach 1:
The control frame is segmented into multiple fields, with only the check field (containing random value and MIC check value) being encrypted using the data key, while other fields remain unencrypted. This selective encryption approach maintains compatibility and simplicity for most frame processing while providing security for critical verification data
Solution Approach 2:
Different parts of the control frame are treated differently regarding encryption. The check field containing security-critical data (random value and MIC check value) is encrypted with the data key, while other fields maintain their original unencrypted form. This local differentiation provides security where needed without compromising overall frame processing simplicity
2Object-affected harmful factors
If encryption is applied to all control frame fields to enhance security, then network security is improved, but device complexity and processing overhead increase
Solution Approach 1:
The control frame is divided into encrypted and unencrypted portions. Only the check field (containing random value and MIC check value) requires decryption and verification processing, while other fields are processed normally. This segmentation reduces the computational burden of encryption/decryption operations
Solution Approach 2:
Instead of encrypting the entire control frame, only the critical check field is encrypted with the data key. This partial encryption approach provides adequate security for the security-critical portion while avoiding the excessive processing complexity that would result from full-frame encryption
3Object-affected harmful factors
If a check field with random value and MIC check value is added to control frames to prevent attacks, then network security is improved, but device complexity and frame processing complexity increase
Solution Approach 1:
The check field containing the random value and MIC check value is prepared in advance during frame generation. The random value is generated and the MIC check value is calculated beforehand, then both are encrypted together using the data key. This preliminary preparation simplifies the receiving end's processing as the verification data is already ready for comparison
Solution Approach 2:
The check field is given special treatment with encryption and verification mechanisms, while other fields follow standard processing. This localized enhancement provides attack prevention for the critical verification data without requiring complex processing changes across the entire frame structure
Data Source
AI summary
A control frame processing method receives a control frame transmitted by the access point, and parses the received control frame to extract a random value and a MIC check value therein; decrypts the random value and the MIC check value by using a data key from the access point to obtain an original plaintext of the random value and the original plaintext of the MIC check value; calculates a local MIC check value using the MIC key from the access point, the non-check field in the control frame, and the random value; determines whether the original plaintext of the MIC check value is consistent with the local MIC check value, and in response to that the original plaintext of the MIC check value is consistent with the local MIC check value, performs a corresponding control operation according to the control frame.