Wireless Intrusion Prevention System Blocking Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless intrusion prevention systems face challenges in rapidly blocking connections between access points and terminals, especially when the connection time is faster than the time required to generate a blocking event, particularly in networks using IEEE 802.11w technology, where deauthentication frames are not effectively protected.
Innovation Solution
A method and apparatus within a wireless intrusion prevention system that involves monitoring wireless frames across multiple channels, generating and transmitting blocking messages using separate communication modules to rapidly detect and block unauthorized access, including the use of protected deauthentication frames to ensure effective blocking even in IEEE 802.11w networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the WIPS monitors wireless frames and generates blocking messages using the same communication module, then the system structure is simple, but the blocking speed is insufficient when connection time is faster than blocking event generation time
Solution Approach 1:
The patent divides the communication functionality into separate monitoring and transmission modules. The monitoring module captures wireless frames while the transmission module sends blocking messages, allowing these operations to occur in parallel and independently, thus increasing blocking speed without requiring complex coordination between shared resources.
Solution Approach 2:
The patent introduces a separate transmission module as an intermediary between the detection logic and the wireless medium. This intermediary module is dedicated solely to sending blocking messages, eliminating bottlenecks associated with shared communication modules and enabling faster response times.
2Reliability
If the WIPS uses a single communication module for both monitoring and transmission, then the device complexity is low, but the blocking reliability is insufficient when dealing with IEEE 802.11w protected deauthentication frames
Solution Approach 1:
The patent segments the communication functions into distinct monitoring and transmission modules. This separation ensures that the transmission module can be optimized specifically for sending protected deauthentication frames with proper security handling, while the monitoring module focuses on detecting intrusions, thereby improving blocking reliability for IEEE 802.11w networks.
Solution Approach 2:
The patent applies different functional qualities to different modules: the monitoring module is optimized for frame capture and analysis, while the transmission module is optimized for sending secured blocking messages. This local specialization ensures that each module performs its function with high reliability, particularly for handling the security requirements of IEEE 802.11w protected frames.
3Loss of time
If the WIPS processes blocking events sequentially through a single module, then the processing logic is simple, but the response time increases when multiple channels need monitoring
Solution Approach 1:
The patent divides the response processing into separate monitoring and transmission modules that can operate in parallel. When intrusions are detected across multiple channels, the monitoring module can identify multiple threats simultaneously while the transmission module handles blocking message generation and sending, eliminating sequential processing bottlenecks and reducing overall response time.
Data Source
AI summary
The present disclosure relates to a method for blocking the connection of an electronic device inside a wireless intrusion prevention system, the method comprising the steps of: successively monitoring wireless frames in a plurality of channels through a first communication module; generating a first blocking message on the basis of at least one wireless frame received as a result of the monitoring and generating a second blocking message on the basis of a first wireless frame, to which a predetermined wireless network technology has been applied, among the at least one wireless frame; and transmitting at least one of the first and second blocking messages through a second communication module. The present disclosure is not limited to the above embodiment, and other embodiments are also possible.