PREVENTING AN INPUT/OUTPUT BLOCKING ATTACK TO A WIRELESS ACCESS POINT

Systems, methods, and machine-readable and executable instructions are provided for preventing an input/output blocking attack to a wireless access point. Prevention can include instructions to receive a first comeback request from a querying station and to transmit a first portion of a response in a first comeback response frame including an indication of a comeback delay. Prevention can include instructions to receive a second comeback request from the querying station and transmit a second portion of the response in a second comeback response frame in response to the second comeback request complying with the comeback delay. Prevention can include instructions to drop the second comeback request from the querying station in response to the second comeback request not complying with the comeback delay.

BACKGROUND

The Institute of Electrical and Electronics Engineers (IEEE) 802.11u is an extension of the IEEE 802.11 standard to improve the ability of mobile stations (e.g., laptop computers, smartphones, tablets, etc.) to automatically discover, authenticate, and use a wireless access point (AP), which delivers a cellular network-like mobile broadband experience that users want. An IEEE 802.11u enabled wireless AP may provide an unauthenticated mobile station with query capabilities of the wireless AP and its backhaul access networks before associating with the wireless AP. Examples of environments that may use an IEEE 802.11u wireless AP can include educational campuses, airports, hotels, and/or retail outlets, among others.

DETAILED DESCRIPTION

The generic advertisement service (GAS) is a component of IEEE 802.11u that enables a mobile station to query an advertisement server for information elements (IEs) via a wireless AP. GAS provides for layer 2 transport of an advertisement server's responses between the advertisement server, a wireless AP, and a mobile station. The wireless AP is responsible for relaying the mobile station's query to the advertisement server in the carrier's network and for delivering the advertisement server's response back to the mobile station.

To help ensure that mobile stations that are far away from a wireless AP can communicate with the wireless AP, GAS messages are specified to be transmitted with a low frame rate to help protect against wireless signal interference. However, such reliable transmission of GAS messages poses a danger to the wireless AP for input/output (I/O) degradation if the wireless AP has to deliver many relatively large access network query protocol (ANQP) IEs such that normal downstream traffic is affected. ANQP is a query and response protocol used by a mobile station to discover a range of IEs including the operator's domain name, roaming partners accessible via the wireless AP along with their credential type and extensible authentication protocol (EAP) method supported for authentication, Internet protocol (IP) address type availability, among other IEs.

The danger to the wireless AP can be exploited by an I/O attack. An example of an I/O attack includes an attacking station rapidly querying the wireless AP for IEs with different (e.g., spoofing) media access control (MAC) addresses so that the I/O bandwidth of the wireless AP is blocked because the transmission of GAS comeback responses can occupy a lot of air time. To help address this potential attack, systems, methods, and machine-readable and executable instructions are provided for preventing an input/output blocking attack to a wireless access point. Prevention can include instructions to receive a first comeback request from a querying station and to transmit a first portion of a response in a first comeback response frame including an indication of a comeback delay. Prevention can include instructions to receive a second comeback request from the querying station and transmit a second portion of the response in a second comeback response frame in response to the second comeback request complying with the comeback delay. Prevention can include instructions to drop the second comeback request from the querying station in response to the second comeback request not complying with the comeback delay. Examples of the present disclosure can slow down the rate of GAS comeback responses in the wireless AP's transmission queue without significantly increasing query completion time for legitimate mobile stations. Furthermore, examples of the present disclosure do not require operational deviations from the IEEE 802.11u standard that could cause the wireless AP to be noncompliant with the standard.

In the present disclosure, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration how a number of examples of the disclosure can be practiced. These examples are described in sufficient detail to enable those of ordinary skill in the art to practice the examples of this disclosure, and it is to be understood that other examples can be used and that process, electrical, and/or structural changes can be made without departing from the scope of the present disclosure.

FIG. 1is a prior art diagram illustrating an instance of an I/O blocking attack to a wireless AP104. When the wireless interface of the wireless AP104is busy for transmission, newly arrived frames (e.g., frames112-1,112-2) to be sent may be inserted into a transmission queue of the wireless AP104until competition of the transmission of the previous frame. If the wireless interface of the wireless AP104is frequently occupied for sending ANQP responses, which can take a relatively long time to finish, the latency of normal downstream data traffic can be prolonged. Furthermore, if a burst of ANQP responses deplete the transmission queue of the wireless AP104, the downstream data frames may be dropped at the wireless interface of the wireless AP104, which may cause packet loss for normal communications.

An attacking mobile station102may send numerous GAS initial requests106with spoofing source MAC addresses to query multiple ANQP IEs such as venue name, network access identifier (NAI) realm list, etc. The attacking mobile station102can enqueue the spoofing MAC addresses. When the query responses from the advertisement server (not illustrated inFIG. 1) are buffered by the wireless AP104, the attacking mobile station102may send a burst of GAS comeback requests108including the spoofing MAC addresses to fetch the GAS comeback responses112-1,112-2(e.g., the entire responses) each included in a GAS comeback response frame110, or as much of the response as will fit within the respective frame110, from the wireless AP104, which may quickly block the wireless I/O bandwidth of the wireless AP104. The spoofing MAC addresses make it more difficult for the wireless AP104to detect the attack and force the wireless AP104to spend more time sending ANQP responses to the spoofing MACs because the responses may not be acknowledged by the interface card of the attacking mobile station102due to the difference from the interface's real MAC address. As a result, the wireless AP104may retransmit each ANQP response until a retry limit is reached.

FIG. 2is a diagram illustrating an example of preventing an I/O blocking attack to a wireless AP204according to the present disclosure. A mobile station202can transmit a GAS initial request206to the wireless AP204. An ANQP query can be encapsulated in the GAS initial request206message. The wireless AP204can allocate a memory block (control block) to store information of the query such as a mobile station MAC address, a dialog identifier, etc., then send an internal query218to an advertisement server214(e.g., located in an operator's core network) based on the GAS initial request206in response to receiving the GAS initial request206. Although not specifically illustrated, the wireless AP204can query the advertisement server214in response to receiving a first GAS comeback request208-1that complies with the comeback delay associated with the GAS initial response208(e.g., rather than querying the advertisement server214in response to receiving the GAS initial request206). The wireless AP204can transmit a GAS initial response216to the querying mobile station202. Although not specifically illustrated, the GAS initial response216can include an indication of a comeback delay, which effectively tells the querying mobile station202“I will get your information from the advertisement server, please come back later to fetch it.” The wireless AP204can store (e.g., in the control block) the ANQP information elements received according to the response220from the advertisement server214.

According to some examples of the present disclosure, the wireless AP204can (e.g., via a non-transitory machine readable medium storing instructions executable by a processing resource of the wireless AP204) receive a first comeback request208-1from a querying station202. The wireless AP204can transmit a first portion222-1of a response in a first comeback response frame210-1including an indication of a comeback delay224-1. The comeback delay224-1instructs the querying station202to request a next portion and/or a remainder of the comeback response after a delay of a particular length of time (e.g., x milliseconds). As opposed to a potential solution involving a rate-controllable transmission queue for the wireless access point204, this solution moves the timer scheduling and overhead from the wireless AP204to the querying station202. The wireless AP204can timestamp the first comeback response210-1(e.g., t1). The wireless AP204can set a timeout of the buffered response220from the advertisement server214as the comeback delay224-1(e.g., x) plus a relaxed estimation of total transmission time of the comeback response frame210-1and the comeback request208-2(e.g., Δ). For example, assuming that the GAS messages are transmitted at 1 megabit per second (Mbps) and the size of the comeback request208-2and comeback response210-1is 1000 bits, Δ can be set as

assuming that the retry limit is 7. The combination of dropping earlier arriving comeback requests208-X (described below) and timeout can force querying stations202to obey the comeback delay224-1or have their subsequent comeback requests dropped.

The wireless AP204can receive a second comeback request208-2from the querying station202and transmit a second portion222-2of the response in a second comeback response frame210-2in response to the second comeback request208-2complying with the comeback delay224-1. The wireless AP204can receive the second comeback request208-2at time t2and verify compliance of the second comeback request208-2with the comeback delay224-1by checking whether (t2−t1) falls within the range [x, x+Δ]. If (t2−t1) does not fall within the range, the second comeback request208-2can be dropped. If (t2−t1) does fall within the range, the wireless AP204can take additional actions (e.g., make responses) as described herein. The wireless AP204can proactively split the comeback response into portions smaller than an entire maximal packet delivery unit (MPDU)212and send one portion222-1,222-2, . . . ,222-N in each comeback response frame210-1,210-2, . . . ,210-N. For example, the portion222-1of the response in comeback response frame210-1can be less than a frame capacity of the comeback response frame210-1. The portions222-1,222-2, . . . ,222-N in comeback responses210-1,210-2, . . .210-N can include information from the control block. In some examples, and as illustrated inFIG. 2, the size of the portions222-1,222-2, . . . ,222-N can be equal.

The wireless AP204can drop the second comeback request208-X from the querying station202in response to the second comeback request208-X not complying with the comeback delay224-1. As illustrated inFIG. 2, the second comeback request208-X can indicate either a comeback request from the original querying station202that does not comply with the comeback delay224-1(in alternative to the illustrated comeback request208-2, which does comply with the comeback delay224-1), or the second comeback request208-X can indicate a comeback request from a querying station other than station202or a same querying station202with a different (e.g., spoofing) MAC address. For example, when the first comeback request208-1includes a first MAC address for the querying station202, the wireless AP204can drop the comeback request208-X in response to the comeback request208-X including a different MAC address and in response to the comeback request208-X being received during the comeback delay224-1. This can help the wireless AP204prevent the attacks described herein.

FIG. 3is a diagram illustrating an example of preventing an I/O blocking attack to a wireless AP304according to the present disclosure. The mobile station302, wireless AP304, advertisement server314, GAS initial request306, advertisement server query318, GAS initial response316, and response from the advertisement server320can be analogous to the mobile station202, wireless AP204, advertisement server214, GAS initial request206, advertisement server query218, GAS initial response216, and response from the advertisement server220illustrated and described with respect toFIG. 2.

According to some examples of the present disclosure, the wireless AP304can (e.g., via a non-transitory machine readable medium storing instructions executable by a processing resource of the wireless AP304) receive a first comeback request308-1from a querying station302. The wireless AP304can transmit a first portion322-1, having a first size, of a response in a first comeback response frame310-1including an indication of a comeback delay324-1. The wireless AP304can receive a second comeback request308-2from the querying station302and transmit a second portion322-2, having a second size that is larger than the first size, of the response in a second comeback response frame310-2in response to the second comeback request308-2complying with the comeback delay324-1. The wireless AP304can proactively split the comeback response into portions smaller than an entire MPDU312and send one portion322-1,322-2, . . . ,322-N in each comeback response frame310-1,310-2, . . . ,310-N. For example, the portion322-1of the response in comeback response frame310-1can be less than a frame capacity of the comeback response frame310-1.

In some examples, and as illustrated inFIG. 3, the size of the portions322-1,322-2, . . . ,322-N can be different. For example, the size of a first portion322-1can be smaller than the size of a second portion322-2(and the size of the second portion322-2can be smaller than a size of the nth portion322-N). The wireless AP304can transmit subsequent portions322-2, . . . ,322-N of the response having sizes larger than previous portions322-1,322-2of the response until an entirety312of the response has been transmitted in response to respective comeback requests308-2, . . . ,308-N complying with respective comeback delays324-1,324-2. Such examples can help to reduce query completion time associated with splitting a response into multiple portions322-1,322-2, . . . ,322-N and transmitting the portions322-1,322-2, . . . ,322-N from the AP304to the querying station302in multiple GAS comeback response frames310-1,310-2, . . . ,310-N. Once (or each time) a querying station302complies with a comeback delay324-1,324-2, an increased likelihood that the querying station302is not an attacking station exists. Thus, the querying station302can benefit from complying with the comeback delay(s)324-1,324-2by subsequently receiving larger portion(s)322-1,322-2, . . . ,322-N of the response (e.g., until the portion size reaches the MPDU).

The wireless AP304can receive a first comeback response from a second querying station (e.g., station302). The wireless AP304can transmit a first portion (e.g., portion322-1) of a second response including an indication of a comeback delay (e.g., comeback delay324-1) to the second querying station. The wireless AP304can drop a second comeback request308-X from the second querying station (e.g., station302) in response to the second comeback request308-X not complying with the comeback delay (e.g., comeback delay324-1).

FIG. 4is a diagram illustrating an example of preventing an I/O blocking attack to a wireless AP404according to the present disclosure. The mobile station402, wireless AP404, advertisement server414, GAS initial request406, advertisement server query418, GAS initial response416, and response420from the advertisement server414can be analogous to the mobile station202, wireless AP204, advertisement server214, GAS initial request206, advertisement server query218, GAS initial response216, and response from the advertisement server220illustrated and described with respect toFIG. 2.

According to some examples of the present disclosure, the wireless AP404can (e.g., via a non-transitory machine readable medium storing instructions executable by a processing resource of the wireless AP404) receive a first comeback request408-1from a querying station402. The wireless AP404can transmit a first portion422-1of a response in a first comeback response frame410-1including an indication of a first comeback delay424-1. The wireless AP404can receive a second comeback request408-2from the querying station402and transmit a second portion422-2of the response in a second comeback response frame410-2including an indication of a second comeback delay424-2that is shorter than the first comeback delay424-1in response to the second comeback request408-2complying with the first comeback delay424-1. The wireless AP402can transmit subsequent portions422-2,422-3, . . . ,422-N of the response including indications of subsequent comeback delays424-2,424-3that are shorter than previous comeback delays424-1,424-2included with previous portions422-1,422-2,422-3of the comeback response in response to respective comeback requests408-2,408-3, . . . ,408-N complying with respective comeback delays424-1,424-2,424-3. Such examples can help to reduce query completion time associated with splitting a response into multiple portions422-1,422-2,422-3, . . . ,422-N and transmitting the portions422-1,422-2,422-3, . . . ,422-N from the AP404to the querying station402in multiple GAS comeback response frames410-1,410-2,410-3, . . . ,410-N. Once (or each time) a querying station402complies with a comeback delay424-1,424-2, an increased likelihood that the querying station402is not an attacking station exists. Thus, the querying station402can benefit from complying with the comeback delay(s)424-1,424-2by subsequently having shorter comeback delays424-1,424-2,424-3associated with respective GAS comeback response frames410-1,410-2,410-3, . . . ,410-N.

The wireless AP404can proactively split the comeback response into portions smaller than an entire MPDU412and send one portion422-1,422-2,422-3, . . . ,422-N in each comeback response frame410-1,410-2,410-3, . . . ,410-N. For example, the portion422-1of the response in comeback response frame410-1can be less than a frame capacity of the comeback response frame410-1. In some examples, and as illustrated inFIG. 4, the size of the portions422-1,422-2,422-3, . . . ,422-N can be equal. Any comeback request can be dropped in response to the comeback request not complying with a respective comeback delay. For example, the wireless AP404can drop the second comeback request408-X from the querying station402in response to the second comeback request408-X not complying with the first comeback delay424-1.

FIG. 5is a diagram illustrating an example of preventing an I/O blocking attack to a wireless AP504according to the present disclosure. The mobile station502, wireless AP504, dropped GAS comeback request508-X, MPDU512, advertisement server514, GAS initial request306, advertisement server query518, GAS initial response516, and response from the advertisement server514can be analogous to the mobile station202, wireless AP204, dropped GAS comeback request208-X, MPDU212, advertisement server214, GAS initial request206, advertisement server query218, GAS initial response216, and response from the advertisement server220illustrated and described with respect toFIG. 2.

According to some examples of the present disclosure, the wireless AP504can (e.g., via a non-transitory machine readable medium storing instructions executable by a processing resource of the wireless AP504) receive a first comeback request508-1from a querying station502. The wireless AP504can transmit a first portion522-1, having a first size, of a response in a first comeback response frame510-1including an indication of a first comeback delay524-1. The wireless AP504can receive a second comeback request508-2from the querying station502and transmit a second portion522-2, having a second size greater than the first size of the first portion522-1, of the response in a second comeback response frame510-2including an indication of a second comeback delay524-2that is shorter than the first comeback delay524-1in response to the second comeback request508-2complying with the first comeback delay524-1.

The wireless AP502can transmit subsequent portions522-2,522-3of the response having sizes larger than previous portions522-1,522-2of the response and including indications of subsequent comeback delays524-2,524-N that are shorter than previous comeback delays524-1,524-2included with previous portions522-1,522-2of the comeback response in response to respective comeback requests508-2,508-3, . . . ,508-N complying with respective comeback delays524-1,524-2, . . . ,524-N until an entirety512of the response has been transmitted in response to respective comeback requests508-2, . . . ,508-N complying with respective comeback delays524-1,524-2, . . . ,524-N. Such examples can help to reduce query completion time associated with splitting a response into multiple portions522-1,522-2,522-3and transmitting the portions522-1,522-2,522-3from the AP504to the querying station502in multiple GAS comeback response frames510-1,510-2,510-3. Once (or each time) a querying station502complies with a comeback delay524-1,524-2, . . . ,524-N, an increased likelihood that the querying station502is not an attacking station exists. Thus, the querying station502can benefit from complying with the comeback delay(s)524-1,524-2, . . . ,524-N by subsequently receiving larger portion(s)522-1,522-2,522-3of the response and by subsequently having shorter comeback delays524-1,524-2, . . . ,524-N associated with respective GAS comeback response frames510-1,510-2,510-3. Changes in the size of the portions and/or the length of the comeback delays can be secret to querying stations to help prevent an attacking station from guessing the comeback delay for making legitimate comeback requests.

FIG. 6is a diagram illustrating an example of a wireless AP604according to the present disclosure. The wireless AP604can utilize software, hardware, firmware, and/or logic to perform a number of functions. The wireless AP604can be a combination of hardware and program instructions configured to perform a number of functions (e.g., actions). The hardware, for example, can include a number of processing resources626and a number of memory resources628, such as a machine-readable medium (MRM) or other memory resources628. The memory resources can be internal and/or external to the wireless AP604(e.g., the wireless AP604can include internal memory resources and have access to external memory resources). The program instructions (e.g., machine-readable instructions (MRI)) can include instructions stored on the MRM to implement a particular function (e.g., an action such as preventing an I/O blocking attack). The set of MRI can be executable by one or more of the processing resources626. The memory resources628can be coupled to the wireless AP604in a wired and/or wireless manner. For example, the memory resources628can be an internal memory, a portable memory, a portable disk, and/or a memory associated with another resource, e.g., enabling MRI to be transferred and/or executed across a network such as the Internet.

Memory resources628can be non-transitory and can include volatile and/or non-volatile memory. Volatile memory can include memory that depends upon power to store information, such as various types of dynamic random access memory (DRAM) among others. Non-volatile memory can include memory that does not depend upon power to store information. Examples of non-volatile memory can include solid state media such as flash memory, electrically erasable programmable read-only memory (EEPROM), phase change random access memory (PCRAM), magnetic memory such as a hard disk, tape drives, floppy disk, and/or tape memory, optical discs, digital versatile discs (DVD), Blu-ray discs (BD), compact discs (CD), and/or a solid state drive (SSD), etc., as well as other types of machine-readable media.

The processing resources626can be coupled to the memory resources628via a communication path630. The communication path630can be local or remote to the wireless AP604. Examples of a local communication path630can include an electronic bus internal to a machine, where the memory resources628are in communication with the processing resources626via the electronic bus. Examples of such electronic buses can include Industry Standard Architecture (ISA), Peripheral Component Interconnect (PCI), Advanced Technology Attachment (ATA), Small Computer System Interface (SCSI), Universal Serial Bus (USB), among other types of electronic buses and variants thereof. The communication path630can be such that the memory resources628are remote from the processing resources626, such as in a network connection between the memory resources628and the processing resources626. That is, the communication path630can be a network connection. Examples of such a network connection can include local area network (LAN), wide area network (WAN), personal area network (PAN), and the Internet, among others.

As shown inFIG. 6, the MRI stored in the memory resources628can be segmented into a number of modules632-1,632-2,632-3that when executed by the processing resources626can perform a number of functions. As used herein a module includes a set of instructions included to perform a particular task or action. The number of modules632-1,632-2,632-3can be sub-modules of other modules. For example, the drop module632-3can be a sub-module of the receive module632-1and/or the drop module632-3and the receive module632-1can be contained within a single module. Furthermore, the number of modules632-1,632-2,632-3can comprise individual modules separate and distinct from one another. Examples are not limited to the specific modules632-1,632-2,632-3illustrated inFIG. 6.

The receive module632-1can comprise MRI that can be executed by the processing resources626to receive requests (e.g., GAS initial requests, GAS comeback requests, etc.) from a querying station and/or to receive responses from an advertisement server, among other receptions, as described herein. Although not specifically illustrated, the receive module632-1can make use of a number of antennas associated with the wireless AP604.

The transmit module632-2can comprise MRI that are executed by the processing resources626to transmit responses (e.g., GAS initial response, GAS comeback responses, etc.) to a querying station and/or to transmit queries to an advertisement server, among other transmissions, as described herein. Although not specifically illustrated, the transmit module632-2can make use of a number of antennas associated with the wireless AP604.

The drop module632-3can comprise MRI that are executed by the processing resources626to drop requests (e.g., GAS comeback requests) received from a querying station in response to the requests not complying with a comeback delay, in response to the requests not having a MAC address in an appropriate control block in the memory resources628of the wireless AP604, and/or in response to other conditions as described herein.

FIG. 7is a flow chart illustrating an example of a method for preventing an input/output blocking attack to a wireless access point according to the present disclosure. At block740, a first comeback request from a querying station can be received with a wireless AP. At block742, a first portion of a response can be transmitted with the wireless AP in a first comeback response frame having a first size and including an indication of a comeback delay. At block744, a second comeback request can be received from the querying station with the wireless AP. At block746, a second portion of the response can be transmitted with the wireless AP in a second comeback response frame having a size that is larger than the first size in response to the second comeback request complying with the comeback delay.

As used herein, “logic” is an alternative or additional processing resource to perform a particular action and/or function, etc., described herein, which includes hardware, e.g., various forms of transistor logic, application specific integrated circuits (ASICs), etc., as opposed to computer executable instructions, e.g., software firmware, etc., stored in memory and executable by a processor.

As used herein, “a” or “a number of” something can refer to one or more such things. For example, “a number of widgets” can refer to one or more widgets.