Patent Publication Number: US-8117658-B2

Title: Access point, mobile station, and method for detecting attacks thereon

Description:
BACKGROUND 
     1. Technical Field 
     Embodiments of the present disclosure relate to wireless communications, and particularly, to an access point, a mobile station, and a method for detecting attacks thereon. 
     2. Description of Related Art 
     Referring to  FIG. 3 , a wireless communication system  100  is shown, comprising a plurality of access points (APs)  10 ′, mobile stations (STAs)  20 ′, and potential attackers  30 . When an AP  10 ′ and an STA  20 ′ communicate, and one receives a disassociation or deauthentication frame from the other, the AP  10 ′ and the STA  20 ′ must reassociate or reauthenticate with each other, or even roam. 
     However, if either the disassociation frame or the deauthentication frame is a spurious data frame transmitted by one of the attackers  30 , posing as the STA  20 ′ or the AP  10 ′, the conventional AP  10 ′ and the conventional STA  20 ′, unaware of the presence of the attacker  30 , may be susceptible to attack thereby. Accordingly, it is desirable to provide an STA, an AP, or a method for detecting attacks brought by the spurious deauthentication or deassociation frames. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of an embodiment of a first wireless local area system (WLAN) device in a wireless communication system, according to the present disclosure. 
         FIG. 2  is a flowchart of an embodiment of a method for the first WLAN device to determine whether a second WLAN device is under attack, according to the present disclosure. 
         FIG. 3  depicts a schematic diagram of a widely used wireless communication system. 
     
    
    
     DETAILED DESCRIPTION 
     Referring to  FIG. 1 , a block diagram of an embodiment of a first wireless local area network (WLAN) device  10  shows the first WLAN device  10  wirelessly communicating with a second WLAN device  20  over the wireless communication system  100 . The first WLAN device  10  and the second WLAN device  20  may be both mobile stations (STAs), or an access point (AP) and an STA, respectively, or an STA and an AP, respectively. When the first WLAN device  10  communicates with the second WLAN device  20 , a potential attacker  30  can create and transmit a spurious data frame posing as the first WLAN device  10  to the second WLAN device  20 , interrupting communication between the first WLAN device  10  and the second WLAN device  20 . The spurious data frame may be a spurious media access control (MAC) management protocol data unit (MMPDU). 
     In the illustrated embodiment, the first WLAN device  10  comprises a detection module  102 , an address determination module  104 , a transmission module  106 , and a response module  108 . The first WLAN device  10  further comprises a storage system  110  storing the modules  102 ,  104 ,  106 ,  108 , and a processor  112  that executes at least one computerized instruction for the modules  102 ,  104 ,  106 ,  108 . 
     The detection module  102  is configured for detecting an MMPDU transmitted over the wireless communication system  100 . As it is known, there are many kinds of MMPDUs, such as an association frame and a disassociation frame. In one embodiment, the MMPDU mainly mentions a disassociation frame or a deauthentication frame. 
     The address determination module  104  is configured for determining whether the MMPDU comprises a spurious data frame posing as the first WLAN device  10  to the second WLAN device  20 . In one embodiment, the above-mentioned determination is based at least partly on a comparison of a source address and a destination address of the MMPDU detected by the detection module  102  with network addresses of the first WLAN device  10  and the second WLAN device  20 , respectively. The attacker  30  transmits the spurious data frame posing as the first WLAN device  10  to the second WLAN device  20 . The source address and the destination address of the MMPDU and the network addresses of the first WLAN device  10  and the second WLAN device  20  are MAC addresses, in one embodiment. 
     The transmission module  106  is configured for instantly transmitting a request data frame having a highest priority in a current connection state between the first WLAN device  10  and the second WLAN device  20  to the second WLAN device  20  if the MMPDU is a spurious data frame. The detection module  102  will continue detection of the MMPDU, if the MMPDU is not a spurious data frame. 
     The connection state between the first WLAN device  10  and the second WLAN device  20  comprises an authentication state, a disassociation state, an associated state, a deauthentication state, and a data communication state. In one embodiment, the current connection state above-mentioned mainly comprises a disassociation state and a deauthentication state. The request data frame having the highest priority in the current connection state here comprises an association frame in the disassociation state and a deauthentication frame in the deauthentication state. 
     The response module  108  is configured for determining whether the second WLAN device  20  is under attack by the attacker  30  according to whether the response module  108  receives a response data frame from the second WLAN device  20  after the transmission module  106  transmits the request data frame having the highest priority in the current connection state. If the response module  108  receives the response data frame from the second WLAN device  20 , the response module  108  determines that the second WLAN device  20  is under attack by the attacker  30 . If the response module  108  does not receive any response data frame from the second WLAN device  20 , the response module  108  determines the second WLAN device  20  is not under attack by the attacker  30 . The response data frame is only generated when the second WLAN device  20  receives a request data frame to associate or authenticate with the first WLAN device  10 . 
       FIG. 2  is a flowchart of an exemplary embodiment of a method of the first WLAN device  10  determining whether the second WLAN device  20  is under attack, the method performed by the function modules of  FIG. 1 . 
     In block S 300 , the first WLAN device  10  wirelessly communicates with the second WLAN device  20 . The potential attacker  30  may attack the second WLAN device  20  by a spurious data frame posing as the first WLAN device  10 , so as to interrupt communication between the first WLAN device  10  and the second WLAN device  20 . 
     In block S 302 , the detection module  102  detects an MMPDU over the communication system  100 . 
     In block S 304 , the address module  104  determines whether the MMPDU is a spurious data frame. In one embodiment, the above-mentioned determination is based at least partly on a comparison of a source address and a destination address of the MMPDU respectively with network addresses of the first WLAN device  10  and the second WLAN device  20 . If the source address and the destination address of the MMPDU are the same as those of the first WLAN device  10  and the second WLAN device  20 , the address determination module  104  determines the MMPDU is spurious. If not, the address determination module  104  determines that the MMPDU is not spurious. In one embodiment, the source address and the destination address of the MMPDU and the network address of the STA and the network address of the WLAN device are MAC addresses. 
     If the first WLAN device  10  receives no spurious data frames, block S 302  is executed, in which the detection module  102  continues detection of the MMPDU. 
     If the first WLAN device  10  receives the spurious data frame, block S 306  is repeated, wherein transmission module  106  transmits a request data frame having a highest priority in a current connection state between the first WLAN device  10  and the second WLAN device  20 . 
     The connection state between the first WLAN device  10  and the second WLAN device  20  comprises an authentication state, a disassociation state, an associated state, a deauthentication state, and a data communication state. In one embodiment, the current connection state above-mentioned mainly comprises a disassociation state and a deauthentication state. The request data frame having the highest priority in the current connection state comprises an association frame in the disassociation state and a deauthentication frame in the deauthentication state. 
     In block S 308 , the response module  208  determines whether the first WLAN device  10  has received the response data frame from the second WLAN device  20 . 
     If the first WLAN device  10  receives no response data frame, the response module  208  determines no attack has been attempted, and block S 302  is executed, in which the detection module  102  continues detection of the MMPDU. 
     If the first WLAN device  10  receives the response data frame from the second WLAN device  20 , the response module  208  determines that the second WLAN device  20  is currently under attack. 
     Thus, the first WLAN device  10  detects attacks via spurious data frame representations from attackers  30 . 
     The description of the present disclosure has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the forms disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. Various embodiments were chosen and described in order to best explain the principles of the disclosure, the practical application, and to enable others of ordinary skill in the art to understand the disclosure for various embodiments with various modifications as are suited to the particular use contemplated.