Wi-Fi deauthentication attack detection and prevention

An apparatus for wireless communications, comprising:

• at least one memory;
• and
• at least one processor coupled to the at least one memory and configured to:
• receive, by the apparatus, a protected Wi-Fi data frame including an address indicative of an identified wireless access point (AP), wherein data of the protected Wi-Fi data frame is encrypted with a cryptographic transmission key;
• determine, based on successful decryption of the protected Wi-Fi data frame using a stored transmission key obtained in a previous key exchange between the apparatus and the identified wireless AP, that the identified wireless AP is a genuine AP having the address, wherein the stored transmission key is the cryptographic transmission key;
• based on the determination the identified wireless AP is a genuine AP, generate a stored transmitter signature indicative of physical transmission characteristics measured by the apparatus for the protected Wi-Fi data frame, wherein the stored transmitter signature is associated to the identified wireless AP within the at least one memory;
• receive, by the apparatus, an unprotected management frame indicative of a disconnection of the apparatus, wherein a source address of the unprotected management frame is the address indicative of the identified wireless AP, and wherein the apparatus is an associated client connected to the identified wireless AP;
• determine a transmitter signature for the unprotected management frame, the transmitter signature determined based on one or more physical transmission characteristics measured by the apparatus for the unprotected management frame;
• determine a difference between the transmitter signature for the unprotected management frame and the stored transmitter signature associated to the identified wireless AP;
• determine, based on the difference being greater than a threshold, the unprotected management frame is not transmitted by the identified wireless AP;
• and
• drop the unprotected management frame based on the determination that the unprotected management frame is not transmitted by the identified wireless AP.