US 2021/0282016 A1 · DENIAL OF SERVICE ATTACK DETECTION AND MITIGATION

Abstract

Wireless communications systems may detect network attacks based on analysis of medium access control (MAC) addresses and origination locations associated with incoming authentication requests. For example, a DoS attack may be detected by determining (e.g., via a database) whether a particular MAC address is associated with multiple authentication request messages without proceeding to an authentication step. According to the described techniques, a system (e.g., an AP, controller/cloud, etc.) may maintain a database of authentication requests and associated MAC addresses, timestamps, and location information. As such, upon reception of an authentication request corresponding to a MAC address, the MAC address may be compared to the database. If the delta (e.g., timestamp difference) between authentication requests from a same MAC address is less than a threshold, the system may detect a potential DoS attack by a client associated with the MAC address and the MAC address may be removed from the AP.

Claims20

Dependent claims

A method for wireless communications, comprising:

receiving an authentication request corresponding to a medium access control (MAC) address;
comparing the MAC address to a database comprising one or more MAC address entries associated with other received authentication requests, a timestamp associated with each of the one or more MAC address entries, and location information associated with each of the one or more MAC address entries;
detecting a denial of service attack based at least in part on the comparison;
and
discarding the received authentication request based at least in part on the detected denial of service attack.

2 more elements

An apparatus for wireless communications, comprising:

a processor,
memory coupled with the processor;
and
instructions stored in the memory and executable by the processor to cause the apparatus to:
receive an authentication request corresponding to a medium access control (MAC) address;
compare the MAC address to a database comprising one or more MAC address entries associated with other received authentication requests, a timestamp associated with each of the one or more MAC address entries, and location information associated with each of the one or more MAC address entries;
detect a denial of service attack based at least in part on the comparison;
and
discard the received authentication request based at least in part on the detected denial of service attack.

6 more elements

Dependencies are inferred from the claim text.

Denial of service attack detection and mitigation

Life of this patent

Denial of service attack detection and mitigation

Life of this patent

Abstract

Claims20