A Simplified Solution For Critical A-MPDU DoS Issues July 2008 doc.: IEEE 802.11-08/1021r0 September 2008 A Simplified Solution For Critical A-MPDU DoS Issues Date: 2008-09-04 Authors: Luke Qian etc. Luke Qian etc, Cisco

July 2008 doc.: IEEE 802.11-08/1021r0 September 2008 Abstract Current operation rules for A-MPDU and BAR facilitate a number of Denial of Service (DoS) attacks as presented in 802.11-08/0703r0. This submission proposes a simplified solution to mitigate the most damaging and easiest-to-launch ones. Luke Qian etc. Luke Qian etc, Cisco

Overview for the Issues September 2008 Overview for the Issues Per current 11n A-MPDU/BA rules, advanced SN in data frames or BAR can advance the left edge of the BA re-ordering buffer on the receiver. However, BAR is a control frame which is not encrypted, nor has any authentication information SN in a data frame is not protected with encryption. As a result, a receiver running BA can be exposed to DoS attacks by rogue devices which move the receiver BA reordering buffer with falsely advanced SN, potentially causing subsequent valid frames to be discarded Such identified DoS attacks include: (Ref. 11-08/0703) Forged packets with advanced Sequence Numbers (SN) Captured and Replayed packets with modified SN. Captured and Replayed packets with advanced SN without modification. False Block ACK Request (BAR) with advanced SN. False BA to prevent retransmission. They can cause severe performance degradation, such as drop of voice calls, lost connection for TCP traffic etc. Luke Qian etc.

Uniqueness of the DoS Issues July 2008 doc.: IEEE 802.11-08/1021r0 September 2008 Uniqueness of the DoS Issues Hit-and-run type of attack as only one packet is needed to cause the DoS. So an attacker does not need to be at the spot to launch attacks persistently, making it hard to identify or catch the attackers. Significantly long period of DoS for a single attack At the order of tens of seconds. Can cause disassociations or dropped sessions, especially problematic for tcp sessions and voice connections A regular DoS, CTS with excessive NAV setting for example, can only cause a DoS for a period of tens of ms, several order of magnitudes less than that of an A-MPDU DoS, and will have to repeatedly launch the attacks. Luke Qian etc. Luke Qian etc, Cisco

September 2008 The Proposed Approach The proposed solution focuses on one of the two easiest-to-launch DoS for a better acceptance in TGn: False Block ACK Request (BAR) with advanced SN. Note 1- The another is Forged packets with advanced Sequence Numbers (SN), addressed by switching the blocks of BA reordering and decryption Note2 - Both are “fire and forget” attacks whereby an attacker need nothing but a single packet to launch a DoS. Luke Qian etc.

A Simpler Solution September 2008 July 2008 doc.: IEEE 802.11-08/1021r0 September 2008 A Simpler Solution Introduce a capability bit to signal the protection for backward compatibility Transmitter rules: Never sends BAR with a SN which would cause the receiver to advance the left edge over a “hole” Sends an 11w type of encrypted management action frame, the protected ADDBA, to advance the left edge of the receiver window over a “hole” when needed. Overload the existing ADDBA request frame ADDBA request already contains all the required information Only need to allow an ADDBA request to be used during an established BA session to move the left edge of receiver window Receiver rules: On receiving a BAR which advances the left edge of receiver window over a “hole”, drop the BAR and flag a DoS attack (immediate detection of attack upon receipt of just one frame from attacker), and tear down BA session to minimize disruption On receiving a protected ADDBA for an established BA session, adjust the left edge as requested. Luke Qian etc. Luke Qian etc, Cisco

A Capability Bit for Negotiation: RSN Element changes September 2008 A Capability Bit for Negotiation: RSN Element changes Pre-Auth No Pairwise PTKSA Replay Counter GTKSA Replay Counter Reserved PeerKey Enabled SPP A-MSDU Capable & Required PBAC Resv B0 B1 B2 B3 B4 B5 B6 B8 B9 B10 B11 B12 B13 B15 Modified RSN Capabilities subfield of the RSN Element A bit for signaling the capability: PBAC – Protected BAR Capable Indicates capability to perform modified BAR rules and decryption ordering If both STA advertise PBAC=1, then PBAC SHALL be used If at least one STA of a pair advertises PBAC=0, then PBA SHALL NOT be used STA that supports PBAC must also indicate TGw (e.g. dot11RSNAProtectedManagementFramesEnabled) Luke Qian etc.