KR102627393B1 - Method and apparatus for preventing wireless intrusion - Google Patents

Abstract

This specification relates to a method and device for blocking wireless intrusion. A wireless intrusion blocking method according to an embodiment includes the steps of checking whether a wireless terminal connected to an AP (Access Point) is a terminal to be blocked, and if the wireless terminal is confirmed to be a terminal to be blocked, a channel for channel switching of the wireless terminal. It may include generating a fake action frame including transition notification information and transmitting the fake action frame to the wireless terminal. According to embodiments, there is an advantage of efficiently blocking wireless network access of wireless terminals that violate security policies, regardless of whether PMF technology is applied.

Description

Method and device for blocking wireless intrusion {METHOD AND APPARATUS FOR PREVENTING WIRELESS INTRUSION}

This specification relates to a method and device for blocking wireless intrusion, and more specifically, to a method and device for disconnecting a wireless terminal from a wireless network when a wireless terminal subject to blocking intrudes into a wireless network.

Due to the development of communication technology, wireless LAN technology is becoming widely available. Wireless LAN is a wireless data communication technology that connects two or more devices using a wireless signal transmission method. Through wireless LAN technology, users can continuously access the network while moving in a short distance.

In a wireless LAN environment, a wireless terminal can easily access the wireless network through a communication connection with an AP (Access Point). However, recently, as the number of wireless devices with malicious intent accessing wireless networks increases, wireless network security technology is also developing.

A representative wireless network security technology is WIPS (Wireless Intrusion Prevention System). The WIPS sensor detects packets transmitted between the AP and wireless terminals, determines whether predefined security policies are violated, and can block access of wireless terminals with illegal or malicious purposes. For example, when a wireless terminal to be blocked is discovered, the WIPS sensor can disconnect the wireless terminal to be blocked by transmitting a deauthentication frame or a disassociation frame to the wireless terminal or AP to be blocked.

Meanwhile, in the recently announced WPA3 encryption environment of WIFI6 (IEEE 802.11ax), the PMF (Protected Managed Frame) function based on IEEE 802.11w is applied. When the PMF function is applied, the data exchanged between the wireless terminal and the AP is encrypted and protected, so it becomes difficult to block wireless intrusion of the WIPS sensor using a deauthentication frame or disassociation frame.

The purpose of this specification is to provide a wireless intrusion blocking method and device that can efficiently block wireless network access of wireless terminals that violate security policies, regardless of whether the PMF function is applied.

The purpose of the present specification is not limited to the purposes mentioned above, and other purposes and advantages of the present specification that are not mentioned will be more clearly understood by the examples of the present specification described below. Additionally, the objects and advantages of the present specification can be realized by the components and combinations thereof described in the claims.

A wireless intrusion blocking method according to an embodiment includes the steps of checking whether a wireless terminal connected to an AP (Access Point) is a terminal to be blocked, and if the wireless terminal is confirmed to be a terminal to be blocked, a channel for channel switching of the wireless terminal. It may include generating a fake action frame including transition notification information and transmitting the fake action frame to the wireless terminal.

The wireless intrusion blocking device according to one embodiment may include a control unit that checks whether the wireless terminal connected to the AP is a terminal to be blocked, a frame generator that generates a fake action frame, and a communication unit that transmits or receives data. You can. In one embodiment, when the control unit determines that the wireless terminal is a blocking target terminal, the frame generator controls the fake action frame to generate the fake action frame including channel change notification information for channel change of the wireless terminal, The communication unit may control transmission of the fake action frame to the wireless terminal.

According to embodiments, there is an advantage of efficiently blocking wireless network access of wireless terminals that violate security policies, regardless of whether PMF technology is applied.

Figure 1 shows a network configuration including a wireless intrusion prevention device, a wireless terminal, and an AP according to an embodiment.
Figure 2 is a flowchart showing a connection establishment process between a wireless terminal and an AP according to an embodiment.
Figure 3 is a flowchart showing a process in which a wireless intrusion prevention device disconnects the AP and the wireless terminal when the wireless terminal established a connection with the AP is a terminal to be blocked in one embodiment.
Figure 4 shows the structure of an action frame generated by a wireless intrusion prevention device in one embodiment.
Figure 5 shows the category of the action frame according to the field value of the category field of the action frame generated by the wireless intrusion prevention device in one embodiment.
Figure 6 shows types of public action frames according to field values of the action field of the public action frame generated by the wireless intrusion prevention device in one embodiment.
Figure 7 shows the structure of a channel change notification field included in a public action frame generated by a wireless intrusion prevention device in one embodiment.

The above-mentioned objectives, features and advantages will be described in detail later with reference to the attached drawings, and thus, those skilled in the art will be able to easily implement the embodiments of the present specification. In describing the present specification, if it is determined that a detailed description of known technology related to the present specification may unnecessarily obscure the gist of the present specification, the detailed description will be omitted. Hereinafter, preferred embodiments of the present specification will be described in detail with reference to the attached drawings. In the drawings, identical reference numerals indicate identical or similar components.

Figure 1 shows a network configuration including a wireless intrusion prevention device, a wireless terminal, and an AP according to an embodiment.

Referring to FIG. 1, a wireless network according to an embodiment may include a wireless intrusion prevention device (1), a WIPS server (2), an Access Point (AP) (3), and a wireless terminal (4). In FIG. 1, only one wireless terminal 4 is shown for convenience of explanation, but in other embodiments, the wireless network may include multiple wireless terminals.

AP 3 is a device that provides access to the distribution system via wireless media for terminals associated with it. AP is used as a concept that includes PCP (Personal BSS Coordination Point), and in a broad sense, it refers to concepts such as centralized controller, base station (BS), Node-B, BTS (Base Transceiver System), or site controller. All can be included. In this specification, the AP may also be referred to as a base wireless communication terminal, and the base wireless communication terminal is a term that includes all of the AP, base station, eNodeB (eNB), and transmission point (TP) in a broad sense. It can be used as In addition, the base wireless communication terminal may include various types of wireless communication terminals that allocate communication medium resources and perform scheduling in communication with a plurality of wireless communication terminals.

The wireless terminal (station) 4 is a device that can wirelessly connect to the AP (3) through wireless communication. Examples of the wireless terminal 4 include a desktop or laptop equipped with a wireless LAN device, a smartphone, and a tablet, but the type of the wireless terminal 4 is not limited thereto. The wireless terminal 4 is any device that includes Medium Access Control (MAC) and a physical layer interface to the wireless medium that complies with the provisions of the IEEE 802.11 standard. In the broad sense, it is a non-access point (nonAP). ) It can include both stations as well as access points (APs). In this specification, 'terminal' refers to a non-AP station, but depending on the embodiment, it may be used to refer to both a non-AP station and an AP.

The wireless terminal 4 includes a processor and a transmit/receive unit, and may further include a user interface unit and a display unit, depending on the embodiment. The processor may generate frames to be transmitted over a wireless network, process frames received over a wireless network, and perform various other processes to control the station. And the transmitting and receiving unit is functionally connected to the processor and transmits and receives frames for the station through a wireless network. The wireless terminal 4 can exchange frames with the AP 3 through a wireless network.

The wireless intrusion prevention device 1 according to an embodiment can detect or collect data packets transmitted between the AP 3 and the wireless terminal 4. A data packet may refer to a unit of information transmitted as a block from one device to another device through a communication network. In one embodiment, a data packet may include various element fields such as service set identifier (SSID), supported rate, timestamp, beacon interval, channel information, etc. In one embodiment, the wireless intrusion prevention device 1 may also be referred to as a WIPS sensor.

The wireless intrusion blocking device 1 can check whether the wireless terminal 4 is a terminal to be blocked based on the collected data packets. In this specification, a 'blocking target terminal' may be defined as a terminal included in a predetermined blocking target list or a terminal that violates a predetermined blocking policy. If it is confirmed that the wireless terminal 4 is a terminal subject to blocking, the wireless intrusion prevention device 1 may release the connection between the wireless terminal 4 and the AP 3.

The WIPS server (2) may transmit a list of blocked targets or a blocking policy to the wireless intrusion prevention device (1). Depending on the embodiment, the WIPS server 2 may receive data packets collected by the wireless intrusion prevention device 1 and determine whether the wireless terminal 4 is a terminal to be blocked based on the received data packets. The WIPS server 2 may provide the wireless intrusion prevention device 1 with a determination result as to whether the wireless terminal 4 is a terminal subject to blocking.

In another embodiment, the wireless intrusion blocking device 1 may independently determine whether the wireless terminal 4 is a terminal to be blocked based on a blocking target list or blocking policy provided by the WIPS server 2.

The wireless intrusion prevention device 1 according to an embodiment may include a communication unit 10, a frame generation unit 11, and a control unit 12.

The communication unit 10 may transmit a data packet to another device or receive a data packet transmitted by another device.

The frame generator 11 may generate a data frame to be transmitted to another device according to a command from the controller 12. In one embodiment, the frame generator 11 may generate a fake action frame.

The control unit 12 can check whether the wireless terminal 4 connected to the AP 3 is a terminal subject to blocking based on the data packet received through the communication unit 10. In one embodiment, the control unit 12 transmits a data packet received through the communication unit 10 to the WIPS server 2, and determines whether the wireless terminal 4 is a terminal to be blocked from the WIPS server 2. By receiving the result, it can be confirmed whether the wireless terminal 4 is a terminal subject to blocking. In another embodiment, the control unit 12 may determine whether the wireless terminal 4 is a terminal to be blocked based on a blocking target list or blocking policy provided by the WIPS server 2.

In one embodiment, the control unit 12 may obtain information about the AP 3 and the wireless terminal 4 by analyzing each data packet collected through the communication unit 10. For example, the information on the AP 3 acquired from the control unit 12 includes the basic service set ID (BSSID) and service ID (SSID) of the AP 3 included in the beacon frame that the AP 3 continuously broadcasts. set ID), channel information, whether PMF is used, encryption information, MAC (medium access control) address, etc. In addition, the information on the wireless terminal 4 acquired by the control unit 12 includes the BSSID of the wireless terminal 4, the medium access control (MAC) address, the SSID of the connected AP 3, the BSSID of the connected AP 3, and the connected AP. It may include channel information performing communication with (3).

The control unit 12 may transmit the acquired data packet or information about the AP 3 or the wireless terminal 4 obtained through the data packet to the WIPS server 2.

In one embodiment, if it is confirmed that the wireless terminal 4 connected to the AP 3 is a blocking target terminal, the control unit 12 may request the frame generator 11 to generate a fake action frame.

The frame generator 11 may generate a fake action frame according to a request from the control unit 12. In one embodiment, the fake action frame may include channel switch notification information to induce a channel switch or channel change of the wireless terminal 4.

When the frame generation unit 11 generates a fake action frame, the control unit 12 may request the communication unit 12 to transmit the generated fake action frame to the wireless terminal 4, which is the terminal to be blocked. Accordingly, the communication unit 12 can transmit a fake action frame to the wireless terminal 4.

In one embodiment, the fake action frame generated by the frame generator 11 may be an unencrypted frame based on the Protected Managed Frame (PMF) function.

In one embodiment, the fake action frame generated by the frame generator 11 may be a public action frame defined in the IEEE 802.11 standard.

In one embodiment, the channel switch notification information included in the fake action frame generated by the frame generator 11 may be defined by the extended channel switch announcement field included in the public action frame. .

In one embodiment, the frame generator 11 may generate at least one of the field value of the New Operating Class field and the field value of the New Channel Number field included in the extended channel change notification field. You can create a fake action frame by changing one.

In one embodiment, the transmission address of the fake action frame generated by the frame generator 11 may be set to the address of the AP 3. In one embodiment, the destination address of the fake action frame generated by the frame generator 11 may be set to the address of the wireless terminal 4.

Below, an exemplary embodiment in which the wireless intrusion prevention device 1 according to an embodiment releases the communication connection between the wireless terminal 4 and the AP 3 when the wireless terminal 4 is a terminal subject to blocking is described.

Figure 2 is a flowchart showing a connection establishment process between a wireless terminal and an AP according to an embodiment.

Referring to FIG. 2, AP 3 transmits a beacon frame (S101). In step S101, the AP 3 may set the receiver address or destination address so that the receiver or destination of the beacon frame is not specified. (For example, set to “ff:ff:ff:ff:ff:ff”) That is, in step S101, the AP 3 may transmit a beacon frame by broadcasting. The beacon frame may include the AP 3's basic service set ID (BSSID), service set ID (SSID), channel information, whether PMF is used, encryption information, medium access control (MAC) address, etc.

The wireless terminal 4, which has received the beacon frame transmitted by the AP 3, transmits a probe request frame to the AP 3 (S102).

The AP 3, which has received the probe request frame, transmits a probe response frame to the wireless terminal 4 (S103). At this time, the recipient address or destination address of the probe response frame may be specified as the address of the wireless terminal 4. That is, the probe response frame can be transmitted to the wireless terminal 4 in a unicasting manner.

The wireless terminal 4, which has received the probe response frame, transmits an authentication request frame to the AP 3 (S104).

The AP 3, which has received the authentication request frame, transmits an authentication response frame to the wireless terminal 4 (S105). When the wireless terminal 4 receives the authentication response frame, an authentication procedure is performed between the AP 3 and the wireless terminal 4.

The wireless terminal 4, which has received the authentication response frame and completed the authentication process, transmits an Association Request Frame to the AP 3 (S106).

The AP 3, which has received the authentication request frame, transmits an Association Response Frame to the wireless terminal 4 (S107). When the wireless terminal 4 receives the connection response frame, an association process between the AP 3 and the wireless terminal 4 may be performed based on the information included in the beacon frame or probe response frame.

When the wireless terminal 4 receives the connection response frame and completes the connection with the AP 3, encryption key exchange is performed between the AP 3 and the wireless terminal 4 (S108). An example of an encryption key exchange method is 4-Way Handshake, but the encryption key exchange method is not limited to this.

When the encryption key exchange step (S108) is completed, the connection between the AP (3) and the wireless terminal (4) is established, enabling communication between the AP (3) and the wireless terminal (4) using encryption (e.g., PMF). It becomes.

Figure 3 is a flowchart showing a process in which a wireless intrusion prevention device disconnects the AP and the wireless terminal when the wireless terminal established a connection with the AP is a terminal to be blocked in one embodiment.

Referring to FIG. 3, connection establishment between the AP 3 and the wireless terminal 4 may be performed (S201). The connection establishment step (S201) may include steps (S101) to (S108) shown in FIG. 2. However, depending on the embodiment, connection establishment between the AP 3 and the wireless terminal 4 may be performed through another process.

While connection establishment between the AP (3) and the wireless terminal (4) is being performed, the control unit (12) of the wireless intrusion prevention device (1) transmits and receives information between the AP (3) and the wireless terminal (4) through the communication unit (10). Data packets can be collected (S202). The control unit 12 can collect data packets exchanged between the AP 3 and the wireless terminal 4 even after the connection establishment between the AP 3 and the wireless terminal 4 is completed.

The control unit 12 of the wireless intrusion prevention device 1 can check whether the wireless terminal 4 is a terminal to be blocked using the information included in the collected data packet (S203). In one embodiment, the control unit 12 transmits the collected data packets and/or the information contained in the collected data packets to the WIPS server 2 to confirm whether the wireless terminal 4 is a terminal subject to blocking. You can make a request to the server (2) and receive the confirmation result from the WIPS server (2). In another embodiment, the control unit 12 may independently determine whether the wireless terminal 4 is a blocking target terminal based on the collected data packets and/or information included in the collected data packets.

If it is confirmed in step S203 that the wireless terminal 4 is a terminal to be blocked, the control unit 12 requests the frame generating unit 11 to generate a fake action frame.

The frame generator 11 may generate a fake action frame by referring to the data packets collected by the control unit 12 and/or the information included in the collected data packets (S204).

Figure 4 shows the structure of an action frame generated by a wireless intrusion prevention device in one embodiment.

According to the IEEE 802.11 standard, the action frame is one of the management frames transmitted and received between the AP (3) and the wireless terminal (4). Action frames can be used to trigger specific actions within the network.

Figure 4 shows the structure of an action frame generated by the frame generator 11. The action frame may include a header field, a category field (F1), an action details field (F2, F3), and an FCS field. The action detail field may include an Action field (F2) and an Elements field (F3).

The header field is a Frame Control field indicating the type of frame (control, management, data), a Duration field indicating the waiting time for communication, and a destination address (DA) indicating the destination address of the action frame. Destination Address field, Source Address (SA) field indicating the transmission address of the action frame, BSS ID field indicating the ID of the basic service set, and Sequence, a field related to the order and fragmentation of each frame. A control (Seq-ctl, Sequence Control) field may be included.

The category field (F1) is a field indicating the category of the frame. Figure 5 shows the category of the action frame according to the field value of the category field of the action frame generated by the wireless intrusion prevention device in one embodiment.

In the table shown in FIG. 5, Code represents the field value of the category field of the action frame, and Meaning represents the category of the action frame corresponding to the field value of the category field. Additionally, in Figure 5, Robust indicates whether the action frame corresponding to each category is protected by the PMF function. If the Robust item is 'Yes', it means that the action frame is encrypted and protected by the PMF function. If the Robust item is 'No', it means that the action frame is not protected by the PMF function.

As shown in Figure 5, among action frames, the action frame with Code 4, that is, the public action frame, is not protected by the PMF function. Accordingly, the frame generator 11 may generate a public action frame in which the field value of the category field (F1) is 4 in accordance with the request of the control unit 12.

Public action frames created in this way are not subject to protection by the PMF function. Therefore, when the wireless intrusion prevention device 1 transmits a public action frame to the wireless terminal 4, the wireless terminal 4 receives the public action frame regardless of whether the PMF function is applied and uses the information included in the public action frame. Therefore, channel switching can be performed.

Figure 6 shows types of public action frames according to field values of the action field of the public action frame generated by the wireless intrusion prevention device in one embodiment.

In FIG. 6, Public Action field value represents a field value recorded in the action field (F2) shown in FIG. 4. Additionally, in FIG. 6, Description indicates the type of information included in the public action frame according to the field value of the action field (F2), and the type of information included in the Elements field (F3) is determined accordingly.

In one embodiment, the frame generator 11 may set the field value of the action field (F2) of the public action frame to 4. Accordingly, the public action frame generated by the frame generator 11 may include an extended channel switch announcement field. In one embodiment, the extended channel change notification field can be used as information necessary for channel change of the wireless terminal 4, that is, channel change notification information. The channel change notification field may be included in the element field (F3) shown in FIG. 4.

Figure 7 shows the structure of a channel change notification field included in a public action frame generated by a wireless intrusion prevention device in one embodiment.

Referring to FIG. 7, the channel switch notification field includes a Channel Switch Mode field, a New Operating Class field, a New Channel Number field, and a Channel Switch Count field. , may include a Mesh Channel Switch Parameters element field.

The channel switching mode field indicates restrictions on the data transmission and reception process that must be observed until channel switching is performed. The new operating class field defines a new operating class to which the wireless terminal 4 must change. Each operating class represents a different channel starting frequency, channel frequency spacing, channel set, and operating restrictions. The new channel number field indicates the identifier or number of the new channel to which the wireless terminal 4 must switch. The channel switching count field defines the timing at which channel switching should be performed. The mesh channel switching parameter element field is a field that is used only when the mesh station performs MBSS (Mesh Basic Service Set) channel switching.

In one embodiment, the frame generator 11 allows the wireless terminal 4 to perform communication with the AP 3 by referring to the data packets collected by the control unit 12 and/or the information included in the collected data packets. For this purpose, check at least one of the operation class and identifier of the current channel being used, and at least one of the operation class and identifier that is different from the operation class or identifier of the current channel in the new operation class field and new channel number included in the channel switching mode field. A fake action frame having the structure of a public action frame can be created by recording in at least one of the fields.

Referring again to FIG. 3, the frame generator 11 may generate a fake action frame having the structure of the public action frame described with reference to FIGS. 4 to 7 (S204). The fake action frame generated by the frame generator 11 in step S204 includes a new operation as described above in order to switch to a channel different from the current channel used by the wireless terminal 4 for communication with the AP 3. A channel change notification field in which at least one of the class field and the new channel number field is changed may be included as channel change notification information.

Additionally, the transmission address of the fake action frame generated by the frame generator 11 may be set to the address of the AP, and the destination address may be set to the address of the wireless terminal. Accordingly, the communication release procedure described later can be applied only to the wireless terminal 4 that is the terminal to be blocked, excluding normal wireless terminals.

The control unit 12 may request the communication unit 10 to transmit a fake action frame. Accordingly, the communication unit 10 can transmit a fake action frame to the wireless terminal 4 (S205).

The fake action frame transmitted by the wireless intrusion prevention device 1 may be a public action frame that is not protected by the PMF function. Therefore, the wireless terminal 4 receiving the fake action frame refers to the channel change notification information (e.g., channel change notification field) included in the fake action frame and performs a change to a new channel specified by the fake action frame (S206) ).

When the wireless terminal 4 performs channel switching, data transmission and reception with the AP 3 becomes impossible. Accordingly, the AP 3 can transmit a query message to the wireless terminal 4 (S207). An example of a query message is SA Query, but the type of query message is not limited to this.

Even if the AP 3 transmits an inquiry message, the wireless terminal 4 does not transmit a response message to the inquiry message of the AP 3 because the channel switch has been completed. If a response message to the query message is not received from the wireless terminal 4, the AP 3 releases the communication connection with the wireless terminal 4 (S208). Accordingly, the communication connection between the wireless terminal 4, which is the terminal to be blocked, and the AP 3 is terminated.

According to the wireless intrusion prevention method performed by the wireless intrusion prevention device 1 according to the above-described embodiment, communication connection to the wireless terminal 4 is disconnected by using a public action frame that is not subject to PMF as a fake action frame. do. Therefore, there is an advantage that the connection between the wireless terminal 4 and the AP 3 can be disconnected even when the AP 3 and the wireless terminal 4, which is the terminal to be blocked, are communicating using the PMF function. Of course, the wireless intrusion prevention method performed by the wireless intrusion prevention device 1 according to the above-described embodiment is effective even when the AP 3 and the wireless terminal 4, which is the terminal to be blocked, are communicating without using the PMF function. Applicable.

In addition, according to the above-described embodiment, in the process of disconnecting the wireless terminal 4 recognized as a blocking target terminal, no separate data packet is transmitted to the AP 3, and no separate data packet is transmitted to the AP 3. Not required. Therefore, there is an advantage in that it is possible to efficiently disconnect the connection between the AP (3) and the wireless terminal (4), which is recognized as a blocking target terminal, without increasing the load or consuming resources of the AP (3).

As described above, the present specification has been described with reference to the illustrative drawings, but the present specification is not limited to the embodiments and drawings disclosed herein, and various modifications may be made by those skilled in the art. In addition, even if the effects of the configuration of the present specification were not explicitly described and explained in the above description of the embodiments of the present specification, the predictable effects of the configuration should also be recognized.

Claims (12)

Confirming whether a wireless terminal connected to an AP (Access Point) is a terminal subject to blocking;
If it is confirmed that the wireless terminal is a blocking target terminal, generating a fake action frame including channel change notification information for channel change of the wireless terminal; and
Transmitting the fake action frame to the wireless terminal,
The step of generating the fake action frame is
With reference to the data packet transmitted between the AP and the wireless terminal or the information included in the data packet, information about a channel different from the current channel that the wireless terminal is using to communicate with the AP is provided. Including the step of generating channel change notification information,
The fake action frame is an unencrypted public action frame based on the Protected Managed Frame (PMF) function.
How to block wireless intrusion.
delete delete According to paragraph 1,
The channel change notification information is
Defined by the extended channel switch announcement field included in the public action frame
How to block wireless intrusion.
According to clause 4,
The step of generating the fake action frame is
Comprising the step of changing at least one of the field value of the New Operating Class field and the field value of the New Channel Number field included in the extended channel change notification field.
How to block wireless intrusion.
According to paragraph 1,
The transmission address of the fake action frame is set to the address of the AP, and the destination address of the fake action frame is set to the address of the wireless terminal.
How to block wireless intrusion.
A control unit that checks whether the wireless terminal connected to the AP is a terminal to be blocked;
A frame generator that generates a fake action frame; and
It includes a communication unit that transmits or receives data,
The control unit
When it is confirmed that the wireless terminal is a blocking target terminal, the frame generating unit controls the fake action frame to generate the fake action frame including channel change notification information for channel switching of the wireless terminal, and the communication unit sends the fake action frame to the wireless terminal. Controls transmission of action frames,
The frame generator
With reference to the data packet transmitted between the AP and the wireless terminal or the information included in the data packet, information about a channel different from the current channel that the wireless terminal is using to communicate with the AP is provided. Created with channel change notification information,
The fake action frame is an unencrypted public action frame based on the Protected Managed Frame (PMF) function.
Wireless intrusion prevention device.
delete delete In clause 7,
The channel change notification information is
Defined by the extended channel switch announcement field included in the public action frame
Wireless intrusion prevention device.
According to clause 10,
The frame generator
Generating the fake action frame by changing at least one of the field value of the New Operating Class field and the field value of the New Channel Number field included in the extended channel change notification field.
Wireless intrusion prevention device.
In clause 7,
The transmission address of the fake action frame is set to the address of the AP, and the destination address of the fake action frame is set to the address of the wireless terminal.
Wireless intrusion prevention device.