Protection of a wireless access point (AP) from repeated attacks

1 . A wireless access point (AP), comprising:

at least one memory;

at least one processor communicatively coupled with the at least one memory, the at least one processor operable to cause the wireless AP to:

receive a first incorrect security credential input from a wireless station (STA) to connect to the wireless AP;

add a first delay time period for entry of another security credential input in an input field on the wireless STA;

receive a second incorrect security credential input from the wireless STA after the first delay time period;

add a second delay time period for entry of another security credential input in the input field on the wireless STA, wherein the second delay time period has a non-zero value and is a higher value than the first delay time period;

receive one or more additional incorrect security credential inputs from the wireless STA to connect to the wireless AP, wherein the first incorrect security credential input, the second incorrect security credential input, and the one or more additional incorrect security credential inputs comprise multiple incorrect security credential inputs associated with one or more media access control (MAC) addresses of the wireless STA;

detect that a number of consecutive incorrect security credential inputs exceeds a threshold;

add the one or more MAC addresses and a location of the wireless STA to an embargo list comprising a list of banned MAC addresses and locations based on the number of consecutive incorrect security credential inputs exceeding the threshold; and

perform one or more actions to block one or more other security credential inputs from each other wireless STA located at and near the location of the wireless STA to connect to the wireless AP, wherein to perform the one or more actions, the at least one processor is further operable to cause the wireless AP to transmit an alert message to a wireless device of an administrator of the wireless AP based on the number of consecutive incorrect security credential inputs exceeding the threshold, wherein the alert message comprises data associated with the number of consecutive incorrect security credential inputs and the one or more MAC addresses associated with the multiple incorrect security credential inputs.

2 . The wireless AP of claim 1 , wherein the at least one processor, to perform the one or more actions, is further operable to disable an input field on the wireless STA to prevent entry of the one or more other security credential inputs to connect to the wireless AP.

3 . The wireless AP of claim 1 , wherein the at least one processor, to perform the one or more actions, is further operable to cause the wireless AP to generate an alert tone based on the number of consecutive incorrect security credential inputs exceeding the threshold.

4 . The wireless AP of claim 1 , wherein the at least one processor is further operable to cause the wireless AP to:

receive a third incorrect security credential input of the multiple incorrect security credential inputs from the wireless STA after the second delay time period; and

add a third delay time period for entry of another security credential input in the input field on the wireless STA, wherein a value of the third delay time period is a higher value than a value of the second delay time period.

5 . The wireless AP of claim 1 , wherein the at least one processor is further operable to cause the wireless AP to determine the location of the wireless STA, using at least one of: a round trip time (RTT) measurement or an angle of arrival (AoA) measurement, based on one or more of the multiple incorrect security credential inputs received from the wireless STA.

6 . The wireless AP of claim 5 , wherein the at least one processor, to perform the one or more actions, is further operable to cause the wireless AP to block one or more subsequent security credential inputs received from each wireless STA located at the determined location to prevent connection to the wireless AP based on the number of consecutive incorrect security credential inputs exceeding the threshold.

7 . The wireless AP of claim 1 , wherein the at least one processor is further operable to cause the wireless AP to:

receive, from the wireless STA associated with a first MAC address, a first connection request to connect to the wireless AP;

determine a first location of the wireless STA, using at least one of: a round trip time (RTT) measurement or an angle of arrival (AoA) measurement, based on the first connection request; and

determine whether at least one of the first MAC address or the first location is in an allow list comprising a list of approved MAC addresses and corresponding locations.

8 . The wireless AP of claim 7 , wherein the at least one processor is further operable to cause the wireless AP to:

present an input field on the wireless STA for entry of a first security credential input, based on at least one of the first MAC address or the first location being within the allow list;

receive the first security credential input from the wireless STA to connect to the wireless AP; and

connect with the wireless STA, based on the first security credential input being correct.

9 . The wireless AP of claim 8 , wherein the at least one processor is further operable to cause the wireless AP to:

add the first MAC address and the first location of the wireless STA in the embargo list, based on the first security credential input being incorrect.

10 . The wireless AP of claim 1 , wherein the at least one processor is further operable to cause the wireless AP to:

receive, from the wireless STA associated with a first MAC address, a first connection request to connect to the wireless AP;

determine a first location of the wireless STA, using at least one of: a round trip time (RTT) measurement or an angle of arrival (AoA) measurement, based on the first connection request; and

determine whether the first MAC address and the first location are within the embargo list.

11 . The wireless AP of claim 10 , wherein the at least one processor is further operable to cause the wireless AP to:

cause an input field to be presented on the wireless STA for entry of a first security credential input to connect to the wireless AP, based on the first MAC address and the first location not being within the embargo list;

receive the first security credential input from the wireless STA to connect to the wireless AP; and

connect with the wireless STA, based on the first security credential input being correct.

12 . The wireless AP of claim 11 , wherein the at least one processor is further operable to cause the wireless AP to:

add the first MAC address and the first location of the wireless STA to a candidate embargo list, based on the first security credential input being incorrect.

13 . The wireless AP of claim 12 , wherein the at least one processor is further operable to cause the wireless AP to:

receive one or more additional security credential inputs from the wireless STA to connect to the wireless AP; and

add the first MAC address and the first location of the wireless STA to the embargo list, based on the one or more additional security credential inputs received from the wireless STA being incorrect and the number of consecutive incorrect security credential inputs exceeding the threshold.

14 . A method for wireless communication performable at a wireless access point (AP), comprising:

receiving a first incorrect security credential input from a wireless station (STA) to connect to the wireless AP;

adding a first delay time period for entry of another security credential input in an input field on the wireless STA;

receiving a second incorrect security credential input from the wireless STA after the first delay time period;

adding a second delay time period for entry of another security credential input in the input field on the wireless STA, wherein the second delay time period has a non-zero value and is a higher value than the first delay time period;

receiving one or more additional incorrect security credential inputs from the wireless STA to connect to the wireless AP, wherein the first incorrect security credential input, the second incorrect security credential input, and the one or more additional incorrect security credential inputs comprise multiple incorrect security credential inputs associated with one or more media access control (MAC) addresses of the wireless STA;

detecting that a number of consecutive incorrect security credential inputs exceeds a threshold;

adding the one or more MAC addresses and a location of the wireless STA to an embargo list comprising a list of banned MAC addresses and locations based on the number of consecutive incorrect security credential inputs exceeding the threshold; and

performing one or more actions to block one or more other security credential inputs from each other wireless STA located at and near the location of the wireless STA to connect to the wireless AP, wherein the performing of the one or more actions further comprises transmitting an alert message to a wireless device of an administrator of the wireless AP based on the number of consecutive incorrect security credential inputs exceeding the threshold, wherein the alert message comprises data associated with the number of consecutive incorrect security credential inputs and the one or more MAC addresses associated with the multiple incorrect security credential inputs.

15 . The method of claim 14 , wherein the performing of the one or more actions further comprises disabling an input field on the wireless STA to prevent entry of the one or more other security credential inputs to connect to the wireless AP.

16 . The method of claim 14 , the performing of the one or more actions further comprises generating an alert tone based on the number of consecutive incorrect security credential inputs exceeding the threshold.

17 . The method of claim 14 , wherein:

the receiving comprises receiving a third incorrect security credential input of the multiple incorrect security credential inputs from the wireless STA after the second delay time period; and

adding a third delay time period for entry of another security credential input in the input field on the wireless STA, wherein a value of the third delay time period is a higher value than a value of the second delay time period.

18 . The method of claim 14 , further comprising determining the location of the wireless STA, using at least one of: a round trip time (RTT) measurement or an angle of arrival (AoA) measurement, based on one or more of the multiple incorrect security credential inputs received from the wireless STA.

19 . The method of claim 18 , further comprising blocking one or more subsequent security credential inputs received from each wireless STA located at the determined location to prevent connection to the wireless AP based on the number of consecutive incorrect security credential inputs exceeding the threshold.

20 . The method of claim 14 , further comprising:

receiving, from the wireless STA associated with a first MAC address, a first connection request to connect to the wireless AP;

determining a first location of the wireless STA, using at least one of: a round trip time (RTT) measurement or an angle of arrival (AoA) measurement, based on the first connection request; and

determining whether at least one of the first MAC address or the first location is in an allow list comprising a list of approved MAC addresses and corresponding locations.

21 . The method of claim 20 , further comprising:

presenting an input field on the wireless STA for entry of a first security credential input based on at least one of the first MAC address or the first location being within the allow list;

receiving the first security credential input from the wireless STA to connect to the wireless AP; and

connecting with the wireless STA based on the first security credential input being correct.

22 . The method of claim 21 , further comprising:

adding the first MAC address and the first location of the wireless STA in the embargo list based on the first security credential input being incorrect.