I know that this question is old but, I feel the need to follow up with what dr jimbo mentioned.
"...you can possibly get around the rate-limit by frequently
changing your MAC address..."
Well while this is true, mac filtering during wps authentication has been further updated to a fixed rate and most manufacturers no longer rely on filtering the wps locked situation based on the number of attempt "per mac." Instead many have incorporated a general number of attempts total by ANY mac that tries to authenticate. For example:
If 00:11:22:33:44:55 tries to attack twice and fails...
And then 11:22:33:44:55:66 tries to attack...
The combined number of attacks by BOTH macs will trigger the wps locked state. Therefore making mac changing pointless.
Each lock time varies from vendor to vendor. Some will lock for 30 seconds on first failed attempt, some will lock for 60 seconds, some for 120 seconds, etc... It just depends on the vendor. However these are mostly vendor-specific firmware updates and it is not, to my knowledge, a standard practice from the WiFi Alliance. However, there has since been a method of getting around this general lock by using EAPOL flooding and Authentication DOS attacks to force the router to reset. This resets the rate limit timer and wps is no longer locked which allows the attack to continue.
I would assume that a good way to prevent this reset, is to have the external registrar operate on a totally different section of hardware that works independent of the main hardware. This separate section could have something like a CMOS battery which saves the wps states so that even in the case of a power shutdown, the locked state will remain in the case of a bruteforce attempt. I don't know its just a thought I have had as I have reset many routers using a simple tool called MDK3.