Location privacy protection method for preventing WiFi ranging

Abstract

The invention discloses a location privacy protection method for preventing WiFi ranging, which comprises the following steps of: S1, proposing a method for checking a ranging frame in an MAC (Media Access Control) layer for a legal ranging request of an 802.11 mc protocol; and S2, aiming at unauthorized ranging implemented by an attacker, a legal wireless node (STA) and a wireless access point (AP) respectively execute a designed suspicious node detection algorithm. And S3, according to a detection result in the S2, the legal STA dynamically adjusts the time length of a short inter-frame space (SIFS) of the MAC layer to influence the accuracy of the distance measured by the attacker. And S4, according to a detection result in the S2, the AP notifies suspicious node information of the whole network, and the legal STA stops sending an ACK acknowledgement frame to the suspicious node. According to the method, firstly, a legal ranging request is rejected, secondly, the ranging precision of an attacker is influenced, thirdly, the legal STA is prevented from continuously sending an ACK frame to the attacker, and finally, position privacy protection is realized.

Description

Technical Field

[0001] The invention belongs to the technical field of computer networks, and in particular relates to a location privacy protection method for preventing WiFi ranging. Background Art

[0002] According to statistics, humans spend an average of 80% of their time indoors, so indoors are an important place for human activities, and their positioning needs are becoming increasingly important. Indoor positioning technology has broad application prospects in public safety and emergency response, positioning guidance, social needs and market promotion needs. However, GPS (Global Positioning System) signals will be greatly weakened indoors, so it is difficult to completely rely on GPS technology for positioning in indoor environments. Therefore, indoor wireless positioning technology is increasingly valued by academia and industry. In addition to cellular positioning technology for communication networks, common indoor wireless positioning technologies include WiFi, Bluetooth, ultra-wideband, RFID (Radio Frequency Identification), ZigBee and ultrasound. However, due to the existence of building structures in the indoor environment, the indoor environment of buildings is more complex and diverse than the outdoor environment, which brings great challenges to indoor positioning technology.

[0003] Through a wireless local area network composed of wireless access points (or wireless routers), 802.11 (or WiFi) can achieve positioning, monitoring and tracking tasks in complex environments. The 802.11mc standard released by IEEE (Institute of Electrical and Electronics Engineers) defines a fine timing measurement (FTM) mechanism to support precise time measurement with a timing granularity of 0.1 nanoseconds (ns). Therefore, FTM technology can theoretically achieve a ranging granularity of 3 cm. However, the FTM ranging positioning mechanism requires both parties to enable the 802.11mc function. In other words, authorization is required from both parties to the ranging.

[0004] The working principle of FTM ranging protocol is as follows Figure 5As shown. Consider that there is a target terminal Station (STA) and a wireless access point Access Point (AP) in the network. STA first sends an FTM ranging request to AP. When AP receives the FTM request sent by STA, AP can agree or reject the ranging. If AP sends an ACK (Acknowledge) confirmation frame agreeing to the ranging, it means that it agrees to perform the ranging task. After that, AP starts sending FTM data frames and waits for STA to return an ACK confirmation frame. Based on the timestamp of the FTM frame sending and the timestamp of the ACK frame receiving, AP estimates the round trip time (RTT) of the two frames. AP can send multiple FTM frames, but must wait to receive the ACK frame sent back by STA before continuing to send new FTM data frames.

[0005] According to the above FTM ranging principle, the total round-trip time of a data frame exchange in the ranging process can be defined as:

[0006] RTT = (t4-t1)-(t3-t2) (1)

[0007] Among them, t4 is the time when the AP receives the ACK frame from the target terminal STA, t1 is the time when the AP sends the FTM data frame, t2 is the time when the target terminal STA receives the FTM data frame, and t3 is the time when the STA sends the ACK frame. In the 802.11 protocol network, (t3-t2) is the SIFS (Short interframe space) time of the MAC layer, which is usually set to a static value.

[0008] Therefore, equation (1) can be written as: RTT = (t4-t1)-tSIFS (2)

[0009] From the above formula, we can see that the total round-trip time of the FTM data frame (t4-t1) minus the SIFS time can be obtained to get the round-trip time for transmitting an FTM data frame. Then, by multiplying the electromagnetic wave speed C and the round-trip time value RTT, we can get the one-way distance between the AP and the STA: D = 0.5*RTT*C (3)

[0010] In order to reduce the random error of the measurement, L FTM data frames can be transmitted successively, and the above calculation process is repeated for each FTM data frame message exchange. Then the above L RTT measurement values ​​are averaged, and the average round-trip time of the FTM message can be obtained as:

[0011]

[0012] Based on this, we can substitute it into formula (3) to calculate the average distance between STA and AP.

[0013] The study of the document "Non-Cooperative Wi-Fi Localization & its Privacy Implications" (Abedi, International Conference on Mobile Computing and Networking 2022) shows that due to the inherent design defects of the IEEE802.11 device hardware and the physical layer of the communication protocol, even if the stranger host is not legally authorized to join a WiFi (in other words, the stranger host does not have the access password of this WiFi), the legitimate wireless terminal in this WiFi will still send an ACK frame without discrimination when receiving the data frame of the stranger wireless host, thereby exposing its MAC address and related information. The document calls the above phenomenon "polite WiFi". According to the survey, the vast majority of WiFi terminals on the market have "polite WiFi" behavior. Therefore, hackers can use the above FTM ranging principle and "polite WiFi" to propose an unauthorized WiFI positioning attack. Consider that there are three types of nodes in the unauthorized ranging scenario. The first type is the WiFi manager AP. The second type is the legitimate wireless node STA of WiFi. As a terminal member of WiFi, we can also call it a "target machine" because it may become a victim of location privacy leakage. The third type is the thief of location distance privacy, which we call a suspicious node or attacker. Without the consent of the wireless terminal under test, hackers can use forged data frames to measure the round-trip time, measure the distance between the two parties in an unauthorized environment, and finally obtain the location information of the terminal under test. Unlike legal FTM ranging, "courtesy WiFi" attackers do not need to send special 802.11mc ranging frames, nor do they need the target machine to support the 802.11mc protocol. The attacker only needs to forge ordinary data frames and lure the target machine to send ACK confirmation frames according to the 802.11MAC layer communication rules to measure the flight time of the forged data frame transmission and calculate the distance between the attacker and the victim terminal. The specific process of network attacks based on "courtesy WiFi" is as follows: Figure 6 As shown. The attacker sends a forged data frame and records the time when it sends the data frame and the time when it receives the ACK confirmation frame from the target machine. Then, according to the static SIFS value specified by the default 802.11 protocol, the distance between the target machine and itself can be obtained using formula (2) and formula (3), thereby obtaining the target machine's location privacy data.

[0014] After searching domestic and foreign literature, it was found that the existing paper "Indoor Positioning System Based on WIFI-RTT" (Peng Zhaofeng, Master's Thesis of Huazhong University of Science and Technology, 2020) proposed a WiFi-based indoor positioning technology solution. The existing paper "Research on Wireless Network Indoor Positioning System Based on Precise Time Measurement" (Tang Xiangyu, Journal of Computer Science, 2022) uses low-cost market equipment to build an indoor positioning system and proposes a new single-target network positioning solution. However, neither of the above two documents considers the problem of unauthorized positioning. The existing paper "Non-Cooperative Wi-Fi Localization & its Privacy Implications" (Abedi, International Conference on Mobile Computing and Networking 2022) proposes an unauthorized positioning solution based on 802.11 confirmation frames to address the security vulnerabilities of the 802.11 protocol. Experiments show that this scheme can bypass the consent of legitimate users and obtain more accurate victim location information, which poses a severe challenge to the location privacy of 802.11 networks. Summary of the invention

[0015] Purpose of the invention: The present invention proposes a location privacy protection method to prevent WiFi ranging by modifying the algorithm of the MAC protocol without modifying the underlying hardware and physical layer programs. First, in order to prevent attackers from using the 802.11mc protocol enabled by the legal STA by default to perform legal ranging, the present invention proposes a method for the MAC layer to verify the activation of the 802.11mc ranging function, so as to prevent users from defaulting to or accidentally enabling the 802.11mc ranging protocol and leaking their own location information. Secondly, in order to prevent attackers from using the "courtesy WiFi" security vulnerability to implement unauthorized ranging, the present invention designs a suspicious node detection algorithm. On the one hand, the legal STA node affects the accuracy of the distance measured by the attacker by dynamically adjusting the SIFS duration frame. On the other hand, the AP can notify the entire network, and the legal STA can stop sending response frames to the potential attacker node, so as to achieve the purpose of preventing ranging, and realize location privacy protection.

[0016] Technical solution: In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is specifically: a location privacy protection method for preventing WiFi ranging, comprising the following steps:

[0017] S1: Detect and judge the 802.11mc ranging data packet, and do not respond to the ranging request based on the FTM mechanism.

[0018] S2: Design a suspicious node detection algorithm, and the legitimate terminal STA node and AP node each perform suspicious node detection.

[0019] S3: According to the execution result of the suspicious node detection in S2, the legal terminal STA obtains the suspicious weight coefficient w, sets the execution probability p equal to w, and STA executes the ranging error strategy according to the probability p, that is, dynamically changes the SIFS value.

[0020] S4: According to the execution result of the suspicious node detection in S2, the AP broadcasts the suspicious node information to the network. After receiving the broadcast notification, the legal terminal STA parses the MAC address information carried in it, and the STA stops responding to the data frame of the suspicious node.

[0021] As an optimization, S1: detects and judges the 802.11mc ranging data packet, and does not respond to the ranging request based on the FTM mechanism.

[0022] The wireless frames transmitted in the 802.11 protocol are divided into three categories, namely management frames, control frames and data frames. Management frames can be further divided into subcategories such as beacon frames, association frames, inquiry frames and action frames. Action frames are mainly used to send various management messages, such as bandwidth adjustment, power control and QoS. The FTM protocol uses the action frames of the 802.11 protocol to transmit ranging requests and responses. Therefore, the present invention detects the received data frames on the legal STA to determine whether they are 802.11mc ranging data frames. For ranging data frames, the legal STA does not respond at the MAC layer.

[0023] S1.1: After receiving an 802.11 frame, a legitimate STA reads the type and subtype fields of the frame control field of the frame.

[0024] If the content in the type field is binary "00" and the content in the subtype field is binary "1101", the frame is determined to be an action frame in the management frame, and the detection process enters S1.2.

[0025] If the content in the type field is not equal to binary "00" or the content in the subtype field is not equal to binary "1101", it is determined that the frame is not an action frame and the first step S1 detection procedure is exited.

[0026] Therefore, the pseudo code of S1.1 is

[0027] if(pkt.type==00&&pkt.Subtype==1101)

[0028] {the frame is an action frame;

[0029] Enter S1.2;

[0030] }

[0031] Else{exit S1}

[0032] S1.2: The legitimate STA continues to read the payload content of the action frame, reading the category code and publication fields.

[0033] If the contents of the above two fields are "0100" and "00100000" respectively, it means that the frame is an 802.11mc protocol frame, which uses the FTM protocol to make a ranging request. At this time, the legitimate STA does not send a ranging response frame.

[0034] If the contents of the above two fields are not "0100" and "00100000", the first step S1 detection program is exited.

[0035] Therefore, the pseudo code of S1.2 is

[0036] if(pkt.category code==0100&&pkt.public action==00100000)

[0037] {the frame is 802.11mc frame;

[0038] Disable FTM;

[0039] }

[0040] Else{exit S1}.

[0041] As an optimization, S2: the legitimate terminal STA node and AP node each perform suspicious node detection.

[0042] If an attacker attempts to use non-FTM frames to implement malicious ranging, according to the ranging principle, it is also necessary to ensure that the legitimate STA responds to the malicious frame. However, in order to extend the working time, wireless network nodes usually periodically enter a power-saving sleep state. Therefore, in order to implement malicious ranging, the attacker first needs to wake up all wireless nodes that may be in a sleep state in the network by broadcasting beacon frames.

[0043] In order to enable the wireless terminal STA to achieve energy saving, the energy saving mode working mechanism of the 802.11 protocol is as follows. In order to save communication energy consumption, the wireless terminal is periodically in the dormant (unable to communicate) and awake (normal communication) states. When an AP receives a data frame frame destined for a wireless terminal A, considering that terminal A may be in a dormant state at this time, the AP will not forward it to terminal A immediately. Instead, it will first cache the data frame frame, and only when terminal A actively requests the AP after the dormancy ends, the AP will send the data frame frame. However, in the actual communication environment, the wireless terminal does not know whether the AP has its own cached data frame. Therefore, the AP needs to periodically broadcast the status of its own cache area in the network to ensure that the wireless terminal knows whether it has cached data frames. After the dormancy period ends, the awakened terminal A interprets the cache information contained in the periodically sent broadcast frame. If the broadcast packet contains the cache information of terminal A, A will request data from the AP, otherwise it will continue to dormant. This can effectively avoid invalid data requests when the node does not have cached data on the AP.

[0044] After a wireless terminal STA joins a WiFi, the AP will map an "Association Identifier" (AID) in the network based on the globally unique MAC address submitted when it first joins. Therefore, AID can be understood as an alias assigned by AP to STA in the network to facilitate communication between AP and many STAs. The range of AID is from 0 to 2007.

[0045] The 802.11 protocol uses the Traffic Indication Map (TIM) field in the beacon frame to identify the forwarding node information corresponding to the AP's cached data frame. Therefore, by detecting the TIM field of the beacon frame, the wireless terminal can know whether it needs to be in the awake state in the next transmission cycle and pull the data frame cached by the AP. If the number of beacon frames sent by a node to try to wake up the wireless terminal is abnormal, it can be determined that the wireless source node may be forging a beacon frame to wake up the dormant terminal.

[0046] S2.1: If the TIM field of the beacon frame received by the legitimate STA is a complete representation. Traverse the Bitmap field in the beacon frame. If all bits in the field are 1, it means that the AP that sent the beacon frame has cached data for all associated STAs. In this case, the frame is suspected to be a wake-up fake frame. Set its suspicious weight w to 1, record the source MAC address of the beacon frame and save it in the suspicious MAC address list. Traverse the Bitmap field in the beacon frame. If the field is not all 1, count the number of binary bits with a value of 1 and record it as j, and set the suspicious weight w to w=w max *j / 2007, where w maxIt can be set to a decimal in the closed interval [0,1], and the source MAC address of the beacon frame is saved in the suspicious MAC address list.

[0047] The complete representation of the TIM field of the beacon frame uses a Bitmap structure to identify and save the cache information status of the wireless terminal. The Bitmap structure is essentially a matrix. Each row of the matrix has 8 columns (8 bits, i.e., one byte), and the number of rows ranges from 1 to 251. Therefore, the maximum storage space of the matrix is ​​251 bytes. Taking the first row of the matrix (containing the 8-bit first byte) as an example, the first to eighth bits of the byte represent AID values ​​0 to 7, that is, the corresponding wireless terminals STA0 to STA7, and the wireless terminals corresponding to the bits in the subsequent bytes are deduced in the same way. The value of a specific element in the matrix represents the cache information status of the corresponding wireless terminal. If the value of an element is 1, it means that the corresponding wireless terminal has a data frame cache on the AP; if the value of an element is 0, it means that the corresponding wireless terminal does not have a data frame cache on the AP. Figure 7 For example, the value in the Bitmap structure indicates that STA1 and STA7, STA12 and STA2003 have data frame caches on the AP. On this basis, the AP periodically broadcasts the beacon frame containing the Bitmap structure. After receiving the broadcast frame, the wireless nodes in the network can check the element value at the corresponding position of the bitmap structure to decide whether to send request data to the AP. The wireless node can also determine whether the sender of the broadcast frame is an attacker who attempts to maliciously wake up the legitimate node by detecting the element value at the corresponding position of the Bitmap structure.

[0048] Therefore, the pseudo code for step S2.1 is

[0049] If (all bits in the Bitmap field content are 1)

[0050] {w=1}

[0051] Else

[0052] {Count the number of binary bits with a value of 1 in the Bitmap field as j;

[0053] w=w max *j / 2007}

[0054] End If.

[0055] S2.2: If the TIM field of the beacon frame received by the legitimate STA is abbreviated, read the associated ID number (AID) of the awakened wireless terminal filled in it. If continuous AID numbers are continuously received from the same AP, the frame is suspected to be a wake-up forged frame, and the source MAC address of the beacon frame is recorded, its suspicious weight is set to w, and saved in the suspicious MAC address list.

[0056] The complete representation of the TIM field in the beacon frame can clearly record the wireless node information of the data frame cached by the AP, but since it marks the cache status of all nodes, it requires up to 251 bytes, which lengthens the length of the beacon frame. Due to the importance of the beacon frame, it is usually sent at the lowest transmission rate (such as 1Mb / s), which affects the transmission efficiency of the 802.11 network. Therefore, the TIM field in the beacon frame can also be abbreviated to identify and save the cache information status of the wireless terminal. The abbreviation of the TIM field can be divided into two components: Bitmap Control and Partial Virtual Bitmap, such as Figure 8 shown.

[0057] The highest bit X0 of Bitmap Control represents whether the AP has multicast / broadcast data packets cached. If it is 1, it means that the wireless terminal has multicast / broadcast data cached by the AP. If it is 0, it means that the wireless terminal has no multicast / broadcast data cached by the AP. The last 7 bits of Bitmap Control, X1 to X7, are Bitmap offsets, which are used to indicate the offset of the AID number of the wireless terminal.

[0058] The Partial Virtual Bitmap is a variable length field ranging from 1 to 251. If the wireless node with the following AID number does not have a corresponding cache, it will not be stored in the Partial Virtual Bitmap. Therefore, the storage space occupied by recording the awakened node information in the beacon frame can be reduced, thereby reducing the length of the beacon frame.

[0059] According to the definition of the abbreviation of the TIM field of the beacon frame above, read the last seven bits of the Bitmap Control field and calculate F = X1*2*8+X2*4*8+X3*8*8+X4*16*8+X5*32*8+X6*64*8+X7*128*8

[0060] Read the Partial Virtual Bitmap field, from Y0 to Y2007, so there are

[0061] G=Y0*0+Y1*1+Y2*2+Y3*3+Y4*4+Y5*5+Y6*6+Y7*7+…+Y2007 *2007

[0062] The AID number of the awakened wireless node is

[0063] AID=F+G

[0064] The receiving node records the AID numbers carried in each beacon frame it receives. If the AID number of the receiving node is in the TIM field of the beacon frame, it needs to remain in a non-sleep state in the next cycle.

[0065] If the wireless terminal detects that the AID number contained in the beacon frame is a continuous value (n, n+1, n+2, ..., n+m), and n and m are both non-negative integers, the device sending the beacon is considered a suspicious node, and the source MAC address of the beacon frame is recorded and saved in the suspicious MAC address list. Otherwise, the detection S2 program is exited.

[0066] Set the suspicious weight to w = w max *m / AP_max

[0067] The number of wireless terminals supported by home Wi-Fi is usually about 20. Therefore, the AP_max parameter of the algorithm is set to 20 by default, and users can also set it by themselves.

[0068] Therefore, the pseudo code for step S2.2 is

[0069] Read the last seven bits of the Bitmap Control field and calculate

[0070] F=X1*2*8+X2*4*8+X3*8*8+X4*16*8+X5*32*8+X6*64*8+X7*128*8

[0071] Read the Partial Virtual Bitmap field, from Y0 to Y2007, and calculate

[0072] G=Y0*0+Y1*1+Y2*2+Y3*3+Y4*4+Y5*5+Y6*6+Y7*7+…+Y 2007 *2007

[0073] The AID number of the awakened wireless node is

[0074] AID=F+G

[0075] If (there are several groups of consecutive numerical values ​​(n, n+1, n+2, ..., n+m) AID numbers in the read beacon frame)

[0076] {w=w max *m / AP_max}

[0077] Else

[0078] {Exit S2}.

[0079] As an optimization, S3: According to the execution result of the suspicious node detection in S2, the legal terminal STA obtains the suspicious weight coefficient w, and sets the execution probability p equal to w. The STA executes the ranging error strategy according to the probability p, that is, dynamically changes the SIFS value.

[0080] Therefore, in order to interfere with the attacker's ranging, this patent intends to dynamically and randomly adjust the SIFS time of the MAC layer on the legitimate wireless node to achieve the effect of increasing the ranging error and prevent the attacker from accurately measuring the distance. Suppose the SIFS baseline value of the legitimate STA's 802.11 network card is b. The user chooses to mislead the ranging value to be too small or too large. If the user does not choose, the default misleading ranging value is too large to protect the location privacy of the legitimate user.

[0081] S3.1: According to the result of the suspicious node detection in step S2, the legal terminal STA obtains the suspicious weight coefficient w, and sets the execution probability p equal to w. The STA executes the ranging error strategy from S3.2 to S3.4 as follows according to the probability p.

[0082] S3.2: If the ranging value is to be misleadingly small, the following operations are performed: When a legitimate STA receives a data frame, it first selects a random positive integer q in the closed interval [b / 2,1].

[0083] q = randint(b / 2,1)

[0084] The SIFS time is (bq) microseconds. Therefore,

[0085] SIFS=bq

[0086] S3.3: If the ranging value is to be misleadingly large, the following operations are performed: The legal STA receives the data frame and randomly selects a positive integer v in the closed interval [b-1,1].

[0087] v = randint(b-1,b)

[0088] The SIFS time is (b+v) microseconds.

[0089] SIFS=b+v

[0090] S3.4: If the legitimate STA sends an ACK confirmation frame in the Tth cycle, and the source is still retransmitting the previous data frame, it means that the SIFS setting is too large, resulting in the MAC frame confirmation timeout on the attacker's side. Therefore, the legitimate STA needs to reduce its SIFS duration by 1 slot. According to the newly calculated SIFS time, the legitimate STA sends an ACK confirmation frame in the next response cycle T+1. Until the other party no longer retransmits the data frame.

[0091] If(data frame is duplicate)then

[0092] {SIFS T+1 =SIFS T -slot}.

[0093] As an optimization, S4: according to the execution result of the suspicious node detection in S2, the AP broadcasts the suspicious node information to the network. After receiving the broadcast notification, the legitimate terminal STA parses the MAC address information carried therein, and the STA stops responding to the data frame of the suspicious node.

[0094] AP does not have energy-saving issues, so it can continuously monitor the energy-saving wake-up packets sent by any nearby node. After executing the suspicious node detection program S2, the results obtained by AP are more comprehensive and accurate. AP first defines all wireless nodes that have not established WiFi encryption authentication with itself as "strange nodes". Secondly, set the notification threshold of suspicious nodes. max , when the AP detects that the suspicious weight coefficient w of a strange node is greater than notice max , then it is determined to be a suspicious node.

[0095] S4.1: The AP executes the suspicious node detection procedure S2. The AP obtains information about all unfamiliar nodes that send beacon frames and calculates the suspicious weight coefficient w of each unfamiliar wireless node.

[0096] S4.2: If the suspicious weight coefficient w of a strange wireless node is greater than the notification threshold max , then AP determines it as a suspicious node. Calculate the number of suspicious nodes r.

[0097] S4.3: The AP constructs a broadcast data frame to notify the network of suspicious nodes.

[0098] In the body of the beacon frame, a "distance privacy flag" (1 byte) field and a "suspicious host MAC address" field (6*k bytes, k is a positive integer) are designed. Fig. 9 shown.

[0099] If the number r of suspicious nodes determined by the AP is equal to 0, the AP exits step S4.

[0100] If the number of suspicious nodes r determined by the AP is a positive integer less than or equal to 254, the binary value of r is filled in the "Distance Privacy Flag" field of the beacon frame body, and the MAC addresses of the suspicious nodes are written in sequence in the "Suspicious Host MAC Address" field of the beacon frame body.

[0101] If the AP determines that the number of suspicious nodes exceeds 255 or the AP cannot identify the attacker's MAC address because the attacker randomly changes its own MAC address, the value of the "Distance Privacy Flag" field is marked as binary "11111111" (i.e., a positive integer 255), indicating that all unfamiliar nodes may be suspicious nodes. Therefore, at this time, the MAC address of the suspicious node does not need to be filled in the "Suspicious Host MAC Address" field of the beacon frame body.

[0102] S4.4: After receiving the broadcast frame, the legitimate wireless terminal parses the "Distance Privacy Flag" field. If the value of this field is equal to 0, the frame parsing is exited. If the value of this field is a positive integer less than or equal to 254, the "Suspicious Host MAC Address" field is read continuously, and the MAC addresses of the suspicious nodes contained therein are extracted one by one. The legitimate wireless terminal no longer responds to any request frames from the above suspicious wireless terminal. If the value of this field is 255, there is no need to read the "Suspicious Host MAC Address" field, and the wireless terminal no longer responds to any request frames from unfamiliar nodes.

[0103] S4.5: The AP periodically broadcasts the MAC address of the unfamiliar node to the legitimate terminals in the network.

[0104] Compared with the prior art, the beneficial effects of the present invention are as follows: S1 in the present invention can prevent users from enabling the 802.11mc ranging protocol by default or unintentionally, thereby leaking their own location information; S3 can affect the accuracy of distance measurement by attackers by dynamically adjusting the SIFS duration frame; S4 notifies the entire network through the AP to stop legitimate STAs from sending response frames to potential attacking nodes, thereby preventing ranging and ultimately achieving location privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0106] Figure 1 This is a schematic diagram of distance measurement comparison in which the distance measurement misleading strategy is executed with a 100% probability when the user does not select the misleading mode or selects the misleading distance measurement value mode which is too large.

[0107] Figure 2This is a schematic diagram of distance measurement comparison in which the user does not select the misleading mode or selects the misleading distance measurement value mode with a large probability of executing the distance measurement misleading strategy.

[0108] Figure 3 A schematic diagram of distance measurement comparison in which the user selects a small misleading distance measurement value mode and executes the distance measurement misleading strategy with a 100% probability.

[0109] Figure 4 A schematic diagram of distance measurement comparison in which the user selects a small misleading distance measurement value mode and executes the distance measurement misleading strategy with a probability of 50%.

[0110] Figure 5 This is the data frame transmission process of the FTM ranging protocol.

[0111] Figure 6 To implement the unauthorized ranging principle using "courtesy WiFi".

[0112] Figure 7 It is the Bitmap structure identifier of the TIM field.

[0113] Figure 8 It is the Bitmap Control and Partial Virtual Bitmap structure of the TIM field.

[0114] Fig. 9 The AP designed for the present invention constructs a broadcast frame for notifying the suspicious node information to the network. DETAILED DESCRIPTION

[0115] The technical solutions in the embodiments of the present invention will be described clearly and completely below so that those skilled in the art can better understand the advantages and features of the present invention, thereby making a clearer definition of the protection scope of the present invention. The embodiments described in the present invention are only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention.

[0116] like Figure 1-9 As shown, the experimental parameters of the present invention are set as follows: the benchmark value b of the 802.11 network card SIFS of the legitimate STA is 10. The wmax of the detection algorithm is 1, and AP_max is usually about 20. The electromagnetic wave propagation speed C is 3*108m / s, and the actual distance between STA and AP is 1000 meters. The attacker measures the same legitimate wireless node 6 times, and the average measurement value is taken as the distance between the attacker and the legitimate STA node. For the convenience of description, in the following embodiments, the legitimate STA node is referred to as "target machine". Specific embodiment 1

[0118] The user did not select the misleading mode or selected the misleading ranging value mode which is too large:

[0119] When the target drone executes the ranging misleading strategy with probability p=100% (i.e. w=1), the ranging correct value and the ranging misleading value implemented by the present invention are as follows: Figure 1 As shown. It can be seen that after detecting a clear location privacy attacker, the patented algorithm randomly increases the SIFS time, and the misleading value of the measured distance between the attacker and the target aircraft is greater than the correct value (1000 meters). At this time, the minimum misleading value is 1150 meters and the maximum is 2350 meters. The attacker can calculate that the average distance between him and the target aircraft is 1650 meters. This value is much greater than the correct value of 1000 meters, achieving the purpose of protecting the location privacy of the target aircraft.

[0120] When the target drone executes the ranging misleading strategy with probability p=50% (i.e. w=0.5), the ranging correct value and the ranging misleading value implemented by the present invention are as follows: Figure 2 As shown. It can be seen that by randomly increasing the SIFS time, the patent algorithm makes the measured distance misleading value between the attacker and the target aircraft greater than or equal to the correct value (1000 meters). At this time, the minimum misleading value is 1000 meters and the maximum is 2200 meters. The attacker can calculate the average distance between the attacker and the target aircraft as 1480 meters. It can be seen that this value is still greater than the correct value of 1000 meters, and the location privacy of the target aircraft can still be well protected. Of course, since the target aircraft only executes the ranging misleading strategy with a probability of 50%, the average distance value (1480 meters) is significantly lower than the ranging average value (1650 meters) when the target aircraft executes the ranging misleading strategy with a probability of p=100%. If the attacker keeps measuring, since the distance misleading algorithm is only executed with a probability of 50% at this time, the attacker may eventually obtain a measurement value that is closer to the true value through a larger number of measurements. However, since the AP can detect the attacker's information and broadcast the network, the target aircraft will stop responding to the suspicious node's data frame after receiving the suspicious node information broadcast. Therefore, the attacker cannot obtain the correct distance value through a higher number of measurements. Specific embodiment 2

[0122] The user selects the misleading small distance measurement mode:

[0123] When the target drone executes the ranging misleading strategy with probability p=100% (i.e. w=1), the ranging correct value and the ranging misleading value implemented by the present invention are as follows: Figure 3 As shown. It can be seen that after detecting a clear location privacy attacker, the patented algorithm randomly reduces the SIFS time, and the misleading value of the measured distance between the attacker and the target aircraft is less than the correct value (1000 meters). At this time, the minimum misleading value is 250 meters and the maximum is 850 meters. The attacker can calculate the average distance between him and the target aircraft to be 625 meters. This value is much smaller than the correct value of 1000 meters, achieving the purpose of protecting the location privacy of the target aircraft.

[0124] When the target drone executes the ranging misleading strategy with probability p=50% (i.e. w=0.5), the ranging correct value and the ranging misleading value implemented by the present invention are as follows: Figure 4 As shown. It can be seen that by randomly reducing the SIFS time, the patented algorithm misleads the actual distance between the attacker and the target aircraft to be less than or equal to the correct value (1000 meters). At this time, the minimum misleading value is 250 meters and the maximum is 1000 meters. The attacker can calculate the average distance between the attacker and the target aircraft to be 725 meters. This value is less than the correct value of 1000 meters, and can still better protect the location privacy of the target aircraft. Of course, since the target aircraft only executes the ranging misleading strategy with a probability of 50%, the average distance value (725 meters) is higher than the ranging average value (625 meters) when the target aircraft executes the ranging misleading strategy with a probability of p=100%. If the attacker keeps measuring, since the distance misleading algorithm is only executed with a probability of 50% at this time, the attacker may eventually obtain a measurement value that is closer to the true value through a larger number of measurements. However, since the AP can detect the attacker's information and broadcast this network, the target aircraft receives such information. Fig. 9 After the suspicious node information is broadcast, read Fig. 9 The attacker can extract the suspicious node information by using the broadcast frames in the network, and then stop responding to the suspicious node’s data frames. Therefore, the attacker cannot obtain the correct distance value through a higher number of measurements.

Claims

1. A location privacy protection method for preventing WiFi ranging, characterized by: The following steps are involved: Step S1: Detect and judge the 802.11mc ranging data frame, and do not respond to the ranging request based on the FTM (Fine Time Measurement) mechanism; Step S2: Design a suspicious node detection algorithm, and the legal terminal STA (Station) node and AP (Access Point) node each perform suspicious node detection; Step S3: According to the execution result of the suspicious node detection in S2, the legal terminal STA obtains the suspicious weight coefficient w, sets the execution probability p equal to w, and the STA executes the ranging error strategy according to the probability p, that is, dynamically changes the SIFS value; Step S4: According to the execution result of the suspicious node detection in S2, the AP broadcasts the suspicious node information to the network. After receiving the broadcast notification, the legal terminal STA parses the MAC address information carried therein, and the STA stops responding to the data frame of the suspicious node.

2. The location privacy protection method for preventing WiFi ranging according to claim 1, characterized in that: Step S1 includes the following steps: S1.1: After receiving the 802.11 frame, the legitimate STA reads the type and subtype fields of the frame control field of the frame; If the content of the type field is binary "00" and the content of the subtype field is binary "1101", the frame is determined to be an action frame in the management frame, and the detection process enters S1.2; If the content in the type field is not equal to binary "00" or the content in the subtype field is not equal to binary "1101", it is determined that the frame is not an action frame and the first step S1 detection procedure is exited; Therefore, the pseudo code of S1.1 is if(pkt.type==00&&pkt.Subtype==1101) {the frame is an action frame; Enter S1.2; } Else{exit S1} S1.2: The legal STA continues to read the payload content of the action frame, reading the category code and public action fields; If the contents of the above two fields are "0100" and "00100000" respectively, it means that the frame is an 802.11mc protocol frame, which uses the FTM protocol to make a ranging request. At this time, the legitimate STA does not send a ranging response frame; If the contents of the above two fields are not "0100" and "00100000", the first step S1 detection program is exited; Therefore, the pseudo code of S1.2 is if(pkt.category code==0100&&pkt.public action==00100000) {the frame is 802.11mc frame; Disable FTM; } Else{exit S1}.

3. A location privacy protection method for preventing WiFi ranging according to claim 1, characterized in that: Step S2 includes the following steps: S2.1: If the TIM field of the beacon frame received by the legitimate STA is a complete representation, traverse the Bitmap field in the beacon frame. If all bits in the field are 1, it means that the AP sending the beacon frame has cached data for all associated STAs. In this case, the frame is suspected to be a wake-up forged frame, and its suspicious weight w is set to 1. The source MAC address of the beacon frame is recorded and saved in the suspicious MAC address list. Traverse the Bitmap field in the beacon frame. If the field is not all 1, count the number of binary bits with a value of 1 and record it as j. Set the suspicious weight w to w=wmax*j / 2007, where wmax can be set to a decimal in the closed interval [0,1], and save the source MAC address of the beacon frame in the suspicious MAC address list; Therefore, the pseudo code of step S2.1 is If(all bits in the Bitmap field content are 1) {w＝1} Else {Count the number of binary bits with a value of 1 in the Bitmap field as j; w=wmax*j / 2007} End If S2.2: If the TIM field of the beacon frame received by the legitimate STA is abbreviated, read the associated ID number (AID) of the awakened wireless terminal filled therein; if continuous AID numbers are continuously received from the same AP, the frame is suspected to be a wake-up forged frame, and the source MAC address of the beacon frame is recorded, its suspicious weight is set to w, and saved in the suspicious MAC address list; According to the abbreviation rules of the TIM field of the beacon frame, the TIM field can be divided into two components: Bitmap Control and PartialVirtualBitmap. First, read the last seven bits of the Bitmap Control field and calculate F=X1*2*8+X2*4*8+X3*8*8+X4*16*8+X5*32*8+X6*64*8+X7*128*8 Next, read the Partial Virtual Bitmap field, from Y0 to Y2007, so there are G=Y0*0+Y1*1+Y2*2+Y3*3+Y4*4+Y5*5+Y6*6+Y7*7+…+Y2007*2007 The AID number of the awakened wireless node is AID=F+G After the wireless terminal STA is authorized to join a WiFi, the AP will map an "Association Identifier" (AID) in the network based on the globally unique MAC address submitted when it first joined. The range of AID is from 0 to 2007. The receiving node records several AID numbers carried by each beacon frame it receives. If the AID number of the receiving node is in the TIM field of the beacon frame, it needs to remain in a non-sleep state in the next cycle. If the wireless terminal detects that the AID number contained in the beacon frame is a continuous value (n, n+1, n+2, ..., n+m), and n and m are both non-negative integers, the device sending the beacon is considered a suspicious node, and the source MAC address of the beacon frame is recorded and saved in the suspicious MAC address list; Set the suspicious weight to w = wmax*m / AP_max The number of wireless terminals supported by home Wi-Fi is usually about 20, so the AP_max parameter of the algorithm is set to 20 by default, and users can also set it by themselves; If the wireless terminal detects that the AID number contained in the beacon frame is a discontinuous value, it exits the detection S2 program; Therefore, the pseudo code of step S2.2 is Read the last seven bits of the Bitmap Control field and calculate F=X1*2*8+X2*4*8+X3*8*8+X4*16*8+X5*32*8+X6*64*8+X7*128*8 Read the Partial Virtual Bitmap field, from Y0 to Y2007, and calculate G=Y0*0+Y1*1+Y2*2+Y3*3+Y4*4+Y5*5+Y6*6+Y7*7+…+Y2007*2007 The AID number of the awakened wireless node is AID=F+G If (there are several groups of consecutive numerical values ​​(n, n+1, n+2, ..., n+m) AID numbers in the read beacon frame) {w=wmax*m / AP_max} Else {Exit S2}.

4. A location privacy protection method for preventing WiFi ranging according to claim 1, characterized in that: Step S3 includes the following steps: In order to interfere with the ranging of attackers, this patent dynamically and randomly adjusts the SIFS time of the MAC layer on the legitimate wireless node STA to increase the ranging error and prevent the attacker from accurately measuring the distance. Assume that the SIFS baseline value of the legitimate STA node 802.11 network card is b; the user chooses to mislead the ranging value to be smaller or larger. If the user does not choose, the default misleading ranging value is larger, which is conducive to protecting the location privacy of the legitimate user. S3.1: According to the result of the suspicious node detection in step S2, the legal terminal STA obtains the suspicious weight coefficient w, and sets the execution probability p equal to w. The STA executes the ranging error strategy from S3.2 to S3.4 as follows according to the probability p; S3.2: If the ranging value is to be misled to be too small, the following operations are performed: the legal STA receives the data frame and first takes a random positive integer q between the closed interval [b / 2,1]; q = randint(b / 2,1) Taking (bq) microseconds as SIFS time, we have SIFS=bq S3.3: If the ranging value is to be misleadingly large, the following operations are performed: the legal STA receives the data frame and randomly selects a positive integer v in the closed interval [b-1,1]; v = randint(b-1,b) Taking (b+v) microseconds as SIFS time, we have SIFS=b+v S3.4: If the legitimate STA sends an ACK confirmation frame in the Tth cycle, and the source is still retransmitting the previous data frame, it means that the SIFS setting is too large, resulting in the MAC frame confirmation timeout on the attacker's side. Therefore, the legitimate STA needs to reduce its own SIFS time by 1 time slot. According to the newly calculated SIFS time, the legitimate STA sends an ACK confirmation frame in the next response cycle T+1 until the other party no longer retransmits the data frame; If (data frame is duplicate) then {SIFST+1=SIFST-slot}.

5. A location privacy protection method for preventing WiFi ranging according to claim 1, characterized in that: Step S4 includes the following steps: AP does not have energy-saving problems, so it can continuously monitor the energy-saving wake-up packets sent by any nearby nodes. After executing the suspicious node detection program S2, the results obtained by AP are more comprehensive and accurate. AP first defines all wireless nodes that have not established WiFi encryption authentication with itself as "strange nodes". Secondly, it sets the notification threshold of suspicious nodes, noticemax. When AP detects that the suspicious weight coefficient w of a strange node is greater than noticemax, it determines it as a suspicious node. S4.1: AP executes the suspicious node detection procedure S2. AP obtains the relevant information of all strange nodes that send beacon frames and calculates the suspicious weight coefficient w of each strange wireless node. S4.2: If the suspicious weight coefficient w of a strange wireless node is greater than the notification threshold noticemax, the AP determines it as a suspicious node and calculates the number of suspicious nodes r; S4.3: AP constructs a broadcast data frame to notify the network of suspicious nodes; In the body of the beacon frame, a "distance privacy flag" (1 byte) field and a "suspicious host MAC address" field (6*k bytes, k is a positive integer) are designed. If the number r of suspicious nodes determined by the AP is equal to 0, the AP exits step S4; If the number of suspicious nodes r determined by the AP is a positive integer less than or equal to 254, the binary value of r is filled in the "Distance Privacy Flag" field of the beacon frame body, and the MAC addresses of the suspicious nodes are written in sequence in the "Suspicious Host MAC Address" field of the beacon frame body; If the AP determines that the number of suspicious nodes exceeds 255 or the AP cannot identify the attacker's MAC address because the attacker randomly changes its own MAC address, the value of the "Distance Privacy Flag" field is marked as binary "11111111" (i.e., a positive integer 255), indicating that all unfamiliar nodes may be suspicious nodes; therefore, at this time, the MAC address of the suspicious node does not need to be filled in the "Suspicious Host MAC Address" field of the beacon frame body; S4.4: After receiving the broadcast frame, the legal wireless terminal parses the "distance privacy flag" field; if the value of this field is equal to 0, the frame parsing is exited; if the value of this field is a positive integer less than or equal to 254, the "suspicious host MAC address" field is continued to be read, and the MAC addresses of the suspicious nodes contained therein are extracted in sequence, and the legal wireless terminal no longer responds to any request frames of the above-mentioned suspicious wireless terminal; if the value of this field is 255, there is no need to read the "suspicious host MAC address" field, and the wireless terminal no longer responds to any request frames of unfamiliar nodes; S4.5: The AP periodically broadcasts the MAC address of the unfamiliar node to the legitimate terminals in the network.

Images