Beacon Message Hash Verification for Rogue AP Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Detecting rogue access points in dynamic and rapidly changing network environments is challenging due to the proliferation of various threats and devices, making it difficult to distinguish authentic from impersonating access points.

Innovation Solution

A system that enhances the beacon message process by inserting a hash value based on a unique key, BSSID, SSID, and nonce, which is periodically updated, allowing trusted access points to verify the authenticity of received beacon messages and identify impersonating access points.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional beacon message verification is used, then network devices can communicate wirelessly, but rogue access points cannot be reliably detected

Engineering Contradiction:

Improverogue access point detection accuracyVSAvoidbeacon message structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system pre-generates hash values for legitimate access points and stores them in a database before they are needed for verification. When a beacon message is received, the listening access point can quickly verify the hash value against the pre-stored database entry, enabling reliable rogue detection without complex real-time computation

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A hash value is introduced as an intermediary element in the beacon message structure. This hash value serves as a cryptographic signature that mediates between the transmitting access point and the listening access point, allowing verification of authenticity without requiring direct complex communication protocols

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If hash verification is added to beacon messages, then rogue access points can be detected, but message overhead increases

Engineering Contradiction:

Improveaccess point authenticationVSAvoidbeacon message data

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The system uses a lightweight hash value (typically 16-32 bytes) that is computationally inexpensive to generate and verify. This disposable cryptographic element is added to each beacon message without requiring complex encryption algorithms or large data structures, minimizing the increase in message overhead while providing strong authentication

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If static authentication methods are used, then access points can be identified, but replay attacks succeed

Engineering Contradiction:

Improveaccess point identificationVSAvoidreplay attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The hash value in the beacon message includes a time-varying component (such as a timestamp or counter) that changes periodically. This ensures that even if an attacker captures a valid beacon message, the hash value will have changed by the time they attempt to replay it, making the replay attack detectable and ineffective

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

The authentication mechanism transitions from static to dynamic by incorporating elements that change over time in the hash value calculation. This dynamic approach allows the system to maintain reliable access point identification while automatically defending against replay attacks through the use of time-sensitive verification

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11197160B2System and method for rogue access point detection

Publication Date: 2021.12.07 SOPHOS LTD

AI summary

Methods, systems and computer readable media for rogue access point detection are described.