Wireless AP Detection via Clock Skew Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless local area networks (WLANs) are vulnerable to unauthorized access points (APs) due to their inherent broadcast nature and lack of effective detection methods, particularly in cases where attackers spoof MAC addresses or use stronger signal strength, making it difficult for existing security measures to distinguish between genuine and fake APs.
Innovation Solution
The method employs clock skew, calculated from IEEE 802.11 Time Synchronization Function (TSF) timestamps in beacon/probe response frames, using linear programming and least square fit methods to differentiate between authorized and unauthorized APs by leveraging the unique and consistent clock skew of each AP, thereby providing a robust fingerprinting mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cryptographic methods (digital certificates) are used for authentication, then security strength is improved, but device complexity and ease of operation deteriorate due to cumbersome certificate management
Solution Approach 1:
The patent changes the authentication parameter from cryptographic certificates to physical clock skew characteristics. Instead of managing digital certificates, the system uses inherently different clock frequencies of APs as authentication identifiers, simplifying the authentication mechanism while maintaining security.
Solution Approach 2:
The patent enables APs to automatically provide their clock skew characteristics without requiring manual certificate configuration. The clock skew is an intrinsic property that APs naturally exhibit, eliminating the need for complex certificate issuance and management infrastructure.
2Ease of operation
If AP selection is based on signal strength, then ease of operation is improved, but reliability deteriorates as users can be fooled into connecting to fake APs with stronger signals
Solution Approach 1:
The patent introduces clock skew as an additional feedback parameter for AP selection. Instead of relying solely on signal strength, the system incorporates clock skew verification to provide authenticating feedback, allowing users to distinguish genuine APs from fake ones while maintaining simple automated selection.
3Adaptability or versatility
If fake APs use different physical channel characteristics to evade detection, then adaptability of the attack is improved, but detection precision deteriorates as traditional detection methods fail
Solution Approach 1:
The patent extracts the clock skew parameter from the AP's timing behavior as a unique identifier. By focusing on this specific extracted characteristic rather than general physical channel properties, the system can detect fake APs regardless of what channel characteristics they use for evasion.
Data Source
AI summary
Identifying valid wireless access points based on clock skews. A computing device receives plurality of frames, each including a corresponding timestamp, from a wireless access point. The computing device calculates transmit and receive offsets based on transmit and receive times of the plurality of frames, and also calculates differences between the transmit and receive offsets. The computing device also calculates a clock skew of a clock at the wireless access point based on a slope of the differences. The client computing device determines whether the wireless access point is an authorized wireless access point or an unauthorized wireless access point based on comparing the calculated clock skew with one or more known baseline clock skews of one or more authorized wireless access points.