Hashed SSID Probe Identification for Secure Wi-Fi Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of plain text Service Set Identifiers (SSIDs) in network identification processes exposes devices to security vulnerabilities, allowing unauthorized listeners to detect digital fingerprints and potentially leading to identity theft and other attacks.
Innovation Solution
Implementing a network device that stores and transmits hashed SSIDs instead of plain text SSIDs during the network identification process, using a network interface to send probe responses with plain text names only after validation, thereby obfuscating the SSID information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plain text SSIDs are used in network identification processes, then network devices can easily identify and connect to wireless networks, but security vulnerabilities arise allowing unauthorized listeners to detect digital fingerprints and potentially leading to identity theft
Solution Approach 1:
The patent introduces hash values as an intermediary representation of SSIDs. Instead of transmitting plain text SSIDs directly, the system transmits hashed versions that serve as secure mediators. These hash values allow network identification to proceed while preventing unauthorized parties from reading the actual SSID information, thus resolving the contradiction between ease of operation and security vulnerability.
Solution Approach 2:
The patent transforms the SSID parameter from its original plain text form into a hashed form before transmission. This parameter change maintains the functional ability to identify networks while fundamentally altering the data representation to eliminate security vulnerabilities. The hash function transforms readable SSIDs into non-reversible cryptographic representations that cannot be used for fingerprinting or identity theft.
2Object-affected harmful factors
If hashed SSIDs are transmitted during network identification, then security is enhanced by obfuscating SSID information, but additional computational overhead is introduced for hashing and validation
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing hash values of known SSIDs in a database before the network identification process begins. When a probe request is received, the system only needs to perform a straightforward hash comparison rather than computing hashes in real-time. This preliminary preparation significantly reduces the computational overhead during actual network identification while maintaining enhanced security through hashed SSID transmission.
3Object-affected harmful factors
If hashed SSIDs are used instead of plain text, then it becomes harder for attackers to trace user locations and identities, but network devices must validate hash values against stored hashes
Solution Approach 1:
The patent uses copying by creating and storing hash copies of SSIDs in a centralized database. When validation is needed, the system retrieves the pre-stored hash copy and compares it with the received hash value from probe requests. This copying approach simplifies the validation process compared to computing hashes from scratch or maintaining complex verification protocols, while still effectively preventing attackers from tracing user locations and identities through the use of obfuscated hash values.
Data Source
AI summary
An example operation may include one or more of storing a hash of a service set identifier (SSID) of a wireless network via an apparatus, receiving a probe request message transmitted from a network device, wherein the probe request message comprises a hash value, determining that the hash value within the probe request is a valid SSID based on the hash of the SSID of the wireless network stored in the storage device, and controlling the network interface to transmit a probe response with a plain text name of the SSID to the network device in response to the determination.