Secure Radio Link Establishment via Layer 2-3 Address Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Radio communication systems face security vulnerabilities due to the Address Resolution Protocol (ARP), which can be exploited for spoofing attacks, and existing solutions like Secure ARP (SARP) are not practical for public hotspots and do not address DHCP and DNS server spoofing.
Innovation Solution
A method that establishes a secure radio communication link by authenticating terminals and using a database to map Layer 3 addresses to Layer 2 addresses, avoiding the use of ARP and preventing spoofing, while ensuring secure communication between terminals and servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If ARP is used for address resolution, then devices can discover Layer 2 addresses, but the system becomes vulnerable to spoofing attacks
Solution Approach 1:
The system performs authentication and establishes secure tunnels before any ARP operations. The access point authenticates clients and pre-configures secure communication channels, so that when address resolution is needed, it occurs within the context of an already-established secure connection, preventing spoofing before it can occur
Solution Approach 2:
The access point acts as an intermediary that mediates all ARP operations. Instead of devices performing raw ARP broadcasts that can be spoofed, the access point receives authenticated requests and performs address resolution on behalf of clients within the secure tunnel, verifying the authenticity of each ARP operation
2Reliability
If SARP is implemented to prevent spoofing, then security is improved, but special software must be installed on each client
Solution Approach 1:
The access point performs all security functions autonomously without requiring client software. The system uses standard ARP operations that work with existing client implementations, while the access point itself handles authentication, tunnel establishment, and verification of ARP operations, making the security mechanism self-contained in the network infrastructure rather than requiring deployment on end devices
Solution Approach 2:
The solution works with standard ARP implementations across different operating systems and devices without modification. The access point provides universal security protection that applies to all clients regardless of their platform, using multi-functional authentication mechanisms that protect against spoofing while maintaining compatibility with existing client software
3Reliability
If SARP is used to create secure tunnels, then ARP spoofing is prevented, but DHCP and DNS server spoofing cannot be prevented
Solution Approach 1:
The system performs comprehensive authentication of all network services (DHCP, DNS, ARP) before allowing any operations. The access point pre-establishes secure tunnels and verifies the identity of all servers and clients, so that when DHCP or DNS operations occur, they are already protected by the pre-configured authentication framework
Solution Approach 2:
The system implements continuous verification and monitoring of all communication. The access point receives feedback from authentication mechanisms and dynamically verifies the legitimacy of ARP, DHCP, and DNS operations in real-time, blocking any operations that do not match the authenticated configuration, thus providing comprehensive protection across all protocol layers
Data Source
AI summary
The present invention relates to a method for securing a radio communication link establishment in a radio communication network comprising a local network and a secured network. The local network comprises at least a first terminal and a second terminal and at least the first terminal is capable of communicating with the secured network. The radio communication network implements layered protocol functions, comprising at least Layers 1, 2 and 3, the terminals being identifiable by their Layer 2 and 3 addresses. The secured network comprises a database comprising address correspondence information between Layer 2 and 3 addresses of terminals. In the method the first terminal authenticates itself with the secured network and then by using the Layer 3 address of the second terminal, obtaining the address correspondence information provided by the database and thereby determining the corresponding Layer 2 address of the second terminal. Then the first terminal establishes in the local network the radio communication link with the second terminal by using the Layer 2 address.