Multi-Stream Radio Authentication for Wi-Fi MITM Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Man-in-the-middle (MITM) attacks are easily executed in Wi-Fi networks, as attackers can trick clients into associating with a fake access point, making it difficult to distinguish legitimate from fraudulent transmissions.
Innovation Solution
The use of multiple input, multiple output (MIMO) devices with two or more antennas or an antenna array to split downlink data transmissions across multiple spatially separated access points, allowing clients to identify and reject fraudulent signals by determining the number and spatial characteristics of incoming signals, such as angles and times of arrival.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single access point transmits data to a client, then the transmission structure is simple, but the client cannot distinguish legitimate transmissions from MITM attacks
Solution Approach 1:
The patent segments a single data transmission into multiple parallel radio streams transmitted from spatially separated access points. Each stream carries a portion of the data, and the client reconstructs the complete transmission by combining streams from multiple APs. This segmentation enables the client to verify legitimate transmissions by checking for the expected number of spatially distributed streams, thereby detecting MITM attacks that cannot replicate the multi-AP coordination.
2Reliability
If multiple radio streams are transmitted from spatially separated APs, then MITM attacks can be detected, but the transmission system becomes more complex
Solution Approach 1:
The patent makes each access point multi-functional by enabling them to simultaneously perform standard wireless communication and participate in multi-stream secure transmissions. The same AP infrastructure serves both traditional single-stream communications and the new multi-stream secure mode, eliminating the need for separate dedicated hardware and reducing overall system complexity while maintaining security enhancements.
Solution Approach 2:
The client device performs self-verification by independently analyzing the spatial characteristics and number of received radio streams. The client uses its own signal processing capabilities to determine whether received transmissions originate from the expected multiple APs or from a single MITM source, without requiring external verification infrastructure. This self-service approach simplifies the overall system while enhancing security.
3Reliability
If the client verifies signal characteristics from multiple APs, then MITM attacks are thwarted, but the processing time and complexity at the client increase
Solution Approach 1:
The patent establishes predetermined expectations at the client about the number of APs and their spatial locations before transmissions begin. During verification, the client simply compares received stream characteristics against these pre-established criteria rather than performing complex real-time analysis. This preliminary setup reduces verification time and processing burden during actual communications while maintaining robust security checks.
Data Source
AI summary
The present disclosure generally relates to apparatus, software and methods for thwarting radio spoofing techniques by requiring and sending data from multiple radios positioned such that the receiving client can determine that it came from multiple spatially separated radios due to the Angle of Arrival of each radio's signal.