Wireless Access Point Legitimacy Detection via Network Traceroute
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional technologies for connecting computing devices to wireless access points lack reliable methods to verify the legitimacy and identity of access points, making them vulnerable to attacks from malicious devices that mimic legitimate access points.
Innovation Solution
A computer-implemented method and system that determines if a computing device has connected to a potentially illegitimate wireless access point by comparing network details such as IP addresses, DNS servers, and traceroute information with previously stored data from a known access point, and takes security actions if discrepancies are found.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If computing devices store configuration details of wireless access points for quick reconnection, then connection speed and convenience are improved, but vulnerability to malicious spoofing attacks increases
Solution Approach 1:
The system performs preliminary actions by storing configuration details of legitimate access points before connection attempts. This includes pre-storing network identification strings, IP addresses, DNS server information, and traceroute data. When a connection is attempted, these pre-stored details are used to verify the legitimacy of the access point before allowing connection, thus preventing spoofing attacks while maintaining quick reconnection capability
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring and comparing current access point characteristics against stored legitimate configurations. The traceroute verification process provides feedback about the actual network path, and IP/DNS verification provides feedback about network identity. This feedback loop allows the system to detect spoofing attempts and alert users or block connections accordingly
2Device complexity
If traditional network security systems are used without verification methods, then system simplicity is maintained, but reliability of access point identification deteriorates
Solution Approach 1:
The verification system is segmented into multiple independent verification components: network identification string verification, IP address verification, DNS server verification, and traceroute verification. Each component checks a different aspect of access point legitimacy. This segmentation allows the system to be comprehensive in its verification while maintaining modularity, making the system manageable despite its enhanced functionality
Solution Approach 2:
The system introduces intermediary verification mechanisms between the computing device and the wireless access point. Rather than directly trusting the access point's self-identification, the system uses intermediate verification steps (traceroute to verify network path, DNS verification to verify identity) that mediate the connection process. These intermediaries provide an additional layer of verification without completely overcomplicating the user experience
Data Source
AI summary
The disclosed computer-implemented method for detecting potentially illegitimate wireless access points may include (1) determining that a computing device has established a connection with a wireless access point that resembles a known wireless access point, (2) collecting a set of network details related to a route from the computing device to a network resource via the wireless access point, (3) identifying a previously collected set of network details related to a route from the computing device to the network resource via the known wireless access point, (4) determining that a portion of the set of network details related to the route via the wireless access point does not match the set of network details related to the route via the known wireless access point, and then (5) determining that the wireless access point is potentially illegitimate.