Wireless Network Shielding Against WEP Key Cracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless networks using WEP encryption are vulnerable to key cracking attacks due to the insecurity of the RC4 stream cipher, allowing hackers to recover WEP keys by monitoring network traffic and collecting ARP-reply packets.
Innovation Solution
Implementing a method to transmit duplicate frames with different encryption for identified ARP frames, making them indistinguishable from original frames to hackers while being ignored by valid stations, thus protecting the encryption from decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If WEP encryption with RC4 stream cipher is used, then wireless communication security is provided, but the system becomes vulnerable to key cracking attacks due to weaknesses in the encryption algorithm
Solution Approach 1:
The patent creates duplicate copies of encrypted ARP packets and transmits them with different IVs. These copied packets mimic the structure and encryption of legitimate packets, confusing attackers who collect packets for key recovery. The copies are indistinguishable from real packets to attackers, forcing them to process unnecessary data and slowing down their attack while maintaining the appearance of normal encrypted communication.
Solution Approach 2:
The patent combines multiple encrypted packets with different IVs into a composite transmission strategy. By mixing legitimate encrypted packets with artificially generated duplicate packets that have different initialization vectors, the system creates a composite data stream that maintains encryption integrity while introducing complexity that undermines RC4's weaknesses. This composite approach leverages the existing WEP structure while neutralizing its vulnerabilities.
2Reliability
If duplicate encrypted frames with different encryption are transmitted, then hackers are confused and key cracking is prevented, but the network traffic complexity increases
Solution Approach 1:
The system automatically generates and transmits duplicate encrypted packets without requiring external intervention or complex coordination. The access point or station autonomously monitors outgoing ARP packets, creates encrypted copies with different IVs, and transmits them independently. This self-service mechanism handles the increased traffic complexity through automation, eliminating the need for manual traffic management while maintaining security benefits.
Solution Approach 2:
The patent changes the IV parameter of the encryption algorithm when creating duplicate packets. By systematically varying this single parameter while maintaining the same encryption algorithm and packet structure, the system introduces diversity into the traffic without fundamentally changing the protocol or requiring complex multi-parameter coordination. This simple parameter change achieves security enhancement while minimizing the increase in system complexity.
3Productivity
If ARP packets are monitored and collected for key recovery, then WEP keys can be discovered with reduced number of frames, but the security of the wireless network is compromised
Solution Approach 1:
The patent converts the harmful effect of ARP packet monitoring into a benefit by using the same predictable ARP packet structure to generate legitimate-looking encrypted duplicates. The predictable nature of ARP packets, which attackers exploit for efficient key recovery, is transformed into an opportunity to create confusion. The system uses this predictability to systematically generate protective duplicate packets that appear legitimate but contain different IVs, turning the attacker's efficient collection method against them by forcing them to process redundant data.
Data Source
AI summary
Exemplary embodiments of methods and apparatuses to provide shielding from key cracking in wireless networks are described. In one embodiment, a first frame having a first content is identified. Determination is made whether the first frame needs to be shielded. A second frame having at least a portion of the first content is transmitted in response to determining that the first frame needs to be shielded. The first frame has data encrypted with a first encryption and the second frame has data encrypted with a second encryption.