WLAN AP Authentication via Feature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing access points (APs) disguised as legitimate hotspots pose a security risk by intercepting sensitive information from terminals in wireless local area networks (WLANs), leading to potential losses for users.
Innovation Solution
A method for authenticating access points (APs) in WLANs involves determining AP features using a feature generation rule, sending a request message to the AP, and verifying the response to authenticate the AP's validity, thereby enhancing security by distinguishing between legitimate and phishing APs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a terminal automatically connects to a high-power WLAN hotspot with a familiar SSID, then the ease of operation is improved, but the security is worsened due to potential phishing attacks
Solution Approach 1:
The terminal performs preliminary authentication by obtaining and verifying AP features (such as MAC address, BSSID, or custom identifiers) before automatically connecting to the WLAN hotspot. This preliminary verification ensures the AP is legitimate, preventing phishing attacks while maintaining automatic connection functionality.
Solution Approach 2:
The authentication system uses feedback mechanisms where the terminal requests and verifies AP feature information from the access point. The AP responds with its unique identifiers, and the terminal compares these against expected values to confirm authenticity before establishing connection, creating a closed-loop security verification process.
2Reliability
If AP feature verification is implemented to authenticate access points, then the security is improved, but the device complexity is worsened
Solution Approach 1:
The access point itself provides its authentication features (MAC address, BSSID, or custom identifiers) in response to terminal requests. The terminal independently verifies these features against pre-stored expected values without requiring complex external authentication servers, making the system self-serve and reducing overall complexity.
Solution Approach 2:
The patent extracts only the essential authentication elements (AP identifiers such as MAC address, BSSID, or custom features) from the complex AP configuration and uses these extracted features for verification. This extraction approach simplifies the authentication process by focusing only on critical identifying information rather than verifying entire AP configurations.
Data Source
AI summary
An access point AP authentication method, a system, and a related device are provided, so as to improve security of accessing an AP of a WLAN by a terminal. The method is as follows: determining, by the terminal, an AP feature according to a feature generation rule corresponding to the access point AP of the wireless local area network WLAN; sending, by the terminal to the AP, a request message for requesting to provide an AP feature, and obtaining a response message that is returned by the AP according to the request message; and determining, by the terminal according to the response message and the determined AP feature, whether the AP can be authenticated.