Protecting Privacy in WLAN with DoS
Resistance using Client Puzzle
CSC 774 – Advanced Network Security
Prof. Peng Ning
Team 7
Yanisa Akkarawichai
Rohan Shah
Outline
•
•
•
•
•
Overview of 802.11
Security issues in Access Point Discovery
Our proposed approach
Security Analysis
Future work
Overview of 802.11
• Based on the exchange of
request/response messages
• Rely on an access point as a
central node
• No well defined physical
boundaries
• Exposure to malicious stations
within the range
• widespread deployment makes
802.11-based networks an
attractive target for potential
attackers.
802.11 Network Discovery Protocol
Security issues in Access Point Discovery
Information leaks
•
•
•
•
•
•
•
•
•
physical fingerprint of the radio transmitter
logical MAC-layer fingerprint
access point BSSID
SSID(s) in Beacon and Probe Response
willingness to associate with an SSID
SSID in authentication and association exchanges
TLS certificates in EAP-TLS
physical location of the clients and AP
association between clients and APs (implicitly associates APs
with each other)
Security issues in Access Point Discovery
Denial of Service
• Probe request Flood
• Authentication Attack
• Association Attack
Possible countermeasure
• MAC address spoof detection
- analysis of sequence number pattern of the captured traffic
• Cryptographically protecting management and control frames
• Cryptographic (client) puzzles
• Protocol repair
• Using Neighbor Signal Threshold to determine client’s proximity
• Other non-cryptographic solutions
– Delaying the effects of requests
– Define a new interpretation of the duration field
– Decreasing the retry limit
Why Client Puzzle?
• Before authenticating the user or committing
resources, check the intent of the user/client.
• Guard against DoS attacks.
Desired properties of client puzzle
• Creating a puzzle and verifying the solution is inexpensive for the
server/AP.
• Puzzle requires the client to perform computations.
• The puzzle difficulty can be easily adjusted by the AP.
• The puzzle can be solved on most types of client hardware.
• It is not possible to pre-compute solutions to the puzzles.
• While the client is solving the puzzle, the server does not need to store
the solution or other client-specific data.
• If the same puzzle may be given to several clients, knowing the solution of
one or more clients does not help a new client in solving the puzzle.
• A client can reuse a puzzle by creating several instances of it.
Proposed Approach
Security Analysis
• Anti- DoS attack
Use of Client Puzzle requires the client to commit to resources early on and hence
discourages DoS attacks.
• Anti- replay attack
Using nonce and timestamp discourages any anti-replay attacks.
• Information Privacy
An attacker observing the discovery protocol cannot learn the network name, but
only a random generated temporary identifier (R-SSID) and is encrypted with the
shared key
Security Analysis
Puzzle Difficulty (k)
Time Required (ms)
16
73.296
18
239.118
20
917.348
22
7352.367
24
83921.165
26
210304.113
Security Analysis
Time Required v/s Puzzle Difficulty
250000
200000
Time required (ms)
150000
100000
Time Required (ms)
50000
0
0
-50000
5
10
15
Puzzle Difficulty in bits
20
25
30
Thank you !!!
Questions?