Wireless networks are vulnerable to many identity-based attacks in which a malicious device uses forged MAC addresses to masquerade as a specific client or to create multiple illegitimate identities. For example, several link-layer services in IEEE 802.11 networks have been shown to be vulnerable to such attacks even when 802.11i/1X and other security mechanisms are deployed. In this paper we show that a transmitting device can be robustly identified by its signalprint, a tuple of signal strength values reported by access points acting as sensors. We show that, different from MAC addresses or other packet contents, attackers do not have as much control regarding the signalprints they produce. Moreover, using measurements in a testbed network, we demonstrate that signalprints are strongly correlated with the physical location of clients, with similar values found mostly in close proximity. By tagging suspicious packets with their corresponding signalprints, the network is able to robustly identify each transmitter independently of packet contents, allowing detection of a large class of identity-based attacks with high probability.

No abstract

After the vulnerabilities found in the WEP protocol, providing secure wireless network access has been shown to be a complicated task. This paper describes the specification of a two-protocol architecture that provides secure, flexible, and convenient Internet access. Mutual authentication between mobile clients and access points is performed using public keys tied to domain names while confidentiality, sender authentication and replay detection are provided on a per-frame basis, using per-client dynamic session keys. Designed for the mobile environment, the architecture also provides users with mobility between networks with different address prefixes.