Protecting Privacy in WLAN with DoS Resistance using Client Puzzle Team 7 Yanisa Akkarawichai Rohan Shah CSC 774 – Advanced Network Security Prof. Peng Ning

Outline Overview of Security issues in Access Point Discovery Our proposed approach Security Analysis Future work

Overview of Based on the exchange of request/response messages Rely on an access point as a central node No well defined physical boundaries Exposure to malicious stations within the range widespread deployment makes based networks an attractive target for potential attackers.

Network Discovery Protocol

Security issues in Access Point Discovery Information leaks physical fingerprint of the radio transmitter logical MAC-layer fingerprint access point BSSID SSID(s) in Beacon and Probe Response willingness to associate with an SSID SSID in authentication and association exchanges TLS certificates in EAP-TLS physical location of the clients and AP association between clients and APs (implicitly associates APs with each other)

Security issues in Access Point Discovery Denial of Service Probe request Flood Authentication Attack Association Attack

Possible countermeasure MAC address spoof detection - analysis of sequence number pattern of the captured traffic Cryptographically protecting management and control frames Cryptographic (client) puzzles Protocol repair Using Neighbor Signal Threshold to determine client’s proximity Other non-cryptographic solutions – Delaying the effects of requests – Define a new interpretation of the duration field – Decreasing the retry limit

Why Client Puzzle? Before authenticating the user or committing resources, check the intent of the user/client. Guard against DoS attacks.

Desired properties of client puzzle Creating a puzzle and verifying the solution is inexpensive for the server/AP. Puzzle requires the client to perform computations. The puzzle difficulty can be easily adjusted by the AP. The puzzle can be solved on most types of client hardware. It is not possible to pre-compute solutions to the puzzles. While the client is solving the puzzle, the server does not need to store the solution or other client-specific data. If the same puzzle may be given to several clients, knowing the solution of one or more clients does not help a new client in solving the puzzle. A client can reuse a puzzle by creating several instances of it.

Proposed Approach

Security Analysis Anti- DoS attack Use of Client Puzzle requires the client to commit to resources early on and hence discourages DoS attacks. Anti- replay attack Using nonce and timestamp discourages any anti-replay attacks. Information Privacy An attacker observing the discovery protocol cannot learn the network name, but only a random generated temporary identifier (R-SSID) and is encrypted with the shared key

Security Analysis Puzzle Difficulty (k)Time Required (ms)

Security Analysis

Thank you !!! Questions?