雙基地台偵測-客戶端偵測惡意無線基地台機制;Gemini detector-Client side solutions to detect the evil twin access point

NCUIR > College of Electrical Engineering & Computer Science > Graduate Institute of Computer Science and Information Engineering > Electronic Thesis & Dissertation > Item 987654321/72095

Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/72095

Title:	雙基地台偵測-客戶端偵測惡意無線基地台機制;Gemini detector-Client side solutions to detect the evil twin access point
Authors:	徐裕量;Hsu,Yu-Liang
Contributors:	資訊工程學系
Keywords:	Wireless;Evil twin;Rogue AP;Wireless;Evil twin;Rogue AP
Date:	2016-07-26
Issue Date:	2016-10-13 14:26:05 (UTC+8)
Publisher:	國立中央大學
Abstract:	現今越來越多的裝置透過無線網路技術存取網路資訊，當資訊從空氣中交換時容易受到惡意攻擊者的攻擊，因此我們提出三種在使用者端的偵測機制，其中兩種被動偵測機制與一種主動偵測機制是用來偵測環境上是否有惡意孿生基地台(Evil Twin)，而這種惡意孿生基地台可能造成不同種類的安全問題，如:詐欺、使用者資訊擷取和中間人攻擊。由於惡意孿生基地台產生很嚴重的安全性威脅，有許多解決方案已經被提出，然而大多數的解決方案都是以管理者端的角度作為設計來偵測，通常這類解決方式需要昂貴或是大量資料來判讀，而不是以使用者端的角度來解決惡意孿生基地台。我們提出兩種在使用者端可以偵測是否有惡意孿生基地台轉發封包的行為，在公眾區域或是未加密的無線網路環境中，第一種方式透過觀察封包傳遞是否被轉發，這種方式稱為ET Detector，第二種方式透過觀察TCP三方交握的資訊來判讀是否有惡意孿生基地台再轉發網路封包至合法的基地台上，這種偵測方法稱為LAF，因為ET Detector與LAF不積極發送探索封包，所以惡意孿生基地台不會察覺到ET Detector與LAF的存在。如果攻擊者在公眾區域架設的惡意基地台，不是透過合法基地台存取網路，而是接取3G/4G的網路存取網路，為了對抗這種惡意基地台(Rogue AP)我們提出了RAF方法，使用者使用RAF在兩個相同SSID的基地台環境內發送封包後，透過網路上的一台伺服器去偵測這兩個收到的封包路徑，來判讀使用者環境中，是否有非法基地台，透過這三種偵測方法可以提升在公眾區域使用無線網路的安全。;This paper proposes two passive and one active user-side solutions, called Evil Twin Detector(ET-Detector), Wi-Fi Legal AP Finder (LAF) and Wi-Fi Malicious Rouge AP Finder (RAF), to the notorious evil twin access point problem which in turn can result in diverse security problems, such as fraud, identity theft, and man-in-the-middle attacks. Due to the severe security threats created by evil twins, many promising solutions have been proposed. However, the majority of these solutions are designed for the administrators of wireless networks, not for Wi-Fi users. Hence, they are either too expensive or need some data that are usually not accessible to normal users. ET Detector detects wireless packets and forwarding behavior. LAF utilizes the TCP three-way handshake-related packets and packet forwarding property created by evil twins to find legal APs, called good twins, at public hotspots or unencrypted WLANs; thus, it does not need any data or assistance from wireless network administrators. LAF does not send exploring packets actively; hence, evil twins cannot sense its existence. If the evil twins connected the Internet by 3G/4G network, LAF can′t collect the TCP packets between evil twins and the Internet. RAF utilizes the routing path to find out the rogue AP, the routing path is not the same with good AP and rogue AP. No matter when and where a user needs to utilize an AP to connect to the Internet at a hotspot, he can use ET Detector,LAF and RAF to find a good twin AP to connect to.
Appears in Collections:	[Graduate Institute of Computer Science and Information Engineering] Electronic Thesis & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	246	View/Open

社群 sharing

Loading...