Method to secure 802.11 traffic against MAC address spoofing

• US 20060114863A1
• Filed: 12/01/2004
• Published: 06/01/2006
• Est. Priority Date: 12/01/2004
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Sapkota, Bhawani, Meier, Robert C., Cam Winget, Nancy, Sanzgiri, Ajit
• Application Number:
  US11/000,629
• Publication Number:
  US 20060114863A1
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

A method for protecting a wireless network against spoofed MAC address attacks. A database is used for storing MAC address and user identity bindings. When a new request to access the network is received, the MAC address and user identity of the request is compared to the stored MAC address and user identity bindings. If a new request has an existing MAC address, but not the corresponding user identity, then the request will be denied. The bindings database contains the MAC Address, User identity bindings for wireless nodes and/or, for wired nodes. The MAC address, User identity bindings contained in the bindings database may be automatically learned or statically configured.

Claims

1. A method to protect a network from MAC address spoofing, comprising:

receiving a request to associate with the network, the request having a MAC address;

receiving a user identity associated with the MAC address;

verifying the MAC address does not already have an associated user identity in a database; and

storing the association of the MAC address with the user identity in the database.

2. The method of claim 1, further comprising:

receiving a subsequent request to associate with the network with the MAC address;

receiving a user identity for the subsequent request to associate;

comparing the MAC address and the user identity received with the subsequent request to associate with the stored association of the MAC address with the user identity in the database; and

preventing access to the network responsive to the comparison of the MAC address and the user identity of the subsequent request not matching the stored association of the MAC address with the user identity.

3. The method of claim 1, further comprising:

receiving a subsequent request to associate, the subsequent request having the MAC address;

receiving the user identity with the subsequent request;

verifying the MAC address and user identity of the subsequent request match the stored association of the MAC address and user identity in the database; and

approving the request.

4. The method of claim 1, further comprising removing the association of the MAC address with the user identity after a user associated with the user identity logs out.

5. The method of claim 1, further comprising removing the association of the MAC address with the user identity after inactivity occurs for more than a predetermined time period

6. The method of claim 1, wherein the receiving a user identity further comprises obtaining the user identity from an EAPID field of an Extensible Authentication Protocol message.

7. The method of claim 1, further comprising:

receiving subsequent association requests from the same MAC;

obtaining the user identity obtained from a message integrity check;

comparing the user identity obtained from the message integrity check with the stored user identity associated with the MAC address.

8. A computer readable medium of instructions, comprising:

means for receiving a MAC address associated with a request for access;

means for receiving a user identity associated with request for access; and

means for accessing a database;

wherein the means for accessing a database responsive to the means for receiving a MAC address and means for receiving a user identity to verifying the MAC address does not already have an associated user identity in a database; and

wherein the means for accessing a database is responsive for storing the association of the MAC address with the user identity in the database.

9. The computer readable medium of instructions of claim 8, further comprising:

means for receiving a subsequent request to associate with the network with the MAC address;

means for receiving a user identity for the subsequent request to associate;

means for comparing the MAC address and the user identity received with the subsequent request to associate with the stored association of the MAC address with the user identity in the database; and

means for preventing access to the network responsive to the comparison of the MAC address and the user identity of the subsequent request not matching the stored association of the MAC address with the user identity.

10. The computer readable medium of instructions of claim 8, further comprising:

means for receiving a subsequent request to associate, the subsequent request having the MAC address;

means for receiving the user identity with the subsequent request;

verifying the MAC address and user identity of the subsequent request match the stored association of the MAC address and user identity in the database; and

approving the request.

11. The computer readable medium of instructions of claim 8, further comprising means for removing the association of the MAC address with the user identity after a user associated with the user identity logs out.

12. The computer readable medium of instructions of claim 8, further comprising means for removing the association of the MAC address with the user identity after inactivity occurs for more than a predetermined time period

13. The computer readable medium of instructions of claim 8, wherein the means for receiving a user identity further comprises means for obtaining the user identity from an EAPID field of an Extensible Authentication Protocol message.

14. The computer readable medium of instructions of claim 8, further comprising:

means for receiving subsequent association requests from the same MAC;

means for obtaining the user identity obtained from a message integrity check;

means for comparing the user identity obtained from the message integrity check with the stored user identity associated with the MAC address.

15. A network, comprising:

an authentication entity;

a database communicatively coupled to the authentication entity;

a first access point with a wireless transceiver for communicating with a wireless client;

a second access point with a wireless transceiver for communicating with the wireless client; and

a network backbone coupled to the first access point, the second and the authentication entity, enabling the first access point, second access point and authentication entity to communicate with each other;

wherein the first access point is configured to receive a message from the client via the wireless transceiver to access the network, the message having an associated MAC address and an associated user identity; and

wherein the authentication entity is configured to receive the request from the first access point, and upon verifying there is no entry for the MAC address in the database, updating the database by adding a new record into the database, the new record comprising the MAC address and the user identification.

16. The network of claim 15, further comprising:

the second access point suitably adapted to receiving a subsequent request to associate, the subsequent request having the same MAC address as the message;

the second access point suitably adapted to receiving a user identity for the subsequent request to associate;

the second access point responsive to forwarding the subsequent request, the MAC address and user identity for the subsequent request to the authentication entity;

the authentication entity configured to comparing the MAC address and the user identity received with the subsequent request to associate with the stored MAC address and user identity, and returning the results of the comparison to the second access point; and

the second access point responsive to preventing access to the network when the comparison of the MAC address and the user identity of the subsequent request do not matching the user identity stored with the MAC address.

17. The network of claim 15, further comprising the authentication entity configured to removing the new record from the database after a user associated with the user identity logs out.

18. The network of claim 15, further comprising the authentication entity configured to removing the new record the database after the client is inactive for more than a predetermined time period

19. The network of claim 15, wherein the first access point is configured to obtaining the user identity from an EAPID field of an Extensible Authentication Protocol message.