Regional-based authentication against dos attacks in wireless networks
Ivan Martinović, Frank A. Zdarsky, Jens Burkhard Schmitt · 2007
In this work we focus on resource depletion attacks within IEEE 802.11 networks. This type of DoS attacks is used to exhaust access points' resources resulting in denying service to legitimate clients and rising the opportunity for more sophisticated attacks. It is usually based on flooding an access point (AP) with a high number of fake authentication requests. This paper introduces a protection method which assists APs to selectively block fake requests sent by an attacker, while at the same time allowing other legitimate clients to successfully join the network. For this purpose we introduce the concept of regions, estimates on client's relative locations. The concept itself is similar to a known protection against DoS attacks based on client puzzles in wired networks, yet had to be adjusted to the peculiarities of wireless networks. Rather than utilizing CPU or memory-based resources that are highly variable among wireless clients we take advantage of wireless characteristics such as broadcast communication, signal propagation, and dense deployment of IEEE 802.11 technology. The proposed protection enables a tradeoff between security and performance thus providing its adaptation to different network configurations.