A Robust Certificate Management System to Prevent Evil Twin Attacks in IEEE 802.11 Networks

TL;DR

This paper proposes a practical certificate management system, RCMS, that enhances WLAN security by enabling users to verify network certificates and prevent evil twin attacks without modifying IEEE 802.11 standards.

Contribution

Introduction of RCMS, a new verification method leveraging digital certificates to protect against rogue APs in WLANs, requiring minimal software updates.

Findings

RCMS effectively prevents evil twin attacks.

It requires only small software updates on user devices.

No modifications needed for IEEE 802.11 standards.

Abstract

The evil twin attack is a major security threat to WLANs. An evil twin is a rogue AP installed by a malicious user to impersonate legitimate APs. It intends to attract victims in order to intercept their credentials, to steal their sensitive information, to eavesdrop on their data, etc. In this paper, we study the security mechanisms of wireless networks and we introduce the different authentication methods, including 802.1X authentication. We show that 802.1X has improved security through the use of digital certificates but does not define any practical technique for the user to check the network certificate. Therefore, it remains vulnerable to the evil twin attack. To repair this vulnerability, we introduce Robust Certificate Management System (RCMS) which takes advantage of the digital certificates of 802.1X to protect the users against rogue APs. RCMS defines a new verification code to allow the user device to check the network certificate. This practical verification combined with the reliability of digital certificates provides a perfect protection against rogue APs. RCMS requires a small software update on the user terminal and does not need any modification of IEEE 802.11. It has a significant flexibility since trusting a single AP is enough to trust all the APs of the extended network. This allows the administrators to extend their networks easily without the need to update any database of trusted APs on the user devices.