Method and device for fingerprinting of wireless communication devices
View Patent ↗A method for fingerprinting wireless devices and a method for using a device fingerprint for identifying wireless devices. A monitoring station listens to a channel. For each received frame, the station measures the inter-arrival time from the end of the previously received frame to the end of the present frame, If possible, the station obtains the identity of the sender of the frame. If the sender is known, then the station stores the inter-arrival time in a histogram for the sender; the histogram becomes the fingerprint for the sender. Identification of a device begins by obtaining a number of inter-arrival times for an unknown sender and then matching these to stored fingerprints using a suitable similarity measure. The invention is particularly suitable for IEEE 802.11 and may for example be used to detect so-called MAC spoofing and as an additional layer of an identification protocol.
1. A method, in a device listening to a channel, of fingerprinting at least one wireless device transmitting data in frames on the channel, wherein frames are transmitted in succession on the channel, the method comprising:
receiving a current frame that succeeds a preceding frame;
measuring an inter-arrival time from the end of reception of the preceding frame to the end of reception of the current frame;
obtaining an identity of the wireless device that transmitted the current frame; and
storing the inter-arrival time in a set of inter-arrival times for the wireless device corresponding to the obtained identity in order to generate a fingerprint for the wireless device.
2. The method of claim 1 , further comprising arranging the set of inter-arrival times as a histogram that constitutes the fingerprint for the wireless device.
3. The method of claim 2 , further comprising expressing the histogram as a percentage frequency distribution.
4. The method of claim 2 , wherein the histogram comprises bins that correspond to specific times defined by a standard used for communication over the channel.
5. The method of claim 4 , wherein the standard is IEEE 802.11.
6. The method of claim 5 , wherein the standard is IEEE 802.11g.
7. The method of claim 5 , wherein a first bin corresponds to a Short Interframe Space (SIFS), a second bin corresponds to a Distributed coordination function Interframe Space (DIFS) minus the SIFS, and at least a third and a fourth bin, each corresponding to a length of a timeslot.
8. The method of claim 1 , further comprising:
comparing the generated fingerprint with stored fingerprints; and
identifying the wireless device as the device whose stored fingerprint most resembles the generated fingerprint.
9. The method of claim 8 , wherein resemblance is determined using a similarity measure.
10. A device for fingerprinting at least one wireless device transmitting data in frames on a channel, wherein frames are transmitted in succession on the channel, the device comprising:
a wireless interface configured to:
listen to the channel; and
receive a current frame that succeeds a preceding frame;
a processor configured to:
measure an inter-arrival time from the end of reception of the preceding frame to the end of reception of the current frame;
obtain an identity of the wireless device that transmitted the current frame; and
memory configured to store the inter-arrival time in a set of inter-arrival times for the wireless device corresponding to the obtained identity in order to generate a fingerprint for the wireless device.
11. The device of claim 10 , wherein the processor is further configured to arrange the set of inter-arrival times as a histogram that constitutes the fingerprint for the wireless device.
12. The device of claim 11 , wherein the processor is configured to express the histogram as a percentage frequency distribution.
13. The device of claim 10 , wherein the processor is further configured to compare the generated fingerprint with stored fingerprints; and to identify the wireless device as the device whose stored fingerprint most resembles the generated fingerprint.
14. The device of claim 11 , wherein the histogram comprises bins that correspond to specific times defined by a standard used for communication over the channel.
15. The device of claim 14 , wherein a first bin corresponds to a Short Interframe Space (SIFS), a second bin corresponds to a Distributed coordination function Interframe Space minus the SIFS, and at least a third and a fourth bin, each corresponding to a length of a timeslot.
16. The device of claim 14 , wherein the standard is IEEE 802.11.
17. The device of claim 16 , wherein the standard is IEEE 802.11g.
18. The device of claim 13 , wherein resemblance is determined using a similarity measure.