Device address rotation method to protect against unconsented tracking
A network infrastructure component determines a risk measurement associated with a wireless client device's use of a device address, and provides an advisory with respect to an address rotation strategy of the wireless client device based on the risk measurement. In some embodiments, the risk measurement is based on one or more of an exposure, by the wireless client device, of information on the wireless network that identifies the wireless client device and/or a characterization of a security of the wireless network environment in which the wireless client device operates.
1. A method, comprising:
analyzing wireless communication of a wireless client device on a wireless network;
generating, based on the analyzing, a risk measurement associated with the wireless communication, wherein the risk measurement is generated based, at least in part, on determining a density of other wireless client devices on the wireless network that are an equivalent device type as a device type of the wireless client device and that are located within a predefined threshold distance from the wireless client device; and
transmitting to the wireless client device, based on the risk measurement, an advisory on rotation of a device address of the wireless client device, wherein the advisory comprises one or more attributes indicating a recommended address rotation strategy for the wireless client device that indicates a recommended timing for which the wireless client device is recommended to perform at least one next device address rotation.
2. The method of claim 1 , further comprising determining one or more of: a use of unprotected identifiers in the wireless communication, a correlation between device addresses of multiple radios of the wireless client device, a frequency of probe traffic on the wireless network, and/or a correlation between signatures of a plurality of communications of the wireless client device, wherein the generating of the risk measurement is further based on the determining.
3. The method of claim 2 , further comprising identifying a transmission of vendor specific information elements, a sleep/wake pattern, block acknowledgment pattern, or packet transmission pattern of the wireless client device, wherein the signatures are based on the identifying.
4. The method of claim 1 , wherein at least one attribute of the one or more attributes indicated by the recommended address rotation strategy indicates a delay for the recommended timing of a next device address rotation for the wireless client device.
5. The method of claim 1 , wherein at least one attribute of the one or more attributes indicated by the recommended address rotation strategy indicates a rate for the recommended timing of a plurality of next device address rotations for the wireless client device.
6. The method of claim 1 , wherein at least one attribute of the one or more attributes indicated by the recommended address rotation strategy indicates a maximum time interval between device address rotations for the recommended timing of a plurality of next device address rotations of the wireless client device.
7. The method of claim 1 , further comprising determining a transmission power of the wireless client device, wherein the risk measurement is further based on the transmission power.
8. An apparatus, comprising:
a network interface configured to enable network communications;
one or more processors; and
one or more memories storing instructions that when executed configure the one or more processors to perform operations comprising:
analyzing wireless communication of a wireless client device on a wireless network;
generating, based on the analyzing, a risk measurement associated with the wireless communication, wherein the risk measurement is generated based, at least in part, on determining a density of other wireless client devices on the wireless network that are an equivalent device type as a device type of the wireless client device and that are located within a predefined threshold distance from the wireless client device; and
transmitting to the wireless client device, based on the risk measurement, an advisory on rotation of a device address of the wireless client device, wherein the advisory comprises one or more attributes indicating a recommended address rotation strategy for the wireless client device that indicates a recommended timing for which the wireless client device is recommended to perform at least one next device address rotation.
9. The apparatus of claim 8 , the operations further comprising determining one or more of: a use of unprotected identifiers in the wireless communication, a correlation between device addresses of multiple radios of the wireless client device, a frequency of probe traffic on the wireless network, and/or a correlation between signatures of a plurality of communications of the wireless client device, wherein the generating of the risk measurement is further based on the determining.
10. The apparatus of claim 9 , the operations further comprising identifying a transmission of vendor specific information elements, a sleep/wake pattern, block acknowledgment pattern, or packet transmission pattern of the wireless client device, wherein the signatures are based on the identifying.
11. The apparatus of claim 8 , wherein at least one attribute of the one or more attributes indicated by the recommended address rotation strategy indicates a delay for the recommended timing of a next device address rotation for the wireless client device.
12. The apparatus of claim 8 , wherein at least one attribute of the one or more attributes indicated by the recommended address rotation strategy indicates a rate for the recommended timing of a plurality of next device address rotations for the wireless client device.
13. A non-transitory computer readable storage medium comprising instructions that when executed configure one or more processors to perform operations comprising:
analyzing wireless communication of a wireless client device on a wireless network;
generating, based on the analyzing, a risk measurement associated with the wireless communication, wherein the risk measurement is generated based, at least in part, on determining a density of other wireless client devices on the wireless network that are an equivalent device type as a device type of the wireless client device and that are located within a predefined threshold distance from the wireless client device; and
transmitting to the wireless client device, based on the risk measurement, an advisory on rotation of a device address of the wireless client device, wherein the advisory comprises one or more attributes indicating a recommended address rotation strategy for the wireless client device that indicates a recommended timing for which the wireless client device is recommended to perform at least one next device address rotation.
14. The non-transitory computer readable storage medium of claim 13 , the operations further comprising determining one or more of: a use of unprotected identifiers in the wireless communication, a correlation between device addresses of multiple radios of the wireless client device, a frequency of probe traffic on the wireless network, and/or a correlation between signatures of a plurality of communications of the wireless client device, wherein the generating of the risk measurement is further based on the determining.
15. The non-transitory computer readable storage medium of claim 14 , the operations further comprising identifying a transmission of vendor specific information elements, a sleep/wake pattern, block acknowledgment pattern, or packet transmission pattern of the wireless client device, wherein the signatures are based on the identifying.
16. The method of claim 1 , wherein the device address of the wireless client device is a Media Access Control (MAC) address of the wireless client device.
17. The method of claim 1 , wherein the advisory further comprises an acceptable use policy that defines a maximum time interval that the wireless client device can operate without performing the at least one next device address rotation and the wireless client device is to acknowledge the acceptable use policy.
18. The method of claim 17 , wherein the acceptable use policy further defines a minimum time between each of a plurality of next device address rotations to be performed by the wireless client device.
19. The method of claim 1 , wherein determining the density includes determining the density based on a density weight function that is based on a number of a plurality of wireless client devices on the wireless network within an area and on a number of the other wireless client devices on the wireless network that are an equivalent device type as the wireless client device within the area.
20. The non-transitory computer readable storage medium of claim 13 , wherein determining the density includes determining the density based on a density weight function that is based on a number of a plurality of wireless client devices on the wireless network within an area and on a number of the other wireless client devices on the wireless network that are an equivalent device type as the wireless client device within the area.