Wi-Fi Identification Impacts and Solutions in IEEE Standards
Explore the impacts of MAC randomization, client steering, QoS/QoE treatments, and lawful intercept on Wi-Fi identification in IEEE standards. Learn about the challenges faced and proposed solutions for maintaining network efficiency and security.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
July 2021 doc.: IEEE 802.11-21/1141r0 TGbh Excerpts of WBA Document Wi-Fi Identification Scope Date: 2021-07 Authors: Name Graham Smith Company Address SR Technologies Phone email gsmith@srtrl.com Sunrise, Florida Submission Slide 1 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 Objective 1. Provide an overview 2. Summarize identified impacts and link to identified Use Cases Submission Slide 2 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 1 - MAC Randomization Impacts MAC-Based Access Control Deny or allow access based on MAC is ineffective Pay Per Use (PPU) associated with MAC ineffective Complimentary limited time services ineffective Passpoint Profiles The acceptance of terms & conditions in Section 10.1 indicates that the AAA server saves the timestamp associated with the STA MAC address. Certificate Enrollment in Section 7.6.1/7.6.4, the STA MAC address is one of the options to identify a Wi-Fi client device and bind the certificate to. DevDetail MO vendor specific extension Section 9.2, the DevDetail MO contains a Wi-FiMACAddress node which the STA fills with its currently set MAC address Submission Slide 3 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 Client Steering Different bands with different SSIDs (split-SSID on 2.4GHz and 5GHz), will see different MAC addresses on the different SSIDs, which will break MAC-based (band-)steering between the SSIDs. Any network supporting more than one SSID will suffer similar Wi-Fi client steering issues. MAC Collisions understand that this is an exceedingly unlikely event and so not of any real concern. Physical Layer Analytics identify a unique device consistently over time no longer be possible to identify manufacturer from OUIs or CIDs in the IEEE registry for the purposes of troubleshooting, diagnostics, and analytics Accounting and billing issues rates rely on a unique device identifier. [This could be accomplished instead with proper support for Chargeable-User-Identity (CUI)]. Submission Slide 4 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 QoS and QoE APs that form the network hold a synchronized list of MAC address to QoS/QoE mapping to ensure that Wi-Fi clients receive a uniform QoS/QoE treatment throughout the full network. DHCP and ACLs Devices asking for IP addresses or renewal are identified by MAC address Where MAC address instrumental in providing an identifier for use in ACLs - the MAC itself, the IP Address, or a MAC-based hostname then the ACL will not function as intended. Lawful Intercept LI LI may use the uniqueness of a Wi-Fi device s MAC address to facilitate identification MAC address is used to help link IP sessions to particular users devices Submission Slide 5 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 2 - Wi-Fi Identification Standards Home Networks Steering across ESSs Access time restrictions, QoS and QoE controls L2 analytics Support for IoT and legacy devices (e.g., registration). Providing restricted access Community Networks Access Control MAC or IP based QoS (need to be tied to UID/DID every session. Submission Slide 6 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 Enterprise/Corporate Networks MAC used for L2 QoS and Analytics BYOD, MAC filtering will not work Courtesy network suffers same as Community networks Industrial Networks Non-IOT devices may have MAC dependence - printers, barcode readers, badge readers, robotics controls Trucking manifest and navigation systems information exchange, product delivery tracking Hospitality Networks guest may need to reauthenticate daily or use an app. Change to Passpoint Submission Slide 7 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 Public Networks accept per-session authentication and loss of control over access restrictions Passpoint networks requiring Ts & Cs acceptance this and other Passpoint features may have a dependence on MAC. MACs can no longer be used to block devices that make repeated retries of invalid credentials, the AAA must communicate to the device that the credentials are not valid, and the device must honor that and seek remediation or stop trying to use them Submission Slide 8 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 Future Investigation The suitability of the following for alleviating MAC randomization issues should be investigated: Passpoint and WRIX/AAA WRIX: Wireless Roaming Intermediary eXchange OpenRoaming WBA centralized policy authority, allows users to join any network managed by a federation member. Identity Providers and Network Providers Wi-Fi Easy Connect Wi-Fi Open Enhanced Captive portal and/or Capport Resorting to indirect IDs such as a network operators App. Submission Slide 9 Graham Smith, SR Technologies
May 2021 doc.: IEEE 802.11-21/1141r0 Next Steps recommend that the operator and vendor community join forces to identify further mitigations for the effects of MAC randomization, and alternative secure identifiers that are not publicly observable, nor shared outside of a network. Submission Slide 10 Graham Smith, SR Technologies
