Papers for

enterprise network administrators

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Physical layer deception improves enterprise wi fi authentication security

Protocol Integration of Physical Layer Deception into EAP-TEAP Wi-Fi Authentication

Abstract: Credential-based Extensible Authentication Protocol (EAP) authentication cannot distinguish a legitimate credential holder from an adversary using compromised credentials. Physical Layer Deception (PLD) complements credential-based authentication by exposing a deceptive primary object over a primary transport while a separate recovery object travels with differentiated reliability over a secondary channel. Existing PLD studies remain, to our knowledge, at the physical/link-model level; using PLD's activation/deactivation mechanism as an authentication gate creates an authentication-specific design requirement, since an all-inactive attempt would exercise no recovery path. We present a batched PLD-based re-verification step for Enterprise Wi-Fi's TEAP/RADIUS/IEEE 802.11 authentication chain, implemented end to end across the server, access point, and device in the open-source hostap 2.12 codebase. Each attempt carries three rounds, at least one active, with no dedicated activation flag. Across four campaigns totaling 1593 attempts, the prototype evaluates batched recovery behavior, rejects the implemented naive credential-bearing attacker in all 30 attempts, measures successful-path latency, and evaluates the security-reliability trade-off for one, two, and three active rounds under two modeled recovery regimes. The evaluation exercises the protocol and software-MAC behavior directly and analyzes informed and retry-seeking attackers under the software recovery model.

Thu 1 OctCryptography and SecurityNetworking and Internet Architecture
The gist
Credential-based Wi-Fi logins can be tricked if someone steals your password, because the system can't always tell who's really logging in. The authors designed a way to add a hidden extra check that uses signals at the physical level of the network to spot impostors trying to sneak in with stolen credentials. They built and tested this method in real Wi-Fi authentication systems, showing it can reject attackers while keeping connection delays reasonable. Their approach tries multiple verification steps together to make attacks harder without causing big slowdowns.
Open → 2610.01580v1

Wi-Fi localization achieves meter-level accuracy on campus network

Meter-Level Wi-Fi RTT Localization on a Production Enterprise WLAN

Abstract: Wi-Fi Fine Time Measurement (FTM) promises indoor localization by reusing access points (APs) already deployed for connectivity, but prior evaluations mostly use APs purpose-deployed or calibrated for ranging, leaving it unclear whether a production enterprise WLAN can provide useful localization without localization-specific infrastructure. We evaluate Wi-Fi round-trip time (RTT) localization on IllinoisNet, a live campus WLAN whose APs were placed for coverage and capacity. Using five commodity Android phones at 10 static locations across a 50 m x 30 m office floor spanning LOS, NLOS, and multipath conditions, weighted nonlinear least squares achieves a median error of 1.21 m and a 90th-percentile error of 2.68 m, with no AP replacement, repositioning, or ranging calibration. Residuals vary in magnitude and sign across APs and propagation conditions, suggesting a single global correction is insufficient and motivating AP-aware software calibration rather than new localization-specific infrastructure.

Sat 12 SeptNetworking and Internet Architecture
The gist
Indoor location tracking using Wi-Fi signals usually needs special equipment or setups. This study shows that everyday Wi-Fi routers in a university network can locate devices to about one meter accuracy without extra hardware changes. The researchers tested this on several phones across an office space with different physical obstructions. They found that fixed calibration for all devices doesn’t work well, suggesting smarter software adjustments for each router instead of new equipment.
Open → 2609.13795v1