Physical layer deception improves enterprise wi fi authentication security
Protocol Integration of Physical Layer Deception into EAP-TEAP Wi-Fi Authentication
Cryptography and SecurityNetworking and Internet Architecture
Summary
Credential-based Wi-Fi logins can be tricked if someone steals your password, because the system can't always tell who's really logging in. The authors designed a way to add a hidden extra check that uses signals at the physical level of the network to spot impostors trying to sneak in with stolen credentials. They built and tested this method in real Wi-Fi authentication systems, showing it can reject attackers while keeping connection delays reasonable. Their approach tries multiple verification steps together to make attacks harder without causing big slowdowns.
What this means in practice
- •For enterprise network administrators: Integrate layered deception techniques into corporate Wi-Fi authentication workflows to detect misuse of stolen credentials.
- •For wireless security product developers: Develop Wi-Fi authentication products that embed physical layer deception to enhance resistance to credential-based attacks.$Commercial implications: Enables new enterprise-grade Wi-Fi security solutions that sell improved protection against stolen credential attacks.
Authors
Moustafa Ibrahim, Bin Han, Hans D. Schotten
Abstract
Credential-based Extensible Authentication Protocol (EAP) authentication cannot distinguish a legitimate credential holder from an adversary using compromised credentials. Physical Layer Deception (PLD) complements credential-based authentication by exposing a deceptive primary object over a primary transport while a separate recovery object travels with differentiated reliability over a secondary channel. Existing PLD studies remain, to our knowledge, at the physical/link-model level; using PLD's activation/deactivation mechanism as an authentication gate creates an authentication-specific design requirement, since an all-inactive attempt would exercise no recovery path. We present a batched PLD-based re-verification step for Enterprise Wi-Fi's TEAP/RADIUS/IEEE 802.11 authentication chain, implemented end to end across the server, access point, and device in the open-source hostap 2.12 codebase. Each attempt carries three rounds, at least one active, with no dedicated activation flag. Across four campaigns totaling 1593 attempts, the prototype evaluates batched recovery behavior, rejects the implemented naive credential-bearing attacker in all 30 attempts, measures successful-path latency, and evaluates the security-reliability trade-off for one, two, and three active rounds under two modeled recovery regimes. The evaluation exercises the protocol and software-MAC behavior directly and analyzes informed and retry-seeking attackers under the software recovery model.