Over-the-Air Runtime Wi-Fi MAC Address Re-randomization

TL;DR

This paper tackles the privacy challenge of MAC address unlinkability during an active Wi-Fi session by introducing over-the-air runtime MAC re-randomization. The approach synchronizes re-randomized MAC addresses across APs and stations, derived from a hash of the base MAC, the WPA3/PTK, and a time-interval index, with coordinated SN and nonce resets to prevent linkage. The authors implement the scheme on off-the-shelf hardware, including a modified driver, and validate its feasibility through small-scale experiments that show comparable performance to standard operation while achieving enhanced unlinkability. The work advances practical privacy protection in Wi-Fi by enabling ephemeral MAC usage within ongoing connections, laying groundwork for broader deployment and future refinements.

Abstract

Medium Access Control (MAC) address randomization is a key component for privacy protection in Wi-Fi networks. Current proposals periodically change the mobile device MAC addresses when it disconnects from the Access Point (AP). This way frames cannot be linked across changes, but the mobile device presence is exposed as long as it remains connected: all its communication is trivially linkable by observing the randomized yet same MAC address throughout the connection. Our runtime MAC re-randomization scheme addresses this issue, reducing or eliminating Wi-Fi frames linkability without awaiting for or requiring a disconnection. Our MAC re-randomization is practically 'over-the-air': MAC addresses are re-randomized just before transmission, while the protocol stacks (at the mobile and the AP) maintain locally the original connection MAC addresses - making our MAC layer scheme transparent to upper layers. With an implementation and a set of small-scale experiments with off-the-shelf devices, we show the feasibility of our scheme and the potential towards future deployment.

Figures (7)

• Figure 1: 48-bit nonce/PN comprises $h$/$l$-bit PN-H/PN-L.
• Figure 2: Over-the-air MAC conversion.
• Figure 3: Interval between two PN wraps, as a function of $T$ (1$s$$\sim$ 24$h$), for 50 $byte$ data frames and 10 $Gbps$ bit rate.
• Figure 4: MAC re-randomization example with five stations.
• Figure 5: (\ref{['copy_to_server_off_vanila']}, \ref{['copy_to_server_500_vanila']}) Vanilla driver and (\ref{['copy_to_server_off']}, \ref{['copy_to_server_500']}) our scheme. Average copy speed of 50 $MB$ files to the server (public IP) with (\ref{['copy_to_server_off_vanila']}, \ref{['copy_to_server_off']}) RTS/CTS off and (\ref{['copy_to_server_500_vanila']}, \ref{['copy_to_server_500']}) RTS_threshold=500 $bytes$.