Secure way to grant access to WIFI network based on dynamic parameters?

Question

I am looking for a way to grant access to a secured WiFi network, based on certain external information?

For example, some server on the internet could store MAC addresses that ought to be granted access, in addition to MAC addresses stored in router itself.

Or, access to WiFi network is password protected, but it will be granted if password supplied by newly connected device matches one of the passwords contained in a dynamic list.

The idea behind this question is the following: I have WiFi with flat rate plan. I should not resell it, but I can share it with friends and family, when they pay me a visit.

Now, I would be willing to allow access to an unknown "visitor" which happens to be within the range, provided he does the same with his WiFi. If there are enough like-minded individuals within an area, I could get access to free internet at many more spots.

However, this should work automatically, should not incur any costs on new participant, and should end its participation X days after he ceases to provide free internet to others.

Are there any security concerns? I am aware that this is still somewhat a general question, and pointing me into the right direction how this could be achieved would be great help!

Thanks!

Answer 1

You can use WPA-Enterprise with a RADIUS Server for authentication. If you want to implement these exotic methods you mentioned, look for existing RADIUS policies that fit your needs or write your own. http://freeradius.org/features/policy.html

Answer 2

There are numerous methods to achieve what you are talking about. You do NOT want to use MAC address, these can be spoofed. You either want to assign a certificate or some other credential, and ensure you control the enrollment process.

Using Network Access Control mechanisms, you can restrict access to authorized users, those with certain system settings, etc.

Your question is a little high level, so you may want to put in some more specifics or the use scenario. A good place to start would be by looking into 802.1x and Network Access Control and/or Network Admission Control

Answer 3

You might want to take a look at the term Wireless_community_network which expresses a similar intend like your question. One of the most known is Freifunk which is a big non-commercial organisation with about 20,000 access points. A commercial version which requires the user to also share his wifi or to pay is the commercial organisation FON but the legal status is questionable since most ISPs do not allow commercial reselling.

I am not affiliated or anything else with any of theese organisations and never used them but only put them in as example for further research and cannot say anything of their fitness for any particular purpose.