Detecting a counterfeit access point in a wireless local area network

• US 20030185244A1
• Filed: 03/29/2002
• Published: 10/02/2003
• Est. Priority Date: 03/29/2002
• Status: Active Grant

• Current Assignee: Airmagnet (NetScout Systems Incorporated)
• Original Assignee: Airmagnet (NetScout Systems Incorporated)
• Inventors: Kuan, Chia-Chee, Wu, Miles, Au, Dean
• Granted Patent: US 7,236,460 B2
• Time in Patent Office: Days
• US Class Current: 370/503
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 48/20 Selecting an access point
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

In a wireless local area network, beacon frames are transmitted over the wireless local area network by one or more access points. The beacon frames are received at a detector in the wireless local area network. The received beacon frames are analyzed at the detector to detect a counterfeit access point in the wireless local area network.

Claims

1. A method of detecting a counterfeit access point in a wireless local area network comprising:

receiving beacon frames at a detector in the wireless local area network, wherein the beacon frames are transmitted over the wireless local area network by one or more access points; and

analyzing the received beacon frames at the detector to detect a counterfeit access point in the wireless local area network.

2. The method of claim 1, wherein analyzing comprises:

obtaining a stated beacon frame rate from a received beacon frame;

determining a measured beacon frame rate; and

comparing the measured beacon frame rate and the stated beacon frame rate.

3. The method of claim 2, wherein a counterfeit access point is detected if the measured beacon frame rate and the stated beacon frame rate are inconsistent.

4. The method of claim 2, wherein obtaining a stated beacon frame rate from the received beacon frame comprises:

examining a beacon frame to obtain a beacon frame rate stated in the beacon frame.

5. The method of claim 2, wherein determining a measured beacon frame rate comprises:

counting the number of received beacon frames during a period of time.

6. The method of claim 1, wherein analyzing comprises:

obtaining a sequence number from a received beacon frame; and

comparing the obtained sequence number to a sequence number of a previously received beacon frame.

7. The method of claim 6, wherein a counterfeit access point is detected if the obtained sequence number and the sequence number of the previously received beacon frame are inconsistent.

8. The method of claim 7, wherein a counterfeit access point is detected if the obtained sequence number and the sequence number of the previously received beacon frame are not sequential.

9. The method of claim 6 comprising:

replacing the sequence number of the previously received beacon frame with the obtained sequence number if the obtained sequence number and the sequence number of the previously received beacon frame are consistent.

10. The method of claim 6, wherein the sequence number of the previously received beacon frame is associated with a medium access control (MAC) address of the previously received beacon frame, and wherein analyzing comprises:

obtaining a sender MAC address of the received beacon frame; and

comparing the sequence number of the received beacon frame to the sequence number of the previously beacon frame if the obtained MAC address is the same as the MAC address associated with the sequence number of the previously received beacon frame.

11. The method of claim 1, wherein the beacon frames are received below a network layer in an Open Systems Interconnection (OSI) model.

12. The method of claim 1, wherein the beacon frames are sent and received according to the IEEE 802.11 standard.

13. The method of claim 1, wherein the detector is a station in the wireless local area network.

14. A method of detecting a counterfeit access point in a wireless local area network comprising:

receiving beacon frames transmitted over the wireless local area network;

examining a received beacon frame to obtain a stated beacon frame rate;

determining a measured beacon frame rate; and

comparing the measured beacon frame rate and the stated beacon frame rate to detect a counterfeit access point in the wireless local area network.

15. The method of claim 14, wherein a counterfeit access pint is detected if the measured beacon frame rate and the stated beacon frame rate are not consistent.

16. The method of claim 15, wherein a counterfeit access point is detected if the measured beacon frame rate and the stated beacon frame rate are different.

17. The method of claim 14, wherein determining a measured beacon frame rate comprises:

counting the number of received beacon frames during a period of time.

18. The method of claim 14, wherein the beacon frames are received, the received beacon frame is examined, the measured beacon rate is determined, and the measured beacon frame rate and the stated beacon frame rate are compared at a detector connected to the wireless local area network.

19. The method of claim 18, wherein the detector is a station.

20. A method of detecting a counterfeit access point in a wireless local area network comprising:

receiving a beacon frame transmitted over the wireless local area network,

wherein the beacon frame includes a sequence number; and

comparing the sequence number of the received beacon frame to a sequence number of a previously received beacon frame to detect a counterpart access point in the local area network.

21. The method of claim 20, wherein a counterfeit access point is detected if the sequence number of the received beacon frame and the sequence number of the previously received beacon frame are not sequential.

22. The method of claim 21 comprising:

replacing the sequence number of the previously received beacon frame with the sequence number of the received beacon frame if the sequence number of the received beacon frame and the sequence number of the previously received beacon frame are sequential.

23. The method of claim 22 comprising:

storing the sequence number of the previously received beacon frame after replacing the sequence number of the previously received beacon frame with the sequence number of the received beacon frame.

24. The method of claim 20, wherein the received beacon frame includes a medium access control (MAC) address, and wherein the sequence number of the previously received beacon frame is associated with a MAC address of the previously received beacon frame, and wherein analyzing comprises:

obtaining a sender MAC address of the received beacon frame; and

comparing the sequence number of the received beacon frame to the sequence number of the previously beacon frame if the MAC address of the received beacon frame is the same as the MAC address of the previously received beacon frame.

25. An apparatus for detecting a counterfeit access point in a wireless local area network comprising:

a detector in the wireless location area configured to;

receive beacon frames transmitted over the wireless local area network; and

analyze the received beacon frames to detect a counterfeit access point in the wireless local area network.

26. The apparatus of claim 25, wherein the detector is configured to:

examine a received beacon frame to obtain a stated beacon frame;

measure a beacon frame rate; and

compare the measured beacon frame rate and the stated beacon frame rate.

27. The apparatus of claim 26, wherein the detector is configured to count the number of received beacon frames during a period of time to measure a beacon frame rate.

28. The apparatus of claim 25, wherein the detector is configured to:

examine a received beacon frame to obtain a sequence number for the received beacon frame; and

compare the obtained sequence number to a sequence number of a previously received beacon frame.

29. The apparatus of claim 28, wherein the sequence number of the previously received beacon frame is associated with a medium access control (MAC) address of the previously received beacon frame, and wherein the detector is configured to:

obtain a sender MAC address of the received beacon frame; and

compare the sequence number of the received beacon frame to the sequence number of the previously beacon frame if the obtained MAC address is the same as the MAC address associated with the sequence number of the previously received beacon frame.

30. The apparatus of claim 25, wherein the detector receives the beacon frames below a network layer in an Open Systems Interconnection (OSI) model.

31. The apparatus of claim 25, wherein the detector is a station in the wireless local area network.

32. A computer-readable storage medium containing computer executable code to detect a counterfeit access point in a wireless local area network by instructing the computer to operate as follows:

receiving beacon frames transmitted over the wireless local area network at a station in the wireless local area network; and

analyzing the received beacon frames at the station to detect a counterfeit access point in the wireless local area network.

33. The computer-readable storage medium of claim 32, wherein analyzing comprises:

obtaining a stated beacon frame rate from a received beacon frame;

determining a measured beacon frame rate; and

comparing the measured beacon frame rate and the stated beacon frame rate.

34. The computer-readable storage medium of claim 33, wherein determining a measured beacon frame rate comprises:

counting the number of received beacon frames during a period of time.

35. The computer-readable storage medium of claim 32, wherein analyzing comprises:

obtaining a sequence number from a received beacon frame; and

comparing the obtained sequence number to a sequence number of a previously received beacon frame.

36. The computer-readable storage medium of claim 35, wherein a counterfeit access point is detected if the obtained sequence number and the sequence number of the previously received beacon frame are not sequential.

37. The computer-readable storage medium of claim 35 comprising:

replacing the sequence number of the previously received beacon frame with the obtained sequence number if the obtained sequence number and the sequence number of the previously received beacon frame are consistent.

38. The computer-readable storage medium of claim 35, wherein the sequence number of the previously received beacon frame is associated with a medium access control (MAC) address of the previously received beacon frame, and wherein analyzing comprises:

obtaining a sender MAC address of the received beacon frame; and

comparing the sequence number of the received beacon frame to the sequence number of the previously beacon frame if the obtained MAC address is the same as the MAC address associated with the sequence number of the previously received beacon frame.