System and method for detecting unauthorized wireless access points

• US 20040003285A1
• Filed: 06/28/2002
• Published: 01/01/2004
• Est. Priority Date: 06/28/2002
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Wavelink Corporation (Ivanti Software, Inc.)
• Inventors: Whelan, Robert, Morris, Roy, Van Wagenen, Lamar
• Granted Patent: US 7,965,842 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Unauthorized wireless access points are detected by configuring authorized access points and mobile units to listen to all wireless traffic in its cell and report all detected wireless devices to a monitor. The monitor checks the reported devices against a list of authorized network devices. If the reported wireless device is not an authorized device, the monitor determines if the reported device is connected to the network. If the reported device is connected to the network and is not an authorized device, the monitor alerts the network operator or network manager of a rogue device connected to the network and attempts to locate and isolate the rogue device.

Claims

1. A system for detecting unauthorized access points, comprising:

a database of authorized access points; and

a server configured to receive a message from a wireless device, the message indicating the existence of an access point, the server being further configured to query the database to determine whether the access point is authorized.

2. The system of claim 1, wherein the wireless device comprises an access point.

3. The system of claim 1, wherein the wireless device comprises a mobile wireless device.

13. The system of claim 1, wherein the wireless device comprises only conventional wireless hardware.

4. A system for detecting unauthorized access points, comprising:

one or more electronic data structures comprising data representing one or more mobile wireless devices operatively associated with one or more authorized access points;

a network monitor configured to detect on a wired network a message originating from a mobile wireless device;

the network monitor being further configured to query the one or more data structures to determine whether the message originated from a mobile wireless device associated with an authorized access point.

5. A system for detecting unauthorized wireless mobile units, comprising:

one or more electronic data structures representing one or more mobile wireless devices operatively associated with one or more authorized access points; and

a network monitor configured to detect on a wired network a message originating from a mobile wireless device, the network monitor being further configured to query the one or more data structures to determine whether the message originated from a wireless device associated with an authorized access point.

6. A system for detecting unauthorized access points, comprising:

a network segment for which no access point is authorized; and

a network monitor configured to detect on the network segment a message originating from a wireless device.

7. A system for detecting unauthorized access points comprising:

a wired network segment enabling communication between a first network device and a second network device via at least one wire;

an access point electrically connected to the wired network segment configured to communicate via wireless electromagnetic signals with one or more mobile wireless devices when the one or more mobile wireless devices are within a communication zone of the access point; and

a network monitor configured to receive from the access point a list of all mobile wireless devices within the communication zone of the access point and to determine the presence of an unauthorized device electrically connected to the wired network based on the list of wireless devices received from the access point.

8. A method for detecting an unauthorized wireless device on a WLAN comprising the steps of:

detecting the presence of an unknown wireless device within a cell of a wireless device known to the WLAN;

monitoring WLAN traffic for a message from the unknown wireless device; and

classifying the unknown wireless device as an unauthorized wireless device if the monitored traffic includes a message from the unknown wireless device.

9. A system for securing a network, comprising:

a network monitor configured to monitor a network for unauthorized access points;

the network monitor being further configured to attempt to disable wireless communications via an unauthorized access point.

10. The system of claim 9, wherein

the unauthorized access point comprises a MAC address filter for prohibiting access to the access point based on information describing one or more MAC addresses;

and

the network monitor is further configured to set the MAC address filter of the unauthorized access point to prohibit access by any wireless device to the access point.

11. The system of claim 9, further comprising:

a switch or router configured to transfer information between at least two network segments;

wherein the network monitor is further configured to configure the switch or router to prevent transfer of information through the switch originating from or addressed to the unauthorized access point.

12. A wireless security system, comprising:

a wired network segment enabling communication between a first network device and a second network device via at least one wire;

at least one access point electrically connected to the wired network segment configured to communicate via wireless electromagnetic signals with one or more mobile wireless devices when the one or more mobile wireless devices are within a communication zone of the access point; and

a network monitor configured to disable wireless communication with the at least one access point according to a regular business schedule.