System and method for sensing wireless LAN activity

• US 20040008652A1
• Filed: 02/06/2003
• Published: 01/15/2004
• Est. Priority Date: 05/20/2002
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott E., Tanzella, Fred C.
• Granted Patent: US 7,277,404 B2
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A wireless network sensor includes a system data store capable of storing a variety of data associated with a wireless computer network and communication(s) transmitted thereon, a communication interface supporting at least reception of wireless communication(s) over the wireless computer network and a system processor. Data is extracted into one or more logical units or frames according to the protocol of the wireless network from signal received by the communication interface. This extracted data is inspected and stored. In some embodiments, the stored data is aggregated with information subsequently derived from further received signals. The stored data can be locally or remotely analyzed to generate a security rating which can be forwarded to either a user or a further data processing system.

Claims

1. A wireless network sensor comprising:

a) a wireless receiver adapted to receive wireless transmissions of signals within a predetermined frequency range;

b) a system data store comprising one or more data storage elements, the system data store capable of storing received data and program data; and

c) a system processor comprising one or more processing elements, wherein the system processor is in communication with the wireless receiver and the system data store and wherein the system processor'"'"'s one or more processing elements are programmed or adapted to;

i) extract data into one or more logical units according to a selected networking protocol from signals received by the wireless receiver;

ii) inspect each extracted logical unit; and

iii) store information derived from the inspection of each logical unit in the system data store.

2. The system of claim 1, wherein the wireless receiver receives one or more peer signals corresponding to information derived from inspecting logical units extracted by a second wireless network sensor and wherein the system processor is further programmed or adapted to determine the corresponding information from the received one or more peer signals and to aggregate the determined information with the stored information in the system data store.

3. The system of claim 1, wherein the system processor'"'"'s one or more processing elements are further programmed or adapted to:

iv) analyze the information derived from each inspection in the aggregate to generate a security rating; and

v) output the security rating to a user or a data processing system.

4. The system of claim 3, and further comprising:

d) a sensor communication interface, and

e) a host communication interface, and

wherein the system processor comprises a sensor processing element in communication with the sensor communication interface and a host processing element in communication with the host communication interface, wherein the sensor communication interface and the host communication interface are connected via one or more communication channels,

wherein the sensor processing element is programmed or adapted to perform the extraction, inspection and storing functionality of the system processor and further programmed or adapted to transmit the stored information to the host processing element via the sensor communication interface, and

wherein the host processing element is programmed or adapted to perform the analysis and output functionality of the system processor and further programmed or adapted to receive store information from one or more sensor processing elements via the host communication interface.

5. The system of claim 4, wherein the sensor and host communication interfaces connect to communication channels of differing types.

6. The system of claim 4, wherein the sensor and host communication interfaces connect to communication channels of similar types.

7. The system of claim 6, wherein the sensor and host communication interfaces are computer network interfaces.

8. The system of claim 7, wherein the sensor communication interface is a wired computer network interface.

9. The system of claim 4, and further comprising a chaining communication interface to a third communication channel, wherein the sensor processing element is further programmed or adapted to:

i) receive inbound network data from the chaining communication interface;

ii) output the received inbound network data via the sensor communication interface;

iii) receive outbound network data from the sensor communication interface; and

iv) output the received outbound network data via the chaining communication interface.

10. The system of claim 9, and further comprising a wireless access point that connects to the chaining communication interface.

11. The system of claim 3, and further comprising a clock in communication with the system processor, wherein the system processor is further programmed or adapted to monitor the clock and wherein the system processor analyzes the aggregated information derived from each inspection to generate a security rating based upon the monitoring of the clock.

12. The system of claim 11, wherein the system processor analyzes the aggregated information derived from each inspection to generate a security rating at periodic time intervals.

13. The system of claim 11, wherein the system processor analyzes the aggregated information derived from each inspection to generate a security rating at one or more specified times.

14. The system of claim 1, and further comprising:

d) a wireless transceiver adapted to wirelessly send and receive signals within a predetermined frequency range, and e) a communication interface to a computer network,

wherein the system processor'"'"'s one or more processing elements are further programmed or adapted to;

iv) extract inbound network data into one or more logical units according to a selected networking protocol compatible with the communication interface from signals received by the wireless transceiver;

v) output the extracted inbound network data via the communication interface;

vi) receive outbound network data from the communication interface in the selected networking protocol; and

vii) causing the transceiver to output signals representing the outbound network data according to a selected wireless transmission protocol.

15. The system of claim 1, wherein the selected networking protocol conforms to 802.11.

16. The system of claim 1, wherein the system processor is programmed or adapted to inspect each extracted logical unit by determining its type and selectively processing the extracted logical unit based upon the determined type.

17. The system of claim 16, wherein a portion of extracted logical units are of one or more types comprising redundant information and wherein the processor is programmed or adapted to store information derived from the inspection of each logical unit in the system data store by aggregating information derived from each logical unit of a selected type comprising redundant information with any previously stored information derived from prior inspections of logical units of the selected type.

18. The system of claim 16, wherein a portion of the extracted logical units are of one or more types comprising source and destination information and wherein the system processor'"'"'s selective processing of the extracted logical unit of such types comprising source and destination information comprises identifying the source and destination information.

19. The system of claim 1, and further comprising a bus interface adapted to allow integration with a wireless access point having a receptor adapted to receive the bus interface.

20. A wireless network sensor comprising:

a) storing means for storing information derived from signals from the receiving and access point means;

b) access point means for receiving and transmitting wireless signals within a predetermined frequency range;

c) receiving means for receiving wireless signals within the predetermined frequency range;

d) security processing means for deriving security relevant information from signals received by the receiving means, for formatting the security relevant information as outbound security data and for storing the outbound security data in the storing means.

e) data processing means for deriving outbound communication data from wireless signals received by the access point means and for storing the outbound communication data in the storing means;

f) interface communication means for;

i) receiving an inbound communication from a computer network;

ii) storing inbound data derived from the received inbound communication in the storing means;

iii) causing the access point means to transmit a wireless signal based upon the inbound data in the storing means;

iv) retrieving outbound data comprising outbound security data, outbound communication data or a combination thereof from the storing means;

v) converting the outbound data into an outbound communication in a format suitable for transmission via the computer network; and

vi) forwarding the outbound communication to the computer network.

21. The system of claim 20, and further comprising timing means for tracking passage of time and for triggering retrieving, converting and forwarding of outbound security data by the interface communication means based upon the tracked passage of time at periodic intervals or until one or more predetermined times.

22. The system of claim 20, wherein the storing means is further for receiving and storing configuration information comprising network configuration and default data, wherein the interface communication means is further for receiving an active defense request signal from an intrusion detection system, wherein a received request signal comprises an access point indicator corresponding to an access point potentially compromised by an intruder and further comprising g) honeypot processing means for:

(1) receiving configuration data associated with the potentially compromised access point via the interface communication means;

(2) storing identification information associated with the potentially compromised access point based on the received configuration data;

(3) communicating with the intruder via the access point means as if the intruder were communicating with the potentially compromised access point based upon the stored identification information; and

(4) transmitting a communication comprising a channel change request to the potentially compromised access point via the interface communication means.

23. A security data acquisition process, the process comprising the steps of:

a) receiving a wireless signal within a predetermined frequency range;

b) extracting data into one or more logical units according to a selected networking protocol from the received wireless signal;

c) inspecting each extracted logical unit;

d) storing information derived from the inspection of each logical unit;

e) at periodic time intervals or at one or more predetermined times, forwarding the stored information for analysis;

f) analyzing the forwarded information to generate a security rating; and

g) outputting the security rating to a user or a data processing system.

24. The method of claim 23, and further comprising the step of repeating steps a) through d) for a plurality of received wireless signals.

25. The method of claim 24, and further comprising the step of repeating steps a) through e) and the step of repeating steps a) through d) at a plurality of wireless signal reception locations.