Wireless local or metropolitan area network with intrusion detection features and related methods

• US 20040027988A1
• Filed: 08/12/2002
• Published: 02/12/2004
• Est. Priority Date: 08/12/2002
• Status: Active Grant

• Current Assignee: Stingray IP Solutions LLC (Acacia Research Corporation)
• Original Assignee: Harris Corporation (L3Harris Technologies, Inc.)
• Inventors: Billhartz, Thomas Jay
• Granted Patent: US 7,224,678 B2
• Time in Patent Office: Days
• US Class Current: 370/229
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A wireless local or metropolitan area network may include a plurality of stations for transmitting data therebetween using a media access layer (MAC), where each of the stations has a respective MAC address associated therewith. The wireless network may also include a policing station for detecting intrusions into the wireless network by monitoring transmissions among the plurality of stations to detect frame check sequence (FCS) errors from a MAC address, and generating an intrusion alert based upon detecting a number of FCS errors for the MAC address exceeding a threshold. The policing station may also detect intrusions based upon one or more of failed MAC address authentications, illegal network allocation vector (NAV) values, and unexpected contention or contention-free operation.

Claims

1. A wireless local or metropolitan area network comprising:

a plurality of stations for transmitting data therebetween using a media access layer (MAC), each of said stations having a respective MAC address associated therewith; and

a policing station for detecting intrusions into the wireless network by

monitoring transmissions among said plurality of stations to detect frame check sequence (FCS) errors from a MAC address; and

generating an intrusion alert based upon detecting a number of FCS errors for the MAC address exceeding a threshold.

2. The wireless network of claim 1 wherein said policing station further detects intrusions into the wireless network by:

monitoring transmissions among said plurality of stations to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

3. The wireless network of claim 2 wherein said policing station generates an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

4. The wireless network of claim 1 wherein said plurality of stations transmit request to send (RTS) and clear to send (CTS) packets therebetween prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring RTS and CTS packets transmitted among said plurality of stations to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

5. The wireless network of claim 1 wherein said plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

6. The wireless network of claim 1 wherein said plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation outside a CFP.

7. The wireless network of claim 1 wherein the wireless network has at least one service set identification (ID) associated therewith;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

8. The wireless network of claim 1 wherein said plurality of stations transmit data over at least one channel;

and wherein said policing station further detects transmissions over the at least one channel not originating from one of the plurality of stations and generates an intrusion alert based thereon.

9. The wireless network of claim 1 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.

10. The wireless network of claim 1 wherein said policing station comprises a base station.

11. The wireless network of claim 1 wherein said policing station comprises a wireless station.

12. A wireless local or metropolitan area network comprising:

a plurality of stations for transmitting data therebetween using a media access layer (MAC), each of said stations having a respective MAC address associated therewith; and

a policing station for detecting intrusions into the wireless network by

monitoring transmissions among said plurality of stations to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

13. The wireless network of claim 12 wherein said policing station generates an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

14. The wireless network of claim 12 wherein said plurality of stations transmit request to send (RTS) and clear to send (CTS) packets therebetween prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring RTS and CTS packets transmitted among said plurality of stations to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

15. The wireless network of claim 12 wherein said plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

16. The wireless network of claim 12 wherein said plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP.

17. The wireless network of claim 12 wherein the wireless network has at least one service set identification (ID) associated therewith;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

18. The wireless network of claim 12 wherein said plurality of stations transmit data over at least one channel;

and wherein said policing station further detects transmissions over the at least one channel not originating from one of the plurality of stations and generates an intrusion alert based thereon.

19. The wireless network of claim 12 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.

20. The wireless network of claim 12 wherein said policing station comprises a base station.

21. The wireless network of claim 12 wherein said policing station comprises a wireless station.

22. A wireless local or metropolitan area network comprising:

a plurality of stations for transmitting data therebetween;

said plurality of stations transmitting request to send (RTS) and clear to send (CTS) packets therebetween prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data; and

a policing station for detecting intrusions into the wireless network by

monitoring RTS and CTS packets transmitted among said plurality of stations to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

23. The wireless network of claim 22 wherein said plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

24. The wireless network of claim 22 wherein said plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP.

25. The wireless network of claim 22 wherein the wireless network has at least one service set identification (ID) associated therewith;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

26. The wireless network of claim 22 wherein said plurality of stations transmit over at least one channel;

and wherein said policing station further detects transmissions over the at least one channel not originating from one of the plurality of stations and generates an intrusion alert based thereon.

27. The wireless network of claim 22 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.

28. The wireless network of claim 22 wherein said policing station comprises a base station.

29. The wireless network of claim 22 wherein said policing station comprises a wireless station.

30. A wireless local or metropolitan area network comprising:

a plurality of stations for transmitting data therebetween, said plurality of stations intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs; and

a policing station for detecting intrusions into the wireless network by

monitoring transmissions among said plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP.

31. The wireless network of claim 30 wherein the wireless network has at least one service set identification (ID) associated therewith;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

32. The wireless network of claim 30 wherein said plurality of stations transmit over at least one channel;

and wherein said policing station further detects transmissions over the at least one channel not originating from one of the plurality of stations and generates an intrusion alert based thereon.

33. The wireless network of claim 30 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.

34. The wireless network of claim 30 wherein said policing station comprises a base station.

35. The wireless network of claim 30 wherein said policing station comprises a wireless station.

36. A wireless local or metropolitan area network comprising:

a plurality of stations for transmitting data therebetween, said plurality of stations intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs; and

a policing station for detecting intrusions into the wireless network by

monitoring transmissions among said plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP.

37. The wireless network of claim 36 wherein the wireless network has at least one service set identification (ID) associated therewith;

and wherein said policing station further detects intrusions into the wireless network by;

monitoring transmissions among said plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

38. The wireless network of claim 36 wherein said plurality of stations transmit over at least one channel;

and wherein said policing station further detects transmissions over the at least one channel not originating from one of the plurality of stations and generates an intrusion alert based thereon.

39. The wireless network of claim 36 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.

40. The wireless network of claim 36 wherein said policing station comprises a base station.

41. The wireless network of claim 36 wherein said policing station comprises a wireless station.

42. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:

transmitting data between the plurality of stations using a media access layer (MAC), each of the stations having a respective MAC address associated therewith;

monitoring transmissions among the plurality of stations to detect frame check sequence (FCS) errors from a MAC address; and

generating an intrusion alert based upon detecting a number of FCS errors for the MAC address exceeding a threshold.

43. The method of claim 42 further comprising:

monitoring transmissions among the plurality of stations to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

44. The method of claim 43 wherein generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address comprises generating an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

45. The method of claim 42 further comprising:

transmitting request to send (RTS) and clear to send (CTS) packets between the plurality of stations prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

monitoring the RTS and CTS packets sent between the plurality of stations to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

46. The method of claim 42 wherein the plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

47. The method of claim 42 wherein the plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

48. The method of claim 42 wherein the wireless network has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

49. The method of claim 42 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of stations and generating an intrusion alert based thereon.

50. The method of claim 42 further comprising transmitting the intrusion alert to at least one of the plurality of stations.

51. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:

transmitting data between the plurality of stations using a media access layer (MAC), each of the stations having a respective MAC address associated therewith;

monitoring transmissions among the plurality of stations to detect failed attempts to authenticate MAC addresses; and

generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address.

52. The method of claim 51 wherein generating an intrusion alert based upon detecting a number of failed attempts to authenticate a MAC address comprises generating an intrusion alert based upon detecting the number of failed attempts to authenticate the MAC address within a predetermined period.

53. The method of claim 51 further comprising:

transmitting request to send (RTS) and clear to send (CTS) packets between the plurality of stations prior to transmitting data, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting the data;

monitoring the RTS and CTS packets sent between the plurality of stations to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

54. The method of claim 51 wherein the plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

55. The method of claim 51 wherein the plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

56. The method of claim 51 wherein the wireless network has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

57. The method of claim 51 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of stations and generating an intrusion alert based thereon.

58. The method of claim 51 further comprising transmitting the intrusion alert to at least one of the plurality of stations.

59. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:

transmitting request to send (RTS) and clear to send (CTS) packets between the plurality of stations, the RTS and CTS packets comprising a network allocation vector (NAV) value indicating a time duration reserved for transmitting data between the plurality of stations;

transmitting data between the plurality of stations;

monitoring the RTS and CTS packets sent between the plurality of stations to detect an illegal NAV value therein; and

generating an intrusion alert based upon the detected illegal NAV value.

60. The method of claim 59 wherein the plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

61. The method of claim 59 wherein the plurality of stations intermittently operate in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

and further comprising;

monitoring transmissions among the plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

62. The method of claim 59 wherein the wireless network has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

63. The method of claim 59 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of stations and generating an intrusion alert based thereon.

64. The method of claim 59 further comprising transmitting the intrusion alert to at least one of the plurality of stations.

65. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:

transmitting data between the plurality of stations, the plurality of stations intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

monitoring transmissions among the plurality of stations to detect contention-free mode operation outside of a CFP; and

generating an intrusion alert based upon detecting contention-free mode operation outside a CFP period.

66. The method of claim 65 wherein the wireless network has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

67. The method of claim 65 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of stations and generating an intrusion alert based thereon.

68. The method of claim 65 further comprising transmitting the intrusion alert to at least one of the plurality of stations.

69. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:

transmitting data between the plurality of stations, the plurality of stations intermittently operating in a contention-free mode during contention-free periods (CFPs) and in a contention mode outside CFPs;

monitoring transmissions among the plurality of stations to detect contention mode operation during a CFP; and

generating an intrusion alert based upon detecting contention mode operation during a CFP period.

70. The method of claim 69 wherein the wireless network has at least one service set identification (ID) associated therewith;

and further comprising;

monitoring transmissions among the plurality of stations to detect service set IDs associated therewith; and

generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.

71. The method of claim 69 wherein transmitting data comprises transmitting data over at least one channel;

and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of stations and generating an intrusion alert based thereon.

72. The method of claim 69 further comprising transmitting the intrusion alert to at least one of the plurality of stations.