Method and apparatus for ensuring address information of a wireless terminal device in communications network

• US 20040148374A1
• Filed: 05/01/2003
• Published: 07/29/2004
• Est. Priority Date: 05/07/2002
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Haverinen, Henry, Rinnemaa, Jyri, Tuominen, Hannu, Tuomi, Jukka, Bush, Anton, Smith, Mike, Takamaki, Timo
• Granted Patent: US 7,480,933 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 80/02 Data link layer protocols
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method and device for ensuring address information of a wireless terminal device in a wireless local area network, the network comprising; an access point for setting up a communication connection to the terminal device, the method comprising establishing a communication connection between the terminal device and the access point (101), and relaying data packets from the terminal device to the network and from the network to the terminal device (105). The method further comprising the steps at the access point: detecting an IP address of the terminal device in response to the established communication connection (103), associating the detected IP address of the terminal device to the MAC address of the terminal device (104), and comparing that the address information of the terminal device on the relayed data packets are corresponding to the associated address information (111, 112).

Claims

1. A method for checking address information of a wireless terminal device in a wireless local area network, the network comprising an access point for setting up a communication connection to the terminal device,

the method comprising:

establishing (101) a communication connection between the terminal device and the access point,

receiving (102) identifying information from the terminal device, characterised by the method further comprising at the access point;

detecting (103) an IP address of the terminal device after having established the communication connection,

associating (104) the detected IP address of the terminal device to the identifying information received from the terminal device,

relaying (105) data packets from the terminal device to the network and from the network to the terminal device, said data packets comprising an IP address, and

comparing (111) if the IP address in the relayed data packets corresponds to the associated IP address.

2. A method according to claim 1, characterised in that the destination IP address of the data packets going to the terminal device is compared to the associated IP address.

3. A method according to claim 1, characterised in that the source IP address of the data packets coming from the terminal device is compared to the associated IP address.

4. A method according to claim 1, characterised in that the access point detects the IP address of the terminal device from DHCP packets that the terminal device sends and/or receives.

5. A method according to claim 1, characterised in that the access point detects the IP address of the terminal device when the access point is relaying the DHCP packets of the terminal device.

6. A method according to claims 1 to 5, characterised in that if the IP address of a data packet sent to or received from the terminal device does not correspond to the associated IP address, the packet is discarded.

7. A method according to claims 1 to 5, characterised in that if the IP address of a data packet sent to or received from the terminal device does not correspond to the associated IP address, the connection between the access point and the terminal device is terminated.

8. A method according to claims 6 and 7, characterised in that the terminal device is added to a list of terminals behaving badly.

9. A method according to claim 8, characterised in that the communication connection between the terminal device and the access point has an integrity protection comprising the MAC address of the terminal device.

10. An access point (300) for setting up a communication connection to a terminal device in a wireless local area network, the access point comprising;

establishing means (301-303, 306, 307) for establishing a communication connection between the terminal device and the access point

receiving means (305-307) for receiving identifying information from the terminal device, and

characterised by the access point further comprising;

detecting means (301-303) for detecting an IP address of the terminal device after having established the communication connection,

associating means (301-304) for associating the detected IP address of the terminal device to the identifying information received from the terminal device, and

relaying means (301-303, 305) for relaying data packets from the terminal device to the network and from the network to the terminal device, said data packets comprising an IP address, and

comparing means (301-305) for comparing if the IP address in the relayed data packets corresponds to the associated IP address.

11. An access point according to claim 10, characterised in that the comparing means is arranged to compare the destination IP address of the data packets going to the terminal device to the associated IP address of the terminal device.

13. An access point according to claim 11, characterised in that the comparing means are arranged to compare the source IP address of the data packets coming from the terminal device to the associated IP address of the terminal device.

14. An access point according to claim 11, characterised in that the detecting means are arranged to detect the IP address of the terminal from DHCP packets the terminal device sends and/or receives.

15. An access point according to claim 11, characterised in that the detecting means are arranged to detect the IP address of the terminal device when the access point is relaying the DHCP packets of the terminal device.

16. An access point according to claim 11, characterised in that the access point further comprising discarding means for discarding the data packet of the terminal device if the IP address of the data packet sent to or received from the terminal device does not correspond to the associated IP address.

17. An access point according to claim 16, characterised in that the discarding means are further arranged to terminate the connection between the access point and the terminal device.

18. An access point (300) for setting up a communication connection to a terminal device in a wireless local area network, the access point comprising;

an establisher (301-303, 306, 307) configured to establish a communication connection between the terminal device and the access point

a receiver (305-307) configured to receive identifying information from the terminal device, the information identifying said terminal device, and

characterised by the access point further comprising;

a detector (301-303) configured to detect an IP address of the terminal device after having established the communication connection,

a memory (302,304) configured to store an association of the detected IP address of the terminal device to the identifying information received from the terminal device, and

a relay (301-303, 305) configured to relay data packets from the terminal device to the network and from the network to the terminal device, said data packets comprising an IP address of the terminal device, and

a comparator (301-305) configured to compare if the IP address in the relayed data packets corresponds to the associated IP address.

19. A computer program product for an access point (300) setting up a communication connection to a terminal device in a wireless local area network, the access point comprising;

establishing means (301-303,306,307) for establishing a communication connection between the terminal device and the access point,

receiving means (305-307) for receiving identifying information from the terminal device, the information identifying said terminal device, and

characterised by the computer program product comprising;

computer program means for causing the access point to detect an IP address of the terminal device after having established the communication connection,

computer program means for causing the access point to associate the detected IP address of the terminal device to the identifying information of the terminal device, and

computer program means for causing the access point to relay data packets from the terminal device to the network and from the network to the terminal device, said data packets comprising an IP address, and

computer program means for causing the access point to compare if the IP address of the terminal device in the relayed data packets corresponds to the associated IP address.