Method and system for locating a wireless access device in a wireless network

• US 20040198392A1
• Filed: 04/03/2003
• Published: 10/07/2004
• Est. Priority Date: 04/03/2003
• Status: Active Grant

• Current Assignee: Ozmo Licensing LLC
• Original Assignee: MCI Communications Services Incorporated (Verizon Communications Inc.)
• Inventors: Harvey, Elaine, Walnock, Matthew
• Granted Patent: US 7,853,250 B2
• Time in Patent Office: Days
• US Class Current: 455/456.1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A wireless access device in a wireless network, whether a known or unknown entity, can be located using a geolocation system according to the present invention. A signal strength is determined by a wireless intrusion detection system (WIDS) node in a wireless network for each wireless access device that it detects. Based on the signal strength, an approximate distance from the node is determined, which, in one embodiment corresponds to a radius of a circle around the node. To account for error, an approximation band of the circle is calculated that will allow a user to determine the approximate location of the device within the wireless network.

Claims

1. A method comprising:

detecting the existence of a wireless access device using a plurality of nodes at known locations;

measuring a signal strength of said wireless access device detected by said plurality of nodes;

determining a distance to said detected wireless access device from each of said plurality of nodes based on said signal strength; and

estimating an area for each of said plurality of nodes corresponding to the possible locations of said one or more wireless access devices;

wherein the location of said detected wireless access device can be established based on one or more intersections between said areas.

2. A method as in claim 1 wherein said detecting further comprises determining a communications channel in use between two wireless access devices.

3. A method as in claim 2 wherein said determining a communications channel further comprises:

observing a channel in a wireless network for a predetermined amount of time;

determining the received signal strength of transmissions received on said wireless network channel;

detecting a wireless access device in said wireless network;

for said wireless access device, calculating an average received signal strength value per wireless network channel; and

determining a communications channel in use by said wireless access device based on said average received signal strength value.

4. A method as in claim 1 wherein said estimating further comprises determining an approximation band around each of said nodes within which each wireless access device could exist based upon said distance.

5. A method as in claim 4 wherein said determining an approximation band is further based on a margin of error.

6. A method comprising:

observing a channel in a wireless network for a predetermined amount of time;

determining the received signal strength of transmissions received on said wireless network channel;

detecting a wireless access device in said wireless network;

for said wireless access device, calculating an average received signal strength value per wireless network channel; and

determining a communications channel in use by said wireless access device based on said average received signal strength value.

7. A method as in claim 6, further comprising forming a table containing a channel and signal strength entry for each said wireless access device.

8. A method as in claim 6, wherein said calculating an average further comprises calculating a weighted average.

9. A method as in claim 8, wherein said measuring occurs at a node.

10. A method as in claim 8, further comprising the discarding of extraneous channel hopping data prior to said step of calculating an average.

11. A method comprising:

determining a location of a wireless access device;

comparing said location of said wireless access device to policy elements applicable to said wireless access device; and

creating an alert if said wireless access device violates more than a threshold number of said policy elements.

12. A method as in claim 11, wherein said determining step further comprises determining an approximate location.

13. A method as in claim 11, wherein said comparing the location further comprises evaluating said location against a plurality of policy elements.

14. A method as in claim 13, wherein each policy element is selected from the group consisting of:

fixed wireless access device location, moving wireless access device, movable wireless access device, or unknown wireless access device.

15. A wireless intrusion detection node, comprising:

means for detecting the existence of a wireless access device in an area; and

means for determining a received signal strength for said wireless access device;

wherein a distance from said node to said wireless access device can be approximated from said received signal strength.

16. A wireless intrusion detection collector, comprising:

means for collecting, from two or more nodes, a distance from each node to a wireless access device detected by a plurality of said nodes; and

means for determining an area around each of said nodes corresponding to the possible locations of said wireless access device;

wherein the location of a detected wireless access device can be established based on one or more intersections between said areas.

17. A computer readable medium containing computer program instructions for:

detecting the existence of a wireless access device using a plurality of nodes at known locations;

measuring a signal strength of said wireless access device detected by said plurality of nodes;

determining a distance to said detected wireless access device from each of said plurality of nodes based on said signal strength; and

estimating an area for each of said plurality of nodes corresponding to the possible locations of said one or more wireless access devices;

wherein the location of said detected wireless access device can be established based on one or more intersections between said areas.

18. A computer readable medium containing computer program instructions for:

detecting the existence of a wireless access device in an area; and

measuring, at a node, a received signal strength of said wireless access device;

wherein a distance from said node to said wireless access device can be determined from said received signal strength.

19. A computer readable medium containing computer program instructions for:

collecting, from two or more nodes, a distance from each node to a wireless access device detected by a plurality of said nodes; and

calculating an area around each of said nodes corresponding to the possible locations of said wireless access device;

wherein the location of a detected wireless access device can be established based on one or more intersections between said areas.