System and method for determining location of rogue wireless access point

• US 20050113090A1
• Filed: 10/31/2003
• Published: 05/26/2005
• Est. Priority Date: 10/31/2003
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Symbol Technologies, Inc. (Zebra Technologies Corporation)
• Inventors: Sharony, Jacob
• Granted Patent: US 7,069,024 B2
• Time in Patent Office: Days
• US Class Current: 455/436
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

Described are a method and system for determining a location of an unauthorized wireless access point (“AP”) accessing a communication network. Upon notification of existence of the unauthorized AP, at least three authorized APs of the communication network initiate tracking a beacon of the unauthorized AP. A tracking data record is generated partially based on information obtained during the tracking of the tracking beacon. The tracking record may include a location of each of the authorized APs and at least one of (i) a first strength data corresponding to a strength of the tracking beacon as measured by each of the authorized APs and (ii) a first time data corresponding to a time period that it takes for the tracking beacon to arrive at each of the authorized APs. The location of the unauthorized AP is determined as a function of at least one of (i) the tracking record and (ii) a calibrating record. The calibrating record may include (a) at least one of a second strength data corresponding to a strength of a calibrating beacon as transmitted from a predetermined location within the communication network and received by each of the authorized APs and a second time data corresponding to a time period that it takes for the calibrating beacon to arrive from the predetermined location to each of the authorized AP, (b) the predetermined location and (c) the location of each of the authorized AP.

Claims

1. A method for determining a location of an unauthorized wireless access point (“

AP”

) accessing a communication network, comprising;

upon notification of existence of the unauthorized AP, tracking a beacon of the unauthorized AP using at least three authorized APs of the communication network;

generating a tracking data record partially based on information obtained in the tracking step, the tracking record including a location of each of the authorized APs and at least one of (i) a first strength data corresponding to a strength of the tracking beacon as measured by each of the authorized APs and (ii) a first time data corresponding to a time period that it takes for the tracking beacon to arrive at each of the authorized APs; and

determining the location of the unauthorized AP as a function of at least one of (i) the tracking record and (ii) a calibrating record, the calibrating record including (a) at least one of a second strength data corresponding to a strength of a calibrating beacon as transmitted from a predetermined location within the communication network and received by each of the authorized APs and a second time data corresponding to a time period that it takes for the calibrating beacon to arrive from the predetermined location to each of the authorized AP, (b) the predetermined location and (c) the location of each of the authorized AP.

2. The method according to claim 1, wherein when the tracking record includes the first strength data, the determining step includes the substep of calculating the location of the unauthorized AP as a function of the first and second strength data.

3. The method according to claim 1, wherein when the tracking record includes the first time data, the determining step includes at least one of (i) the substep of triangulating the precise location of the unauthorized AP using the first time data and (ii) the substep of calculating the location of the unauthorized AP as a function of the first and second time data.

4. The method according to claim 1, further comprising:

before the tracking step, performing a calibration procedure including the following substeps;

placing a calibrating device at a plurality of predetermined locations within the communication network,

tracking the calibrating beacon from the calibrating device using each of the authorized APs, and

generating the calibration record based on data generated in the tracking substep.

5. The method according to claim 1, further comprising:

overlaying a geographical map of the communication network with the location of each of the authorized APs and the results of the determining step.

6. The method according to claim 1, wherein the tracking record includes a MAC address of the unauthorized AP.

7. The method according to claim 1, wherein the tracking step includes the substep of selecting the at least three authorized APs from a plurality of available authorized APs of the communication network as a function of geographical locations of the authorized APs.

8. The method according to claim 1, further comprising:

after the generating step, storing the tracking record in a memory arrangement of each of the authorized APs; and

providing to the tracking record to a computer of the communication network,

wherein the determining step is performed by the computer.

9. A system for determining a location of an unauthorized wireless access point (“

AP”

) accessing a communication network, comprising;

a plurality of authorized APs; and

a computing arrangement,

wherein upon notification of existence of the unauthorized AP, at least three authorized APs of the plurality of the authorized APs track a beacon of the unauthorized AP, the at least three authorized APs generating a tracking data record which includes a location of each of the authorized APs and at least one (i) a first strength data corresponding to a strength of the tracking beacon as measured by each of the authorized APs and (ii) a first time data corresponding to a time period that it takes for the tracking beacon to arrive at each of the authorized APs, and

wherein the computer determines the precise location of the unauthorized AP as a function of the tracking record and a calibrating data record, the calibrating record including (a) at least one of (i) a second strength data corresponding to a strength of a calibrating beacon as transmitted from a predetermined location within the communication network and received by each of the authorized APs and (ii) a second time data corresponding to a time period that it takes for the calibrating beacon to arrive from the predetermined location at each of the authorized APS, (b) the predetermined location and (c) the location of each of the authorized APS.

10. The system according to claim 9, further comprising:

a calibrating device transmitting the calibrating beacon, the calibrating device including a wireless transmitter.

11. The system according to claim 10, wherein the calibrating device is one of a wireless mobile device and an AP.

12. The system according to claim 9, wherein when the tracking record includes the first strength data, the computing arrangement calculates the location of the unauthorized AP as a function of the first and second strength data.

13. The system according to claim 9, wherein when the tracking record includes the first time data, the computing arrangement includes at least one of (i) triangulating the precise location of the unauthorized AP using the first time data and (ii) calculating the location of the unauthorized AP as a function of the first and second time data.

14. The system according to claim 9, wherein the computing arrangement overlays a geographical map of the communication network with the location of each of the authorized APs and the unauthorized AP.

15. The system according to claim 9, wherein the tracking record includes a MAC address of the unauthorized AP.

16. The system according to claim 9, wherein the computing arrangement selects the at least three authorized APs from the plurality of authorized APs to track the unauthorized AP as a function of the location of each of the authorized APs.

17. The system according to claim 9, wherein the tracking record is situated in a memory arrangement of each of the authorized APs, the tracking record being provided to the computing arrangement upon one of (i) an expiration of a predetermined time period and (ii) a request from the computing arrangement.

18. The system according to claim 9, wherein when the computing arrangement determines the existence of the unauthorized AP, the computing arrangement directs the at least three authorized APs to initiate tracking of the beacon of the unauthorized AP.

19. A computing device for determining a location of an unauthorized wireless access point (“

AP”

) accessing a communication network, comprising;

a memory arrangement storing a calibrating data record;

a communication arrangement communicating with the authorized APs; and

a processor determining the precise location of the unauthorized AP as a function of at least one of a tracking data record and the calibrating data record,

wherein the tracking record is generated by at least three authorized APs of a plurality of authorized APs during tracking of the unauthorized AP, the data record including a location of each of the authorized APs and at least one (i) a first strength data corresponding to a strength of a tracking beacon as measured by each of the authorized APs and (ii) a first time data corresponding to a time period that it takes for the tracking beacon to arrive at each of the authorized APs, and

wherein the calibrating record includes (a) at least one of (i) a second strength data corresponding to a strength of a calibrating beacon as transmitted from a predetermined location within the communication network and received by each of the authorized APs and (ii) a second time data corresponding to a time period that it takes for the calibrating beacon to arrive from the predetermined location at each of the authorized APs,(b) the predetermined location and (c) the location of each of the authorized APs.