System and method for centralized station management

• US 20050213579A1
• Filed: 03/23/2004
• Published: 09/29/2005
• Est. Priority Date: 03/23/2004
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Taylor, John, Iyer, Pradeep J., Andrade, Merwyn, Narasimhan, Partha
• Granted Patent: US 7,969,937 B2
• Time in Patent Office: Days
• US Class Current: 370/395.200
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

In one embodiment of the invention, a wireless network is adapted with a wireless network switch in communication with a plurality of access points, which are in communication with one or more stations. Coupled to the access points over an interconnect, the wireless network switch is adapted to receive a DEAUTHENTICATION message sent by one of the plurality of access points in the same coverage area of the station so as to detect the DEAUTHENTICATION message and to block communications between the plurality of access points and the station in response to determining that the DEAUTHENTICATION message is invalid.

Claims

1. A wireless network adapted with a plurality of access points and a station, comprising:

an interconnect; and

a wireless network switch coupled to the interconnect for communications with the plurality of access points, the wireless network switch to receive a DEAUTHENTICATION message sent by one of the plurality of access points in a coverage area of the station and to block communications between the plurality of access points and the station in response to determining that the DEAUTHENTICATION message is invalid.

2. The wireless network of claim 1, wherein the DEAUTHENTICATION message is invalid upon determination that the DEAUTHENTICATION message originated from a source other than the wireless network switch.

3. The wireless network of claim 1, wherein the wireless network switch to determine the DEAUTHENTICATION message is invalid by recovering a destination address of the DEAUTHENTICATION message and comparing the destination address with a list of destination addresses associated with valid DEAUTHENTICATION messages transmitted by the wireless network switch.

4. The wireless network of claim 1, wherein the wireless network switch blocks communications between the plurality of access points and the station by signaling an access point currently associated with the station to disassociate and denying subsequent request messages from the station on behalf of the plurality of access points.

5. The wireless network of claim 4, wherein the request messages comprise any one of a PROBE REQUEST message, an ASSOCIATION REQUEST message and a REASSOCIATION REQUEST message.

6. The wireless network of claim 4, wherein the wireless network switch denying subsequent request messages from the station for a prescribed period of time.

7. A method for selectively associating with a station transmitting a first PROBE REQUEST message followed by a second PROBE REQUEST message under control of a wireless network switch, comprising:

receiving a received signal strength indicator (RSSI) value corresponding to signal strength of the first PROBE REQUEST message detected by each access point;

receiving a message identifying that the second PROBE REQUEST message has been detected; and

responding only to the second PROBE REQUEST message on behalf of an access point selected to associate with the station using at least the RSSI value.

8. The method of claim 7, wherein the message is the second PROBE REQUEST message.

9. The method of claim 7, wherein prior to receiving the RSSI value, the method further comprises:

generating the RSSI value of the first PROBE REQUEST message;

loading the RSSI value into a field of the first PROBE REQUEST message to produce a modified PROBE REQUEST message; and

transferring the modified PROBE REQUEST message to the wireless network switch.

10. The method of claim 7 wherein prior to receiving the message, the method further comprises receiving load parameters from each access point detecting the first PROBE REQUEST message placing the load into a field of the modified PROBE REQUEST message.

11. The method of claim 7 wherein prior to receiving the RSSI value, the method further comprises:

generating the RSSI value of the first PROBE REQUEST message by each access point;

inserting the RSSI value into a first field of the first PROBE REQUEST message to produce a modified PROBE REQUEST message;

computing a load by each access point detecting the first PROBE REQUEST message;

inserting a load parameter into a second field of the modified PROBE REQUEST message; and

transferring the modified PROBE REQUEST message to the wireless network switch.

12. The method of claim 11 wherein the access point being selected based on the load parameter and the RSSI value.

13. A method comprising:

setting a plurality of received signal strength indicator (RSSI) thresholds including a first RSSI threshold and a second RSSI threshold having a value lower than the first RSSI threshold;

computing a RSSI value for a management message by a plurality of access points detecting the management message, the management message originating from a station; and

placing an address of the station into a list identifying stations located in a potential coverage hole if none of the plurality of access points computes a RSSI value of the management message above the second RSSI threshold.

14. The method of claim 13 further comprising removing the address of the station from the list if one of the plurality of access points computes a RSSI value of the management message above the first RSSI threshold.

15. The method of claim 13, wherein the first RSSI threshold is greater than or equal to 20 dbmO and the second RSSI threshold is less than 20 dbmO.

16. The method of claim 13 further comprising initiating an event to mitigate a coverage hole at a location of the station if the station fails to complete association with any of the plurality of access points.

17. The method of claim 13 further comprising initiating an event to mitigate a coverage hole at a location of the station if the station continues to provide management messages with RSSI values below the second RSSI threshold.

18. A method comprising:

receiving a PROBE REQUEST message on different channels by a plurality of access points, the PROBE REQUEST message being sent from a station;

forwarding the PROBE REQUEST message from each of the plurality of access points, each PROBE REQUEST message includes a channel number and media access control (MAC) address of an access point forwarding the PROBE REQUEST message;

creating a list including the MAC address of each of the plurality of access points and the corresponding channel number; and

providing the list to the station originally initiating the PROBE REQUEST message at completion of an association phase between the station and one of the plurality of access points.

19. The method of claim 18, wherein the forwarding of the PROBE REQUEST message is to a wireless network switch coupled to each of the plurality of access points over an interconnect.