Collaboratively locating disconnected clients and rogue access points in a wireless network

• US 20060068811A1
• Filed: 01/31/2005
• Published: 03/30/2006
• Est. Priority Date: 09/24/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Paramvir, Chandra, Ranveer, Adya, Atul, Qiu, Lili
• Granted Patent: US 7,317,914 B2
• Time in Patent Office: Days
• US Class Current: 455/456.200
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

Methods are described for using collaboration of neighboring wireless devices to enable location of disconnected wireless devices and rogue wireless access points. A central server computes the locations of the neighboring clients and uses those locations to estimate the location of a disconnected client. These techniques may take advantage of the beaconing and probing mechanisms of IEEE 802.11 to ensure that connected clients do not pay unnecessary overheads for detecting disconnected clients. Methods are also described for detecting and locating rogue devices by collaboratively collecting information from neighboring devices and comparing the information to a database.

Claims

1. A computer-readable medium including computer-executable instructions for determining the location of a first wireless device, the computer-executable instructions executing on one or more other wireless devices connected to an infrastructure network and located in the vicinity of the first device, and performing the steps of:

receiving one or more signals from the first device;

recording signal strength information about the first device according to the signals; and

transmitting the signal strength information to the diagnostic server for estimating the location of the first device,

wherein the diagnostic server estimates the location of the first device by performing the steps of;

receiving the transmitted signal strength information;

computing estimates of the locations of the one or more other wireless devices; and

approximating the location of the first device using the received signal strength information and the computed estimates of the locations of the one or more other wireless devices.

2. The computer-readable medium of claim 1 wherein the signals are beacon signals.

3. The computer-readable medium of claim 1 wherein the signals are sent by the first device in response to a determination that the first device is not connected to the infrastructure network.

4. The computer-readable medium of claim 1 wherein the first device is a rogue or faulty wireless access point.

5. The computer-readable medium of claim 1 wherein the location of the first device is approximated to within about twelve meters.

6. The computer-readable medium of claim 1 wherein the location of the first device approximately corresponds to an RF hole.

7. A computer-readable medium including computer-executable instructions for determining the location of a first wireless device, the wireless device being in the vicinity of one or more other wireless devices connected to an infrastructure network, the computer-executable instructions executing on a server, and performing the steps of:

receiving signal strength information about the first device from the one or more other devices;

computing estimates of the locations of the one or more other wireless devices; and

approximating the location of the first device using the computed estimates and the received signal strength information.

8. The computer-readable medium of claim 7 wherein the one or more other devices performs the steps of:

receiving one or more beacon signals from the first device;

recording signal strength information about the first device according to the beacon signals; and

transmitting the signal strength information for estimating the location of the first device.

9. The computer-readable medium of claim 8 wherein the beacon signals are sent by the first device in response to a determination that the first device is not connected to the infrastructure network.

10. The computer-readable medium of claim 7 wherein the first device is a rogue or faulty wireless access point.

11. The computer-readable medium of claim 7 wherein the location of the first device is approximated to within about twelve meters.

12. The computer-readable medium of claim 7 wherein the location of the first device approximately corresponds to an RF hole.

13. A method for identifying a rogue wireless access point in an infrastructure network, method comprising the steps of:

receiving information about a suspicious access point, the information collected by one or more nearby wireless computing devices or access points;

comparing the information with an access point database; and

identifying the suspicious access point as rogue if the information is inconsistent with the access point database.

14. The method of claim 13 wherein the information comprises a combination of one or more of:

signal strength information;

MAC address;

SSID; and

channel information.

15. The method of claim 13 wherein the information comprises a MAC address, and the MAC address is obtained by the one or more nearby wireless devices by listening to a beacon of the suspicious access point.

16. The method of claim 13 wherein the information comprises a MAC address, and the MAC address is obtained by the one or more nearby wireless devices by performing a method comprising the steps of:

sending a probe request;

receiving a probe response from the suspicious access point; and

retrieving the MAC address from the probe response.

17. The method of claim 13 wherein the information comprises signal strength information, the method further comprising the steps of:

estimating the location of the suspicious access point using the signal strength information received; and

identifying the suspicious access point as rogue if the estimated location is inconsistent with the access point database.

18. The method of claim 17 wherein estimating the location comprises:

computing estimates of the locations of the nearby wireless computing devices or access points; and

using the computed estimates and received signal strength information to further estimate the location of the suspicious access point.

19. The method of claim 13 wherein the information comprises channel information, the method further comprising the step of:

identifying the suspicious access point as rogue if it broadcasts on a channel that does not overlap with the channel indicated in the access point database.

20. The method of claim 13 further comprising the step of:

updating the access point database with new information in response to receiving an update request from an authenticated access point.