Dynamically measuring and re-classifying access points in a wireless network

• US 20060193284A1
• Filed: 07/25/2005
• Published: 08/31/2006
• Est. Priority Date: 02/25/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Stieglitz, Jeremy, Roshan, Pejman D., Olson, Timothy S.
• Granted Patent: US 7,676,216 B2
• Time in Patent Office: Days
• US Class Current: 370/328
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 40/246 Connectivity information discovery
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method, an apparatus, and a carrier medium carrying computer readable code segments to instruct a processor to execute the method. The method is in a wireless network that includes at least one access point. The method includes, from time-to-time, measuring a first set of at least one property of each access point of a set of at least one classified access point of the wireless network. The method further includes re-classifying each access point based on at least one function of a second set of at least one property of the access point, the second set of properties including the first set of properties. The set of at least one access point is classified according to a set of AP classifications, and the re-classifying is into one of the AP classifications.

Claims

1. A method in a wireless network, the wireless network including at least one access point (“

AP”

), the method comprising;

from time-to-time, measuring a first set of at least one property of each access point of a set of at least one classified access point of the wireless network; and

re-classifying each access point based on at least one function of a second set of at least one property of the access point, the second set of properties including the first set of properties,

wherein the set of at least one access point is classified according to a set of AP classifications, and wherein the re-classifying is into one of the AP classifications.

2. A method as recited in claim 1, wherein the re-classifying is triggered by at least one function indicative of a significant changes in one or more of the second set of properties of the access point.

3. A method as recited in claim 2, wherein the reclassifying is triggered by the at least one function indicative of a significant changes in one or more of the second set of properties of the access point changing by at lease one corresponding pre-set threshold.

4. A method as recited in claim 3, wherein the re-classifying is triggered by a change in any one of the one or more of the second set of properties of the access point changing by a corresponding pre-set threshold.

5. A method as recited in claim 2, wherein the second set of properties of the access point whose significant change triggers re-classifying includes:

detection of changes in the RSSI of packets received at the particular AP from other neighboring APs;

in the case of the AP having been classified as a managed access point, detection of new or different configuration settings;

detecting significant changes in RF parameters including one or more of;

transmission timings to or from other APs, and

path loss to or from other APs;

detecting new network address changes of an AP;

detecting a significant change in the data framing of an AP; and

detecting a significant location change in the case the AP was previously at a known location.

6. A method as recited in claim 1, wherein the at least one function of a second set of at least one property of the access point is the time, such that the re-classification is according to a pre-set time-schedule.

7. A method as recited in claim 1, wherein the first set of one or more properties of the access point includes at least one of:

in-wire wireless station detection;

a determined location of the station;

radio signal strength measurements at the access point of signals from other APs; and

determined transmission times for the access points to and/or from one or more other wireless stations of the wireless network.

8. A method as recited in claim 1, wherein the wireless network is a managed wireless network, and wherein the set of AP classifications includes a managed AP, a friendly AP, and a rogue AP.

9. A method as recited in claim 8, wherein the classifications of access points of the wireless network are stored in a database, the database maintained in a wireless manager coupled to each managed AP of the wireless network.

10. A method as recited in claim 1,

wherein the wireless network conforms to one of the 801.11 standards or variations thereof,

wherein the re-classification of an AP is based on at least one of:

the AP'"'"'s BSSID;

the channel any beacon or probe response from the AP was received on;

the MAC address of the station receiving a beacon or probe response;

the signal strength detected at the physical layer level of the receiving station of the beacon or probe response;

any other measures of received signal quality of the received beacon or probe response available at the physical layer level of the receiving station; and

/or

received beacons and probe responses from other APs,

and wherein the beacon or probe response received from the AP includes one or more of;

the SSID in the beacon or probe response;

beacon time (TSF timer) information. In one embodiment, this is sent in the form of TSF offset determined by comparing the timestamp in the beacon/probe response with the TSF timer at the managed AP receiving the response or at the managed client receiving the response; and

/or

configuration parameters included in the received beacon/probe response.

11. A method as recited in claim 1, further comprising:

determining for each AP an aggregate trust level, such trust level being a weighted sum of functions indicative of changes in one or more parameters of the second set of parameters.

12. A method as recited in claim 11, wherein the weightings used to determine the aggregate trust levels depend on the most recent classification of the access point.

13. A carrier medium carrying or more computer readable code segments to instruct at least one processor of a processing system to execute a method in a wireless network, the wireless network including at least one access point (“

AP”

), the method comprising;

from time-to-time, measuring a first set of at least one property of each access point of a set of at least one classified access point of the wireless network; and

re-classifying each access point based on at least one function of a second set of at least one property of the access point, the second set of properties including the first set of properties,

wherein the set of at least one access point is classified according to a set of AP classifications, and wherein the re-classifying is into one of the AP classifications.

14. A carrier medium as recited in claim 13, wherein the re-classifying is triggered by at least one function indicative of a significant changes in one or more of the second set of properties of the access point.

15. A carrier medium as recited in claim 14, wherein the re-classifying is triggered by the at least one function indicative of a significant changes in one or more of the second set of properties of the access point changing by at lease one corresponding pre-set threshold.

16. A carrier medium as recited in claim 3claim 15, wherein the re-classifying is triggered by a change in any one of the one or more of the second set of properties of the access point changing by a corresponding pre-set threshold.

17. A carrier medium as recited in claim 14, wherein the second set of properties of the access point whose significant change triggers re-classifying includes:

detection of changes in the RSSI of packets received at the particular AP from other neighboring APs;

in the case of the AP having been classified as a managed access point, detection of new or different configuration settings;

detecting significant changes in RF parameters including one or more of;

transmission timings to or from other APs; and

path loss to or from other APs;

detecting new network address changes of an AP;

detecting a significant change in the data framing of an AP; and

detecting a significant location change in the case the AP was previously at a known location.

18. A carrier medium as recited in claim 13, wherein the at least one function of a second set of at least one property of the access point is the time, such that the reclassification is according to a pre-set time-schedule.

19. A carrier medium as recited in claim 13, wherein the first set of one or more properties of the access point includes at least one of:

in-wire wireless station detection;

a determined location of the station;

radio signal strength measurements at the access point of signals from other APs; and

determined transmission times for the access points to and/or from one or more other wireless stations of the wireless network.

20. A carrier medium as recited in claim 13, wherein the wireless network is a managed wireless network, and wherein the set of AP classifications includes a managed AP, a friendly AP, and a rogue AP.

21. A carrier medium as recited in claim 20, wherein the classifications of access points of the wireless network is stored in a database, the database maintained in a wireless manager coupled to each managed AP of the wireless network.

22. A carrier medium as recited in claim 13,

wherein the wireless network conforms to one of the 801.11 standards or variations thereof,

wherein the re-classification of an AP is based on at least one of:

the AP'"'"'s BSSID;

the channel any beacon or probe response from the AP was received on;

the MAC address of the station receiving a beacon or probe response;

the signal strength detected at the physical layer level of the receiving station of the beacon or probe response;

any other measures of received signal quality of the received beacon or probe response available at the physical layer level of the receiving station; and

received beacons and probe responses from other APs;

and wherein the beacon or probe response received from the AP includes one or more of;

the SSID in the beacon or probe response;

beacon time (TSF timer) information. In one embodiment, this is sent in the form of TSF offset determined by comparing the timestamp in the beacon/probe response with the TSF timer at the managed AP receiving the response or at the managed client receiving the response; and

configuration parameters included in the received beacon/probe response.

23. A carrier medium as recited in claim 13, further comprising:

determining for each AP an aggregate trust level, such trust level being a weighted sum of functions indicative of changes in one or more parameters of the second set of parameters.

24. A carrier medium as recited in claim 23, wherein the weightings used to determine the aggregate trust levels depend on the most recent classification of the access point.

25. An apparatus in a wireless network, the wireless network including at least one access point (“

AP”

), the apparatus comprising;

means for measuring from time-to-time a first set of at least one property of each access point of a set of at least one classified access point of the wireless network; and

means for re-classifying each access point based on at least one function of a second set of at least one property of the access point, the second set of properties including the first set of properties,

wherein the set of at least one access point is classified according to a set of AP classifications, and wherein the re-classifying is into one of the AP classifications.

26. An apparatus as recited in claim 25, wherein the means for re-classifying is triggered to reclassify by at least one function indicative of significant changes in one or more of the second set of properties of the access point.

27. An apparatus as recited in claim 25, further comprising:

means for determining for each AP an aggregate trust level, such trust level being a weighted sum of functions indicative of changes in one or more parameters of the second set of parameters.

28. An apparatus as recited in claim 27, wherein the weightings used to determine the aggregate trust levels depend on the most recent classification of the access point.