Location-based enhancements for wireless intrusion detection

• US 20060193299A1
• Filed: 02/25/2005
• Published: 08/31/2006
• Est. Priority Date: 02/25/2005
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Jasper Technologies, Inc. (Cisco Systems, Inc.)
• Inventors: Krischer, Mark, Olson, Timothy S., Winget, Nancy Cam, Yang, Sheausong
• Application Number:
  US11/066,009
• Publication Number:
  US 20060193299A1
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 40/246 Connectivity information discovery
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

In a wireless local area network, a method for detecting the presence of an unauthorized device comprises: detecting the presence of neighboring devices from which management frames can be sent; saving a representation of each neighboring device present; receiving a management frame purporting to be from one of the detected device; determining that the received management frame was sent by an unauthorized device; and indicating the presence of the unauthorized device.

Claims

1. In a wireless local area network, a method for detecting the presence of an unauthorized device, the method comprising:

detecting the presence of neighboring devices from which management frames can be sent;

saving a representation of each neighboring device present;

receiving a management frame purporting to be from one of the detected device;

determining that the received management frame was sent by an unauthorized device; and

indicating the presence of the unauthorized device.

2. The method of claim 1, wherein the neighboring devices comprise access points.

3. The method of claim 1, wherein the neighboring devices comprise stations.

4. The method of claim 1, wherein detecting comprises performing radio discovery to determine individual signal strengths of the neighboring devices.

5. The method of claim 1, wherein detecting the presence of neighboring devices comprises manually configuring a device that manages the neighboring devices with location information for each neighboring device.

6. The method of claim 1, wherein a walkabout is performed to determine the locations of the neighboring devices.

7. The method of claim 1, wherein saving a representation of each neighboring device present comprises saving a representation of each neighboring device and its determined individual signal strength.

8. The method of claim 7, wherein receiving a management frame comprises receiving a management frame containing a signal strength indication and a device identifier.

9. The method of claim 8, further comprising:

matching said access point identifier from the management frame with one of the neighboring devices;

comparing the signal strength indication from the received management frame with the determined signal strength of the matched neighboring device; and

indicating the presence of an unauthorized device if the difference between the signal strength indication and determined signal strength is greater than a threshold amount.

10. The method of claim 1, wherein saving a representation of each neighboring device comprises storing information describing the physical location of each neighboring device.

11. The method of claim 1, wherein at least one of the neighboring devices detects and validates radio traffic.

12. The method of claim 11, wherein validation is performed by detecting a key within a received management frame, the key being unique to one of the neighboring devices.

13. The method of claim 11, wherein validation is performed by detecting a message integrity check within a received management frame.

14. The method of claim 11, wherein the detecting neighboring device maintains location information for its neighboring devices and performs validation by determining if a management frame could be received from the device indicated as the source of the management frame.

15. A wireless local area network managing device, comprising:

means for detecting the presence of neighboring devices from which management frames can be sent;

means for saving a representation of each neighboring device present;

means for receiving a management frame purporting to be from one of the detected device;

means for determining that the received management frame was sent by an unauthorized device; and

means for indicating the presence of the unauthorized device.

16. The wireless local area network managing device of claim 15, wherein neighboring devices comprise access points.

17. The wireless local area network managing device of claim 15, wherein neighboring devices comprise stations.

18. A device managed by a wireless local area network managing device, comprising:

means for detecting the presence of neighboring devices from which management frames can be sent;

means for saving a representation of each neighboring device present;

means for receiving a management frame purporting to be from one of the detected device;

means for determining that the received management frame was sent by an unauthorized device; and

means for indicating the presence of the unauthorized device.

19. The device of claim 18, wherein neighboring devices comprise access points.

20. The device of claim 18, wherein neighboring devices comprise stations.