Method and system for detecting rogue access points and device for identifying rogue access points

• US 20070058598A1
• Filed: 12/30/2005
• Published: 03/15/2007
• Est. Priority Date: 09/09/2005
• Status: Active Grant

• Current Assignee: Hon Hai Precision Industry Co., Ltd.
• Original Assignee: Hon Hai Precision Industry Co., Ltd.
• Inventors: Ling, Kin-Leung
• Granted Patent: US 7,561,554 B2
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

A system for detecting rogue access points (APs) includes a detecting station (130) and a device for identifying rogue access points (110). The detecting station scans access points and stations associated with the access points, in order to compile an AP list and an association list within the scope of the detecting station, and transmits the AP list and the association list. The device for identifying rogue access points (110) includes a receiving module (112) and a determining module (114). The receiving module receives the AP list and the association list. The determining module determines whether each access point in the AP list is a rogue access point. A related method is also provided.

Claims

1. A method for detecting rogue access points, comprising the steps of:

providing a detecting station and a device for identifying rogue access points;

scanning access points (APs) and stations associated with the access points by the detecting station, in order to compile an AP list and an association list within the scope of the detecting station;

transmitting the AP list and the association list from the detecting station to the device for identifying rogue access points; and

determining whether each access point in the AP list is a rogue access point, according to the AP list and the association list, by the device for identifying rogue access points.

2. The method as claimed in claim 1, wherein the scanning step further comprises the step of scanning beacon frames in every channel to compile the AP list;

and scanning association frames in every channel to compile the association list.

3. The method as claimed in claim 1, wherein the determining step comprises the steps of:

providing an effective client list, comprising a plurality of effective clients;

determining whether each access point is pre-authorized;

determining whether the access point is directly connected to the device for identifying rogue access points, if the access point is not pre-authorized;

determining whether the access point has an associated client, if the access point is not directly connected to the device for identifying rogue access points;

determining whether the associated client is in the effective client list, if the access point has an associated client; and

determining that the access point is a rogue access point, if the associated client is in the effective client list.

4. The method as claimed in claim 3, further comprising the step of adding the associated station of the access point to the effective client list, if the access point is pre-authorized.

5. The method as claimed in claim 3, wherein if the access point is directly connected to the device for identifying rogue access points, the access point is not a rogue access point.

6. The method as claimed in claim 3, wherein if the access point does not have an associated client, the access point is not a rogue access point.

7. The method as claimed in claim 3, wherein if the associated client is not in the effective client list, the access point is not a rogue access point.

8. The method as claimed in claim 3, wherein the step of determining whether each access point is pre-authorized comprises the steps of:

providing an authorized access point list, comprising a plurality of authorized access points;

determining whether the access point is in the authorized access point list; and

determining that the access point is pre-authorized, if the access point is in the authorized access point list.

9. The method as claimed in claim 3, wherein the step of determining whether the access point is directly connected to the device for identifying rogue access points comprises the step of:

sending an address resolution protocol (ARP) request from the device for identifying rogue access points to the access point;

wherein if the access point gives a reply to the request by sending back an ARP reply, the access point is directly connected to the device for identifying rogue access points.

10. A system for detecting rogue access points, comprising:

a detecting station for scanning access points (APs) and stations associated with the access points, in order to compile an AP list and an association list within the scope of the detecting station, and for transmitting the AP list and the association list; and

a device for identifying rogue access points, comprising a receiving module and a determining module;

wherein the receiving module receives the AP list and the association list, and the determining module determines whether each access point in the AP list is a rogue access point.

11. The system as claimed in claim 10, wherein the device for identifying rogue access points comprises a wireless switch.

12. The system as claimed in claim 10, wherein the AP list comprises all access points within the scope of the detecting station, and the association list comprises a plurality of associated stations that correspond to the access points in the AP list.

13. The system as claimed in claim 10, wherein the detecting station comprises at least one of a scanning module for scanning the access points and the stations associated with the access points within the scope of the detecting station, a list storage module for storing the AP list and the association list, and a transmitting module for transmitting the AP list and the association list stored in the list storage module.

14. The system as claimed in claim 10, wherein the device for identifying rogue access points further comprises a storage module for storing an authorized access point list and an effective client list, the authorized access point list comprises a list of access points authorized by the device for facilitating identification of rogue access points, and the effective client list comprises a list of effective clients of the device for facilitating identification of rogue access points.

15. The system as claimed in claim 10, wherein the determining module comprises at least one of an authorization-determining sub-module for determining whether each access point in the AP list is pre-authorized, a connection-determining sub-module for determining whether an unauthorized access point is directly connected to the device for identifying rogue access points, and a client-determining sub-module for determining whether an unauthorized and not directly connected access point has an associated client, and if so, for determining whether the associated client is in the effective client list.

16. A device for identifying rogue access points, comprising:

a receiving module for receiving an access point (AP) list and an association list; and

a determining module for determining whether each access point in the AP list is a rogue access point according to the AP list and the association list.

17. The device as claimed in claim 16, wherein the device comprises a wireless switch.

18. The device as claimed in claim 16, further comprising a storage module for storing an authorized AP list and an effective client list.

19. The device as claimed in claim 18, wherein the determining module comprises at least one of an authorization-determining sub-module for determining whether each access point in the AP list is pre-authorized, a connection-determining sub-module for determining whether an unauthorized access point is directly connected to the device for identifying rogue access points and a client-determining sub-module for determining whether an unauthorized and not directly connected access point has an associated client, and if so, for determining whether the associated client is in the effective client list.