Collaboratively locating disconnected clients and rogue access points in a wireless network

• US 20070081488A1
• Filed: 12/12/2006
• Published: 04/12/2007
• Est. Priority Date: 09/24/2004
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Paramvir, Chandra, Ranveer, Adya, Atul, Qiu, Lili
• Application Number:
  US11/637,292
• Publication Number:
  US 20070081488A1
• Time in Patent Office: Days
• US Class Current: 370/328
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

Methods are described for using collaboration of neighboring wireless devices to enable location of disconnected wireless devices and rogue wireless access points. A central server computes the locations of the neighboring clients and uses those locations to estimate the location of a disconnected client. These techniques may take advantage of the beaconing and probing mechanisms of IEEE 802.11 to ensure that connected clients do not pay unnecessary overheads for detecting disconnected clients. Methods are also described for detecting and locating rogue devices by collaboratively collecting information from neighboring devices and comparing the information to a database.

Claims

1-12. -12. (canceled)

13. A method for identifying a rogue wireless access point in an infrastructure network, method comprising the steps of:

receiving information about a suspicious access point, the information collected by one or more nearby wireless computing devices or access points;

comparing the information with an access point database; and

identifying the suspicious access point as rogue if the information is inconsistent with the access point database.

14. The method of claim 13 wherein the information comprises a combination of one or more of:

signal strength information;

MAC address;

SSID; and

channel information.

15. The method of claim 13 wherein the information comprises a MAC address, and the MAC address is obtained by the one or more nearby wireless devices by listening to a beacon of the suspicious access point.

16. The method of claim 13 wherein the information comprises a MAC address, and the MAC address is obtained by the one or more nearby wireless devices by performing a method comprising the steps of:

sending a probe request;

receiving a probe response from the suspicious access point; and

retrieving the MAC address from the probe response.

17. The method of claim 13 wherein the information comprises signal strength information, the method further comprising the steps of:

estimating the location of the suspicious access point using the signal strength information received; and

identifying the suspicious access point as rogue if the estimated location is inconsistent with the access point database.

18. The method of claim 17 wherein estimating the location comprises:

computing estimates of the locations of the nearby wireless computing devices or access points; and

using the computed estimates and received signal strength information to further estimate the location of the suspicious access point.

19. The method of claim 13 wherein the information comprises channel information, the method further comprising the step of:

identifying the suspicious access point as rogue if it broadcasts on a channel that does not overlap with the channel indicated in the access point database.

20. The method of claim 13 further comprising the step of:

updating the access point database with new information in response to receiving an update request from an authenticated access point.