Auto-detection and notification of access point identity theft

• US 20070186276A1
• Filed: 02/09/2006
• Published: 08/09/2007
• Est. Priority Date: 02/09/2006
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: McRae, Matthew, Harrington, Kendra
• Application Number:
  US11/350,707
• Publication Number:
  US 20070186276A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

Systems and techniques for detecting rogue access points. A wireless signal may be received from a wireless device. The wireless device may be determined to be a candidate device based on network identification information. Additional information associated with the wireless device may be acquired, and the wireless device may be determined to be a rogue device based on the additional information. Notification information indicative of the determination may be transmitted.

Claims

1. A method comprising:

receiving a wireless signal from a wireless device at an access point associated with a particular service provider, the wireless signal including network identification information;

determining that the wireless device is a candidate device using the network identification information;

acquiring additional information associated with the wireless device at the access point associated with the particular service provider; and

determining that the wireless device is a rogue access point or a legitimate access point based on the additional information.

2. The method of claim 1, further comprising:

prior to determining that the wireless device a rogue access point or a legitimate access point, provisionally determining that the wireless device is a rogue access point.

3. The method of claim 2, further comprising:

determining that the provisional determination that the wireless device is a rogue access point is false; and

wherein determining that the wireless device comprises determining that the wireless device is a legitimate access point.

4. The method of claim 1, further comprising:

prior to determining that the wireless device is a rogue access point or a legitimate access point, provisionally determining that the wireless device is a legitimate access point.

5. The method of claim 1 wherein determining that the wireless device is a rogue access point or a legitimate access point comprises determining that the wireless device is a rogue access point, and further comprising:

transmitting notification information indicative of the determining that the wireless device is a rogue access point.

6. The method of claim 1, wherein acquiring additional information from the wireless device at the access point comprises:

establishing a wireless connection with the wireless device and attempting to log in to the particular service provider using the established wireless connection.

7. The method of claim 6, wherein attempting to log in to the particular service provider comprises transmitting information indicative of known good credentials for the particular service provider over the established wireless connection.

8. A wireless access system, comprising:

a wireless access point device configured to receive wireless signals and to provide wireless access to an information network, the wireless access point device including;

a wireless interface configured to receive the wireless signals;

one or more processors configured to process information included in the wireless signals; and

memory configured to store instructions that, when executing, cause the one or more processors to perform the steps of;

determining a network identifier for a wireless device based on a received wireless signal, the network identifier indicative of a particular service provider;

acquiring additional information associated with the wireless device; and

determining that the wireless device is a rogue access point or a legitimate access point based on the additional information.

9. The system of claim 8, further comprising:

a network device associated with the particular service provider in communication with the wireless access point, and wherein determining that the wireless device is a rogue access point or a legitimate point comprises determining that the wireless device is a rogue access point, and wherein the network device is configured to receive information indicative of the determining that the wireless device is a rogue access point and further configured to generate notification information.

10. The system of claim 9, wherein the network device is configured to transmit the notification information to an alert system.

11. A wireless access system comprising:

means for receiving wireless signals and providing wireless access to an information network;

means for determining a network identifier for a wireless device based on a received wireless signal, the network identifier indicative of a particular service provider;

means for acquiring additional information associated with the wireless device; and

means for determining that the wireless device is a rogue access point or a legitimate access point based on the additional information.

12. An article comprising a machine-readable medium embodying information indicative of instructions that when performed by one or more machines result in operations comprising:

receiving a wireless signal from a wireless device at an access point associated with a particular service provider, the wireless signal including network identification information;

determining that the wireless device is a candidate device using the network identification information;

acquiring additional information associated with the wireless device at the access point associated with the particular service provider;

determining that the wireless device is a rogue access point based on the additional information; and

transmitting notification information indicative of the determining that the wireless device is a rogue access point.

13. The article of claim 12, wherein acquiring additional information from the wireless device at the access point comprises:

establishing a wireless connection with the wireless device.

14. The article of claim 13, wherein acquiring additional information from the wireless device at the access point comprises:

attempting to log in to the particular service provider using the established wireless connection.

15. The article of claim 14, wherein attempting to log in to the particular service provider comprises transmitting information indicative of known good credentials for the particular service provider over the established wireless connection.

16. The article of claim 14, wherein acquiring additional information associated with the wireless device comprises determining that the attempting to log in to the particular service provider was unsuccessful.