DETECTION OF UNAUTHORIZED WIRELESS ACCESS POINTS

• US 20080066157A1
• Filed: 08/25/2006
• Published: 03/13/2008
• Est. Priority Date: 08/25/2006
• Status: Active Grant

• Current Assignee: Qwest Communications International Incorporated (Lumen Technologies, Inc.)
• Original Assignee: Qwest Communications International Incorporated (Lumen Technologies, Inc.)
• Inventors: Cook, Charles I., Stevens, Gilman R.
• Granted Patent: US 8,782,745 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A public wireless network has authorized wireless access points through which users connect to the network. A monitoring client simulates a user and detects available access points, and compares the identity of any available access points to those maintained by an authentication server associated with the network.

Claims

1. In a public wireless network where users connect to the network through a wireless access point, a system for detecting unauthorized access points, comprising:

a monitoring device connected to the network that simulates a user and requests connection to the network through an available access point; and

an authentication server that maintains a configuration file with an identifier associated with each authorized access point for the network;

wherein the monitoring device requests an identifier from the available access point, and wherein the authentication server compares the requested identifier with each identifier in the configuration file, in order to determine whether the available access point is an authorized access point.

2. The system of claim 1, wherein the physical location is determined for any available access point that does not have an associated identifier in the configuration file.

3. The system of claim 2, wherein triangulation methods are used to determine the location of the unauthorized access point.

4. The system of claim 3, wherein there is further maintained in the configuration file an identifier for any access point that is determine to be an access point of a legitimate, nearby network.

5. The system of claim 1, wherein the monitoring device is a programmed element of an authorized access point.

6. The system of claim 1, wherein the monitoring device is a device separate from any authorized access point.

7. The system of claim 1, wherein the network has multiple authorized access points.

8. The system of claim 1, wherein the network is a WiFi network.

10. The system of claim 1, wherein an alert is provided by the authentication server when the available access point is not an authorized access point.

9. The system of claim 9, wherein the network connects a user to the internet.

11. A method for detecting unauthorized access points in a public wireless network serving wireless users within a predetermined geographical area, comprising:

storing an identifier associated with one or more authorized access points for the network;

providing a monitoring client for detecting available wireless access points within the area;

determining the identity of the available access points; and

comparing the identity of the available access points with the stored identifier associated with the authorized access point.

12. The method of claim 11, further comprising:

determining the physical location of any available access points that do not have a stored associated identifier.

13. The method of claim 11, wherein the monitoring client is a device separate from any authorized access point.

14. The method of claim 11, wherein the network has multiple authorized access points.

15. The method of claim 11, wherein the network is a WiFi network.

16. The method of claim 15, wherein the network connects a user to the internet.

17. The method of claim 11, further comprising:

providing an alert from the authentication server when an available access point is not an authorized access point.