Method, Device and Program for Detection of Address Spoofing in a Wireless Network

• US 20080263660A1
• Filed: 02/15/2006
• Published: 10/23/2008
• Est. Priority Date: 02/18/2005
• Status: Abandoned Application

• Current Assignee: Orange S.A.
• Original Assignee: Orange S.A.
• Inventors: Razniewski, Jerome, Duffau, Roland, Butti, Laurent
• Application Number:
  US11/884,603
• Publication Number:
  US 20080263660A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

The invention relates to a method, device and program for detection of address spoofing in a wireless network. According to the invention, a sensor is installed in order to capture frames transmitted over the wireless network which have an address field comprising an address of a network access point. The captured frames are analyzed in order to establish a list of stations that are associated with the access point. Another list of stations associated with the access point is obtained from the latter. The two station lists are compared in order to detect possible access point address spoofing.

Claims

1. A method of detecting address spoofing in a wireless network, comprising the following steps:

capturing frames transmitted over the wireless network, having an address field that comprises an address of a network access point;

analyzing the captured frames to establish a first list of stations associated with said access point;

obtaining from said access point a second list of stations that are associated with it; and

comparing the first and second lists of stations.

2. The method as claimed in claim 1, wherein an alarm is triggered if the first list includes at least one station that is absent from the second list.

3. The method as claimed in claim 1, wherein the obtaining and the comparing of the first and second lists are repeated regularly, and an alarm is triggered if P consecutive comparisons show that the first list includes at least one station that is absent from the second list, P being a number at least equal to two.

4. The method as claimed in claim 1, wherein the captured frames comprise management frames confirming the association of stations with the access point and management frames terminating the association of stations with said access point.

5. The method as claimed in claim 1, wherein the captured frames comprise data frames having the address of said access point in a source address field, and the associated stations of the first list (L1) are identified from a destination address field of said data frames.

6. The method as claimed in claim 5, wherein a station is included in the first list only once its address has been noted at least N times in the destination address field of data frames having the address of said access point in the source address field, N being a predefined threshold value.

7. The method as claimed in claim 1, wherein the captured frames comprise data frames having the address of said access point in a destination address field, and the associated stations of the first list are identified from a source address field of said data frames.

8. The method as claimed in claim 7, wherein a station is included in the first list only once its address has been noted at least N times in the source address field of data frames having the address of said access point in the destination address field, N being a predefined threshold value.

9. The method as claimed in claim 1, wherein a number of sensors are deployed in a coverage area of the wireless network to capture said frames and establish the first lists relative to at least one access point, and wherein each first established list is compared to the second list obtained from said access point to detect an address spoofing in the network.

10. A device for detecting address spoofing in a wireless network, comprising:

means for receiving from at least one sensor identification information originating from frames captured by said sensor on the wireless network, the captured frames having an address field that comprises an address of a network access point, said received identification information corresponding to a first list of stations associated with said access point;

means for obtaining from said access point a second list of stations associated with said access point; and

means for comparing the first and second lists of stations.

11. The device for detecting address spoofing as claimed in claim 10, also comprising:

means of analyzing the identification information received from the sensor, to establish the first list.

12. The device for detecting address spoofing as claimed in claim 10, wherein the identification information received from the sensor comprises the first list.

13. A system for detecting address spoofing in a wireless network, comprising:

a device for detecting address spoofing as claimed in claim 10, and

a sensor comprising

means for capturing frames transmitted over the wireless network, having an address field that comprises an address of a network access point, and

means of transmitting, to the device for detecting address spoofing, identification information relating to the stations associated with said access point, said identification information originating from the captured frames,

the sensor being arranged to recommence at zero establishing new identification information relating to the stations associated with the access point, after having transmitted the preceding identification information.

15. A system for detecting address spoofing in a wireless network, comprising:

a device for detecting address spoofing as claimed in claim 11, and

a sensor comprising

means for capturing frames transmitted over the wireless network, having an address field that comprises an address of a network access point, and

means of transmitting, to the device for detecting address spoofing, identification information relating to the stations associated with said access point, said identification information originating from the captured frames,

the sensor being arranged to recommence at zero establishing new identification information relating to the stations associated with the access point, after having transmitted the preceding identification information.

16. A system for detecting address spoofing in a wireless network, comprising:

a device for detecting address spoofing as claimed in claim 12, and

a sensor comprising

means for capturing frames transmitted over the wireless network, having an address field that comprises an address of a network access point, and

means of transmitting, to the device for detecting address spoofing, identification information relating to the stations associated with said access point, said identification information originating from the captured frames,

the sensor being arranged to recommence at zero establishing new identification information relating to the stations associated with the access point, after having transmitted the preceding identification information.

14. A computer program to be installed in a device interfaced with at least one access point of a wireless network and with a sensor to help in detecting address spoofing in the wireless network, to be run by a processing unit of said device, the program comprising instructions for executing the following steps when the program is run by said processing unit:

receiving from the sensor identification information originating from the frames captured by the sensor on the wireless network, the captured frames having an address field that comprises an address of the access point, said received identification information corresponding to a first list of stations associated with said access point;

obtaining from said access point a second list of stations that are associated with it; and

comparing the first and second lists of stations.