Detecting Double Attachment Between a Wired Network and At Least One Wireless Network

• US 20090213752A1
• Filed: 06/28/2006
• Published: 08/27/2009
• Est. Priority Date: 07/18/2005
• Status: Active Grant

• Current Assignee: Orange S.A.
• Original Assignee: Orange S.A.
• Inventors: Veysset, Franck, Leclerq, Eric, Butti, Laurent
• Granted Patent: US 8,724,506 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

The invention concerns the detecting of a double attachment of an equipment communicating both with a wireless network and with a wired network, in particular when the connections with said networks are established by sending a connection configuration request comprising an identifier of the equipment, such as DHCP Host Name. The invention is characterized in that it consists: a) in detecting, at least on the wireless network, connection configuration requests emitted by the equipments (E10), b) analyzing the contents of the requests and extracting the equipment identifiers (E11), c) from one equipment identifier extracted at step b), determining whether said equipment has additionally sent a connection configuration request at least to the wired network with the same identifier (E13), and d) triggering an alarm if the result at step c) is positive (E16).

Claims

1. A method of detecting a situation of double attachment of a communicating equipment,

said equipment comprising means of communication with a wireless network, on the one hand, and with a wired network, on the other hand,

the double attachment situation being defined by a connection of the equipment both with the wireless network and with the wired network,

a method wherein the connections with the wired network and with the wireless network are established by sending a request from the equipment, this request comprising an identifier of the equipment, according to a predetermined connection configuration protocol,

and wherein:

a) connection configuration requests sent by one or more equipments are monitored, at least on the wireless network,

b) the content of these connection configuration requests is analyzed and equipment identifiers are extracted from them,

c) from an equipment identifier extracted in step b), it is determined if this equipment has also sent a connection configuration request at least to the wired network with the same identifier, and

d) an alarm is raised if the result of step c) is positive.

2. The method as claimed in claim 1, comprising the following steps:

a) both the wireless network and the wired network are monitored for connection configuration requests sent by one or more equipments,

b) the content of these requests is analyzed and equipment identifiers are extracted from them, both for the requests sent on the wireless network and for the requests sent on the wired network,

c) by comparison of the equipment identifiers in the requests on the wired network, on the one hand, and on the wireless network, on the other hand, it is determined if an equipment has sent connection configuration requests both on the wired network and on the wireless network with the same identifier, and

d) an alarm is raised if the result of step c) is positive.

3. The method as claimed in claim 2, wherein a timing delay of chosen duration is applied between a positive comparison in step c) and an effective raising of the alarm in step d).

4. The method as claimed in claim 2, wherein there is stored:

in a first connection table, at least the equipment identifiers extracted, in step b), from the connection configuration requests on one of the networks among the wireless network and the wired network,

in a second connection table, at least the equipment identifiers extracted, in step b), from the connection configuration requests on the other one of the networks among the wireless network and the wired network,

and in that, in step c), a comparison is made between the respective contents of the first and second connection tables.

5. The method as claimed in claim 1, wherein connection configuration information is accessed in at least one server connected to the wired network, the method comprising the following steps:

a) connection configuration requests sent by one or more equipments are monitored, at least on the wireless network,

b) the content of the connection configuration requests is analyzed and equipment identifiers are extracted from them,

c) said server is interrogated on the basis of an equipment identifier extracted in step b) in order to determine if that equipment has also sent a connection configuration request at least to the wired network with the same identifier, and

d) an alarm is raised if the result of step c) is positive.

6. The method as claimed in claim 5, wherein connection configuration information is accessed on a first server connected to the wired network and, additionally, on a second server connected to the wireless network, the method comprising the following steps:

a) connection configuration requests sent by one of more equipments are monitored on both the wireless network and on the wired network,

b) the content of the connection configuration requests is analyzed and equipment identifiers are extracted from it,

and wherein, in step c), the first server or the second server is interrogated, on the basis of an equipment identifier extracted in step b) from a request received on the wireless network or on the wired network respectively.

7. The method as claimed in claim 1, comprising a step of taking the imprint of an equipment in a double attachment situation, this step comprising the sending of stimuli packets to that equipment and the analysis of the responses from that equipment in order to determine characteristics of that equipment.

8. The method as claimed in claim 7, wherein the imprint taking step is carried out before the effective raising of the alarm in step d).

9. The method as claimed in claim 1, wherein said connection configuration protocol is the DHCP protocol, and in that the identifier of an equipment in the context of this protocol corresponds to a “

Host Name”

.

10. A device for the implementation of the method as claimed in claim 1, for the detection of a double attachment situation of a communicating equipment,

said equipment comprising means of communication with a wireless network, on the one hand, and with a wired network, on the other hand,

the double attachment situation being defined by a connection of the equipment both to the wireless network and to the wired network,

the connections with the wired network and with the wireless network being established by sending a request from the equipment, this request comprising an identifier of the equipment, according to a predetermined connection configuration protocol, the device comprising:

a) probe means at least for the wireless network, in order to detect connection configuration requests sent by one or more equipments,

b) means for analyzing the content of said connection configuration requests and of extraction of the equipment identifiers in said connection configuration requests,

c) means of comparison for determining, from an extracted equipment identifier, if that equipment has also sent a connection configuration request at least to the wired network with the same identifier, a positive determination characterizing a possible double attachment, and

d) alarm means for raising an alarm in the event of a positive determination.

11. The device as claimed in claim 10, intended for detections of double attachment:

between a wired network and a wireless network, managed by a same entity,

and between the wired network and any wireless network, comprising;

radio probe means for said any wireless network,

wired probe means for the wireless network managed by said entity, and

wired probe means for the wired network.

12. A computer program, for the implementation of the method as claimed in claim 1, downloadable via a telecommunications network and/or intended for storage in a memory of a device and/or stored on a memory medium intended to cooperate with a reader of that device,

said device being intended for the detection of a double attachment situation of a communicating equipment,

said equipment comprising means of communication with a wireless network, on the one hand, and with a wired network, on the other hand,

the double attachment situation being defined by a connection of the equipment both to the wireless network and to the wired network,

the connections with the wired network and with the wireless network being established by sending a request from the equipment, this request comprising an identifier of the equipment, according to a predetermined connection configuration protocol, the device comprising:

a) probe means of at least the wireless network, for detecting connection configuration requests sent by one or more equipments,

and the computer program comprising instructions which, when they are executed on said device, carries out the steps of;

b) analyzing the content of the connection configuration requests and of extraction of the equipment identifiers in these connection configuration requests,

c) determining, from an extracted equipment identifier, if that equipment has also sent a connection configuration request at least to the wired network with the same identifier, and

d) raising an alarm in the event of a positive determination.

13. A data storage medium comprising computer program instruction code for the execution of the steps of a method as claimed in claim 1.