METHODS FOR SECURITY AND MONITORING WITHIN A WORLDWIDE INTEROPERABILITY FOR MICROWAVE ACCESS (WIMAX) NETWORK

• US 20110314512A1
• Filed: 06/22/2010
• Published: 12/22/2011
• Est. Priority Date: 06/22/2010
• Status: Abandoned Application

• Current Assignee: Symbol Technologies, Inc. (Zebra Technologies Corporation)
• Original Assignee: Symbol Technologies, Inc. (Zebra Technologies Corporation)
• Inventors: Sinha, Amit, Nightingale, Todd W., Thomas, William D.
• Application Number:
  US12/820,327
• Publication Number:
  US 20110314512A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

A method for security and monitoring within a worldwide interoperability for microwave access (WiMAX) network includes monitoring, by one or more sensors, communications activity on one or more channels; analyzing, by either one or more sensors directly or a server provided with reports of the monitored communication activity for detection of one or more system incidents; and triggering, in response to detection of one or more incidents, an incident notification.

Claims

1. A method for security and monitoring within a worldwide interoperability for microwave access (WiMAX) network comprising:

monitoring, by one or more sensors, communications activity on one or more channels;

providing a report of the monitored communications activity from each of the one or more sensors to a server;

analyzing, by the server, the reports of the monitored communication activity for detection of one or more system incidents; and

triggering, by the server, in response to detection of one or more incidents, an incident notification.

2. The method as claimed in claim 1, wherein the one or more system incidents comprise one or more of a rogue station, a policy violation, a known attack, a protocol violation, and an anomalous behavior.

3. The method as claimed in claim 1, further comprising, when the one or more system incidents comprise a station not following a predetermined security policy:

instructing an operator network, by the server, to deny access to the station.

4. The method as claimed in claim 1, further comprising, when the one or more system incidents comprise an excessive performance degradation:

triggering, by the server, an analysis wizard to determine a root cause of the performance degradation.

5. The method as claimed in claim 1, further comprising, when the one or more system incidents comprises detection of a rogue station:

triggering a location tracking operation to determine a location of the rogue station.

6. The method as claimed in claim 1, further comprising, when the one or more system incidents comprises detection of an unknown station:

estimating, by one or more sensors, a relative distance of the unknown station;

calculating, by the server, a location of the unknown station using sensor locations of each of the one or more sensors;

comparing, by the server, the calculated location of the unknown station to a list of known stations and associated locations; and

when the calculated location does not match an associated location of a known station, identifying, by the server, the unknown station as a rogue station.

7. The method as claimed in claim 6, wherein the relative distance is estimated based at least in part on a received signal strength and an estimated propagation path loss.

8. The method as claimed in claim 1, further comprising prior to the monitoring by the one or more sensors:

configuring at least one server and the one or more sensors including setting one or more monitoring policies and thresholds.

9. The method as claimed in claim 8, wherein the configuring includes identifying a list of authorized base stations and their location, one or more operating channels, and one or more supported authentication and encryption schemes.

10. The method as claimed in claim 8, wherein the configuring includes automatically importing, by the server, one or more of a list of authorized base stations and their location, one or more operating channels, and one or more supported authentication and encryption schemes.

11. The method as claimed in claim 1, wherein the monitoring by the one or more sensors comprises promiscuous mode radio frequency capture.

12. The method as claimed in claim 1, wherein the monitoring by the one or more sensors comprises using an intelligent channel scanning algorithm to detect traffic on the one or more channels.

13. The method as claimed in claim 1, further comprising prior to the providing of the report operations:

requesting, by the server, to the one or more sensors, to process more events and statistics and provide a consolidated report periodically.

14. The method as claimed in claim 1, further comprising prior to the providing of the report operations:

requesting, by the server, to the one or more sensors, to provide a real-time feed of all packets it is detecting at any given time.

15. The method as claimed in claim 1, further comprising:

storing, by the server, all observed events and statistics within the received reports of the monitored communication activity.

16. A method for security and monitoring within a worldwide interoperability for microwave access (WiMAX) network comprising:

monitoring, by one or more sensors, communications activity on one or more channels;

analyzing, by each of the one or more sensors, the monitored communication activity for detection of one or more system incidents; and

triggering, by one of the one or more sensors, in response to detection of one or more incidents, an incident notification.

17. The method as claimed in claim 16, further comprising, when the one or more system incidents comprises detection of an unknown station:

estimating, by the one or more sensors, a relative distance of the unknown station;

calculating, by the one or more sensors, a location of the unknown station using sensor locations of each of the one or more sensors;

comparing, by the one or more sensors, the calculated location of the unknown station to a list of known stations and associated locations; and

when the calculated location does not match an associated location of a known station, identifying, by the one or more sensors, the unknown station as a rogue station.

18. The method as claimed in claim 17, wherein the relative distance is estimated based at least in part on a received signal strength and an estimated propagation path loss.

19. A method for security and monitoring within a worldwide interoperability for microwave access (WiMAX) network comprising:

communicating, by at least one sensor, with an unknown station;

communicating a signature packet to the unknown station from the at least one sensor;

determine, by the signature detector within the WiMAX network, if the signature packet is received and is legitimate; and

when the signature packet is not received, flagging the unknown station as a rogue station.

20. The method as claimed in claim 19, wherein the signature detector operates within an operator'"'"'s network of the WiMAX network, and wherein communicating the signature packet from the at least one sensor to the signature detector comprises:

communicating a known signature packet from the sensor to the signature detector through a base station.

21. The method as claimed in claim 19, further comprising prior to communicating by the at least one sensor with an unknown station:

emulating, by the at least one sensor, a subscriber station.