Detecting Rogue Access Points

• US 20120026887A1
• Filed: 07/30/2010
• Published: 02/02/2012
• Est. Priority Date: 07/30/2010
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Vempati, Ramprasad
• Application Number:
  US12/847,899
• Publication Number:
  US 20120026887A1
• Time in Patent Office: Days
• US Class Current: 370/241
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Detecting rogues in a controller-based wireless network impersonating the BSSIDs of known valid access points (APs). Access points (APs) and Air Monitors (AMs, receive-only devices) periodically build RF-neighbor lists by collecting the BSSIDS of all the access points they can receive. These lists are then sent to the host controller. The host controller compares the new RF-neighbor list against the old RF-neighbor list. An otherwise valid BSSID appearing on a RF-neighbor list where it has not appeared before is flagged as a potential rogue.

Claims

1. In a wireless digital network having a plurality of access points (AP) and/or air monitors (AM) connected to a controller, the method of detecting potential rogue wireless devices comprising:

at each AP or AM, building a RF-neighbor list of all the BSSIDs that AP or AM can receive,

transferring the RF-neighbor list to the controller,

comparing, at the controller, the RF-neighbor list transferred from an AP or AM to the last RF-neighbor list transferred to the controller from that AP or AM, and

flagging as a potential rogue any BSSID present in the RF-neighbor list transferred from the AP or AM that is not present in the last RF-neighbor list transferred to the controller from that AP or AM.

2. The method of claim 1 where the RF-neighbor list is transferred from the AP or AM to the controller on a periodic basis.

3. The method of claim 1 where the RF-neighbor list is transferred from the AP or AM to the controller in response to polling by the controller.

4. The method of claim 1 where the process of building a RF-neighbor list includes the step of scanning multiple channels for BSSIDs.

5. A machine readable medium having a set of instructions stored in nontransitory form therein, which when executed on devices connected to a network cause a set of operations to be performed comprising:

building a RF-neighbor list of all BSSIDs received by an access point or air monitor connected to the network,

transferring the RF-neighbor list from the access point or air monitor to the controller hosting the access point or air monitor,

comparing, at the controller, the RF-neighbor list from the access point or air monitor with the last RF-neighbor list transferred to the controller from that access point or air monitor, and

flagging as a potential rogue any BSSID present in the RF-neighbor list transferred from the access point or air monitor that is not present in the last RF-neighbor list transferred to the controller from that access point or air monitor.