Automated method and system for monitoring local area computer networks for unauthorized wireless access

• US 20130117851A1
• Filed: 06/26/2012
• Published: 05/09/2013
• Est. Priority Date: 02/11/2004
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Bhagwat, Pravin, Gogate, Shantanu, King, David C.
• Granted Patent: US 9,003,527 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/102 Route integrity, e.g. using trusted paths
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

The wireless activity in a geographic area containing LAN connection ports is monitored using one or more sensor devices, called sniffers. By analyzing said wireless activity, one or more APs that are operating in said geographic area are identified. The active APs so identified are classified into three categories, namely “authorized” APs (those that are allowed by network administrator), “unauthorized” APs (those that are not allowed by the network administrator, but are still connected to the LAN of interest) and “external” APs (those that are not allowed by network administrator but are not connected to the LAN of interest, for example APs connected to the neighbor'"'"'s LAN) by conducting one or more tests. The sniffers detect any wireless station attempting to connect to or communicating with the one or more identified unauthorized APs. Upon identifying unauthorized AP and/or intruding wireless station an indication is transferred to the prevention process.

Claims

1-50. -50. (canceled)

51. A method for monitoring for unauthorized wireless access to computer network, the method comprising:

monitoring wireless communications within a selected geographic region, the selected geographic region including a wired portion of a computer network that is to be protected from unauthorized wireless access;

detecting a first active wireless access point device that transmits wireless signals within the selected geographic region, the first active wireless access point device being configured to perform a network address translation (NAT) function between its wired and wireless interfaces;

transmitting a first marker packet over a wireless link to the first active wireless access point device, the first marker packet being adapted to be received by the wireless interface of the first active wireless access point device and being adapted to be transferred through the first active wireless access point device to its wired interface and being destined to a predetermined computing device coupled to the computer network;

determining that the first marker packet is received at the predetermined computing device coupled to the computer network;

determining that the first active wireless access point device is connected to the wired portion of the computer network based at least upon the determining that the first marker packet is received at the predetermined computing device coupled to the computer network; and

determining that the first active wireless access point device provides unauthorized wireless access to the wired portion of the computer network based at least upon the determining that the first active wireless access point device is connected to the wired portion.

52. The method of claim 51 wherein the monitoring wireless communications within the selected geographic region being monitoring using one or more sniffers devices positioned within the selected geographic region.

53. The method of claim 52 wherein the transmitting the first marker packet being transmitting using a first sniffer device among the one or more sniffer devices.

54. The method of claim 53 wherein the wireless link is established between a wireless station other than the first sniffer device and the active wireless access point device.

55. The method of claim 54 wherein the first sniffer device spoofs identity of the wireless station while transmitting the first marker packet.

56. An apparatus for monitoring for unauthorized wireless access to computer network, the apparatus comprising:

a first radio interface;

a processor unit; and

a computer readable medium storing instructions executable by the processor unit to perform steps of;

monitoring wireless communications using the first radio interface;

detecting a first active wireless access point device within a radio coverage range of the radio interface, the first active wireless access point device being configured to perform a network address translation (NAT) function between its wired and wireless interfaces, the radio coverage range of the radio interface including at least one connection point on a wired portion of a computer network that is to be protected from unauthorized wireless access;

transmitting a first marker packet over a wireless link using the first radio interface to the first active wireless access point device, the first marker packet being adapted to be received by the wireless interface of the first active wireless access point device and being adapted to be transferred through the first active wireless access point device to its wired interface and being destined to a predetermined computing device coupled to the computer network;

determining that the first marker packet is received at the predetermined computing device coupled to the computer network;

determining that the first active wireless access point device is connected to the wired portion of the computer network based at least upon the determining that the first marker packet is received at the predetermined computing device coupled to the computer network; and

determining that the first active wireless access point device provides unauthorized wireless access to the wired portion of the computer network based at least upon the determining that the first active wireless access point device is connected to the wired portion.

57. The apparatus of claim 56 wherein the wireless link is established between a second radio interface and the first active wireless access point device, the second radio interface being distinct from the first radio interface.

58. The apparatus of claim 57 wherein the first radio interface spoofs identity of the second radio interface while transmitting the first marker packet.