NETWORK INFRASTRUCTURE VALIDATION OF NETWORK MANAGEMENT FRAMES
First Claim
Patent Images
1. A method of operation for an authentication server, comprising:
- establishing a first secure communication session with a first access point;
establishing a second secure communication session with a second access point;
receiving a request from the second access point for a key for validating management frames sent by the first access point via the second secure communication session;
sending the key for validating management frames by the first access point to the second access point via the second secure communication session;
determining the first access point has changed the key for validating management frames to an updated key; and
automatically sending the updated key to the second access point via the second secure communication session responsive to determining the first access point has changed the key for validating management frames to an updated key.
1 Assignment
0 Petitions
Accused Products
Abstract
A detection-based defense to a wireless network. Elements of the infrastructure, e.g., access points or scanning-only access points, detect intruders by detecting spoofed frames, such as from rogue access points. Access points include a signature, such as a message integrity check, with their management frames in a manner that enables neighboring access points to be able to validate the management frames, and to detect spoofed frames. When a neighboring access point receives a management frame, obtains a key for the access point sending the frame, and validates the management frame using the key.
32 Citations
18 Claims
-
1. A method of operation for an authentication server, comprising:
-
establishing a first secure communication session with a first access point; establishing a second secure communication session with a second access point; receiving a request from the second access point for a key for validating management frames sent by the first access point via the second secure communication session; sending the key for validating management frames by the first access point to the second access point via the second secure communication session; determining the first access point has changed the key for validating management frames to an updated key; and automatically sending the updated key to the second access point via the second secure communication session responsive to determining the first access point has changed the key for validating management frames to an updated key. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. An apparatus, comprising:
-
an authentication server configured to communicate via a network to a plurality of access points; wherein the authentication server is configured to establish a first secure communication session with a first access point; wherein the authentication server is configured to establish a second secure communication session with a second access point; wherein the authentication server is configured to receive a request from the second access point for a key for validating management frames sent by the first access point via the second secure communication session; wherein the authentication server is responsive to receiving the request from the second access point to send the key for validating management frames for the first access point to the second access point via the second secure communication session; wherein the authentication server is configured to determine that the first access point has changed the key for validating management frames to an updated key; and wherein the authentication server is responsive to determining the first access point has changed the key for validating management frames to an updated key to automatically send the updated key to the second access point via the second secure communication session. - View Dependent Claims (8, 9, 10, 11)
-
-
12. The apparatus as set forth in 7, wherein the authentication server is configured to receive a request from the second access point via a secure protocol, send the key to the second access point via a secure protocol, and send the updated key to the second access point are via a secure protocol.
-
13. Logic encoded in a non-transitory computer readable medium for execution by a processor, and when executed is operable to:
-
establishing a first secure communication session with a first access point; establishing a second secure communication session with a second access point; receiving a request from the second access point for a key for validating management frames sent by the first access point via the second secure communication session; sending the key for validating management frames by the first access point to the second access point via the second secure communication session; determining the first access point has changed the key for validating management frames to an updated key; and automatically sending the updated key to the second access point via the second secure communication session responsive to determining the first access point has changed the key for validating management frames to an updated key. - View Dependent Claims (14, 15, 16, 17, 18)
-
Specification