Rogue Wireless Access Point Detection

• US 20140161027A1
• Filed: 12/07/2012
• Published: 06/12/2014
• Est. Priority Date: 12/07/2012
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Larue, Troy, Banning, Joseph, Sorrell, Ed
• Granted Patent: US 9,198,118 B2
• Time in Patent Office: Days
• US Class Current: 370/328
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information

Abstract

A method includes, receiving a first set of media access control (MAC) addresses from one or more wireless communication detection devices of a network. The method also includes receiving a second set of MAC addresses from one or more wired devices of the network. The second set of MAC addresses corresponds to devices with wired connections to the network. The method further includes, determining that a wireless device having a first MAC address of the first set of media access control addresses is a potential rogue wireless device when a numeric value of the first MAC address and a numeric value of a second MAC address of the second set of MAC addresses differ by no more than a threshold amount and when a first location associated with a device that detects the first MAC address matches a second location associated with the second MAC address.

Claims

1. A method comprising:

receiving a first set of media access control addresses from one or more wireless communication detection devices of a network;

receiving a second set of media access control addresses from one or more wired devices of the network, wherein the second set of media access control addresses corresponds to devices with wired connections to the network; and

determining that a wireless device having a first media access control address of the first set of media access control addresses is a potential rogue wireless device when a numeric value of the first media access control address and a numeric value of a second media access control address of the second set of media access control addresses differ by no more than a threshold amount and when a first location associated with a device that detects the first media access control address matches a second location associated with the second media access control address.

2. The method of claim 1, further comprising, before determining that the wireless device is a potential rogue wireless device, filtering the second set of media access control addresses to form a filtered second set of media access control addresses, wherein the filtered second set of media access control addresses excludes information associated with authorized devices, wherein the second media access control address is included in the filtered second set of media access control addresses.

3. The method of claim 1, further comprising initiating an action responsive to determining that the wireless device is the potential rogue wireless device.

4. The method of claim 3, wherein the action includes dispatching a technician to investigate the device.

5. The method of claim 3, wherein the action includes sending a message to a user of the device via a wired connection.

6. The method of claim 3, wherein the action includes causing one or more wired routing devices of the network to perform media access control address blocking associated with the second media access control address.

7. The method of claim 1, further comprising, after determining that the wireless device is the potential rogue wireless device, sending a message to a wired device associated with the second media access control address via a wired connection, wherein the wireless device is determined to be an active rogue wireless device when a response to the message is received from the wired device.

8. The method of claim 7, wherein the message includes a ping message.

9. The method of claim 7, wherein the message includes a connection request.

10. The method of claim 1, wherein the one or more wireless communication detection devices include wireless access points.

11. The method of claim 1, wherein the first set of media access control addresses corresponds to devices detected by at least one wireless communication detection device of the one of more of the wireless communication detection devices.

12. The method of claim 1, wherein the network comprises a geographically distributed, access controlled network including one or more authorized wireless access points and including one or more wired connections that are subject to different access controls than the one or more authorized wireless access points.

13. A system comprising

a processor;

and

a memory accessible to the processor, the memory storing instructions that, when executed by the processor, cause the processor to perform operations comprising;

receiving a first set of media access control addresses from one or more wireless communication detection devices of a network;

receiving a second set of media access control addresses from one or more wired devices of the network, wherein the second set of media access control addresses corresponds to devices with wired connections to the network; and

determining that a wireless device having a first media access control address of the first set of media access control addresses is a potential rogue wireless device when a numeric value of the first media access control address and a numeric value of a second media access control address of the second set of media access control addresses differ by no more than a threshold amount and when a first location associated with a device that detects the first media access control address matches a second location associated with the second media access control address.

14. The system of claim 13, wherein the operations further comprise, before determining that the wireless device is a potential rogue wireless device, filtering the second set of media access control addresses to form a filtered second set of media access control addresses, wherein the filtered second set of media access control addresses excludes information associated with authorized devices, wherein the second media access control address is included in the filtered second set of media access control addresses.

15. The system of claim 14, wherein the operations further comprise initiating an action responsive to determining that the wireless device is a potential rogue wireless device.

16. The system of claim 15, wherein the action includes causing one or more wired routing devices of the network to perform media access control address blocking associated with the second media access control address.

17. The system of claim 13, wherein the operations further comprise, after determining that the wireless device is the potential rogue wireless device, sending a message to a wired device associated with the second media access control address via a wired connection, wherein the wireless device is determined to be an active rogue wireless device when a response to the message is received from the wired device.

18. The system of claim 17, wherein the one or more wired devices include wired routers, wired switches, or both.

19. The system of claim 13, wherein the first set of media access control addresses corresponds to devices detected by at least one wireless communication detection devices of the one of more of the wireless communication detection devices.

20. A computer readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving a first set of media access control addresses from one or more wireless communication detection devices of a network;

receiving a second set of media access control addresses from one or more wired devices of the network, wherein the second set of media access control addresses corresponds to devices with wired connections to the network; and

determining that a wireless device having to a first media access control address of the first set of media access control addresses is a potential rogue wireless device when a numeric value of the first media access control address of the first set of media access control addresses and a numeric value of a second media access control address of the second set of media access control addresses differ by no more than a threshold amount and when a first location associated with a device that detects the first media access control address matches a second location associated with the second media access control address.