Method and system for scheduling of sensor functions for monitoring of wireless communication activity

• US 7,333,800 B1
• Filed: 12/29/2004
• Issued: 02/19/2008
• Est. Priority Date: 09/08/2004
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Gopinath, Krishnamurthy N.
• Primary Examiner(s): Perez-Gutierrez; Rafael
• Assistant Examiner(s): Patel; Nimesh
• Application Number:
  US11/026,473
• Time in Patent Office: 1,147 Days
• Field of Search: 455/411, 4554351-435, 455 631- 632, 4551142-114, 455/410, 455/570, 455/296, 370/338, 370/401, 713/157, 713/166, 713/164, 726/23, 726/22, 726/24
• US Class Current: 455/411
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions

Abstract

A method and a system for scheduling instances of prevention processes for inhibiting undesirable wireless communication of wireless devices is provided. The method includes identifying a wireless device based on a detected undesirable wireless communication. The method can initiate an instance of a prevention process directed to the wireless device so identified. The prevention process can include AP flooding, deauthentication and the like. Preferably, the instance of the prevention process can inhibit the wireless device for certain duration. The method includes setting an inhibited time interval. Preferably, the inhibited time interval is associated with the duration for which the wireless device is inhibited due to the instance of the prevention process. Moreover, the method can perform scanning for other undesirable wireless communication and/or access point functionality during at least a portion of the inhibited time interval.

Claims

1. A method for scheduling instances of prevention processes for inhibiting undesirable wireless communication of wireless devices, the method comprising:

identifying a first wireless device based on a detected undesirable wireless communication;

determining a first inhibited time interval for the first wireless device for a first prevention process, the first inhibited time interval being indicative of an interval of time for which the first wireless device is inhibited from wirelessly communicating upon applying an instance of the first prevention process on the first wireless device, the applying the instance of the first prevention process including transmitting one or more wireless signals from a sniffer device to interfere with wireless communication of the first wireless device;

initiating a first instance of the first prevention process for inhibiting the first wireless device by transmitting one or more first wireless signals from the sniffer device;

setting a first timeout interval based at least upon the first inhibited time interval;

performing scanning from the sniffer device for undesirable wireless communication from other wireless devices during at least a portion of the first timeout interval; and

initiating a second instance of the first prevention process for inhibiting the first wireless device by transmitting one or more second wireless signals from the sniffer device upon termination of the first timeout interval.

2. The method of claim 1, wherein the first wireless device is an access point device.

3. The method of claim 1, wherein the first wireless device is a station.

4. The method of claim 1, wherein the first prevention process includes access point flooding.

5. The method of claim 1, wherein the first prevention process includes deauthentication.

6. The method of claim 1, further including confirming the first wireless device is inhibited after initiating the first instance of the first prevention process.

7. The method of claim 6, wherein if the first wireless device is active as determined by the confirming, then initiating a third instance of the first prevention process and updating the first timeout interval.

8. The method of claim 1, further including performing another function in addition to the scanning during at least a portion of the first timeout interval.

9. The method of claim 8, wherein the other function includes performing access point functionality.

10. The method of claim 1, further including initiating a first instance of a second prevention process directed to a second wireless device, the second wireless device detected to be involved in undesirable wireless communication.

11. The method of claim 1, wherein if another undesirable wireless communication is detected during the scanning, then

identifying a second wireless device based on the other detected undesirable wireless communication;

determining a second inhibited time interval for the second wireless device for a second prevention process;

initiating a first instance of the second prevention process for inhibiting the second wireless device;

setting a second timeout interval for the second wireless device based at least upon the second inhibited time interval;

performing scanning for undesirable wireless communication from other wireless devices during at least a portion of the second timeout interval; and

initiating a second instance of the second prevention process for inhibiting the second wireless device upon termination of the second timeout interval.

12. The method of claim 11, wherein the first and the second prevention processes are different.

13. The method of claim 11, wherein the first and the second prevention processes are the same, and lengths of the first and the second timeout intervals are the same.

14. The method of claim 11, wherein the first and the second prevention processes are the same, but lengths of the first and the second timeout intervals are different.

15. The method of claim 1, wherein the identifying includes determining vendor and/or model information about the first wireless device.

16. The method of claim 1, wherein the identifying includes determining a MAC address of the first wireless device.

31. The method of claim 1, wherein the determining the first inhibited time interval for the first wireless device for the first prevention process includes accessing a database storing inhibited time intervals for prevention processes for wireless devices.

17. A method for performing scanning and inhibiting functions in a sensor device, the sensor device capable of monitoring wireless activity in a computer network, the method comprising:

(a) identifying a wireless device to be targeted for inhibiting;

(b) accessing a knowledge library including information regarding one or more inhibited time intervals associated with one or more inhibiting functions, respectively, corresponding to specific wireless devices, the one or more inhibiting functions including transferring one or more interfering wireless signals;

(c) selecting an inhibiting function for the identified wireless device using information from the knowledge library, the information being associated with the identified wireless device;

(d) performing the inhibiting function at selected time intervals by transferring one or more wireless signals to interfere with wireless communication of the identified wireless device, at least one of the selected time intervals being set based on an inhibited time information derived from the knowledge library, the inhibited time information being associated with the identified wireless device and the selected inhibiting function; and

(e) scanning channels for wireless activity either in conjunction or interleaved with steps (a), (b), (c), and (d).

18. The method of claim 17, wherein steps (a), (b), (c), and (d) can be performed for multiple wireless devices.

19. The method of claim 17, wherein the identifying includes at least one of determining

vendor information of the wireless device;

model information of the wireless device; and

a system address of the wireless device.

20. The method of claim 17, wherein the inhibiting function includes at least one of AP flooding and deauthentication.

21. A method for scheduling instances of prevention processes for inhibiting undesirable wireless communication of wireless devices, the method comprising:

identifying a first wireless device based on a detected undesirable wireless communication;

accessing a knowledge library to ascertain an inhibited time interval affected on the first wireless device upon applying an instance of a first prevention process on the first wireless device, the applying the instance of the first prevention process including transmitting one or more wireless signals from a sniffer device to interfere with wireless communication of the first wireless device;

initiating a first instance of the first prevention process by transmitting one or more first wireless signals from the sniffer device;

setting a timeout interval based at least upon the inhibited time interval;

performing access point functionality from the sniffer device during at least a portion of the timeout interval; and

initiating a second instance of the first prevention process by transmitting one or more second wireless signals from the sniffer device upon termination of the timeout interval.

22. The method of claim 21, wherein the first prevention process includes access point flooding.

23. The method of claim 21, wherein the first prevention process includes deauthentication.

24. A method for scheduling instances of prevention processes for inhibiting undesirable wireless communication of wireless devices, the method comprising:

identifying a wireless device based on a detected undesirable wireless communication;

initiating a first instance of a prevention process directed to the wireless device, the prevention process including transmitting one or more wireless signals to interfere with wireless communication associated with the wireless device;

setting an inhibited time interval for the wireless device, the setting the inhibited time interval being based upon knowledge of an interval of time for which the wireless device was inhibited from wirelessly communicating upon applying a second instance of the first prevention process, the second instance being applied prior to the first instance; and

performing at least one of scanning for other undesirable wireless communication, access point functionality, and initiating instance of another prevention process directed to another wireless device during at least a portion of the inhibited time interval.

25. The method of claim 24, wherein the prevention process includes at least one of access point flooding and deauthentication.

26. The method of, claim 24, wherein the identifying includes at least one of determining

vendor information of the wireless device;

model information of the wireless device; and

a system address of the wireless device.

27. The method of claim 24, further including confirming the wireless device is inhibited after initiating the first instance.

28. The method of claim 24, further including monitoring wireless activity associated with the wireless device around expiration of the inhibited time interval.

29. The method of claim 24, wherein the setting the inhibited time interval is further based on desired level of prevention.

32. The method of claim 24, wherein the knowledge of the interval of time for which the wireless device was inhibited from wirelessly communicating upon applying the second instance is stored in a knowledge library.

33. The method of claim 32, further including accessing the knowledge library to ascertain the interval of time for which the wireless device was inhibited from wirelessly communicating upon applying the second instance.

30. A computer network including wireless devices, the computer network comprising:

a sensor for inhibiting undesirable wireless communication of wireless devices, the sensor facilitating;

identifying a wireless device based on a detected undesirable wireless communication;

determining an inhibited time interval for the wireless device for a prevention process, the inhibited time interval being indicative of an interval of time for which the wireless device is inhibited from wirelessly communicating upon applying an instance of the prevention process on the wireless device, the applying the instance of the prevention including transmitting one or more wireless signals from the sensor to interfere with wireless communication of the wireless device;

initiating a first instance of the prevention process by transmitting one or more first wireless signals from the sensor;

setting a timeout interval based at least upon the inhibited time interval;

performing scanning for undesirable wireless communication from other wireless devices during at least a portion of the timeout interval; and

initiating a second instance of the prevention process by transmitting one or more second wireless signals from the sensor upon termination of the timeout interval.