Method and apparatus for ensuring address information of a wireless terminal device in communications network

• US 7,480,933 B2
• Filed: 05/01/2003
• Issued: 01/20/2009
• Est. Priority Date: 05/07/2002
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Smith, Mike, Haverinen, Henry, Rinnemaa, Jyri, Tuominen, Hannu, Tuomi, Jukka, Bush, Anton, Takamäki, Timo
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US10/427,307
• Publication Number:
  US 20040148374A1
• Time in Patent Office: 2,091 Days
• Field of Search: None
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 80/02 Data link layer protocols
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method and device for ensuring address information of a wireless terminal device in a wireless local area network, the network comprising; an access point for setting up a communication connection to the terminal device, the method comprising establishing a communication connection between the terminal device and the access point (101), and relaying data packets from the terminal device to the network and from the network to the terminal device (105). The method further comprising the steps at the access point: detecting an IP address of the terminal device in response to the established communication connection (103), associating the detected IP address of the terminal device to the MAC address of the terminal device (104), and comparing that the address information of the terminal device on the relayed data packets are corresponding to the associated address information (111, 112).

Claims

1. A method, comprising:

receiving unique device identifying information from a wireless terminal device in a wireless local area network,

detecting a unique routing address of the wireless terminal device,

associating the detected unique routing address of the wireless terminal device with the unique device identifying information received from the wireless terminal device,

receiving data packets from or to the wireless terminal device, said data packets comprising a particular routing address, and

checking a secure use of routine address information by comparing whether the particular routing address in the received data packets corresponds with the unique routing address and associated unique device identifying information for the wireless terminal device from or to which the packets have been or are to be relayed, and

relaying the data packets between the wireless terminal device and the network based on said comparison.

2. A method according to claim 1, wherein the particular routing address is a destination Internet protocol address of the data packets going to the wireless terminal device, and wherein the destination Internet protocol address is compared to the unique routing address and associated unique device identifying information.

3. A method according to claim 1, wherein the particular routing address is a source Internet protocol address of the data packets coming from the wireless terminal device, and wherein the source Internet protocol address is compared to the unique routing address and associated unique device identifying information.

4. A method according to claim 1, wherein the access point is arranged to detect the unique routing address of the wireless terminal device from dynamic host configuration protocol packets that the wireless terminal device sends and/or receives.

5. A method according to claim 1, wherein the access point is arranged to detect the unique routing address of the wireless terminal device when the access point is relaying the dynamic host configuration protocol packets of the wireless terminal device.

6. A method according to claim 1, wherein the access point is arranged to discard a data packet if the particular routing address of the data packet sent to or received from the wireless terminal device does not correspond to the unique routing address and associated unique device identifying information.

7. A method according to claim 1, wherein the access point is arranged to terminate the connection between the access point and the wireless terminal device if the particular routing address of the data packet sent to or received from the wireless terminal device does not correspond to the unique routing address and associated unique device identifying information.

8. A method according to claim 6, wherein based on said comparison the unique device identifying information of the wireless terminal device is added to a list of terminals behaving badly.

9. A method according to claim 8, wherein the communication connection between the wireless terminal device and the access point has an integrity protection comprising the MAC address of the wireless terminal device.

10. A method according to claim 1, wherein the unique device identifying information is a MAC address.

11. A method according to claim 1, wherein the unique routing address is an Internet protocol address.

12. A method according to claim 1, wherein the method comprises establishing a communication connection between the wireless terminal device and an access point, and detecting the particular routing address of the wireless terminal device after having established the communication connection.

13. An access point for secure communication connection to a terminal device in a wireless local area network, the access point comprising;

receiving means for receiving unique device identifying information from the terminal device,

detecting means for detecting a unique routing address of the terminal device,

associating means for associating the detected unique routing address of the terminal device to the unique identifying information received from the terminal device using the receiving means for receiving unique device identifying information,

receiving means for receiving data packets to or from the terminal device, said data packets comprising a particular routing address, and

comparing means for checking a secure use of routing address information by comparing whether the particular routing address in the received data packets, received via the receiving means for data packets, corresponds with the unique routing address and associated unique device identifying information for the terminal device to or from which the packets are to be or have been relayed, and

relaying means for relaying data packets between the terminal device and the network based on said comparison.

14. An access point according to claim 13, wherein the particular routing address is a destination Internet protocol address and the comparing means is arranged to compare the destination Internet protocol address of the data packets going to the terminal device to the unique routing address and associated unique device identifying information of the terminal device.

15. An access point according to claim 14, wherein the particular routing address is a source Internet protocol address and the comparing means is arranged to compare the source Internet protocol address of the data packets coming from the terminal device to the unique routing address and associated unique device identifying information of the terminal device.

16. An access point according to claim 14, wherein the detecting means is arranged to detect the unique routing address of the terminal from dynamic host configuration protocol packets the terminal device sends and receives.

17. An access point according to claim 14, wherein the detecting means is arranged to detect the unique routing address of the terminal device when the access point is relaying the dynamic host configuration protocol packets of the terminal device.

18. An access point according to claim 14, wherein the access point further comprises discarding means for discarding the data packet of the terminal device if the particular routing address of the data packet sent to or received from the terminal device does not correspond to the unique routing address and associated unique device identifying information.

19. An access point according to claim 18, wherein the discarding means is further arranged to terminate the connection between the access point and the terminal device.

20. An access point according to claim 15, wherein the unique device identifying information is a MAC address.

21. An access point according to claim 15, wherein the unique routing address is an Internet protocol address.

22. An access point according to claim 15, comprising an establishing means for establishing a communication connection between the terminal device and the access point, and wherein the detecting means is for detecting the unique routing address of the terminal device after having established the communication connection using the establishing means.

23. An apparatus, comprising;

a receiver configured to receive unique device identifying information from a terminal device in a wireless local area network, the information identifying said terminal device,

a detector configured to detect a unique routing address of the terminal device,

a memory configured to store an association of the detected unique routing address of the terminal device with the unique device identifying information received from the terminal device using the receiver for receiving unique device identifying information,

a receiver configured to receive data packets to or from the terminal device, said data packets comprising a particular routing address,

a comparator configured to check a secure use of routine address information by comparing whether the particular routing address in the received data packets corresponds with the unique routing address and associated unique device identifying information for the terminal device to or from which the packets are to be or have been relayed, received from the memory, and

a relay configured to relay data packets between the terminal device and the network based on said comparison.

25. An apparatus according to claim 23, comprising an establisher configured to establish a communication connection between the terminal device and the apparatus, and wherein the detector is configured to detect the unique routing address of the terminal device after having established the communication connection using the establisher.

24. A memory embodying a computer program product for an access point executable by a processor to perform operations arranged to provide a secure communication connection to a terminal device in a wireless local area network, the operations comprising;

receiving unique device identifying information from the terminal device, the information identifying said terminal device,

causing the access point to detect a unique routing address of the terminal device,

causing the access point to associate the detected unique routing address of the terminal device with the unique device identifying information of the terminal device,

receiving data packets to or from the terminal device, said data packets comprising a particular routing address,

causing the access point to check a secure use of routing address information by comparing the particular routing address of the terminal device in the received data packets with the unique routing address and associated unique device identifying information for the terminal device to or from which the packets are to be or have been relayed, and

causing the access point to relay data packets between the terminal device and the network based on said comparison.