Detection of hidden wireless routers

• US 7,840,698 B2
• Filed: 01/14/2004
• Issued: 11/23/2010
• Est. Priority Date: 09/12/2003
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Krishnan, P, Ganu, Sachin Nandkumar, Krishnakumar, Anjur Sundaresan, Kappes, Martin, Fazal, Lookman
• Primary Examiner(s): Chang, Jungwon
• Application Number:
  US10/757,676
• Publication Number:
  US 20050060434A1
• Time in Patent Office: 2,505 Days
• Field of Search: 709/245, 709/238, 709/249, 709/225, 726/11, 726/15, 726/23, 455/411
• US Class Current: 709/238
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

A technique is disclosed for detecting hidden wireless routers that constitute security threats in telecommunications networks that comprise a wireless network portion and a wireline network portion. In accordance with the illustrative embodiment of the invention, a test station is used in the wireless portion of a network to detect the presence of a hidden wireless router. Furthermore, in some embodiments, a test server is used in the wireline portion of the network in order to detect packets that are illegitimately routed from the wireless portion to the wireline portion of the network through the hidden wireless router.

Claims

1. A method for determining if unauthorized routing between a first network and a second network is occurring, comprising:

deploying a first station in said first network;

deploying a test server in said second network connected to said first network through a secure access server;

transmitting from said first station a protocol data unit addressed to a second station in said first network, wherein said protocol data unit comprises a network layer source address of said second station, and an address of said test server;

triggering an alarm if said protocol data unit is received at said test server, wherein said alarm comprises said network layer source address of said second station; and

detecting at said test server that said network layer source address of said second station is identified as an unauthorized router.

2. The method of claim 1 further comprising obtaining a wireline network port number corresponding to said network layer source address of said second station.

3. The method of claim 2 further comprising disabling a network jack associated with said wireline network port number.