Method and system for location estimation in wireless networks

• US 7,856,209 B1
• Filed: 11/30/2005
• Issued: 12/21/2010
• Est. Priority Date: 12/08/2003
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Rawat, Jai
• Primary Examiner(s): Phu; Sanh D
• Application Number:
  US11/291,510
• Time in Patent Office: 1,847 Days
• Field of Search: 455/456.1, 455/67.11, 455/435.1, 455/552.1, 370/338, 370/469
• US Class Current: 455/67.11
• CPC Class Codes: G01S 5/0295 Proximity-based methods, e.g. position inferred from reception of particular signals
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method of estimating a location of a wireless device providing a wireless attack. The method includes disposing a number of sniffers in a geographic region and receiving a number of wireless signals at one or more of the number of sniffers. The method also includes processing the number of wireless signals to identify a subset of the number of wireless signals that are associated with the wireless device and determining a number of received signal strengths associated with the subset of the number of wireless signals. The method further includes providing an estimation of the location of the wireless device utilizing the determined received signal strengths associated with the subset of the number of wireless signals.

Claims

1. A method of estimating a location of a wireless device, the method comprising:

disposing a plurality of sniffers in a geographic region;

receiving a plurality of wireless signals using one or more of the plurality of sniffers;

processing the plurality of wireless signals to identify a subset of the plurality of wireless signals that are associated with the wireless device;

determining a plurality of received signal strengths associated with the subset of the plurality of wireless signals; and

providing an estimation of the location of the wireless device utilizing the determined received signal strengths associated with the subset of the plurality of wireless signals,

wherein the processing the plurality of wireless signals comprises;

obtaining a first frame from the plurality of wireless signals;

identifying a first wireless device by estimating a first starting time for the first wireless device utilizing a first TSF value included in the first frame;

obtaining a second frame from the plurality of wireless signals;

identifying a second wireless device by estimating a second starting time for the second wireless device utilizing a second TSF value included in the second frame, wherein the first TSF value and the second TSF value are different; and

identifying a subset of the plurality of wireless signals associated with either the first or the second wireless device.

18. The method of claim 1 wherein the estimation of the location is provided in relation to the geographic region.

19. The method of claim 1 wherein the providing the estimation of the location comprises displaying the estimation of the location in relation to layout of the geographic region.

20. The method of claim 1 wherein the providing the estimation of the location comprises providing the estimation of the location in relation to a co-ordinate system.

2. A method of estimating a location of a spoofer wireless device, the method comprising:

positioning a plurality of sniffers in a geographic region;

receiving a plurality of wireless signals using one or more of the plurality of sniffers from a first wireless device and a second wireless device, wherein header information associated with the plurality of wireless signals indicates that the plurality of wireless signals are transmitted from a wireless device associated with a first MAC address;

obtaining a first frame from the plurality of wireless signals;

estimating a first starting time for the first wireless device utilizing the first frame;

obtaining a second frame from the plurality of wireless signals;

estimating a second starting time for the second wireless device utilizing the second frame, wherein the first starting time and the second starting time are unequal; and

estimating a location of at least one of the first wireless device or the second wireless device.

3. The method of claim 2 wherein the first frame comprises a first TSF value and the second frame comprises a second TSF value.

4. The method of claim 2 wherein at least one of the first wireless device or the second wireless device is the spoofer device.

5. The method of claim 2 further comprising displaying the location of at least one of the first wireless device or the second wireless device on a display device.

6. The method of claim 5 further comprising concurrently displaying a location of a network device on the display device.

7. The method of claim 2 further comprising:

obtaining additional frames from the plurality of wireless signals;

estimating additional starting times utilizing the additional frames;

relating one or more of the additional frames to the first wireless device based on the estimated first starting time to form a set of frames associated with the first wireless device; and

relating one or more of the additional frames to the second wireless device based on the estimated second starting time to form a set of frames associated with the second wireless device.

8. The method of claim 7 further comprising estimating a location of the first wireless device utilizing a set of received signal strengths associated with the set of frames associated with the first wireless device.

9. The method of claim 7 further comprising estimating a location of the second wireless device utilizing a set of received signal strengths associated with the set of frames associated with the second wireless device.

10. A method of estimating a location of a MAC spoofing device in a wireless network, the method comprising:

(a) positioning a plurality of sniffers in a geographic region;

(b) receiving a plurality of 802.11 frames using one or more of the plurality of sniffers, wherein header information associated with the plurality of 802.11 frames indicates that the plurality of 802.11 frames are transmitted from a wireless device associated with a first MAC address;

(c) processing a first frame from the plurality of 802.11 frames to compute an approximation to a starting time for a first wireless device associated with the first MAC address;

(d) storing the approximation to the starting time for the first wireless device in a location of a memory;

(e) processing a second frame from the plurality of 802.11 frames to compute an approximation to a starting time for a second wireless device, wherein the second wireless device is the MAC spoofing device;

(f) storing the approximation to the starting time for the second wireless device in another location of the memory; and

(g) estimating locations of the first wireless device and the second wireless device.

11. The method of claim 10 further comprising displaying the locations of the first wireless device and the second wireless device on a display device.

12. The method of claim 10 further comprising:

repeating steps (b)-(f) for subsequent frames of the plurality of 802.11 frames.

13. A method of estimating a location of a MAC spoofing device in a wireless network, the method comprising:

(a) positioning a plurality of sniffers in a geographic region;

(b) receiving an 802.11 frame using one or more of the plurality of sniffers, wherein header information associated with the 802.11 frame indicates that the 802.11 frame is transmitted from a wireless device associated with a first MAC address;

(c) processing the 802.11 frame to compute an approximation to a starting time;

(d) comparing the approximation to the starting time to one or more values in a list stored in a memory to ascertain the presence of a match;

(e) storing a received signal strength value in a memory location associated with one of the one or more values in the list if comparing the approximation to the starting time produced a match;

(f) appending the approximation to the starting time to the list if comparing the approximation to the starting time did not produce a match;

(g) repeating steps (b) through (f) until the list comprises at least two starting time values; and

(h) estimating a location for one or more wireless devices associated with the stored values.

14. The method of claim 13 wherein processing the 802.11 frame to compute an approximation to a starting time comprises subtracting a TSF value for the 802.11 frame from a received time.

15. The method of claim 13 wherein a match comprises a predetermined difference between the approximation to the starting time and the stored value.

16. The method of claim 13 wherein estimating a location for one or more wireless devices comprises triangulating using the received signal strength values associated with one of the one or more values in the list.

17. The method of claim 13 further comprising displaying the location of the MAC spoofing device on a display device.

21. A method of estimating a location of a wireless device, the method comprising:

disposing a plurality of sniffers in a geographic region;

receiving a plurality of wireless signals at one or more of the plurality of sniffers;

obtaining a first frame from the plurality of wireless signals;

identifying a first wireless device by estimating a first starting time for the first wireless device utilizing a first TSF value included in the first frame;

identifying a first subset of the plurality of wireless signals that are associated with the first wireless device based upon the estimated first starting time;

obtaining a second frame from the plurality of wireless signals;

identifying a second wireless device by estimating a second starting time for the second wireless device utilizing a second TSF value included in the second frame, the estimate of the second starting time being different from the estimate of the first starting time;

identifying a second subset of the plurality of wireless signals that are associated with the second wireless device based upon the estimated second starting time;

providing an estimation of location of the second wireless device utilizing at least one received signal strength associated with the second subset of the plurality of wireless signals,

wherein the second wireless device spoofs MAC address of the first wireless device.

22. The method of claim 21 wherein the estimation of the location of the second wireless device is provided in relation to the geographic region.

23. The method of claim 21 wherein the providing comprises displaying the estimation of the location of the second wireless device in relation to layout of the geographic region.

24. The method of claim 21 wherein the providing comprises providing the estimation of the location of the second wireless device in relation to a co-ordinate system.