Apparatus, method and computer program product for detection of a security breach in a network

• US 7,877,805 B1
• Filed: 06/13/2007
• Issued: 01/25/2011
• Est. Priority Date: 09/10/2002
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Marvell International Limited (Marvell Technology Group Limited)
• Inventors: Rainnie, Hedley, Leistiko, Tyson, Loc, Peter
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Gregory; Shaun
• Application Number:
  US11/818,104
• Time in Patent Office: 1,322 Days
• Field of Search: 726/14, 726 22- 23, 726 26- 27, 726/29, 713168-169, 380/259, 380/270
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A method for detecting a security breach in a network comprises at one of a plurality of transceivers each having a different media access control address, receiving a signal from an access point, the signal representing one or more packets of data, determining a source media access control address for each of the packets, and alerting the access point when the source media access control address of one of the packets is the media access control address of the transceiver.

Claims

1. A method for detecting a security breach in a network, the method comprising:

providing a plurality of transceivers, each of the plurality of transceivers having a different media access control address,

at one of the plurality of transceivers;

receiving a signal from an access point, the signal comprising at least one packet;

determining a source media access control address for each of the at least one packet;

alerting the access point when the source media access control address of the at least one packet is the media access control address of one of the plurality of transceivers;

determining a packet type unexpected by the access point; and

transmitting an alert packet that comprises an unencrypted alert indicator to the access point, wherein the unencrypted alert indicator includes a packet of the packet type,

wherein the access point recognizes the alert packet as an indication of a security breach in the network by presence of the unencrypted alert indicator in the alert packet regardless of which key is used to encrypt the alert packet.

3. The method of claim 1, further comprising at the access point generating an error based on the unencrypted alert indicator.

2. An apparatus for detecting a security breach in a network, the apparatus comprising:

a receiver to receive a signal from an access point, the signal comprising at least one packet;

a processor to determine a source media access control address for each of the at least one packet;

determining a packet type unexpected by the access point; and

a transmitter to alert the access point when the source media access control address of the at least one packet is the media access control address of the transmitter and the receiver,

wherein the transmitter transmits an alert packet that comprises an unencrypted alert indicator to the access point, wherein the unencrypted alert indicator includes a packet of the packet type, and

wherein the access point recognizes the alert packet as an indication of a security breach in the network by presence of the unencrypted alert indicator in the alert packet regardless of which key is used to encrypt the alert packet.