Containment of rogue systems in wireless network environments

• US 8,000,308 B2
• Filed: 10/20/2008
• Issued: 08/16/2011
• Est. Priority Date: 06/30/2003
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Frascone, David Anthony, Howard, Mathew Douglas, Calhoun, Patrice R., Friday, Robert J., O'Hara, Robert B. Jr., Dietrich, Paul F.
• Primary Examiner(s): Harper; Kevin C
• Application Number:
  US12/254,420
• Publication Number:
  US 20090271864A1
• Time in Patent Office: 1,030 Days
• Field of Search: 370/326, 370/338, 370/401, 726/2, 726 22- 23
• US Class Current: 370/338
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

Methods, apparatuses and systems facilitating containment of the effects of rogue or unauthorized access points on wireless computer network environments. Embodiments of the present invention support one to a plurality of rogue containment methodologies. A first rogue containment type involves identification of the physical connection of the rogue access point to the wired network infrastructure and, thus, allows for disabling of that physical connection to contain the rogue access point. Other rogue containment methods involve wireless techniques for containing the effect of rogue access points. As discussed below, the rogue containment functionality described herein can be applied to a wide variety of wireless network system architectures.

Claims

1. A rogue containment apparatus comprising:

a network interface for communication with one or more wireless network access devices,

a rogue containment component operative to

detect a rogue access point, wherein the rogue access point includes a virtual carrier-sense mechanism operative to adjust a timer in response to wireless frames transmitted from wireless stations, wherein the wireless frames include a duration value, the timer controlling the transmission of frames by the rogue access point,

identify one or more authorized access points that neighbors the rogue access point;

select at least one of the identified authorized access points; and

configure the at least one selected access point to periodically transmit wireless frames, the wireless frames including a predetermined duration value, and wherein the interval at which the data frames are periodically transmitted is less than the duration value.

2. The rogue containment apparatus of claim 1 wherein the wireless frames are transmitted on all available frequency channels.

3. The rogue containment apparatus of claim 1 wherein the rogue containment component is further operative to identify the channel on which the rogue access point is transmitting;

and wherein the wireless frames are transmitted on the identified channel.

4. The rogue containment apparatus of claim 1 wherein the rogue containment component is further operative to identify the channel on which the rogue access point is transmitting;

and wherein the wireless frames are transmitted on a range of channels centered on the identified channel.

5. The rogue containment apparatus of claim 1 wherein the rogue containment component is further operative to process wireless scan data characterizing wireless traffic detected by a plurality of access points against information relating to known access elements to detect rogue access points.

6. A rogue containment apparatus comprising:

a network interface for communication with one or more wireless network access devices,

a rogue containment component operative to

detect a rogue access point, the rogue access point identified by a wireless network address;

select at least one authorized access point;

configure the selected authorized access point to emulate the rogue access point and periodically broadcast, at repetition interval, beacon frames, wherein the beacon frames announce a contention-free period, and wherein the contention-free period is greater than the repetition interval.

7. The rogue containment apparatus of claim 6 wherein the rogue containment component is further operative to process wireless scan data characterizing wireless traffic detected by a plurality of access points against information relating to known access elements to identify rogue access points.

8. The rogue containment apparatus of claim 6 wherein the rogue containment component is further operative to

determine the address of at least one rogue client associated with the rogue access point;

and

identify the port to which the rogue access point is connected by querying, using the addresses of the at least one rogue client, one or more network devices for the port at which data units sourced from the at least one rogue client were encountered.

9. In a computer network environment comprising a wired computer network implemented by at least one network device operative to switch or route packets between devices connected thereto, the packets including a source address and a destination address, wherein the at least one network device comprises at least two ports to which other devices connect, and wherein the at least one network device is operative to store the source addresses of the packets encountered at the ports of the at least one network device, a method for containing rogue access points, comprising

detecting a rogue access point, the rogue access point connected to the wired computer network and bridging wireless traffic between at least one rogue client and the wired computer network;

determining the address of at least one rogue client associated with the rogue access point;

identifying the port to which the rogue access point is connected by querying, using the addresses of the at least one rogue client in the determining step, the at least one network device for the port at which packets sourced from the at least one rogue client were encountered;

processing wireless scan data characterizing wireless traffic detected by a plurality of access points against information relating to known access elements to identify rogue access points;

configuring one or more of the access elements to emulate the rogue access point and transmit connection-terminating frames; and

wherein the connection-terminating frames are transmitted at a repetition interval, and wherein the repetition interval is adjusted in response to detection of wireless traffic transmitted between the rogue access point and a wireless client.

10. The method of claim 9 wherein the connection terminating frames are disassociation frames.

11. The method of claim 9 further comprising

disabling the identified port.

12. The method of claim 9 further comprising

locating the edge port, if more than one network device responds in the querying step.

13. The method of claim 9 wherein the at least one network device is an Ethernet switch.

14. The method of claim 9 further comprising

reporting the identified port to a network administrator.

15. The method of claim 9 further comprising

configuring one or more access elements to contain the detected rogue access point(s).

16. The method of claim 9 wherein the connection terminating frames are de-authentication frames.