Apparatus, method and computer program product for detection of a security breach in a network

• US 8,151,351 B1
• Filed: 01/25/2011
• Issued: 04/03/2012
• Est. Priority Date: 09/10/2002
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Marvell International Limited (Marvell Technology Group Limited)
• Inventors: Loc, Peter, Leistiko, Tyson, Rainnie, Hedley
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Gregory, Shaun
• Application Number:
  US13/013,294
• Time in Patent Office: 434 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A method for detecting a security breach in a network comprises at one of a plurality of transceivers each having a different media access control address, receiving a signal from an access point, the signal representing one or more packets of data, determining a source media access control address for each of the packets, and alerting the access point when the source media access control address of one of the packets is the media access control address of the transceiver.

Claims

1. An apparatus comprising:

a transceiver receiving a first packet transmitted from an access point via a network to the apparatus; and

a processor

(i) determining a source media access control address of the first packet and

(ii) determining whether the source media access control address of the first packet corresponds to a source media access control address of the transceiver,

wherein, in response to the source media access control address of the first packet corresponding to the source media access control address of the transceiver, the transceiver

(i) generates a second packet, wherein the second packet comprises an encrypted portion and an unencrypted portion, wherein the unencrypted portion includes a field, wherein a packet type of the field is different than a packet type expected to be received by the access point, and

(ii) alerts the access point of a security breach in the network by transmitting the second packet to the access point, wherein the access point is alerted of the security breach in the network based on the unencrypted portion and not based on the encrypted portion.

2. The apparatus of claim 1, wherein, in response to the source media access control address of the first packet corresponding to the source media access control address of the transceiver, the transceiver causes an error to be generated at the access point by transmitting the second packet to the access point.

3. The apparatus of claim 1, wherein:

the second packet is an alert packet that alerts the access point of the security breach;

the unencrypted portion includes an unencrypted alert indictor;

the unencrypted alert indicator is the field of the unencrypted portion; and

the access point is alerted of the security breach in the network by presence of the unencrypted alert indicator in the alert packet regardless of which encryption key is used to generate the encrypted portion.

4. The apparatus of claim 1, wherein:

the first packet is transmitted from a network device to the apparatus; and

the network device is an intruder and is attacking the network by

(i) transmitting unauthorized packets on the network,

(ii) receiving unauthorized access to packets transmitted on the network, or

(iii) obtaining unauthorized access to a key transmitted on the network.

5. The apparatus of claim 1, wherein the processor generates the encrypted portion using a first key, and wherein the first key is a predetermined key and is different than a second key currently used to by the processor to encrypt non-alert packets.

6. The apparatus of claim 5, wherein the first key is:

a key provided by an authentication server to the transceiver prior to the second key having been provided to the transceiver;

or

an alert key provided to the transceiver for the purpose of encrypting alert packets.

7. The apparatus of claim 5, wherein the predetermined key is an alert key designated for encrypting alert packets.

8. The apparatus of claim 1, wherein:

the transceiver receives a first key from the access point, wherein the first key is used for encrypting non-alert packets;

the processor

(i) determines whether the first key is an unexpected key and

(ii) rejects the first key when the first key is an unexpected key; and

the transceiver transmits an alert packet to the access point, wherein the alert packet indicates the apparatus has received an unexpected key from the access point.

9. The apparatus of claim 1, wherein:

the transceiver receives a plurality of packets from the access point; and

the processor

(i) decrypts the plurality of packets,

(ii) determines whether the decrypting of the plurality of packets was a success or a failure for each of the plurality of packets, and

(iii) after n consecutive failures to decrypt the plurality of packets, transmits a decryption alert packet to the access point, where n is an integer greater than 1.

10. The apparatus of claim 9, wherein:

the processor

(i) increments an encryption failure counter when decryption of one of the plurality of packets fails and

(ii) decrements the encryption failure counter when decryption of one of the plurality of packets is successful; and

the transceiver transmits the decryption alert packet to the access point when a value of the encryption failure counter is equal to n.

11. A method comprising

receiving a first packet transmitted from an access point over a network via a transceiver to an apparatus;

determining a source media access control address of the first packet;

determining whether the source media access control address of the first packet corresponds to a source media access control address of the transceiver; and

in response to the source media access control address of the first packet corresponding to the source media access control address of the transceiver,

generating a second packet based on, wherein the second packet comprises an encrypted portion and an unencrypted portion, and wherein the unencrypted portion includes a field, and wherein a packet type of the field is different than a packet type expected to be received by the access point; and

alerting the access point of a security breach in the network by transmitting the second packet to the access point, wherein the access point is alerted of the security breach in the network based on the unencrypted portion and not based on the encrypted portion.

12. The method of claim 11, wherein the alerting of the access point of the security breach in the network comprises generating an error at the access point by transmitting the second packet to the access point.

13. The method of claim 11, wherein:

the second packet is an alert packet that alerts the access point of the security breach in the network;

the unencrypted portion includes an unencrypted alert indictor;

the unencrypted alert indicator is the field; and

the access point is alerted of the security breach in the network by presence of the unencrypted alert indicator in the alert packet regardless of which encryption key is used to generate the encrypted portion.

14. The method of claim 11, wherein:

the first packet is transmitted from a network device to the apparatus; and

the network device is an intruder and is attacking the network by at least one of

(i) transmitting unauthorized packets on the network,

(ii) receiving unauthorized access to packets transmitted on the network, or

(iii) obtaining unauthorized access to a key transmitted on the network.

15. The method of claim 11, further comprising generating the encrypted portion using a first key, wherein the first key is a predetermined key and is different than a second key currently used to encrypt non-alert packets.

16. The method of claim 15, wherein the first key is one of

a key provided by an authentication server to the transceiver prior to the second key having been provided to the transceiver;

and

an alert key provided to the transceiver for the purpose of encrypting alert packets.

17. The method of claim 15, wherein the predetermined key is an alert key designated for encrypting alert packets.

18. The method of claim 11, further comprising:

receiving a first key from the access point via the transceiver, wherein the first key is used for encrypting non-alert packets;

determining whether the first key is an unexpected key;

rejecting the first key when the first key is an unexpected key; and

transmitting an alert packet from the transceiver to the access point, wherein the alert packet indicates the apparatus has received an unexpected key from the access point.

19. The method of claim 18, wherein the first packet is transmitted from a network device to the apparatus prior to the first packet being transmitted from the access point to the apparatus, and wherein the method further comprises:

rejecting service to the network device based on use of a first key to encrypt the first packet by the network device and lack of use of a second key by the network device;

receiving the alert packet including an unencrypted alert indicator from the transceiver by the access point; and

generating an error signal at the access point based on the unencrypted alert indicator.

20. The method of claim 11, further comprising:

receiving a plurality of packets from the access point;

decrypting the plurality of packets;

determining whether the decrypting of the plurality of packets was a success or a failure for each of the plurality of packets; and

after n consecutive failures to decrypt the plurality of packets, transmitting a decryption alert packet to the access point, where n is an integer greater than 1.