Detection of falsified wireless access points

• US 8,750,267 B2
• Filed: 01/04/2010
• Issued: 06/10/2014
• Est. Priority Date: 01/05/2009
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Aggarwal, Alok, Hardie, Edward Thomas Lingham, Das, Saumitra Mohan, Gupta, Rajarshi, Naguib, Ayman Fawzy
• Primary Examiner(s): Duong, Frank
• Application Number:
  US12/651,785
• Publication Number:
  US 20100172259A1
• Time in Patent Office: 1,618 Days
• Field of Search: 370229-235, 370/252, 370328-339, 455/456.1, 709224-225, 726/2, 726/3, 726/21, 726/23, 726/27
• US Class Current: 370/338
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

Apparatuses and methods for detecting falsified wireless access points are presented. A method includes identifying a target wireless access point for validation and measuring a round trip time delay to the wireless access point. The method also includes determining an expected processing delay of the wireless access point, analyzing the measured round trip time delay and the expected processing delay, and validating the wireless access point based upon the analysis. An apparatus includes a wireless transceiver, a processing unit coupled to the wireless transceiver, and a memory coupled to the processing unit. The processing unit is configured to identify a target wireless access point for validation, measure a round trip time delay to the wireless access point, determine an expected processing delay of the wireless access point, analyze the measured round trip time delay and the expected processing delay, and validate the wireless access point based upon the analysis.

Claims

1. A method of detecting a falsified wireless access point over a wireless network, comprising:

identifying a wireless access point for validation;

measuring a round trip time delay to the wireless access point;

determining an expected processing delay of the wireless access point;

analyzing the measured round trip time delay using the expected processing delay to estimate a distance to the wireless access point; and

validating the wireless access point based upon the analysis.

2. The method according to claim 1, wherein the measuring the round trip time delay further comprises:

transmitting a packet from a mobile station to the wireless access point;

recording a first time when the transmitted packet was sent;

receiving a response packet from the wireless access point in response to the transmitted packet;

recording a second time when the response packet was received; and

computing a difference between the second recorded time and the first recorded time.

3. The method according to claim 2, wherein the transmitted packet utilizes a unicast packet whereby the mobile station does not associate with the wireless access point.

4. The method according to claim 1, wherein the mobile station and the wireless access point operate in accordance with IEEE 802.11 standards.

5. The method according to claim 1, wherein the identifying further comprises:

determining a media access controller identification (MAC ID) of the wireless access point.

6. The method according to claim 5, wherein the determining the expected processing delay further comprises:

retrieving the expected processing delay using the MAC ID of the wireless access point from memory within a mobile station, or from a server over a wireless network.

7. The method according to claim 1, wherein analyzing the measured round trip time delay using the expected processing delay further comprises:

determining a resulting time value by subtracting the expected processing delay from measured round trip time.

8. The method according to claim 7, wherein the validating further comprises:

comparing the resulting time value to expected operational ranges of the wireless access point.

9. The method according to claim 8, further comprising:

determining that the wireless access point is a falsified wireless access point when the resulting time value is a negative value, or if the resulting time value corresponds to a distance larger than the maximum range of the wireless access point.

10. The method according to claim 1, wherein analyzing the measured round trip time delay using the determined expected processing delay further comprises:

estimating a processing delay of the wireless access point; and

determining a difference between the estimated processing delay and the expected processing delay of the wireless access point.

11. The method according to claim 10, wherein the validating further comprises:

determining if a magnitude of the difference between the estimated processing delay and the expected processing delay exceeds a threshold.

12. The method according to claim 1, wherein the validating further comprises:

determining an independent estimate of distance to the wireless access point; and

determining whether the independent estimate of the distance is consistent with the estimated distance corresponding to the measured round trip time delay.

13. The method according to claim 12, wherein determining the independent estimate of the distance to the wireless access point may be based upon a signal strength (RSSI) model, beacons, and/or satellite position system (SPS) measurements.

14. The method according to claim 1, further comprising:

performing the method of claim 1 over a plurality of packet exchanges;

determining statistics based upon analysis of the plurality of packet exchanges; and

determining whether the wireless access point is falsified based upon the statistics.

15. The method according to claim 14, wherein the plurality of packet exchanges is taken from a fixed location and/or within a time interval such that location can be approximated as being fixed.

16. The method according to claim 14, wherein the determining statistics further comprises determining a mean, a variance, and/or a median value of measured round trip time delays to determine whether the wireless access point is falsified.

17. The method according to claim 1, wherein analyzing the measured round trip time delay using the expected processing delay to estimate a distance to the wireless access point comprises:

determining the distance to the wireless access point according to;

d_i=((RTT−

Δ

_i)/2)*(speed of signal)

where d_i is the distance to an i^th wireless access point from a mobile station, RTT is the measured round trip time delay between the mobile station and the i^th wireless access point, and Δ

_i is the expected processing delay associated with the i^th wireless access point.

18. The method according to claim 1, wherein determining the expected processing delay of the wireless access point comprises:

determining by a mobile station an estimated processing delay of the wireless access point during calibration by the mobile station.

19. An apparatus for detecting a falsified wireless access point over a wireless network, comprising:

a wireless transceiver;

a processing unit coupled to the wireless transceiver; and

a memory coupled to the processing unit, wherein the processing unit is configured to identify a wireless access point for validation,

measure a round trip time delay to the wireless access point,

determine an expected processing delay of the wireless access point,

analyze the measured round trip time delay using the expected processing delay to estimate a distance to the wireless access point, and

validate the wireless access point based upon the analysis.

20. The apparatus according to claim 19, wherein the processing unit is further configured to

transmit, from the wireless transceiver, a packet to the wireless access point,

record a first time when the transmitted packet was sent,

receive, from the wireless transceiver, a response packet from the wireless access point in response to the transmitted packet,

record a second time when the response packet was received, and

compute a difference between the second recorded time and the first recorded time.

21. The apparatus according to claim 20, wherein the transmitted packet utilizes a unicast packet whereby the apparatus does not associate with the wireless access point.

22. The apparatus according to claim 19, wherein the apparatus and the wireless access point operate in accordance with IEEE 802.11 standards.

23. The apparatus according to claim 19, wherein the processing unit is further configured to determine a media access controller identification (MAC ID) of the wireless access point.

24. The apparatus according to claim 23, wherein the processing unit is further configured to retrieve the expected processing delay using the MAC ID of the wireless access point from the memory, or from a server over a wireless network.

25. The apparatus according to claim 19, wherein the processing unit is further configured to determine a resulting time value by subtracting the expected processing delay from measured round trip time.

26. The apparatus according to claim 25, wherein the processing unit is further configured to compare the resulting time value to expected operational ranges of the wireless access point.

27. The apparatus according to claim 26, wherein the processing unit is further configured to

determine that the wireless access point is a falsified when the resulting time value is a negative value, or if the resulting time value corresponds to a distance larger than the maximum range of the wireless access point.

28. The apparatus according to claim 19, wherein the processing unit is further configured to

estimate a processing delay of the wireless access point, and

determine a difference between the estimated processing delay and the expected processing delay of the wireless access point.

29. The apparatus according to claim 28, wherein the processing unit is further configured to

determine if a magnitude of the difference between the estimated processing delay and the expected processing delay exceeds a threshold.

30. The apparatus according to claim 19, wherein the processing unit is further configured to

determine an independent estimate of distance to the wireless access point, and

determine whether the independent estimate of the distance is consistent with the estimated distance corresponding to the measured round trip time delay.

31. The apparatus according to claim 30, wherein the determining the independent estimate of the distance to the wireless access point may be based upon a signal strength (RSSI) model, beacons, and/or satellite position system (SPS) measurements.

32. The apparatus according to claim 19, wherein the processing unit is further configured to

operate over a plurality of packet exchanges,

determine statistics based upon analysis of the plurality of packet exchanges, and

determine whether the wireless access point is falsified based upon the statistics.

33. The apparatus according to claim 32, wherein the plurality of packet exchanges is taken from a fixed location and/or within a time interval such that location can be approximated as being fixed.

34. The apparatus according to claim 32, wherein the processing unit is further configured to

determine a mean, a variance, and/or a median value of measured round trip time delays to determine whether the wireless access point is falsified.

35. An apparatus for detecting a falsified wireless access point over a wireless network, comprising:

means for identifying a wireless access point for validation;

means for measuring a round trip time delay to the wireless access point;

means for determining an expected processing delay of the wireless access point;

means for analyzing the measured round trip time delay using the expected processing delay to estimate a distance to the wireless access point; and

means for validating the wireless access point based upon the analysis.

36. The apparatus according to claim 35, wherein the means for measuring the round trip time delay further comprises:

means for transmitting a packet from the apparatus to the wireless access point;

means for recording a first time when the transmitted packet was sent;

means for receiving a response packet from the wireless access point in response to the transmitted packet;

means for recording a second time when the response packet was received; and

means for computing a difference between the second recorded time and the first recorded time.

37. The apparatus according to claim 36, wherein the transmitted packet utilizes a unicast packet whereby the apparatus does not associate with the wireless access point.

38. The apparatus according to claim 35, wherein the apparatus and the wireless access point operate in accordance with IEEE 802.11 standards.

39. The apparatus according to claim 35, wherein the means for identifying further comprises:

means for determining a media access controller identification (MAC ID) of the wireless access point.

40. The apparatus according to claim 39, wherein the means for determining the expected processing delay further comprises:

means for retrieving the expected processing delay using the MAC ID of the wireless access point from memory within the apparatus, or from a server over a wireless network.

41. The apparatus according to claim 35, wherein the means for analyzing the measured round trip time delay using the expected processing delay further comprises:

means for determining a resulting time value by subtracting the expected processing delay from measured round trip time.

42. The apparatus according to claim 41, wherein the means for validating further comprises:

means for comparing the resulting time value to expected operational ranges of the wireless access point.

43. The apparatus according to claim 42, further comprising:

means for determining that the wireless access point is a falsified when the resulting time value is a negative value, or if the resulting time value corresponds to a distance larger than the maximum range of the wireless access point.

44. The apparatus according to claim 35, wherein the means for analyzing the measured round trip time delay using the determined expected processing delay further comprises:

means for estimating a processing delay of the wireless access point; and

means for determining a difference between the estimated processing delay and the expected processing delay of the wireless access point.

45. The apparatus according to claim 44, wherein the means for validating further comprises:

means for determining if a magnitude of the difference between the estimated processing delay and the expected processing delay exceeds a threshold.

46. The apparatus according to claim 35, wherein the means for validating further comprise:

means for determining an independent estimate of distance to the wireless access point; and

means for determining whether the independent estimate of the distance is consistent with the estimated distance corresponding to the measured round trip time delay.

47. The apparatus according to claim 46, wherein determining the independent estimate of the distance to the wireless access point may be based upon a signal strength (RSSI) model, beacons, and/or satellite position system (SPS) measurements.

48. The apparatus according to claim 35, further comprising:

means for operating over a plurality of packet exchanges;

means for determining statistics based upon analysis of the plurality of packet exchanges; and

means for determining whether the wireless access point is falsified based upon the statistics.

49. The apparatus according to claim 48, wherein the plurality of packet exchanges is taken from a fixed location and/or within a time interval such that location can be approximated as being fixed.

50. The apparatus according to claim 46, further comprising:

means for determining a mean, a variance, and/or a median value of measured round trip time delays to determine whether the wireless access point is falsified.

51. A machine-readable non-transitory medium comprising instructions, which, when executed by a machine, cause the machine to perform operations, the instructions comprising:

instructions to identify a wireless access point for validation;

instructions to measure a round trip time delay to the wireless access point;

instructions to determine an expected processing delay of the wireless access point;

instructions to analyze the measured round trip time delay using the expected processing delay to estimate a distance to the wireless access point; and

instructions to validate the wireless access point based upon the analysis.

52. The machine-readable medium according to claim 51, wherein the instructions to measure the round trip time delay further comprises:

instructions to transmit a packet to the wireless access point;

instructions to record a first time when the transmitted packet was sent;

instructions to receive a response packet from the wireless access point in response to the transmitted packet;

instructions to record a second time when the response packet was received; and

instructions to compute a difference between the second recorded time and the first recorded time.