System and method for detecting unauthorized wireless access points

• US 8,787,576 B2
• Filed: 06/20/2011
• Issued: 07/22/2014
• Est. Priority Date: 06/28/2002
• Status: Expired due to Term

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Crimson Corporation
• Inventors: Whelan, Robert, Van Wagenen, Lamar, Morris, Roy
• Primary Examiner(s): Gee, Jason
• Application Number:
  US13/164,459
• Publication Number:
  US 20110314147A1
• Time in Patent Office: 1,128 Days
• Field of Search: 380/270, 382/70
• US Class Current: 380/270
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Unauthorized wireless access points are detected by configuring authorized access points and mobile units to listen to all wireless traffic in its cell and report all detected wireless devices to a monitor. The monitor checks the reported devices against a list of authorized network devices. If the reported wireless device is not an authorized device, the monitor determines if the reported device is connected to the network. If the reported device is connected to the network and is not an authorized device, the monitor alerts the network operator or network manager of a rogue device connected to the network and attempts to locate and isolate the rogue device.

Claims

1. A system for detecting an access point, comprising:

a network segment for which no access point is authorized; and

a network monitor that (a) receives mobile unit identification information from a wireless receiver and (b) receives network traffic from the network segment, wherein the network monitor detectors an unauthorized access point by comparing the network traffic from the network segment with the mobile unit identification information, wherein when the network traffic from the network segment includes the mobile unit identification information it is determined that an unauthorized access point is on the network segment because no access point is authorized on the network segment, wherein the wireless receiver receives the mobile unit identification information from a mobile wireless device.

2. The system of claim 1, wherein when the unauthorized access point is detected, the network monitor isolates network communication with the unauthorized access point.

3. The system of claim 1, wherein when the unauthorized access point is detected, the unauthorized access point is reported to a network operator.

4. The system of claim 1, wherein the mobile unit identification information comprises a media access control (MAC) address of the mobile wireless device.

5. The system of claim 1, wherein the wireless receiver is located on the network segment, and wherein the wireless receiver is configured to receive wireless network traffic but not to transmit wireless network traffic.

6. The system of claim 1, wherein the wireless receiver is not located on the network segment, but is located elsewhere on the network.

7. The system of claim 1, wherein the wireless receiver is configured to receive wireless network traffic, and wherein the wireless receiver is unable to transmit wireless network traffic.

8. A method for detecting an access point, comprising:

receiving mobile unit identification information from a wireless receiver; and

monitoring network traffic on a network segment for which no access point is authorized, wherein an unauthorized access point is detected by comparing the network traffic from the network segment with the mobile unit identification information, wherein when the network traffic from the network segment includes the mobile unit identification information it is determined that an unauthorized access point is on the network segment because no access point is authorized on the network segment, wherein the wireless receiver receives the mobile unit identification information from a mobile wireless device.

9. The method of claim 8, wherein when the unauthorized access point is detected, network communication with the unauthorized access point is isolated.

10. The method of claim 8, wherein when the unauthorized access point is detected, the unauthorized access point is reported to a network operator.

11. The method of claim 8, wherein the mobile unit identification information comprises a media access control (MAC) address of the mobile wireless device.

12. The method of claim 8, wherein the wireless receiver is located on the network segment, and wherein the wireless receiver is configured to receive wireless network traffic but not to transmit wireless network traffic.

13. The method of claim 8, wherein the wireless receiver is not located on the network segment, but is located elsewhere on the network.

14. The method of claim 8, wherein the wireless receiver is configured to receive wireless network traffic, and wherein the wireless receiver is unable to transmit wireless network traffic.