Wireless communication selective barrier

• US 8,893,252 B1
• Filed: 04/16/2009
• Issued: 11/18/2014
• Est. Priority Date: 04/16/2008
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Meru Networks, Inc. (Fortinet Inc.)
• Inventors: Bharghavan, Vaduvur, Rajanarayanan, Vijaykarthik
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US12/425,098
• Time in Patent Office: 2,042 Days
• Field of Search: 726/11, 726/13, 713/154, 380/258
• US Class Current: 726/11
• CPC Class Codes: H04K 2203/16 for telephony
• CPC Class Codes: H04K 2203/18 for wireless local area networks or WLAN
• CPC Class Codes: H04K 2203/34 involving multiple cooperating jammers
• CPC Class Codes: H04K 3/28 with jamming and anti-jamming mechanisms both included in a same device or system, e.g. wherein anti-jamming includes prevention of undesired self-jamming resulting from jamming
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/825 by jamming
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A selective barrier prevents undesired communication between a protected region and an unprotected region. Wireless communication is allowed within the protected region, while wireless communication is prevented between the protected region and any unprotected regions. Particular undesired message packets might be selected by business rules responsive to aspects of individual messages. Particular unprotected regions might be statically or dynamically determined. Alternatively, the selective barrier similarly operates to block undesired message packets from originating in any of the unprotected regions and successfully being received in the protected region.

Claims

1. A computer-implemented method for blocking selected messages in a wireless network based on crossing a boundary, comprising:

connecting to the wireless network which protects a first region defined by at least one boundary point and distinct from a second region defined by at least one boundary point;

determining physical locations for stations within the first and second regions;

intercepting a message from a first region with a first antenna pointing inward from a boundary, the message comprising a first portion and a second portion;

recognizing from the first portion of the message that the message is unauthorized communication with a device in an unprotected region, the message being sourced from a station physically located within the first and second regions;

disrupting reception of the message using a second antenna pointing outward from the boundary;

subsequently determining physical locations for stations within the first and second regions; and

based on the subsequent determination, dynamically changing the boundary.

2. The method of claim 1, wherein disrupting reception comprises:

disrupting reception of the second portion of the message using the second antenna pointing outward from the boundary by transmitting random noise.

3. The method of claim 1, wherein disrupting reception comprises:

disrupting reception of the second portion of the message using the second antenna pointing outward from the boundary by transmitting an IEEE 802.11-management frame.

4. The method of claim 1, wherein disrupting reception comprises:

disrupting reception of the second portion of the message using the second antenna pointing outward from the boundary by distorting a checksum value associated with the message.

5. The method of claim 1, further comprising:

defining the boundary collectively with a plurality of blocking devices, each blocking device comprising a first antenna pointing inward from the boundary and a second antenna pointing outward from the boundary, and each blocking device covering a portion of the boundary.

6. The method of claim 5, further comprising:

dynamically changing the boundary,

wherein at least one of the plurality of blocking devices comprise a mobile wireless device that dynamically change at least a portion of the boundary.

7. The method of claim 1, wherein recognizing that the message is unauthorized, comprises:

recognizing that the message is formatted according to a protocol that is unauthorized.

8. At least one non-transitory computer readable medium comprising a computer program product that, when executed by one or more processors, performs a method, the method comprising:

connecting to the wireless network which protects a first region defined by at least one boundary point and distinct from a second region defined by at least one boundary point;

determining physical locations for stations within the first and second regions;

intercepting a message from a first region with a first antenna pointing inward from a boundary, the message comprising a first portion and a second portion;

recognizing from the first portion of the message that the message is unauthorized communication with a device in an unprotected region, the message being sourced from a station physically located within the first and second regions;

subsequently determining physical locations for stations within the first and second regions; and

based on the subsequent determination, dynamically changing the boundary.

9. The computer program product of claim 8, wherein disrupting reception comprises:

disrupting reception of the second portion of the message using the second antenna pointing outward from the boundary by transmitting random noise.

10. The computer program product of claim 8, wherein disrupting reception comprises:

disrupting reception of the second portion of the message using the second antenna pointing outward from the boundary by transmitting an IEEE 802.11 management frame.

11. The computer program product of claim 8 wherein disrupting reception comprises:

disrupting reception of the second portion of the message using the second antenna pointing outward from the boundary by distorting a checksum value associated with the message.

12. The computer program product of claim 8, further comprising:

defining the boundary collectively with a plurality of blocking devices, each blocking device comprising a first antenna pointing inward from the boundary and a second antenna pointing outward from the boundary, and each blocking device covering a portion of the boundary.

13. The computer program product of claim 12, further comprising:

dynamically changing the boundary,

wherein at least one of the plurality of blocking devices comprise a mobile wireless devices that dynamically change at least a portion of the boundary.

14. The computer program product of claim 8, wherein recognizing that the message is unauthorized, comprises:

recognizing that the message is formatted according to a protocol that is unauthorized.