Method and system for locating a wireless access device in a wireless network

• US 9,042,914 B2
• Filed: 12/02/2010
• Issued: 05/26/2015
• Est. Priority Date: 04/03/2003
• Status: Expired due to Fees

• Current Assignee: Ozmo Licensing LLC
• Original Assignee: Tekla PEHR LLC (Intellectual Ventures LLC)
• Inventors: Harvey, Elaine, Walnock, Matthew
• Primary Examiner(s): Cumming, William D
• Application Number:
  US12/959,167
• Publication Number:
  US 20120309427A1
• Time in Patent Office: 1,636 Days
• Field of Search: 455/456.3, 455/421, 455/456.5, 455/41.2, 455/414.1, 455/414.2, 455/423, 455/440, 455/456.1, 455/509, 370/280, 370/252, 370/331, 370/336, 370/347, 379/433.04, 342/8.1, 342/10.5, 702/187, 702/150, 340/8.1, 340/10.5, 340/539.11, 340/539.32
• US Class Current: 455/456.3
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A wireless access device in a wireless network, whether a known or unknown entity, can be located using a geolocation system according to the present invention. A signal strength is determined by a wireless intrusion detection system (WIDS) node in a wireless network for each wireless access device that it detects. Based on the signal strength, an approximate distance from the node is determined, which, in one embodiment corresponds to a radius of a circle around the node. To account for error, an approximation band of the circle is calculated that will allow a user to determine the approximate location of the device within the wireless network.

Claims

1. A computer-implemented method, the method comprising:

detecting a wireless access device using a plurality of nodes at known locations;

detecting, with a particular node of the plurality of nodes, a communications channel on which the wireless access device is operating by;

observing a plurality of communications channels; and

selecting the communications channel corresponding to a largest average received signal strength;

determining, with the particular node, a signal strength of the wireless access device with respect to the particular node;

determining, with the particular node, a distance to the wireless access device from the particular node based on the signal strength;

estimating an area using the distance, with the particular node, to determine possible locations of the wireless access device relative to the particular node; and

sending the area to a collector device for determination of a location of the wireless access device using information from at least two of the plurality of nodes.

2. The method of claim 1, wherein detecting the communications channel further comprises detecting a 802.11 communications channel on which the wireless access device is operating among a plurality of 802.11 communications channels.

3. The method of claim 1, wherein detecting the communications channel comprises:

observing a wireless network channel in a wireless network for a predetermined amount of time;

determining signal strengths of individual ones of a plurality of transmissions received on the wireless network channel;

calculating an average signal strength value per wireless network channel, corresponding to the wireless access device; and

detecting the communications channel in use by the wireless access device based on the average signal strength value.

4. The method of claim 1, where the estimating further comprises estimating a band around the particular nodes, within which the wireless access device could be located, based on the distance from the particular nodes.

11. The method of claim 1, further comprising:

receiving information from the plurality of nodes including areas corresponding to possible locations of the wireless access device relative to the plurality of nodes respectively; and

determining an actual location of the wireless access device based on one or more intersections between the areas.

5. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution by a computing device, cause the computing device to perform operations, the operations comprising:

detecting a wireless access device using a plurality of nodes at known locations;

determining a signal strength of the wireless access device with respect to individual ones of the plurality of nodes;

determining a distance to the wireless access device from the individual ones of the plurality of nodes based on the signal strength to determine possible locations of the wireless access device; and

estimating an area for the individual ones of the plurality of nodes corresponding to the possible locations of the wireless access device by detecting a band around the individual ones of the plurality of nodes within which the wireless access device could be located based on the determined distance from the individual ones of the plurality of nodes.

17. The non-transitory computer-readable medium of claim 5, wherein the operations further comprise:

receiving information from the plurality of nodes including areas corresponding to possible locations of the wireless access device relative to the plurality of nodes respectively; and

determining an actual location of the wireless access device based on one or more intersections between the areas.

6. A non-transitory computer-readable medium having instructions stored thereon that, in response to execution by a computing device, cause the computing device to perform operations, the operations comprising:

detecting a wireless access device using a plurality of nodes at known locations;

detecting, with a particular node of the plurality of nodes, a communications channel on which the wireless access device is operating by;

observing a plurality of communications channels; and

selecting the communications channel corresponding to a largest average received signal strength;

determining, with the particular node, a signal strength of the wireless access device with respect to the particular node;

determining, with the particular node, a distance to the wireless access device from the particular node based on the signal strength;

estimating an area using the distance, with the particular node, to determine possible locations of the wireless access device relative to the particular node; and

sending the area to a collector device for determination of a location of the wireless access device using information from at least two of the plurality of nodes.

7. The non-transitory computer-readable medium of claim 6, wherein detecting the communications channel further comprises detecting a 802.11 communications channel on which the wireless access device is operating among a plurality of 802.11 communications channels.

8. The non-transitory computer-readable medium of claim 6, wherein detecting the communications channel comprises:

observing a wireless network channel in a wireless network for a predetermined amount of time;

determining received signal strengths of individual ones of a plurality of transmissions received on the wireless network channel;

calculating an average received signal strength value per wireless network channel corresponding to the wireless access device; and

detecting the communications channel in use by the wireless access device based on the average received signal strength value.

9. The non-transitory computer-readable medium of claim 6, wherein the estimating the area further comprises estimating a band around the particular node within which the wireless access device could be located based on the distance from the particular node.

10. The non-transitory computer-readable medium of claim 6, wherein the operations further comprise:

receiving information from the plurality of nodes corresponding to possible locations of the wireless access device relative to the plurality of nodes respectively; and

determining an actual location of the wireless access device based on one or more intersections between the areas.

12. An apparatus comprising:

a collector device; and

a plurality of nodes at known locations in communication with the collector device;

wherein individual ones of the plurality of nodes are configured to, from a point of view of a particular node of the individual ones of the plurality of nodes;

detect an existence of a wireless access device;

detect a communications channel on which the wireless access device is operating by;

observing a plurality of communications channels; and

selecting the communications channel corresponding to a largest average received signal strength;

determine a signal strength of the wireless access device with respect to the particular node; and

determine a distance to the wireless access device from the particular node based on the signal strength, and

estimate an area using the distance corresponding to the possible locations of the wireless access device relative to the particular node; and

send the area to the collector device for determination of a location of the wireless access device using information from at least two of the individual ones of the plurality of nodes.

13. The apparatus of claim 12, wherein the particular node configured to detect the communications channel comprises the particular node configured to detect a 802.11 communications channel on which the wireless access device is operating among a plurality of 802.11 communications channels.

14. The apparatus of claim 12, wherein the particular node configured to detect the communications channel comprises the particular node configured to:

observe a wireless network channel in a wireless network for a predetermined amount of time;

determine received signal strengths of each of a plurality of transmissions received on the wireless network channel;

calculate an average received signal strength value per wireless network channel, corresponding to the wireless access device; and

detect the communications channel in use by the wireless access device based on the average received signal strength value.

15. The apparatus of claim 12, wherein the particular node configured to estimate the area comprises the particular node configured to estimate a band around the particular node within which the wireless access device could be located based on the distance from the particular node.

16. The apparatus of claim 15, wherein the particular node is further configured to detect the band based on a margin of error.

18. The apparatus of claim 12 wherein the collector device is configured to determine an actual location of the wireless access device based on one or more intersections between areas received from at least two of the plurality of nodes.

19. An apparatus comprising:

a collector device; and

a plurality of nodes at known locations in communication with the collector device;

wherein the plurality of nodes are configured to detect an existence of a wireless access device and determine a signal strength of the wireless access device with respect to individual ones of the plurality of nodes; and

wherein the collector device is configured to;

determine a distance to the wireless access device from individual ones of the plurality of nodes based on the signal strength to determine possible locations of the wireless access device, and

estimate an area for the individual ones of the plurality of nodes corresponding to the possible locations of the wireless access device by detecting a band around each of the plurality of nodes within which the wireless access device could be located based on the determined distance from each of the plurality of nodes.

20. The apparatus of claim 19 wherein the collector is further configured to determine an actual location of the wireless access device based on one or more intersections between the areas.