Rogue wireless beacon device detection

• US 9,258,713 B2
• Filed: 05/15/2014
• Issued: 02/09/2016
• Est. Priority Date: 05/15/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Rangarajan, Raghuram, Hart, Brian D., Hajela, Sujai, Pandey, Santosh, Kloper, David, Corsetto, Greg, Huotari, Allen J.
• Primary Examiner(s): To, Baotran N
• Application Number:
  US14/278,555
• Publication Number:
  US 20150334569A1
• Time in Patent Office: 635 Days
• Field of Search: 726/22, 726/4
• US Class Current: 1/1
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 64/003 locating network equipment

Abstract

Techniques are presented for detecting rogue wireless beacon devices. Wireless transmissions from beacon devices are received at a plurality of receiver devices. The wireless transmissions of the beacon devices comprise packets that carry information used for location-based services for mobile wireless devices. Content of one or more fields of the packets transmitted by the beacon devices and received by one or more of the receiver devices is obtained. The content of one or more fields of the packets is analyzed to detect an unauthorized beacon device. The analyzing operation may involve comparing the content of the one or more fields of the packets against a list that contains one or more identifiers for authorized beacon devices. In another form, analyzing may involve analyzing the content of the one or more fields of the packets with pattern information related to advertising content or advertising source.

Claims

1. A method comprising:

at a plurality of receiver devices, receiving wireless transmissions from beacon devices which are transmit-only capable, wherein the wireless transmissions of the beacon devices comprise packets that carry information used for location-based services to mobile wireless devices, wherein the plurality of receiver devices is a plurality of wireless local area network access points capable of receiving and sending transmissions in a wireless local area network frequency band and the beacon devices are configured to transmit in a subset of the wireless local area network frequency band in accordance with a protocol that is different from a protocol used for wireless local area network transmissions;

obtaining content of one or more fields of packets transmitted by one of the beacon devices and directly received by at least two of the plurality of receiver devices; and

analyzing the content of one or more fields of the packets to detect an unauthorized beacon device.

2. The method of claim 1, wherein analyzing comprises analyzing the content of the one or more fields of the packets with pattern information related to advertising content or advertising source.

3. The method of claim 1, wherein receiving comprises receiving the wireless transmissions from the beacon devices at the plurality of wireless local area network access points capable of receiving transmissions and sending transmissions in a frequency band in which the beacon devices transmit.

4. The method of claim 1, wherein receiving comprises receiving wireless transmissions from beacon devices configured to transmit in accordance with a wireless personal area network communication protocol.

5. The method of claim 4, wherein receiving comprises receiving wireless transmissions that are transmitted in accordance with the Bluetooth Low Energy communication protocol.

6. The method of claim 1, further comprising:

generating measurement data from the received transmissions, the measurement data for use in determining locations of the beacon devices;

computing a location of an unauthorized beacon device from the measurement data obtained by the plurality of monitor devices.

7. The method of claim 6, wherein analyzing further comprises comparing a location of a beacon device with respect to information describing a predetermined perimeter or region for purposes of determining whether a beacon device is an unauthorized beacon device.

8. The method of claim 1, further comprising generating a notification message to be sent to a network administrator person or entity, the notification message including information indicating that an unauthorized beacon device has been detected.

9. The method of claim 1, wherein obtaining comprises obtaining one or more identifiers contained in one or more fields of packets received from beacon devices.

10. The method of claim 9, wherein analyzing comprises comparing the one or more identifiers against a list that contains one or more identifiers for authorized beacon devices.

11. The method of claim 1, wherein analyzing is performed at a server.

12. The method of claim 1, wherein:

receiving comprises receiving transmissions from beacon devices at a mobile wireless device;

obtaining comprises obtaining content of one or more fields of packets received at the mobile wireless device; and

analyzing is based further on the content of one or more fields of packets obtained by the mobile wireless device.

13. An apparatus comprising:

a network interface unit configured to enable communications over a network;

a memory; and

a processor coupled to the memory and the network interface unit, wherein the processor is configured to;

obtain content of one or more fields of packets transmitted by one of a plurality of beacon devices and directly received by at least two of a plurality of receiver devices, wherein the packets transmitted by the beacon devices carry information used for location-based services to mobile wireless devices, and wherein the plurality of receiver devices is a plurality of wireless local area network access points capable of receiving and sending transmissions in a wireless local area network frequency band and in the beacon devices are configured to transmit in a subset of the wireless local area network frequency band in accordance with a protocol that is different from a protocol used for wireless local area network transmissions; and

analyze the content of one or more fields of the packets to detect an unauthorized beacon device.

14. The apparatus of claim 13, wherein the processor is configured to analyze by analyzing the content of the one or more fields of the packets with pattern information related to advertising content or advertising source.

15. The apparatus of claim 13, wherein the processor is configured to analyze by comparing a location of a beacon device with respect to information describing a predetermined perimeter or region for purposes of determining whether a beacon device is an unauthorized beacon device.

16. The apparatus of claim 13, wherein the processor is configured to analyze by comparing one or more identifiers contained in one or more fields of packets received from beacon devices against a list that contains one or more identifiers for authorized beacon devices.

17. The apparatus of claim 13, wherein the processor is configured to generate a notification message to be sent to a network administrator person or entity, the notification message including information indicating that an unauthorized beacon device has been detected.

18. A system comprising:

a plurality of receiver devices, each configured to;

receive wireless transmissions from beacon devices which are transmit-only capable, wherein the wireless transmissions of the beacon devices comprise packets that carry information used for location-based services to mobile wireless devices, and wherein the plurality of receiver devices is a plurality of wireless local area network access points capable of receiving and sending transmissions in a wireless local area network frequency band and the beacon devices are configured to transmit in a subset of the wireless local area network frequency band in accordance with a protocol that is different from a protocol used for wireless local area network transmissions;

obtain content of one or more fields of packets transmitted by one of the beacon devices and directly received by at least two of the plurality of receiver devices; and

a server configured to be in communication with the plurality of receiver devices, wherein the server is configure to analyze the content of one or more fields of the packets to detect an unauthorized beacon device.

19. The system of claim 18, wherein the plurality of receiver devices are configured to receive packets from beacon devices that are formatted in accordance with the Bluetooth Low Energy communication protocol.

20. The system of claim 18, wherein the server is configured to analyze the content of the one or more fields of the packets with pattern information related to advertising content or advertising source.

21. The system of claim 18, wherein the server is configured to analyze by comparing a location of a beacon device with respect to information describing a predetermined perimeter or region for purposes of determining whether a beacon device is an unauthorized beacon device.

22. The system of claim 18, wherein the server is configured to analyze by comparing one or more identifiers contained in one or more fields of packets received from beacon devices against a list that contains one or more identifiers for authorized beacon devices.

23. The system of claim 18, wherein the server is configured to generate a notification message to be sent to a network administrator person or entity, the notification message including information indicating that an unauthorized beacon device has been detected.