Method and system for actively defending a wireless LAN against attacks

• US 20030233567A1
• Filed: 06/03/2002
• Published: 12/18/2003
• Est. Priority Date: 05/20/2002
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott, Lynn, Michael T.
• Granted Patent: US 7,058,796 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04K 2203/18 for wireless local area networks or WLAN
• CPC Class Codes: H04K 2203/22 for communication related to vehicles
• CPC Class Codes: H04K 3/224 with countermeasures at transmission and/or reception of the jammed signal, e.g. stopping operation of transmitter or receiver, nulling or enhancing transmitted power in direction of or at frequency of jammer
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/825 by jamming
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A wireless network security system including a system data store capable of storing network default and configuration data, a wireless transmitter and a system processor. The system processor performs a network security method. An active defense request signal is received, typically from an intrusion detection system. The received request signal includes an indicator of an access point within the wireless computer network that is potentially compromised. In response to the received an active defense of the wireless network is triggered. The triggered active defense may be on or more of transmitting a jamming signal, transmitting a signal to introduce CRC errors, transmitting a signal to increase the difficulty associated with breaking the network encryption (typically by including in the signal packet appearing legitimate but containing randomized payloads, or transmitting a channel change request to the potentially compromised access point.

Claims

1. A network security system, the system comprising:

a) a system data store capable of storing network default and configuration data;

b) a wireless transmitter capable of transmitting communications over a wireless computer network;

c) a system processor comprising one or more processing elements, wherein the system processor is in communication with the system data store and the wireless transmitter and wherein the system processor is programmed or adapted to perform the steps comprising of;

i) receiving an active defense request signal, wherein the request signal comprises an indicator corresponding to a potentially compromised access point in the wireless computer network; and

ii) responsive to the received request signal, triggering one or more of the following defensive actions;

1) transmitting a signal via the wireless transmitter to jam communications targeted at the potentially compromised access point;

2) transmitting a signal via the wireless transmitter to corrupt communications targeted at the potentially compromised access point by introducing CRC errors;

3) transmitting a signal via the wireless transmitter to increase difficulty associated with breaking of encryption associated with the wireless computer network and the potentially compromised access point, wherein the signal includes packets emulating legitimate traffic but with randomized payloads;

or

4) transmitting a channel change request communication via the wireless transmitter to the potentially compromised access point.

2. The system of claim 1, wherein the system processor is further programmed or adapted to perform the steps comprising of receiving configuration information and storing the received configuration information in the system data store.

3. The system of claim 2, wherein the configuration information is received by the system processor from a configuration file, from an interactive data entry interface or from a command line.

4. The system of claim 2, wherein the received configuration information comprises network default data.

5. The system of claim 2, further comprising a wireless receiver capable of receiving communications transmitted over the wireless computer network and wherein the system processor is programmed or adapted to monitor the wireless computer network using the wireless receiver as part of its programming or adaptation to receive configuration information.

6. The system of claim 1, wherein the system processor is further programmed or adapted to perform the step comprising of notifying an administrator of the received request signal.

7. The system of claim 1, wherein the system processor is further programmed or adapted to perform the step comprising of mapping station identity.

8. The system of claim 1, wherein the system processor is further programmed or adapted to perform the step comprising of mapping station location.

9. The system of claim 1, further comprising a mounting card comprising a standard computer interface allowing communication between components mounted thereon and a computer system and wherein at least one of the processing elements of the system data store and the wireless transmitter are mounted on mounting card.

10. The system of claim 9, wherein the standard computer interface is an ISA bus connection, an EISA bus connection, a PCMCIA connection, a USB connection, a SCSI connection, a serial port connection or a parallel port connection.

11. The system of claim 1, further comprising a wireless receiver capable of receiving communications transmitted over the wireless computer network.

12. The system of claim 11, wherein the one or more triggered defensive actions comprises transmitting a channel change request communication and wherein the system processor is further programmed or adapted to perform the steps comprising of assuming characteristics associated with the potentially compromised access point and emulating the potentially compromised access point in communicating with a potential intruder.

13. The system of claim 12, wherein the system processor is further programmed or adapted to perform the steps comprising of identifying a node associated with the potential intruder and locating the identified node.

14. The system of claim 11, wherein the system processor is further programmed or adapted to perform the step comprising of monitoring the wireless computer network using the wireless receiver.

15. The system of claim 14, wherein the system processor is further programmed or adapted to perform the step comprising of communicating information derived from monitoring the wireless computer network to an intrusion detections system.

16. The system of claim 15, further comprising a wired communication interface via which the system processor communicates with the intrusion detection system.

17. The system of claim 15, further comprising the intrusion detection system and wherein the system processor is programmed or adapted to receive the active defense request signal from the intrusion detection system.

18. The system of claim 1, wherein the system processor is further programmed or adapted to perform the step of selecting one or more defensive actions to be triggered.

19. The system of claim 18, wherein the received active defense request signal further comprises a security indicator indicating a type of risk to the wireless computer network and wherein the system processor is further programmed or adapted to perform the step of selecting one or more defensive actions based upon the security indicator in the received active defense request signal.

20. The system of claim 18, wherein the received active defense request signal further comprises a defense indicator corresponding to one or more defensive actions to be triggered and wherein the system processor is further programmed or adapted to perform the step of selecting one or more defensive actions based upon the defense indicator in the received active defense request signal.

21. A network security method, the method comprising the steps of:

a) receiving configuration information comprising network configuration and default data from a configuration file, an interactive data entry interface or a command line interface or from monitoring a wireless computer network;

b) receiving an active defense request signal from an intrusion detection system, wherein the received request signal comprises an access point indicator corresponding to a potentially compromised access point in the wireless computer network and a risk indicator;

c) responsive to the received request signal, selecting one or more defensive actions based upon the received request signal from the group consisting of;

i) transmitting a signal to jam communications targeted at the potentially compromised access point;

ii) transmitting a signal to corrupt communications targeted at the potentially compromised access point by introducing CRC errors;

iii) transmitting a signal to increase difficulty associated with breaking of encryption associated with the wireless computer network and the potentially compromised access point, wherein the signal comprises packets emulating legitimate traffic but with randomized payloads; and

iv) transmitting a channel change request communication to the potentially compromised access point; and

d) triggering the selected one or more defensive actions; and

e) identifying a node or location associated with a potential intruder interacting with the potentially compromised access point.

22. Computer readable storage media storing instructions that upon execution by a system processor cause the system processor to perform the method of claim 21.

23. A network security system, the system comprising:

a) storing means for receiving and storing configuration information comprising network configuration and default data;

b) wireless receiving means for receiving communications transmitted over the wireless communication network;

c) wireless transmitting means for transmitting communications over the wireless communication network;

d) defense request receiving means for receiving an active defense request signal from an intrusion detection system, wherein the received request signal comprises an access point indicator corresponding to a potentially compromised access point in the wireless computer network and a risk indicator;

e) active defense means for selecting one or more defensive actions based upon a received request signal received by the defense request receiving means from the group consisting of;

i) transmitting a signal via the wireless transmitting means intended to jam communications targeted at the potentially compromised access point;

ii) transmitting a signal via the wireless transmitting means to corrupt communications targeted at the potentially compromised access point by introducing CRC errors;

iii) transmitting a signal via the wireless transmitting means to increase difficulty associated with breaking of encryption associated with the wireless computer network and the potentially compromised access point, wherein the signal includes packets emulating legitimate traffic but with randomized payloads; and

iv) transmitting a channel change request communication to the potentially compromised access point via the wireless transmitting means; and

for triggering the selected one or more defensive actions; and

f) mapping means for identifying a node or location associated with a potential intruder interacting with the potentially compromised access point.