Method and apparatus for wireless network security

• US 20070025265A1
• Filed: 07/24/2006
• Published: 02/01/2007
• Est. Priority Date: 07/22/2005
• Status: Active Grant

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Corr, Michael, Manseau, David, Watt, David, Dawson, Steven, Porras, Phillip, Marcotullio, John
• Granted Patent: US 7,724,717 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: G06K 7/0008 General problems related to the reading of electronic memory record carriers, independent of its reading method, e.g. power transfer
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/79 Radio fingerprint

Abstract

In one embodiment, the present invention is a method and apparatus for wireless network security. In one embodiment, a method for securing a wireless computing network includes receiving a communication from an unidentified transmitter, identifying the transmitter in accordance with a fingerprint generated from one or more radio frequency signal characteristics extracted from the communication, and taking action in response to an identity of the transmitter.

Claims

1. A method for securing a wireless computing network, the method comprising:

receiving a communication from an unidentified transmitter;

identifying the transmitter in accordance with a fingerprint generated from one or more radio frequency signal characteristics extracted from the communication; and

making one or more access control decisions in response to an identity of the transmitter.

2. The method of claim 1, wherein the one or more radio frequency signal characteristics are extracted from a physical layer frame of the communication.

3. The method of claim 1, wherein the identifying comprises:

comparing the generated fingerprint to one or more stored fingerprints representing known transmitters.

4. The method of claim 3, wherein the comparing comprises:

generating for each comparison a similarity score indicative of a degree of similarity between the generated fingerprint and a respective one of the one or more stored fingerprints.

5. The method of claim 3, wherein the comparing comprises:

converting the generated fingerprint to a generated fingerprint model, the generated fingerprint model comprising one or more categorical measurements for radio frequency signal characteristics corresponding to the generated fingerprint; and

comparing the generated fingerprint model to a stored fingerprint model of a stored fingerprint, the stored fingerprint model comprising one or more categorical measurements for radio frequency signal characteristics corresponding to the stored fingerprint.

6. The method of claim 5, wherein the stored fingerprint model further comprises:

a tolerance associated with each of the one or more categorical measurements, each tolerance specifying a degree of similarity that an associated categorical measurement must meet with regard to a corresponding categorical measurement of the generated fingerprint model in order to be considered a match.

7. The method of claim 1, wherein the making one or more access control decisions comprises:

registering the transmitter such that the transmitter is allowed to communicate with an infrastructure of the wireless computing network.

8. The method of claim 1, wherein the making one or more access control decisions comprises:

authenticating the transmitter if the generated fingerprint substantially matches a stored fingerprint corresponding to an authorized user of the wireless computing network.

9. The method of claim 1, wherein the making one or more access control decisions comprises:

authenticating the transmitter if the generated fingerprint indicates that an estimated location of the transmitter is within a permissible range.

10. The method of claim 1, wherein the making one or more access control decisions comprises:

generating an alert if the generated fingerprint substantially matches a stored fingerprint corresponding to a known source of malicious activity, the alert indicative of a possible intrusion in the wireless computing network; and

forwarding the alert to an intrusion prevention system.

11. The method of claim 1, wherein the making one or more access control decisions comprises:

rating an alert if the generated fingerprint does not substantially match a stored fingerprint corresponding to an authorized user of the wireless computing network, the alert indicative of a possible intrusion in the wireless computing network; and

forwarding the alert to an intrusion prevention system.

12. The method of claim 11, wherein the alert includes information about the generated fingerprint.

13. The method of claim 1, wherein the making one or more access control decisions comprises:

determining that the transmitter is not an authorized user of the wireless computing device, in accordance with the generated fingerprint; and

disrupting communication sessions associated with the transmitter.

14. The method of claim 13, wherein the disrupting is accomplished in accordance with a frame injection technique.

15. The method of claim 1, wherein the making one or more access control decisions comprises:

sharing the fingerprint with at least one other computing network.

16. The method of claim 15, further comprising:

tracking a location of the transmitter in accordance with the shared fingerprint.

17. The method of claim 1, further comprising:

providing one or more data link layer frames associated with the transmitter to a network firewall; and

indicating to the firewall whether the transmitter has been identified as an authorized user of the wireless computing network or an unauthorized user of the wireless computing network, in accordance with the generated fingerprint.

18. The method of claim 1, wherein the making one or more access control decisions comprises:

marking the transmitter as blacklisted if the generated fingerprint does not substantially match a stored fingerprint corresponding to an authorized user of the wireless computing network.

19. The method of claim 1, wherein the fingerprint is generated periodically.

20. A computer readable medium containing an executable program for securing a wireless computing network, where the program performs the steps of:

receiving a communication from an unidentified transmitter;

identifying the transmitter in accordance with a fingerprint generated from one or more radio frequency signal characteristics extracted from the communication; and

making one or more access control decisions in response to an identity of the transmitter.

21. The computer readable medium of claim 20, wherein the one or more radio frequency signal characteristics are extracted from a physical layer frame of the communication.

22. The computer readable medium of claim 20, wherein the identifying comprises:

comparing the generated fingerprint to one or more stored fingerprints representing known transmitters.

23. The computer readable medium of claim 22, wherein the comparing comprises:

generating for each comparison a similarity score indicative of a degree of similarity between the generated fingerprint and a respective one of the one or more stored fingerprints.

24. The computer readable medium of claim 22, wherein the comparing comprises:

converting the generated fingerprint to a generated fingerprint model, the generated fingerprint model comprising one or more categorical measurements for radio frequency signal characteristics corresponding to the generated fingerprint; and

comparing the generated fingerprint model to a stored fingerprint model of a stored fingerprint, the stored fingerprint model comprising one or more categorical measurements for radio frequency signal characteristics corresponding to the stored fingerprint.

25. The computer readable medium of claim 24, wherein the stored fingerprint model further comprises:

a tolerance associated with each of the one or more categorical measurements, each tolerance specifying a degree of similarity that an associated categorical measurement must meet with regard to a corresponding categorical measurement of the generated fingerprint model in order to be considered a match.

26. The computer readable medium of claim 20, wherein the making one or more access control decisions comprises:

registering the transmitter such that the transmitter is allowed to communicate with an infrastructure of the wireless computing network.

27. The computer readable medium of claim 20, wherein the making one or more access control decisions comprises:

authenticating the transmitter if the generated fingerprint substantially matches a stored fingerprint corresponding to an authorized user of the wireless computing network.

28. The computer readable medium of claim 20, wherein the making one or more access control decisions comprises:

authenticating the transmitter if the generated fingerprint indicates that an estimated location of the transmitter is within a permissible range.

29. The computer readable medium of claim 20, wherein the taking action comprises:

generating an alert if the generated fingerprint substantially matches a stored fingerprint corresponding to a known source of malicious activity, the alert indicative of a possible intrusion in the wireless computing network; and

forwarding the alert to an intrusion prevention system.

30. The computer readable medium of claim 20, wherein the making one or more access control decisions comprises:

generating an alert if the generated fingerprint does not substantially match a stored fingerprint corresponding to an authorized user of the wireless computing network, the alert indicative of a possible intrusion in the wireless computing network; and

forwarding the alert to an intrusion prevention system.

31. The computer readable medium of claim 30, wherein the alert includes information about the generated fingerprint.

32. The computer readable medium of claim 20, wherein the making one or more access control decisions comprises:

determining that the transmitter is not an authorized user of the wireless computing device, in accordance with the generated fingerprint; and

disrupting communication sessions associated with the transmitter.

33. The computer readable medium of claim 32, wherein the disrupting is accomplished in accordance with a frame injection technique.

34. The computer readable medium of claim 20, wherein the making one or more access control decisions comprises:

sharing the fingerprint with at least one other computing network.

35. The computer readable medium of claim 34, further comprising:

tracking a location of the transmitter in accordance with the shared fingerprint.

36. The computer readable medium of claim 20, further comprising:

providing one or more data link layer frames associated with the transmitter to a network firewall; and

indicating to the firewall whether the transmitter has been identified as an authorized user of the wireless computing network or an unauthorized user of the wireless computing network, in accordance with the generated fingerprint.

37. The computer readable medium of claim 20, wherein the making one or more access control decisions comprises:

marking the transmitter as blacklisted if the generated fingerprint does not substantially match a stored fingerprint corresponding to an authorized user of the wireless computing network.

38. The computer readable medium of claim 20, wherein the fingerprint is generated periodically.

39. A system for securing a wireless computing network, comprising:

means for receiving a communication from an unidentified transmitter;

means for identifying the transmitter in accordance with a fingerprint generated from one or more radio frequency signal characteristics extracted from the communication; and

means for making one or more access control decisions in response to an identity of the transmitter.

40. The system of claim 39, wherein the means for receiving comprises one or more antennae.

41. The system of claim 39, wherein the means for identifying comprises:

a standard processing module configured to extract a data link layer frame from a raw radio frequency signal associated with the communication; and

a fingerprint processing module configured to produce the fingerprint.

42. The system of claim 41, wherein the fingerprint processing module is further configured to extract a medium access control address contained in the communication.

43. The system of claim 41, wherein the fingerprint processing module is further configured to demodulate and decode additional radio frequency signals not associated with the transmitter.

44. The method of claim 41, wherein the fingerprint processing module comprises an expert reasoning engine for detecting location-fixed transmitter position violations.

45. The system of claim 39, further comprising:

a fingerprint store comprising fingerprint data for one or more transmitters known to the wireless computing network.

46. The system of claim 45, wherein the fingerprint store is an extension of an address resolution protocol cache.

47. The system of claim 45, wherein at least some of the contents of the fingerprint store are exported to other wireless computing network security systems.

48. The system of claim 45, wherein at least some of the contents of the fingerprint store are imported from other wireless computing network security systems.

49. The system of claim 39, wherein the means for making one or more access control decisions comprises:

a firewall module configured to accept or deny data link layer frames of the communication based on the fingerprint.

50. The system of claim 49, wherein the firewall module is further configured to:

pass data link layer frames associated with authorized transmitters to a network stack module; and

drop data link layer frames that are not associated with authorized transmitters.

51. The system of claim 49, wherein the firewall module is further configured to send an alert to an intrusion prevention system if the data link layer frames are not associated with authorized transmitters.

52. The system of claim 49. wherein the firewall module is further configured to disrupt communications of unauthorized transmitters.

53. The system of claim 39, further comprising:

an intrusion prevention system configured to perform inline packet inspection and anomaly detection.