METHOD AND SYSTEM FOR LOCATING A WIRELESS ACCESS DEVICE IN A WIRELESS NETWORK

• US 20120309427A1
• Filed: 12/02/2010
• Published: 12/06/2012
• Est. Priority Date: 04/03/2003
• Status: Active Grant

• Current Assignee: Ozmo Licensing LLC
• Original Assignee: Network Security Technologies, Inc. (Verizon Communications Inc.)
• Inventors: HARVEY, Elaine, WALNOCK, Matthew
• Granted Patent: US 9,042,914 B2
• Time in Patent Office: Days
• US Class Current: 455/456.5
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A wireless access device in a wireless network, whether a known or unknown entity, can be located using a geolocation system according to the present invention. A signal strength is determined by a wireless intrusion detection system (WIDS) node in a wireless network for each wireless access device that it detects. Based on the signal strength, an approximate distance from the node is determined, which, in one embodiment corresponds to a radius of a circle around the node. To account for error, an approximation band of the circle is calculated that will allow a user to determine the approximate location of the device within the wireless network.

Claims

1. A computer-implemented method, comprising:

detecting an existence of a wireless access device using a plurality of nodes at known locations;

measuring a signal strength of the wireless access device detected by the plurality of nodes;

determining a distance to the detected wireless access device from each of the plurality of nodes based on the signal strength to determine possible locations of the wireless access device;

estimating an area for each of the plurality of nodes corresponding to the possible locations of the wireless access device; and

determining an actual location of the detected wireless access device based on one or more intersections between the areas.

2. The method of claim 1, where the detecting further comprises detecting a communications channel in use between the wireless access device and another wireless access device.

3. The method of claim 2, where detecting the communications channel comprises:

observing a wireless network channel in a wireless network for a predetermined amount of time;

determining received signal strengths of each of a plurality of transmissions received on the wireless network channel;

calculating an average received signal strength value per wireless network channel, corresponding to the wireless access device; and

detecting the communications channel in use by the wireless access device based on the average received signal strength value.

4. The method of claim 1, where the estimating further comprises detecting a band around each node of the plurality of nodes, within which the wireless access device could be located, based on the determined distance from each node of the plurality of nodes.

5. The method of claim 4, where detecting the band comprises detecting the band based on a margin of error.

24. The method of claim 1, where the possible locations include the actual location.

6-15. -15. (canceled)

16. A system, comprising:

means for collecting, from two or more nodes, a distance from each node to a wireless access device detected by a plurality of the nodes;

means for determining an area around each of the nodes corresponding to possible locations of the wireless access device; and

means for determining a location of the wireless access device based on one or more intersections between the areas.

26. The system of claim 16, where the means for determining the area around each of the nodes include means for detecting a band around each node of the plurality of nodes, within which the wireless access device could be located, based on a distance of the wireless access device from each node of the plurality of nodes.

17. A non-transitory computer-readable medium that stores instructions executable by a computer, the instructions comprising:

one or more instructions that, when executed by the computer, cause the computer to detect an existence of a wireless access device using a plurality of nodes that are at known locations;

one or more instructions that, when executed by the computer, cause the computer to measure a signal strength of the wireless access device detected by the plurality of nodes;

one or more instructions that, when executed by the computer, cause the computer to determine a distance to the detected wireless access device from each of the plurality of nodes based on the signal strength;

one or more instructions that, when executed by the computer, cause the computer to estimate an area for each of the plurality of nodes corresponding to possible locations of the wireless access device; and

one or more instructions that, when executed by the computer, cause the computer to determine an actual location of the detected wireless access device based on one or more intersections between the areas.

18. (canceled)

19. A non-transitory computer-readable medium that stores instructions executable by a computer, the instructions including:

one or more instructions that, when executed by the computer, cause the computer to detect an existence of a wireless access device using a plurality of nodes at known locations;

one or more instructions that, when executed by the computer, cause the computer to determine a distance from the plurality of nodes, to the wireless access device detected by the plurality of nodes;

one or more instructions that, when executed by the computer, cause the computer to calculate an area around each node of the plurality of nodes, the areas indicating possible locations of the wireless access device; and

one or more instructions that, when executed by the computer, cause the computer to determine an actual location of the wireless access device based on one or more intersections between the areas.

20. The non-transitory computer-readable medium of claim 19, where the one or more instructions that cause the computer to detect include one or more instructions to detect a communications channel in use between the wireless access device and another wireless access device.

21. The non-transitory computer-readable medium of claim 20, where the one or more instructions that cause the computer to detect the communications channel comprise:

one or more instructions that, when executed by the computer, cause the computer to observe a wireless network channel in a wireless network for a predetermined amount of time;

one or more instructions that, when executed by the computer, cause the computer to determine received signal strengths of each of a plurality of transmissions received on the wireless network channel;

one or more instructions that, when executed by the computer, cause the computer to calculate an average received signal strength value per wireless network channel, corresponding to the wireless access device; and

one or more instructions that, when executed by the computer, cause the computer to detect the communications channel in use by the wireless access device based on the average received signal strength value.

22. The non-transitory computer-readable medium of claim 19, where the one or more instructions that cause the computer to calculate further comprise one or more instructions that, when executed by the computer, cause the computer to detect a band around each node of the plurality of nodes, within which the wireless access device could be located, based on the determined distance from each node of the plurality of nodes.

23. The non-transitory computer-readable medium of claim 19, where the possible locations include the actual location.

25. (canceled)

27-31. -31. (canceled)