Systems and methods for automated network policy exception detection and correction

• US 7,322,044 B2
• Filed: 11/04/2003
• Issued: 01/22/2008
• Est. Priority Date: 06/03/2002
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott E.
• Primary Examiner(s): Barrón, Jr.; Gilberto
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US10/700,842
• Publication Number:
  US 20040098610A1
• Time in Patent Office: 1,540 Days
• Field of Search: 726/22
• US Class Current: 726/22
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

The present invention is directed to systems and methods for automated detection of one or more wireless network policy violations and/or enforcement of such policies. A wireless network policy violation is detected. Associated with the detected violation are one or more wireless network attributes. A responsive corrective action is triggered which is based at least in part upon the detected violation, the associated wireless network attributes or combinations thereof. The corrective action can in some instances include a notification to a user or further system. In addition to, or instead of, a notification, the corrective action can include an attempt to configure one or more devices in the wireless network to correct, in whole or in part, the detected violation.

Claims

1. A policy violation detection and enforcement system for use in a wireless network, the system comprising:

a) a system data store (SDS) capable of storing one or more designations of wireless network attributes of wireless network policy and configuration data associated with the one or more designations, wherein the wireless network attributes comprise wireless channel settings, authentication settings, encryption settings, SSID broadcast settings, and rate settings;

b) a system processor comprising one or more processing elements, wherein the system processor is in communication with the SDS and wherein the one or more processing elements are programmed or adapted to;

i) detect a wireless network policy violation of a device, wherein the wireless network policy violation comprises a deviation from a set of one or more wireless network attributes associated with the policy violation detected; and

ii) trigger an automated corrective action responsive to detecting the policy violation, wherein the corrective action is based upon the policy violation detected and the set of wireless network attributes associated with the policy violation detected, and wherein the corrective action is configured to modify settings of the device in order for the device to operate according to the set of one or more wireless network attributes associated with the policy violation detected.

2. The system of claim 1, and further comprising

c) an interface allowing communication between the system processor and the device associated with the detected violation and wherein the programming or adaptation to trigger a corrective action comprises programming or adaptation to:

(1) establish a communication channel with the device associated with the detected violation via the interface; and

(2) transmit instructions via the communication channel to configure one or more properties of the device, wherein the one or more properties are associated with at least one of the attributes in the set of wireless network attributes associated with the violation detected.

3. The system of claim 2, wherein the programming or adaptation to trigger a corrective action further comprises programming or adaptation to (3) transmit a communication to a monitoring system or to a user.

4. The system of claim 1, wherein the corrective action triggered is further based upon configuration data in the SDS associated with the one or more attributes in the set.

5. The system of claim 4, and further comprising

c) an interface allowing communication between the system processor and a device associated with the detected violation and wherein the programming or adaptation to trigger a corrective action comprises programming or adaptation to:

(1) establish a communication channel with a device associated with the detected violation via the interface; and

(2) transmit instructions via the communication channel to configure one or more properties of the device, wherein the one or more properties are associated with a subset of one or more attributes in the set of wireless network attributes associated with the violation detected and wherein the instructions are based upon configuration data in the SDS associated with the subset of one or more attributes.

6. The system of claim 1, wherein the programming or adaptation to trigger a corrective action comprises programming or adaptation to transmit a communication to a monitoring system or to a user.

7. The system of claim 6, wherein the programming or adaptation to trigger a corrective action further comprises programming or adaptation to prepare a communication for transmission to a monitoring system.

8. The system of claim 7, wherein the programming or adaptation to prepare a communication comprises programming or adaptation to embed in the communication information associated with the violation detected.

9. The system of claim 8, wherein the information associated with the violation detected comprises an indicator of the violation detected, one or more indicators corresponding to attributes in the set associated with the violation detected, or one or more indicators corresponding to configuration data associated with one or more attributes in the set associated with the violation detected.

10. The system of claim 8, wherein the programming or adaptation to prepare a communication comprises further programming or adaptation to embed in the communication instructions that will cause the monitoring system to configure one or more devices in the wireless network based upon the information associated with the violation detected also embedded in the communication.

11. The system of claim 7, wherein the programming or adaptation to prepare a communication comprises programming or adaptation to embed instruction in the communication that will cause the monitoring system to log the violation detected.

12. The system of claim 6, and further comprising

c) an interface allowing communication between the system processor and a device associated with the detected violation and wherein the programming or adaptation to trigger a corrective action comprises further programming or adaptation to establish a communication channel with the device via the interface and to transmit instructions via the communication channel to configure one or more properties of the device,

wherein the one or more properties are associated with a subset of one or more attributes in the set of wireless network attributes associated with the violation detected and wherein the instructions are based upon configuration data in the SDS associated with the subset of one or more attributes.

13. The system of claim 6, wherein the programming or adaptation to trigger a corrective action further comprises programming or adaptation to prepare a communication that comprises information associated with the violation detected for transmission to a user.

14. The system of claim 13, wherein the programming or adaptation to prepare a communication comprises programming or adaptation to embed in the communication a responsive component that allows the user to provide feedback with respect to the communication.

15. The system of claim 14, wherein the embedded responsive component allows the user to provided feedback as a selection of an action from a menu of available actions, wherein the menu of available actions comprises ignore, delegate, log, correct or combinations thereof.

16. The system of claim 14, the programming or adaptation to transmit a communication comprises programming or adaptation to transmit the communication via one or more platforms selected from the group consisting of telephone, facsimile, pager, electronic mail, SMS, or web page.

17. The system of claim 14, and further comprising

c) an interface allowing communication between the system processor and a device associated with the detected violation and wherein the embedded responsive component comprises a link created based upon the violation detected,

wherein activation of the link by the user triggers establishment of a communication channel with the device via the interface and transmission of instructions via the communication channel to configure one or more properties of the device,

wherein the one or more properties are associated with a subset of one or more attributes in the set of wireless network attributes associated with the violation detected and

wherein the instructions are based upon configuration data in the SDS associated with the subset of one or more attributes.

18. The system of claim 14, wherein the programming or adaptation to trigger a corrective action further comprises programming or adaptation to receive user feedback with respect to the communication via one or more platforms selected from the group consisting of an automated voice or tone telephonic response system, a facsimile transmission followed by character recognition performed on the received transmission, an e-mail response system, an SMS return message or a Web server.

19. The system of claim 13, the programming or adaptation to transmit a communication comprises programming or adaptation to transmit the communication via one or more platforms selected from the group consisting of telephone, facsimile, pager, electronic mail, SMS, or web page.

20. A method for policy violation detection and enforcement in a wireless network, the method comprising the steps of:

a) detecting a wireless network policy violation, wherein the wireless network policy violation has an associated set of one or more wireless network attributes, wherein the wireless network attributes comprise wireless channel settings, authentication settings, encryption settings, SSID broadcast settings, and rate settings, and wherein the wireless network policy violation comprises a deviation from the set of one or more wireless network attributes associated with the policy violation detected;

b) notifying a user or a further system of the detected violation; and

c) trigger an automated corrective action responsive to detecting the violation by at least performing the steps comprising of;

i) determining a device based upon the detected violation, the wireless network attribute set associated therewith or a combination thereof;

ii) establishing a communication channel with the determined device; and

iii) transmitting instructions via the communication channel to configure one or more properties of the determined device, wherein the one or more properties are based at least in part upon the detected violation, the set of wireless network attributes associated with the detected violation, the determined device or combinations thereof;

wherein the corrective action is configured to modify settings of the device in order for the device to operate according to the set of one or more wireless network attributes associated with the policy violation detected.

21. One or more computer readable media storing instruction that upon execution by a system process cause the system processor to perform the steps comprising of:

a) detecting a wireless network policy violation, wherein the wireless network violation has an associated set of one or more wireless network attributes, wherein the wireless network attributes comprise wireless channel settings, authentication settings, encryption settings, SSID broadcast settings, and rate settings, and wherein the wireless network policy violation comprises a deviation from the set of one or more wireless network attributes associated with the policy violation detected;

b) notifying a user or a further system of the detected violation; and

c) triggering an automated corrective action responsive to detecting the violation by at least performing the steps comprising of;

i) determining an device based upon the detected violation, the wireless network attribute set associated therewith or a combination thereof;

ii) establishing a communication channel with the determined device; and

iii) transmitting instructions via the communication channel to configure one or more properties of the determined device, wherein the one or more properties are based at least in part upon the detected violation, the set of wireless network attributes associated with the detected violation, the determined device or combinations thereof;

wherein the corrective action is configured to modify settings of the device in order for the device to operate according to the set of one or more wireless network attributes associated with the policy violation detected.

22. A policy violation detection and enforcement system for use in a wireless network, the system comprising:

a) storing means for storing one or more designations of wireless network attributes and configuration data associated with the one or more designations, wherein the wireless network attributes comprise wireless channel settings, authentication settings, encryption settings, SSID broadcast settings, and rate settings;

b) detecting means for detecting a wireless network policy violation comprising a deviation from a set of one or more wireless network, wherein the wireless network policy violation has the associated set of one or more wireless network attributes from the storing means;

c) identification means for identifying a device impacted by the detected policy violation based upon the detected violation, the wireless network attribute set associated therewith or a combination thereof;

d) communication means for allowing communication with the device identified by the identification means;

e) enforcement means for selecting instructions based upon the detected violation, the set of wireless network attributes associated with the detected policy violation, the device identified by the identification means or combinations thereof that upon receipt by the device configure one or more properties of the device and for transmitting the selected instruction to the device via the communication means, wherein the enforcement means are configured to modify settings of the device in order for the device to operate according to the set of one or more wireless network attributes associated with the policy violation detected; and

f) notification means for notifying a user or a farther system of the detected violation.