Wireless LAN intrusion detection based on location

• US 7,827,610 B2
• Filed: 03/27/2008
• Issued: 11/02/2010
• Est. Priority Date: 12/22/2003
• Status: Expired due to Term

• Current Assignee: Symbol Technologies, LLC (Zebra Technologies Corporation)
• Original Assignee: Symbol Technologies, Inc. (Zebra Technologies Corporation)
• Inventors: Willins, Bruce, Wang, Huayan Amy, Goren, Dave, Sharony, Jacob
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US12/056,693
• Publication Number:
  US 20080201377A1
• Time in Patent Office: 950 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 4/16 Communication-related supplementary services, e.g. call-transfer or call-hold
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A intrusion detection method is disclosed for use in a wireless local area data communications system, wherein mobile units communicate with access points, and wherein the system is arranged to locate transmitters using signals transmitted by the transmitters. A database relating authorized transmitters to location is maintained. Selected signals are detected at the access points and location data corresponding to the selected signals for use in locating a source of the signals is recorded. The source location is determined using the location data, and the source location is compared to a corresponding location in the database. An alarm is signaled if the source location is inconsistent with the corresponding database location.

Claims

1. A method for determining a presence of an intruder device within a coverage area of a wireless communication network, comprising:

maintaining a database relating authorized sources to location;

receiving a signal from a source;

determining a location of the source based on a characteristic of the signal;

comparing said source location to a corresponding location in the database;

wherein if the determined location fails to correspond to an authorized location for the source, designating the source as the intruder device; and

signaling an alarm if the source is designated as an intruder device.

2. The method as recited in claim 1, wherein the source is a mobile communication device, and the determining of the location includes determining whether the mobile communication device is within an expected distance from a previously determined location.

3. The method as recited in claim 1, wherein the source is an access point at a fixed location.

4. The method as recited in claim 3, wherein the signal is a beacon signal.

5. The method as recited in claim 3, wherein the signal is one of a de-authorization and a de-authentication signal.

6. The method as recited in claim 3, wherein said signal is a disassociation signal.

7. The method as recited in claim 1, wherein the signal is an association request signal.

8. The method as recited in claim 1, wherein the signal is an Extensible Authentication Protocol over LAN (“

EAPoL”

) signal.

9. The method as recited in claim 1, wherein additional locating devices are used to detect the signal to improve an accuracy of the locating of the source.

10. The method as recited in claim 1, wherein the signal is a management/control signal.

11. A system for determining a presence of an intruder device within a coverage area of a wireless communication network, comprising:

means for maintaining a database relating authorized sources to location;

means for receiving a signal from a source;

means for determining a location of the source based on a characteristic of the signal;

means for comparing said source location to a corresponding location in said database;

means for, if the determined location fails to correspond to an authorized location for the source, designating the source as the intruder device; and

means for signaling an alarm if the source is designated as an intruder device.

12. The system as recited in claim 11, wherein the source is a mobile communication device, and the means for determining includes means for determining whether the mobile communication device is within an expected distance from a previously determined location.

13. The system as recited in claim 11, wherein the source is an access point at a fixed location.

14. The system as recited in claim 13, wherein the signal is a beacon signal.

15. The system as recited in claim 13, wherein the signal is one of a de-authorization and a de-authentication signal.

16. The system as recited in claim 13, wherein the signal is a disassociation signal.

17. The system as recited in claim 11, wherein the signal is an association request signal.

18. The system as recited in claim 11, wherein the signal is an Extensible Authentication Protocol over LAN (“

EAPoL”

) signal.

19. The system as recited in claim 11, wherein additional locating devices are used to detect the signal to improve an accuracy of the locating of the source.

20. The system as recited in claim 13, wherein the signal is a management/control signal.