Method and system for securing wireless local area networks

• US 8,060,939 B2
• Filed: 04/23/2008
• Issued: 11/15/2011
• Est. Priority Date: 05/20/2002
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott, Lynn, Michael T.
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US12/108,429
• Publication Number:
  US 20080201763A1
• Time in Patent Office: 1,301 Days
• Field of Search: 726/26, 726 12- 14, 726/23, 713/150, 713/151, 713/161, 713/168, 380/255, 380/270
• US Class Current: 726/26
• CPC Class Codes: H04K 2203/18 for wireless local area networks or WLAN
• CPC Class Codes: H04K 2203/22 for communication related to vehicles
• CPC Class Codes: H04K 3/224 with countermeasures at transmission and/or reception of the jammed signal, e.g. stopping operation of transmitter or receiver, nulling or enhancing transmitted power in direction of or at frequency of jammer
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/65 using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal
• CPC Class Codes: H04K 3/825 by jamming
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A wireless network security system including a system data store capable of storing network default and configuration data, a wireless transmitter and a system processor. The system processor performs a network security method. An active defense request signal is received, typically from an intrusion detection system. The received request signal includes an indicator of an access point within the wireless computer network that is potentially compromised. In response to the received an active defense of the wireless network is triggered. The triggered active defense may be on or more of transmitting a jamming signal, transmitting a signal to introduce CRC errors, transmitting a signal to increase the difficulty associated with breaking the network encryption (typically by including in the signal packet appearing legitimate but containing randomized payloads, or transmitting a channel change request to the potentially compromised access point.

Claims

1. A method for monitoring and displaying selected wireless activity, the method comprising:

providing one or more segments of a legacy local area network to be protected, the legacy local area network being characterized by an unsecured airspace;

displaying an illustration of the one or more segments of the legacy local area network on a computer display;

determining a security policy associated with the one or more segments of the local area network;

connecting one or more sensor devices into the legacy local area network to be protected;

coupling a server to the legacy local area network;

monitoring wireless activity in the airspace associated with the legacy local area network using the one or more sensor devices;

detecting a violation of the security policy based upon the information from the monitoring of the wireless activity in the airspace associated with the legacy local area network;

automatically processing an action associated with the violation in accordance to the security policy for the one or more segments in the legacy local area network;

displaying an indication associated with the violation in accordance to the security policy for the one or more segments in the legacy local area network;

displaying a spatial location and associated coverage of one or more of the sensor devices; and

displaying a spatial location and associated coverage of at least one access point in the one or more segments of the legacy local area network.

2. The method of claim 1, further comprising:

identifying one or more tests associated with the legacy local area network;

detecting the violation based upon the one or more tests applied to the information from the monitoring of the wireless activity in the airspace associated with the legacy local area network; and

triggering a notification process or an active defense associated in accordance with and based upon the violation.

3. The method of claim 2, wherein the notification process is selected from raising an alarm and/or logging an alarm, the logging comprising a time and date stamp.

4. The method of claim 2, wherein the active defense comprises one of:

a prevention process directed to selectively disrupt one or more intruders, the selective disruption comprising preventing an intruder from successfully communicating with the legacy local area network; and

a prevention process directed to selectively disrupt one or more wireless devices associated with the violation from engaging in communication with the legacy local area network, without affecting other wireless devices;

wherein the prevention has been provided based upon traffic distinguished to be associated with the legacy local area network.

5. The method of claim 2, wherein the security violation is associated with one of a wireless device that is not in a location consistent with its location profile, an unauthorized devices connected into the legacy local area network to be protected, and a wireless device that is one of not properly configured and an unauthorized wireless device that has spoofed a legitimate station.

6. The method of claim 2, further comprising determining at least one wireless device involved in the violation is a rogue deployment on the legacy local area network.

7. The method of claim 2, further comprising determining if at least one wireless device involved in the violation is unauthorized.

8. The method of claim 2, further comprising displaying an alert associated with the violation on a screen display.

9. The method of claim 8, further comprising displaying a probable physical location of an intruder causing the violation in relation to the selected network airspace region.

10. The method of claim 9, wherein the alert indication is associated with an intruder device.

11. The method of claim 2, further comprising preventing traffic associated with the communication of an intruder causing the violation in the legacy local area network.

12. The method of claim 1, wherein the airspace comprises unauthorized WLAN traffic transmitted therein, wherein the airspace is vulnerable to unauthorized traffic transferred therein, and wherein the airspace is vulnerable to one or more denial of service attacks on the wireless local area network using the airspace.

13. The method of claim 1, wherein the airspace is in an area proximate to a connection point to the legacy local area network.

14. The method of claim 13, wherein the connection point is one of an Ethernet and a wireless access point.

15. The method of claim 1, wherein the legacy local area network comprises one or more computing devices having a wireless transmitter/receiver.

16. The method of claim 1, wherein the violation is one of a plurality of security violations.

17. The method of claim 1, further comprising comparing a portion of information associated with the monitoring of the wireless traffic activity with baseline data associated with the sensor devices.