Automated method and system for monitoring local area computer networks for unauthorized wireless access

• US 9,003,527 B2
• Filed: 06/26/2012
• Issued: 04/07/2015
• Est. Priority Date: 02/11/2004
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Bhagwat, Pravin, Gogate, Shantanu, King, David C
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US13/533,674
• Publication Number:
  US 20130117851A1
• Time in Patent Office: 1,015 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25
• US Class Current: 726/23
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/102 Route integrity, e.g. using trusted paths
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

The wireless activity in a geographic area containing LAN connection ports is monitored using one or more sensor devices, called sniffers. By analyzing said wireless activity, one or more APs that are operating in said geographic area are identified. The active APs so identified are classified into three categories, namely “authorized” APs (those that are allowed by network administrator), “unauthorized” APs (those that are not allowed by the network administrator, but are still connected to the LAN of interest) and “external” APs (those that are not allowed by network administrator but are not connected to the LAN of interest, for example APs connected to the neighbor'"'"'s LAN) by conducting one or more tests. The sniffers detect any wireless station attempting to connect to or communicating with the one or more identified unauthorized APs. Upon identifying unauthorized AP and/or intruding wireless station an indication is transferred to the prevention process.

Claims

1. A method for monitoring for unauthorized wireless access to a computer network, the method comprising:

monitoring wireless communications within a selected geographic region, the selected geographic region including a wired portion of the computer network that is to be protected from unauthorized wireless access;

detecting a wireless access point device that transmits wireless signals within the selected geographic region, the wireless access point device being configured to perform a network address translation (NAT) function between its wired and wireless interfaces;

transmitting a marker packet to the wireless access point device by a radio interface on a monitoring device disposed within the selected geographic region over a wireless connection between a wireless station other than the monitoring device and the wireless access point device;

spoofing identity of the wireless station while transmitting the marker packet, the marker packet being adapted to be received by the wireless interface of the wireless access point device and being adapted to be transferred through the wireless access point device to its wired interface and being destined to a selected device coupled to the computer network;

determining that the marker packet is received at the selected device coupled to the computer network;

determining that the wireless access point device is connected to the wired portion of the computer network based at least upon the determining that the marker packet is received at the selected device coupled to the computer network; and

determining that the wireless access point device provides unauthorized wireless access to the wired portion of the computer network based at least upon the determining that the wireless access point device is connected to the wired portion.

2. The method of claim 1 wherein the step of monitoring wireless communications within the selected geographic region comprises monitoring using one or sniffer devices positioned within the selected geographic region.

3. The method of claim 2, wherein the radio interface on the monitoring device comprises a radio interface on one of the sniffer devices positioned within the selected geographic region.

4. The method of claim 2, wherein the selected device comprises one of the sniffer devices that is coupled to the wired portion of the computer network using a wired connection.

5. The method of claim 1, further comprising:

determining that the wireless access point device is not among one or more wireless access point devices that are allowed to be connected to the computer network.

6. The method of claim 1, wherein the marker packet has a predetermined format, and the selected device coupled to the computer network is configured to identify at least a portion of the predetermined format.

7. The method of claim 1, wherein the wireless connection between the wireless station and the wireless access point device is pre-established.

8. The method of claim 1, wherein the radio interface on the monitoring device does not establish a wireless connection with the wireless access point device for transmitting the marker packet.

9. The method of claim 1, wherein the marker packet has a source address corresponding to a MAC address of the wireless station other than the radio interface on the monitoring device.

10. The method of claim 1, wherein the marker packet has a source address corresponding to an IP address of the wireless station other than the radio interface on the monitoring device.

11. An apparatus for monitoring for unauthorized wireless access to a computer network, the apparatus comprising:

a first radio interface;

a processor unit; and

a computer readable medium storing instructions executable by the processor unit configured to;

monitor wireless communications using the first radio interface;

detect a wireless access point device within a radio coverage range of the first radio interface, the wireless access point device being configured to perform a network address translation (NAT) function between its wired and wireless interfaces, the radio coverage range of the first radio interface including at least one connection point on a wired portion of the computer network that is to be protected from unauthorized wireless access;

transmit a marker packet to the wireless access point device by the first radio interface over a wireless connection between a second radio interface and the wireless access point device, wherein the second radio interface is in a wireless station other than the apparatus;

spoof identity of the second radio interface while transmitting the marker packet, the marker packet being adapted to be received by the wireless interface of the wireless access point device and being adapted to be transferred through the wireless access point device to its wired interface and being destined to a selected device coupled to the computer network;

determine that the marker packet is received at the selected device coupled to the computer network;

determine that the wireless access point device is connected to the wired portion of the computer network based at least upon the determining that the marker packet is received at the selected device coupled to the computer network; and

determine that the wireless access point device provides unauthorized wireless access to the wired portion of the computer network based at least upon the determining that the wireless access point device is connected to the wired portion.

12. The apparatus of claim 11, wherein the instructions stored in the computer readable medium are configured to be executed by the processor unit to determine that the wireless access point device is not among one or more wireless access point devices that are allowed to be connected to the computer network.

13. The apparatus of claim 11, wherein the marker packet has a predetermined format, and the selected device coupled to the computer network is configured to identify at least a portion of the predetermined format.

14. The apparatus of claim 11, wherein the wireless connection between the second radio interface and the wireless access point device is pre-established.

15. The apparatus of claim 11, wherein the first radio interface does not establish a wireless connection with the wireless access point device for transmitting the marker packet.

16. The apparatus of claim 11, wherein the marker packet has a source address corresponding to a MAC address of the wireless station other than the first radio interface.

17. The method of claim 11, wherein the marker packet has a source address corresponding to an IP address of the wireless station other than the first radio interface.