Location-based enhancements for wireless intrusion detection

Abstract

In a wireless local area network, a method for detecting the presence of an unauthorized device comprises: detecting the presence of neighboring devices from which management frames can be sent; saving a representation of each neighboring device present; receiving a management frame purporting to be from one of the detected device; determining that the received management frame was sent by an unauthorized device; and indicating the presence of the unauthorized device.

1 . In a wireless local area network, a method for detecting the presence of an unauthorized device, the method comprising: 
 detecting the presence of neighboring devices from which management frames can be sent;    saving a representation of each neighboring device present;    receiving a management frame purporting to be from one of the detected device;    determining that the received management frame was sent by an unauthorized device; and    indicating the presence of the unauthorized device.    
   
   
       2 . The method of  claim 1 , wherein the neighboring devices comprise access points.  
   
   
       3 . The method of  claim 1 , wherein the neighboring devices comprise stations.  
   
   
       4 . The method of  claim 1 , wherein detecting comprises performing radio discovery to determine individual signal strengths of the neighboring devices.  
   
   
       5 . The method of  claim 1 , wherein detecting the presence of neighboring devices comprises manually configuring a device that manages the neighboring devices with location information for each neighboring device.  
   
   
       6 . The method of  claim 1 , wherein a walkabout is performed to determine the locations of the neighboring devices.  
   
   
       7 . The method of  claim 1 , wherein saving a representation of each neighboring device present comprises saving a representation of each neighboring device and its determined individual signal strength.  
   
   
       8 . The method of  claim 7 , wherein receiving a management frame comprises receiving a management frame containing a signal strength indication and a device identifier.  
   
   
       9 . The method of  claim 8 , further comprising: 
 matching said access point identifier from the management frame with one of the neighboring devices;    comparing the signal strength indication from the received management frame with the determined signal strength of the matched neighboring device; and    indicating the presence of an unauthorized device if the difference between the signal strength indication and determined signal strength is greater than a threshold amount.    
   
   
       10 . The method of  claim 1 , wherein saving a representation of each neighboring device comprises storing information describing the physical location of each neighboring device.  
   
   
       11 . The method of  claim 1 , wherein at least one of the neighboring devices detects and validates radio traffic.  
   
   
       12 . The method of  claim 11 , wherein validation is performed by detecting a key within a received management frame, the key being unique to one of the neighboring devices.  
   
   
       13 . The method of  claim 11 , wherein validation is performed by detecting a message integrity check within a received management frame.  
   
   
       14 . The method of  claim 11 , wherein the detecting neighboring device maintains location information for its neighboring devices and performs validation by determining if a management frame could be received from the device indicated as the source of the management frame.  
   
   
       15 . A wireless local area network managing device, comprising: 
 means for detecting the presence of neighboring devices from which management frames can be sent;    means for saving a representation of each neighboring device present;    means for receiving a management frame purporting to be from one of the detected device;    means for determining that the received management frame was sent by an unauthorized device; and    means for indicating the presence of the unauthorized device.    
   
   
       16 . The wireless local area network managing device of  claim 15 , wherein neighboring devices comprise access points.  
   
   
       17 . The wireless local area network managing device of  claim 15 , wherein neighboring devices comprise stations.  
   
   
       18 . A device managed by a wireless local area network managing device, comprising: 
 means for detecting the presence of neighboring devices from which management frames can be sent;    means for saving a representation of each neighboring device present;    means for receiving a management frame purporting to be from one of the detected device;    means for determining that the received management frame was sent by an unauthorized device; and    means for indicating the presence of the unauthorized device.    
   
   
       19 . The device of  claim 18 , wherein neighboring devices comprise access points.  
   
   
       20 . The device of  claim 18 , wherein neighboring devices comprise stations.