Spoofing detection

Abstract

Methods are described herein useful for detecting spoofing by wireless access devices. In some embodiments, spoofing can be detected based on locations for a wireless access device having an identifier at first and second times. The locations are compared to determine whether the wireless access device could access the particular network at the locations in the time period between the first and second times. In several embodiments, spoofing can be detected by tracking the activity of wireless access devices and identifying events that that are prohibited by one or more policy elements of the particular network.

What is claimed is: 
     
         1 . A method comprising:
 detecting the existence of a wireless access device using a plurality of nodes at known locations;   measuring a signal strength of said wireless access device detected by said plurality of nodes;   determining a distance to said detected wireless access device from each of said plurality of nodes based on said signal strength; and   estimating an area for each of said plurality of nodes corresponding to the possible locations of said one or more wireless access devices;   wherein the location of said detected wireless access device can be established based on one or more intersections between said areas.   
     
     
         2 . A method as in  claim 1  wherein said detecting further comprises determining a communications channel in use between two wireless access devices. 
     
     
         3 . A method as in  claim 2  wherein said determining a communications channel further comprises:
 observing a channel in a wireless network for a predetermined amount of time; 
 determining the received signal strength of transmissions received on said wireless network channel; 
 detecting a wireless access device in said wireless network; 
 for said wireless access device, calculating an average received signal strength value per wireless network channel; and 
 determining a communications channel in use by said wireless access device based on said average received signal strength value. 
 
     
     
         4 . A method as in  claim 1  wherein said estimating further comprises determining an approximation band around each of said nodes within which each wireless access device could exist based upon said distance. 
     
     
         5 . A method as in  claim 4  wherein said determining an approximation band is further based on a margin of error. 
     
     
         6 . A method comprising:
 observing a channel in a wireless network for a predetermined amount of time;   determining the received signal strength of transmissions received on said wireless network channel;   detecting a wireless access device in said wireless network;   for said wireless access device, calculating an average received signal strength value per wireless network channel; and   determining a communications channel in use by said wireless access device based on said average received signal strength value.   
     
     
         7 . A method as in  claim 6 , further comprising forming a table containing a channel and signal strength entry for each said wireless access device. 
     
     
         8 . A method as in  claim 6 , wherein said calculating an average further comprises calculating a weighted average. 
     
     
         9 . A method as in  claim 8 , wherein said measuring occurs at a node. 
     
     
         10 . A method as in  claim 8 , further comprising the discarding of extraneous channel hopping data prior to said step of calculating an average. 
     
     
         11 . A method comprising:
 determining a location of a wireless access device;   comparing said location of said wireless access device to policy elements applicable to said wireless access device; and   creating an alert if said wireless access device violates more than a threshold number of said policy elements.   
     
     
         12 . A method as in  claim 11 , wherein said determining step further comprises determining an approximate location. 
     
     
         13 . A method as in  claim 11 , wherein said comparing the location further comprises evaluating said location against a plurality of policy elements. 
     
     
         14 . A method as in  claim 13 , wherein each policy element is selected from the group consisting of: fixed wireless access device location, moving wireless access device, movable wireless access device, or unknown wireless access device. 
     
     
         15 . A wireless intrusion detection node, comprising:
 means for detecting the existence of a wireless access device in an area; and   means for determining a received signal strength for said wireless access device;   wherein a distance from said node to said wireless access device can be approximated from said received signal strength.   
     
     
         16 . A wireless intrusion detection collector, comprising:
 means for collecting, from two or more nodes, a distance from each node to a wireless access device detected by a plurality of said nodes; and   means for determining an area around each of said nodes corresponding to the possible locations of said wireless access device;   wherein the location of a detected wireless access device can be established based on one or more intersections between said areas.   
     
     
         17 . A computer readable medium containing computer program instructions for:
 detecting the existence of a wireless access device using a plurality of nodes at known locations;   measuring a signal strength of said wireless access device detected by said plurality of nodes;   determining a distance to said detected wireless access device from each of said plurality of nodes based on said signal strength; and   estimating an area for each of said plurality of nodes corresponding to the possible locations of said one or more wireless access devices;   wherein the location of said detected wireless access device can be established based on one or more intersections between said areas.   
     
     
         18 . A computer readable medium containing computer program instructions for:
 detecting the existence of a wireless access device in an area; and   measuring, at a node, a received signal strength of said wireless access device;   wherein a distance from said node to said wireless access device can be determined from said received signal strength.   
     
     
         19 . A computer readable medium containing computer program instructions for:
 collecting, from two or more nodes, a distance from each node to a wireless access device detected by a plurality of said nodes; and   calculating an area around each of said nodes corresponding to the possible locations of said. wireless access device;   wherein the location of a detected wireless access device can be established based on one or more intersections between said areas.