Wireless local or metropolitan area network with intrusion detection features and related methods
View Patent ↗A wireless local or metropolitan area network may include a plurality of stations for transmitting data therebetween and a policing station. The policing station may detect intrusions into the wireless network by monitoring transmissions among the plurality of stations to detect transmissions during an unauthorized period and generate an intrusion alert based thereon. The policing station may also detect intrusions based upon one or more of integrity check values which do not correspond with respective data packets, usage of non-consecutive media access control (MAC) sequence numbers by a station, and collisions of packet types and/or MAC addresses.
1. A wireless local or metropolitan area network comprising:
a plurality of stations for transmitting data in packets therebetween and generating respective integrity check values for transmission with each packet; and
a policing station for detecting intrusions into the wireless network by
monitoring transmissions among said plurality of stations to detect transmissions during an unauthorized period and integrity check values which do not correspond with their respective data packets; and
generating an intrusion alert based upon detecting transmissions during the unauthorized period and an integrity check value which does not correspond with its respective data packet.
2. The wireless network of claim 1 wherein said plurality of stations transmit data in packets via a medium access control (MAC) layer and also transmit a respective MAC sequence number with each data packet; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect usage of non-consecutive MAC sequence numbers by a station; and
generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a station.
3. The wireless network of claim 1 wherein said plurality of stations transmit data in packets each having a packet type associated therewith; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.
4. The wireless network of claim 3 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
5. The wireless network of claim 3 wherein the threshold number of collisions is greater than about three.
6. The wireless network of claim 3 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
7. The wireless network of claim 1 wherein said plurality of stations transmit data via a medium access control (MAC) layer; wherein each station has a MAC address associated therewith to be transmitted with data sent therefrom; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
8. The wireless network of claim 7 wherein the threshold number of collisions is greater than about three.
9. The wireless network of claim 1 wherein the wireless network has at least one service set identification (ID) associated therewith; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect service set IDs associated therewith; and
generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.
10. The wireless network of claim 1 wherein said plurality of stations transmit over at least one channel;
and wherein said policing station further detects transmissions over the at least one channel not originating from one of the plurality of stations and generates an intrusion alert based thereon.
11. The wireless network of claim 1 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.
12. The wireless network of claim 1 wherein said policing station comprises a base station.
13. The wireless network of claim 1 wherein said policing station comprises a wireless station.
14. A wireless local or metropolitan area network comprising:
a plurality of stations for transmitting data in packets each having a packet type associated therewith and generating respective integrity check values for transmission with each packet; and
a policing station for detecting intrusions into the wireless network by
monitoring transmissions among said plurality of stations to detect transmissions during an unauthorized period, integrity check values which do not correspond with their respective data packets, and collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting transmissions during the unauthorized period, an integrity check value which does not correspond with its respective data packet, and a threshold number of collisions of packets having the predetermined packet type.
15. The wireless network of claim 14 wherein said plurality of stations transmit data in packets via a medium access control (MAC) layer and also transmit a respective MAC sequence number with each data packet; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect usage of non-consecutive MAC sequence numbers by a station; and
generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a station.
16. The wireless network of claim 14 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
17. The wireless network of claim 14 wherein the threshold number of collisions is greater than about three.
18. The wireless network of claim 14 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
19. The wireless network of claim 18 wherein the threshold number of collisions is greater than about three.
20. The wireless network of claim 14 wherein said plurality of stations transmit data via a medium access control (MAC) layer; wherein each station has a MAC address associated therewith to be transmitted with data sent therefrom; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
21. The wireless network of claim 14 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.
22. The wireless network of claim 14 wherein said policing station comprises at least one of a base station and a wireless station.
23. A wireless local or metropolitan area network comprising:
a plurality of stations for transmitting data in packets via a medium access control (MAC) layer and also for transmitting a respective MAC sequence number with each data packet data; and
a policing station for detecting intrusions into the wireless network by
monitoring transmissions among said plurality of stations to detect usage of non-consecutive MAC sequence numbers by a station; and
generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a station.
24. The wireless network of claim 23 wherein said plurality of stations transmit data in packets each having a packet type associated therewith; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.
25. The wireless network of claim 24 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
26. The wireless network of claim 24 wherein the threshold number of collisions is greater than about three.
27. The wireless network of claim 24 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
28. The wireless network of claim 23 wherein said plurality of stations transmit data via a medium access control (MAC) layer; wherein each station has a MAC address associated therewith to be transmitted with data sent therefrom; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
29. The wireless network of claim 28 wherein the threshold number of collisions is greater than about three.
30. The wireless network of claim 23 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.
31. The wireless network of claim 23 wherein said policing station comprises at least one of a base station and a wireless station.
32. A wireless local or metropolitan area network comprising:
a plurality of stations for transmitting data in packets each having a packet type associated therewith; and
a policing station for detecting intrusions into the wireless network by
monitoring transmissions among said plurality of stations to detect collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.
33. The wireless network of claim 32 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
34. The wireless network of claim 32 wherein the threshold number of collisions is greater than about three.
35. The wireless network of claim 32 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
36. The wireless network of claim 32 wherein said plurality of stations transmit data via a medium access control (MAC) layer; wherein each station has a MAC address associated therewith to be transmitted with data sent therefrom; and wherein said policing station further detects intrusions into the wireless network by:
monitoring transmissions among said plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
37. The wireless network of claim 32 wherein the threshold number of collisions is greater than about three.
38. The wireless network of claim 32 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.
39. The wireless network of claim 32 wherein said policing station comprises at least one of a base station and a wireless station.
40. A wireless local or metropolitan area network comprising:
a plurality of stations for transmitting data via a medium access control (MAC) layer, each station having a MAC address associated therewith to be transmitted with data sent therefrom; and
a policing station for detecting intrusions into the wireless network by
monitoring transmissions among said plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
41. The wireless network of claim 40 wherein the threshold number of collisions is greater than about three.
42. The wireless network of claim 40 wherein said policing station further transmits an intrusion alert to at least one of said plurality of stations.
43. The wireless network of claim 40 wherein said policing station comprises at least one of a base station and a wireless station.
44. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:
transmitting data between the plurality of stations in packets and generating respective integrity check values for transmission with each packet;
monitoring transmissions among the plurality of stations to detect transmissions during an unauthorized period and integrity check values which do not correspond with their respective data packets; and
generating an intrusion alert based upon detecting transmissions during the unauthorized period and an integrity check value which does not correspond with its respective data packet.
45. The method of claim 44 wherein the plurality of stations transmit data in packets via a medium access control (MAC) layer and also transmit a respective MAC sequence number with each data packet; and further comprising:
monitoring transmissions among the plurality of stations to detect usage of non-consecutive MAC sequence numbers by a station; and
generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a station.
46. The method of claim 44 wherein the plurality of stations transmit data in packets each having a packet type associated therewith; and further comprising:
monitoring transmissions among the plurality of stations to detect collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.
47. The method of claim 46 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
48. The method of claim 46 wherein the threshold number of collisions is greater than about three.
49. The method of claim 46 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
50. The method of claim 49 wherein the threshold number of collisions is greater than about three.
51. The method of claim 44 wherein the plurality of stations transmit data via a medium access control (MAC) layer, and wherein each station has a MAC address associated therewith to be transmitted with data sent therefrom; and further comprising:
monitoring transmissions among the plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
52. The method of claim 44 wherein the wireless network has at least one service set identification (ID) associated therewith; and further comprising:
monitoring transmissions among the plurality of stations to detect service set IDs associated therewith; and
generating an intrusion alert based upon one of the detected service set IDs being different than the at least one service set ID of the wireless network.
53. The method of claim 44 wherein the plurality of stations transmit over at least one channel; and further comprising detecting transmissions over the at least one channel not originating from one of the plurality of stations and generating an intrusion alert based thereon.
54. The method of claim 44 further comprising transmitting the intrusion alert to at least one of the plurality of stations.
55. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:
transmitting data between the plurality of stations in packets each having a packet type associated therewith and generating respective integrity check values for transmission with each packet;
monitoring transmissions among said plurality of stations to detect transmissions during an unauthorized period, integrity check values which do not correspond with their respective data packets, and collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting transmissions during the unauthorized period, an integrity check value which does not correspond with its respective data packet, and a threshold number of collisions of packets having the predetermined packet type.
56. The method of claim 55 wherein the plurality of stations transmit data in packets via a medium access control (MAC) layer and also transmit a respective MAC sequence number with each data packet; and further comprising:
monitoring transmissions among the plurality of stations to detect usage of non-consecutive MAC sequence numbers by a station; and
generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a station.
57. The method of claim 55 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
58. The method of claim 55 wherein the threshold number of collisions is greater than about three.
59. The method of claim 55 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
60. The method of claim 59 wherein the threshold number of collisions is greater than about three.
61. The method of claim 59 further comprising transmitting the intrusion alert to at least one of the plurality of stations.
62. The method of claim 55 wherein the plurality of stations transmit data packets via a medium access control (MAC) layer, and wherein each station has a MAC address associated therewith to be transmitted with data sent therefrom; and further comprising:
monitoring transmissions among the plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
63. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:
transmitting data in packets via a medium access control (MAC) layer and transmitting a respective MAC sequence number with each data packet data;
monitoring transmissions among the plurality of stations to detect usage of non-consecutive MAC sequence numbers by a station; and
generating an intrusion alert based upon detecting usage of non-consecutive MAC sequence numbers by a station.
64. The method of claim 63 wherein each data packet has a packet type associated therewith; and further comprising:
monitoring transmissions among the plurality of stations to detect collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.
65. The method of claim 64 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
66. The method of claim 63 wherein the threshold number of collisions is greater than about three.
67. The method of claim 63 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
68. The method of claim 63 wherein the plurality of stations transmit data packets via a medium access control (MAC) layer, and wherein each station has a MAC address associated therewith to be transmitted with data sent therefrom; and further comprising:
monitoring transmissions among the plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
69. The method of claim 68 wherein the threshold number of collisions is greater than about three.
70. The method of claim 63 further comprising transmitting the intrusion alert to at least one of the plurality of stations.
71. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:
transmitting data in packets between the plurality of stations, each packet having a packet type associated therewith;
monitoring transmissions among the plurality of stations to detect collisions of packets having a predetermined packet type; and
generating an intrusion alert based upon detecting a threshold number of collisions of packets having the predetermined packet type.
72. The method of claim 71 wherein the predetermined packet type comprises at least one of authentication packets, association packets, beacon packets, request to send (RTS) packets, and clear to send (CTS) packets.
73. The method of claim 71 wherein the threshold number of collisions is greater than about three.
74. The method of claim 71 wherein the threshold number is based upon a percentage of a total number of monitored packets having the predetermined packet type.
75. The method of claim 71 wherein the plurality of stations transmit data packets via a medium access control (MAC) layer, and wherein each station has a MAC address associated therewith to be transmitted with data packets sent therefrom; and further comprising:
monitoring transmissions among the plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
76. The method of claim 75 wherein the threshold number of collisions is greater than about three.
77. The method of claim 71 further comprising transmitting the intrusion alert to at least one of the plurality of stations.
78. An intrusion detection method for a wireless local or metropolitan area network comprising a plurality of stations, the method comprising:
transmitting data via a medium access control (MAC) layer between the plurality of stations, each station having a MAC address associated therewith to be transmitted with data sent therefrom;
monitoring transmissions among the plurality of stations to detect collisions of a same MAC address; and
generating an intrusion alert based upon detecting a threshold number of collisions of a same MAC address.
79. The method of claim 78 wherein the threshold number of collisions of a same MAC address is greater than about three.
80. The method of claim 78 further comprising transmitting the intrusion alert to at least one of the plurality of stations.