Wireless LAN intrusion detection based on location

1. In a wireless local area data communications system, wherein mobile units communicate with access points, and wherein said system is arranged to locate transmitters using signals transmitted by said transmitters, a method for detecting unauthorized signals, comprising:

maintaining a database relating authorized transmitters to location;

detecting selected signals at said access points and recording location data corresponding to said signals for use in locating a source of said signals;

locating said source using said location data;

comparing said source location to a corresponding location in said database; and

signaling an alarm if said source location is inconsistent with said corresponding database location.

2. A method as specified in claim 1 wherein said selected signal is a signal transmitted by a mobile unit and wherein said source location is compared to a location for said mobile unit in said database.

3. A method as specified in claim 2 wherein said selected signal is an association request signal.

4. A method as specified in claim 2 wherein said signal is an Extensible Authentication Protocol over LAN (“EAPoL”) signal.

5. A method as specified in claim 1 , wherein additional locating devices are used to detect said selected signals to improve the accuracy of the locating of said source.

6. A method as specified in claim 1 wherein said selected signal is a signal type transmitted by an access point, and wherein said source location is compared to a location for said access point.

7. A method as specified in claim 6 wherein said selected signal is a management/control signal.

8. A method as specified in claim 6 wherein said signal is a beacon signal.

9. A method as specified in claim 6 wherein said signal is a de-authorization or de-authentication signal.

10. A method as specified in claim 6 wherein said signal is a disassociation signal.

11. A method as specified in claim 6 wherein said signal is an Extensible Authentication Protocol over LAN (“EAPoL”) signal.

12. In a wireless local area data communications system, wherein mobile units communicate with access points, and wherein said system is arranged to locate transmitters using signals transmitted by said transmitters, a method for detecting unauthorized signals, comprising:

maintaining a database relating authorized transmitters to location, said database further comprising MAC information;

detecting selected signals at said access points and recording location data corresponding to said signals for use in locating a source of said signals;

locating said source using said location data;

comparing said source location to a corresponding location in said database;

extracting a MAC address from said source location;

comparing said MAC address with MAC information in said database; and

signaling an alarm if analysis of said source location and said MAC address suggest possible unauthorized network access.

13. A method as specified in claim 12 wherein said analysis indicates that said MAC address is inconsistent with MAC information relating to substantially the same location.

14. A method as specified in claim 12 wherein said analysis indicates that said MAC address is located at more than one location.

15. In a wireless local area data communications system, wherein mobile units communicate with access points, and wherein said system is arranged to locate transmitters using signals transmitted by said transmitters, a method for detecting unauthorized signals, comprising:

maintaining a database relating to allowed locations;

detecting selected signals at said access points and recording location data corresponding to said signals for use in locating a source of said signals;

locating said source using said location data;

comparing said source location to the allowed locations in said database; and

signaling an alarm if said source location is not within said allowed locations.

16. A method as specified in claim 15 , wherein said allowed locations correspond to locations which are authorized locations for mobile units.

17. A method as specified in claim 15 , wherein said allowed locations correspond to locations which are physically feasible locations for mobile units.

18. A method as specified in claim 15 , wherein said allowed locations correspond to locations which are unobstructed by structures.

19. A method as specified in claim 15 , wherein additional locating devices are used to detect said selected signals to improve the accuracy of the locating of said source.

20. In a wireless local area data communications system, wherein mobile units communicate with a first and second access points, and wherein said system is arranged to locate transmitters using signals transmitted by said transmitters, and further wherein said first and second access points are located substantially within proximity such that under normal conditions they detect signals transmitted by same said transmitters, a method for detecting unauthorized signals, comprising:

detecting selected signals at said first access point and recording location data corresponding to said signals for use in locating a source of said signals; and

signaling an alarm if said signals are not detected at said second access point.

21. In a wireless local area data communications system, wherein mobile units communicate with access points, and wherein said system is arranged to locate transmitters using signals transmitted by said transmitters, a method for detecting unauthorized signals, comprising:

maintaining a database comprising network data traffic information;

detecting selected signals at said access points and recording location data corresponding to said signals for use in locating a source of said signals;

locating said source using said location data;

monitoring said selected signals to determine network data traffic characteristics at said source location;

comparing said determined network data traffic characteristics to information in said database; and

signaling an alarm if said determined network data traffic characteristics at said source location is inconsistent with information in said database.

22. In a wireless local area data communications system, wherein mobile units communicate with access points, and wherein said system is arranged to locate transmitters using signals transmitted by said transmitters, a method for detecting unauthorized signals, comprising:

maintaining a database relating authorized transmitters to location;

detecting selected signals by one or more mobile units and recording location data corresponding to said signals for use in locating a source of said signals;

locating said source using. said location data;

comparing said source location to a corresponding location in said database; and

signaling an alarm if said source location is inconsistent with said corresponding database location.