DETECTING ROGUE-ACCESS-POINT ATTACKS
An electronic device (such as an access point) may receive a packet (or a frame) from a second electronic device, where the packet includes an encrypted unique identifier of the second electronic device. For example, the encrypted unique identifier may be included in a manufacturer-specific information element in a management packet. Then, the electronic device may decrypt the encrypted unique identifier using an encryption key or a secure hash function to obtain the unique identifier. Next, the electronic device may determine whether the second electronic device is an instance of an authorized access point in the WLAN based at least in part on the unique identifier. Note that the second electronic device may be an instance of an authorized access point when the unique identifier is associated with a manufacturer of the electronic device and/or the second electronic device.
1 . An electronic device, comprising:
an interface circuit configured to wirelessly communicate with a second electronic device, wherein the electronic device is configured to:
receive, at the interface circuit, a packet or frame associated with the second electronic device, wherein the packet or frame comprises an encrypted unique identifier of the second electronic device;
decrypt the encrypted unique identifier using an encryption key or a secure hash function to obtain a unique identifier; and
determine whether the second electronic device is an instance of an authorized access point in a wireless local area network (WLAN) based at least in part on the unique identifier.
2 . The electronic device of claim 1 , wherein the electronic device comprises an access point.
3 . The electronic device of claim 1 , wherein the packet or frame comprises a management packet or frame.
4 . The electronic device of claim 3 , wherein the encrypted unique identifier is included in a manufacturer-specific information element in the management packet or frame.
5 . The electronic device of claim 1 , wherein the unique identifier comprises one of: a media access control (MAC) address of the second electronic device, a Serial Number of the second electronic device, an association identifier (AID) of the second electronic device, channel information of the second electronic device, or a radio-frequency configuration of the second electronic device.
6 . The electronic device of claim 1 , wherein the second electronic device is an instance of an authorized access point when the unique identifier is associated with a manufacturer of the electronic device.
7 . The electronic device of claim 1 , wherein the encryption key or the secure hash function are shared by the electronic device and the second electronic device.
8 . The electronic device of claim 1 , wherein, prior to receiving the packet or frame, the electronic device is configured to receive, at the interface circuit and associated with a controller, one or more of: the encryption key, the secure hashing function, the unique identifier of the second electronic device, or a unique identifier of the electronic device.
9 . The electronic device of claim 1 , wherein, when the second electronic device is not the instance of the authorized access point, the electronic device is configured to perform a remedial action.
10 . The electronic device of claim 9 , wherein the remedial action comprises one or more of: providing a message addressed to a controller; providing a second message addressed to one or more additional access points in the WLAN; providing a third message addressed to a third electronic device that is associated with the second electronic device; de-authenticating the third electronic device from the WLAN, so that an association between the third electronic device and the second electronic device is discontinued; changing a channel used by the electronic device in the WLAN; changing a service set identifier (SSID) of the electronic device; or preventing the third electronic device from associating with the second electronic device.
11 . The electronic device of claim 1 , wherein the electronic device is configured to determine a location of the second electronic device; and
wherein determining whether the second electronic device is the instance of an authorized access point is based at least in part on the location.
12 . A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions that, when executed by the electronic device, cause the electronic device to perform operations, comprising:
receiving, at an interface circuit in the electronic device, a packet or frame associated with a second electronic device, wherein the packet or frame comprises an encrypted unique identifier of the second electronic device;
decrypting the encrypted unique identifier using an encryption key or a secure hash function to obtain a unique identifier; and
determining whether the second electronic device is an instance of an authorized access point in a wireless local area network (WLAN) based at least in part on the unique identifier.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein the electronic device comprises an access point.
14 . The non-transitory computer-readable storage medium of claim 12 , wherein the packet or frame comprises a management packet or frame.
15 . The non-transitory computer-readable storage medium of claim 14 , wherein the encrypted unique identifier is included in a manufacturer-specific information element in the management packet or frame.
16 . The non-transitory computer-readable storage medium of claim 12 , wherein the second electronic device is an instance of an authorized access point when the unique identifier is associated with a manufacturer of the electronic device.
17 . The non-transitory computer-readable storage medium of claim 12 , wherein the encryption key or the secure hash function are shared by the electronic device and the second electronic device.
18 . The non-transitory computer-readable storage medium of claim 12 , wherein, prior to receiving the packet or frame, the operations comprise receiving, at the interface circuit and associated with a controller, one or more of: the encryption key, the secure hashing function, the unique identifier of the second electronic device, or a unique identifier of the electronic device.
19 . The non-transitory computer-readable storage medium of claim 12 , wherein, when the second electronic device is not the instance of the authorized access point, the operations comprise performing a remedial action.
20 . A method for detecting a rogue access point, comprising:
by an electronic device:
receiving, at an interface circuit in the electronic device, a packet or frame associated with a second electronic device, wherein the packet or frame comprises an encrypted unique identifier of the second electronic device;
decrypting the encrypted unique identifier using an encryption key or a secure hash function to obtain a unique identifier; and
determining whether the second electronic device is an instance of an authorized access point in a wireless local area network (WLAN) based at least in part on the unique identifier.