Method and system for detecting and preventing access intrusion in a network
A wireless computer network includes components cooperating together to prevent access intrusions by detecting unauthorized devices connected to the network, disabling the network connections to the devices, and then physically locating the devices. The network can detect both unauthorized client stations and unauthorized edge devices such as wireless access points (APs). The network can detect intruders by monitoring information transferred over wireless channels, identifying protocol state machine violations, tracking roaming behavior of clients, and detecting network addresses being improperly used in multiple locations. Upon detecting an intruder, the network can automatically locate and shut off the physical/logical port to which the intruder is connected.
1. In a system comprising one or more network switches that communicate with a network manager through a network using a standard network protocol, the one or more switches having a plurality of ports connected to a plurality of authorized wireless edge devices that permit a plurality of mobile, client stations to access the network over one or more wireless channels, and the network manager running application software that allows a network administrator to configure the ports of the one or more switches and the plurality of authorized wireless edge devices to facilitate communication over the network, a system for preventing access intrusion to the network by an unauthorized wireless edge device connected to or attempting to connect to one of the ports comprising:
the one or more switches and the plurality of authorized wireless edge devices configured, by running intrusion detection application software, to (1) collect information transmitted over the one or more wireless channels, (2) record such information in one or more statistics databases resident on the one or more switches, and (3) periodically update such information as mobile, client stations roam throughout the network;
the network manager configured, by running network-wide analysis application software, to (1) periodically query, using the standard network protocol, the one or more statistics databases resident on the one or more switches for collected information transmitted over the one or more wireless channels, and (2) record the queried information in a network-wide database resident on the network manager;
the network manager further configured, by running the network-wide analysis application software, to apply algorithms to the information stored in the network-wide database resident on the network manager to detect access intrusion to the network by the unauthorized wireless edge device connected to one of the ports; and
the network manager further configured to, when access intrusion by the unauthorized wireless edge device is so detected, (1) locate the port to which the unauthorized wireless edge device is connected or attempting to connect, and (2) transmit a command to the switch containing the port, using the standard network protocol, directing the switch to automatically shut down the port, thereby denying network access to the unauthorized wireless edge device, even when the unauthorized wireless edge device does not adhere to IEEE 802.11 protocol conventions.
2. The system of claim 1 wherein the plurality of authorized wireless edge devices includes one or more wireless access points.
3. The system of claim 1 wherein the plurality of authorized wireless edge devices includes one or more sniffing access points.
4. The system of claim 1 wherein either or both the one or more switches and the plurality of authorized wireless edge devices are configured to collect the information by monitoring beacon frames emitted by the unauthorized wireless edge device.
5. The system of claim 1 wherein either or both the one or more switches and the plurality of authorized wireless edge devices are configured to collect the information by:
transmitting a probe request; and
detecting a probe response from the unauthorized wireless edge device.
6. The system of claim 1 wherein either or both the one or more switches and the plurality of authorized wireless edge devices are configured collect the information by:
monitoring packet information transmitted on a wireless channel used by the unauthorized wireless edge device.
7. The system of claim 1 wherein the network manager is configured to locate the port connected to the unauthorized wireless edge device by:
triangulating on location attributes of the unauthorized wireless edge device to determine the geographic location of the device.
8. The system of claim 1 wherein the unauthorized wireless edge device has a MAC address, a SSID, and security policies, and the network manager is configured to detect the unauthorized wireless edge device by checking one or more of the following:
whether the MAC address is from an approved vendor;
whether the SSID is from a list of supported SSIDs; and
whether the security policies match the network administrator's security policies.
9. In a system comprising one or more network switches that communicate with a network manager through a network using a standard network protocol, the one or more switches having a plurality of ports connected to a plurality of authorized wireless edge devices that permit a plurality of mobile, client stations to access the network over one or more wireless channels, and the network manager running application software that allows a network administrator to configure the ports of the one or more switches and the plurality of authorized wireless edge devices to facilitate communication over the network, a method of preventing access intrusion to the network by an unauthorized wireless edge device connected to or attempting to connect to one of the ports comprising:
in or by the one or more network switches and the plurality of authorized wireless edge devices running intrusion detection application software, (1) collecting information transmitted over the one or more wireless channels, (2) recording such information in one or more statistics databases resident on the one or more switches, and (3) periodically updating such information as mobile, client stations roam throughout the network; and
in or by the network manager running network-wide analysis application software, (1) periodically querying, using the standard network protocol, the one or more statistics databases resident on the one or more switches for collected information transmitted over the one or more wireless channels; (2) recording the queried information in a network-wide database resident on the network manager; (3) applying algorithms to the information stored in the network-wide database resident on the network manger, thereby detecting access intrusion to the network by the unauthorized wireless edge device connected to one of the ports; (4) locating the port to which the unauthorized wireless edge device is connected or attempting to connect, and (5) transmitting a command to the switch containing the port, using the standard network protocol, directing the switch to automatically shut down the port, thereby denying network access to the unauthorized wireless edge device, even when the unauthorized wireless edge device does not adhere to IEEE 802.11 protocol conventions.
10. The method of claim 1 wherein the plurality of authorized wireless edge devices include one or more wireless access points.
11. The method of claim 1 wherein the plurality of authorized wireless edge devices includes one or more sniffing access points.
12. The method of claim 1 wherein the collecting step comprises collecting the information by monitoring beacon frames emitted by the unauthorized wireless edge device.
13. The method of claim 1 wherein the collecting step comprises:
transmitting a probe request; and
detecting a probe response from the unauthorized wireless edge device.
14. The method of claim 1 wherein the collecting step comprises:
monitoring packet information transmitted on a wireless channel used by the unauthorized wireless edge device.
15. The method of claim 1 wherein the locating step comprises:
triangulating on location attributes of the unauthorized wireless edge device to determine the geographic location of the device.
16. The method of claim 1 wherein the unauthorized wireless edge device has a MAC address, a SSID, and security policies, and the detecting comprises the network manager detecting the unauthorized wireless edge device by checking one or more of the following:
whether the MAC address is from an approved vendor;
whether the SSID is from a list of supported SSIDs; and
whether the security policies match the network administrator's security policies.