Systems and methods for concurrent wireless local area network access and sensing
This invention describes systems and methods for combining the Wireless Local Area Network (WLAN) infrastructure and Wireless Intrusion Prevention Systems (WIPS) by leveraging a common radio platform equipped with more than one WLAN radio and a unified management system. The invention provides all the benefits of the WLAN, without sacrificing the 24×7 dedicated security monitoring and performance troubleshooting available from an overlay WIPS system, while reducing the deployment cost and management complexity, by sharing a common hardware platform for the WLAN Access Point (AP) and WIPS sensor and leveraging an integrated management system.
1. An access point and sensor device in a wireless local area network system, comprising:
a plurality of collocated wireless radios operable as either an access point in a wireless device;
or as a wireless sensor for detecting a network intruder;
a processor coupled to the wireless radios and a memory; and
a frequency scanning pattern of a wireless radio operable as a wireless sensor stored in the memory to be used by the processor to adaptively adjust the frequency scanning pattern of the wireless radio operable as a wireless sensor to avoid an operating frequency in proximity to a channel used by a wireless radio operable as an access point for transmitting.
2. The access point and sensor device of claim 1 , wherein some of the wireless radios are operable to change functionality between being an access point and a sensor, and wherein more of the wireless radios are configurable to operate as access points than sensors during higher network usage and wherein more of the wireless radios are configurable to operate as sensors than access points during lower network usage.
3. The access point and sensor device of claim 1 , wherein upon detection of an intrusion by the wireless sensor at least one of the wireless radios operable as an access point is converted to operate as a wireless sensor.
4. The access point and sensor device of claim 1 , wherein the processor is configured to determine how long each channel of the frequency scanning pattern is monitored by the wireless sensor based on risk assessment.
5. The access point and sensor device of claim 1 , wherein the processor is configured to adaptively synchronize access point functionality transmissions at a same time as the sensor functionality to avoid transmit-receive desensitization.
6. The access point and sensor device of claim 1 , wherein the processor is configured to periodically change the functionality of a wireless radio from an access point to a wireless sensor when that wireless radio is not providing wireless access to the wireless network.
7. The access point and sensor device of claim 1 , wherein upon detecting a network intruder, the device operates to terminate the network intruder communications by at least one of jamming communications and corrupting communications, introducing CRC errors, and transmitting a channel change request.
8. The access point and sensor device of claim 1 , wherein upon detecting a network intruder, the device operates to terminate the network intruder communications by at least one of introducing CRC errors, and transmitting a channel change request.
9. A wireless local area network system, comprising:
two or more collocated wireless radios within a wireless device, wherein each of the two or more collocated wireless radios are configurable as either an access point for wireless the local area network or as a wireless sensor operable for detecting a network intruder;
a processor connected to the two or more wireless radios, wherein the processor is configured to control a wireless radio operable as a wireless sensor to adaptively adjust a frequency scanning pattern of the wireless radio operable as the wireless sensor to avoid an operating frequency in proximity to a channel used by a wireless radio operable as an access point for transmitting.
10. The wireless network system of claim 9 , wherein the processor is further configured to synchronize access point transmission with sensor reception.
11. The wireless network system of claim 9 , wherein the processor is further configured to perform packet level processing of data from the wireless sensor to determine if a known attack signature stored in a memory of the processor can been identified in the data indicating an intrusion.
12. The wireless network system of claim 9 , wherein the processor is further configured to perform packet level processing of data from the wireless sensor to determine if a number of association and disassociation requests for a defined time interval exceeds a predetermined protocol threshold indicating an intrusion.
13. The wireless network system of claim 9 , wherein the processor is further configured to perform packet level processing of data from the wireless sensor to provide a normalized statistics of activities in each channel, where an intrusion is indicated if the normalized statistics exceed a predetermined threshold.
14. The wireless network system of claim 9 , wherein the processor is further configured to perform packet level processing of data from the wireless sensor to observe activity in each channel, where an intrusion is indicated if the activity violates a stored activity rule.
15. The wireless network system of claim 13 , wherein the processor is configured to apply multiple intrusion detection tests to data received by the sensor, the tests including signature-based testing, protocol-based testing, anomaly-based testing, and policy deviation-based testing, wherein the results of all of these tests are compared to a predefined confidence level to determine an intruder alert.
16. A method of concurrent wireless local area network access and sensing, comprising:
operating two or more collocated radios in a wireless device, wherein each of the two or more collocated radios are configurable as either an access point for wireless the local area network or as a wireless sensor operable for detecting a network intruder; and
adapting a frequency scanning pattern of the wireless radio operable as the wireless sensor for avoiding an operating frequency in proximity to a channel used by a wireless radio operable as an access point for transmitting.
17. The method of concurrent wireless local area network access and sensing of claim 16 , further comprising:
responsive to the wireless sensor transmitting, synchronizing transmissions of the access point to the wireless sensor reception.
18. The method of concurrent wireless local area network access and sensing of claim 17 , wherein synchronizing is also performed in response to channel usage and transmission power.
19. The method of concurrent wireless local area network access and sensing of claim 16 , further comprising:
scanning a plurality of channels with the wireless sensor in accordance with the frequency scanning pattern; and
adapting how long each channel of the frequency scanning pattern is monitored responsive to a risk history associated with each channel.
20. The method of concurrent wireless local area network access and sensing of claim 16 , further comprising:
changing functionality of the wireless radios between being an access point and a sensor, wherein more of the wireless radios are configurable to operate as access points than sensors during higher bandwidth periods and wherein more of the wireless radios are configurable to operate as sensors than access points during lower bandwidth periods.