Rogue access point detection

摘要

A public wireless access point network includes authorized access points sharing the same SSID and connected to a network core which implements centralized authentication so that wireless client devices can roam between authorized access points. Each authorized access point is adapted to detect the presence of unauthorized rogue access points posing as authorized access points. The authorized access points inspect data packets received from wireless client devices which have roamed into range and from the addressing information in the MAC layer and IP layer can determine whether the wireless device has previously connected to a rogue access point. If such a determination is made, the user of the device is alerted that their confidential information may have been compromised.

主权项

1. A method of detecting unauthorised wireless access points within a wireless access network having a plurality of authorised access points, a network core and a plurality of client devices, the method being performed by each authorised access point and comprising:
establishing a connection from one of the client devices to an authorised access point; receiving data packets from the one of the client devices connected to the authorised access point, wherein said one of the client devices was previously connected to another access point in the wireless access network and the received data packets are addressed to that another access point; upon receipt, at the authorised access point, of the data packets addressed to the another access point and transmitted from the one of the client devices connected to the authorised access point, initiating performance of an unauthorised access point detection including:
analysing network address information contained in the data packet, the analysed network address information including the network information of the another wireless access network that said one of the client devices was previously connected to; anddetermining the presence of an unauthorised wireless access point by comparing said analysed network address information against predetermined criteria, the analysed network address information including the network information of the another wireless access network that said one of the client devices was previously connected to; andalerting said connected one of the client devices that an unauthorised wireless access point has been detected if the network address information in the received packet does not match predetermined criteria.