Method for detecting anomalies on Wi-Fi stations.

Abstract

A method for detecting an association anomaly between a Wi-Fi station and an access point in a communication network, comprising: - each time the Wi-Fi station sends a Wi-Fi standard management frame, known as a "Probe Request," containing a MAC address and content, the following steps are performed: - identification of the content, - application of a unique identification algorithm to the content to generate a unique content identification code, - storage of the unique code within the access point, - verification if the Wi-Fi station is associated with the access point, - if not associated, verification if the unique code is known in the access point and if the Wi-Fi station linked to this unique code has already been associated with the access point; - if so, generation of an alert signal. Figure for the abstract: Fig. 5

Description

Title of the invention: Method for detecting anomalies on Wi-Fi stations. technical field

[0001] The present invention relates to a method for detecting an association anomaly of a Wi-Fi station to an access point of a communication network.

[0002] Such a network is in particular a home network equipped with a gateway as an access point allowing local equipment to be connected to the internet.

[0003] Prior art

[0004] In general, Wi-Fi is the most widely used medium for transmitting data in the home. It is used by a large and growing number of different devices (smartphones, tablets, PCs, TV decoders, IoT devices, etc.) and for a wide variety of uses: email, telephony, live video, OTT video, IoT monitoring, etc.

[0005] Wi-Fi technologies are becoming more complex and providing complementary tools that allow for the optimization of certain characteristics of the streams, while taking into account certain constraints: 802.11e, 802.1lu, 802.11ax, OFDMA, ...

[0006] Similarly, because Wi-Fi technologies are evolving very rapidly, some Wi-Fi equipment already on the market is sometimes incompatible with these developments. For a telecommunications operator deploying a new Wi-Fi technology in a home, it is important not to introduce new problems for its customers' Wi-Fi equipment.

[0007]

[0008] Some stations may occasionally have difficulty using a gateway's Wi-Fi network. These difficulties manifest as an inability to establish a Wi-Fi connection, and the reasons may be numerous: incompatibility of the Wi-Fi station with a particular Wi-Fi standard, incompatibility with a security mode currently in use by the home gateway, or an outdated Wi-Fi driver present on the client's equipment.

[0009]

[0010] It is difficult to detect that a Wi-Fi station can no longer connect to the network because it can use a random MAC address. The home gateway therefore cannot distinguish whether it is a Wi-Fi station already known to its network.

[0011]

[0012] The present invention aims to detect anomalies in the Wi-Fi connection between Wi-Fi stations and a gateway within a home network.

[0013] Another objective of the invention is to optimize the management of Wi-Fi stations within a communication network access point. Description of the invention

[0014] At least one of the aforementioned objectives is achieved with a method for detecting an association anomaly between a Wi-Fi station and an access point of a communication network. According to the invention, each time the Wi-Fi station sends a Wi-Fi standard management frame, called a "Probe Request," comprising a MAC address and content, the following steps are performed: - identification of the content, - application of a unique identification algorithm to the content in order to generate a unique content identification code, - storage of the unique code within the access point, - checking if the Wi-Fi station is associated with the access point, - if not associated, check if the unique code is known in the access point and if the Wi-Fi station linked to this unique code has already been associated with the access point; - if the unique code is known in the access point and if the Wi-Fi station linked to this unique code has already been associated with the access point, an alert signal is generated.

[0015]

[0016] The method according to the invention uses a management frame of the Wi-Fi standard, the "Probe Request". This frame is used by Wi-Fi stations to identify nearby networks. It is a relevant indicator because during an association attempt, this "Probe Request" is systematically sent by the Wi-Fi station.

[0017] If this Wi-Fi standard management frame is present but the Wi-Fi station linked to this Wi-Fi standard management frame is not associated with the network access point, then there is considered to be an interoperability problem between the access point and this Wi-Fi station. The present invention therefore makes it possible to detect the presence of this "Probe Request" by associating it with a Wi-Fi station known to the access point.

[0018] Unique identification could be achieved using the physical address of the Wi-Fi station, i.e., the MAC address. However, since this address, which is supposed to be unique, sometimes changes, the present invention provides for the creation of a unique, unchanging code.

[0019] By retaining only the content of the "Probe Request", the random component is removed and the access point is thus able to link the "Probe Request" to a known device on the network.

[0020] Thus, during a subsequent association attempt, the Wi-Fi station will send a "Probe Request." If the unique code calculated from this "Probe Request" is known to the access point and the Wi-Fi station associated with this unique code is not connected, then the access point considers that this Wi-Fi station is unable to associate and raises an alert. If the station succeeds in connecting, then the alert is lifted.

[0021] Checking whether the Wi-Fi station linked to the unique code has already been associated with the access point consists of checking whether the Wi-Fi station has subsequently been associated and then disassociated from the access point, i.e. whether there has already been a successful association before.

[0022] The check to see if the Wi-Fi station is associated with the access point is carried out immediately, at each "Probe Request" received by the access point.

[0023] With the method according to the invention, if an operator decides to modify a Wi-Fi parameter on an access point, this operator is informed of possible incompatibilities with a client's Wi-Fi equipment, even if the latter uses a random MAC address.

[0024]

[0025] According to an advantageous feature of the invention, the unique identification algorithm can be a hash function.

[0026] This function can more precisely be an MD5 cryptographic hash function. Such a function makes it possible to calculate a unique identifier from a numerical value. This allows Wi-Fi stations to be distinguished from one another.

[0027]

[0028] According to an advantageous embodiment of the invention, the communication network may include several access points including a gateway and at least one repeater, the steps of storing the unique code and verification being carried out within the gateway.

[0029] In this case, the step of verifying whether the Wi-Fi station linked to the unique code has already been associated applies to all access points. Specifically, it checks whether the Wi-Fi station has already been associated with one of the access points.

[0030] According to the invention, a gateway processing unit can be configured to perform the steps of the process according to the invention. The intelligence is in the gateway.

[0031]

[0032] In other words, in a network including repeaters and a home gateway, each time a "Probe Request" is received on one of the network devices, a unique code is calculated and then saved in the home gateway for future comparison.

[0034] According to one embodiment of the invention, the content may include the number of antennas of the Wi-Fi station or the maximum frequency band of the Wi-Fi station. These are elements relating to the Wi-Fi capabilities of the equipment. Obviously, the content of the Wi-Fi standard management frame may include elements other than those mentioned.

[0035]

[0036] According to a preferred embodiment of the invention, for communication according to the IEEE 802.11 standard, the content is the “IEEE 802.11 Wireless management” section. In particular, variable information such as the destination address or the source address is not retained.

[0037]

[0038] According to one embodiment of the invention, the communication network can be a home network, the access point comprising an internet connection router.

[0039] Such a router can be, for example, a gateway, a "homegateway" in English, or any other device capable of connecting user equipment to the internet.

[0040]

[0041] According to another aspect of the invention, a communication network is proposed to detect an association anomaly of a Wi-Fi station to an access point; this access point being configured to implement a method according to the invention.

[0042]

[0043] The present invention also relates to a computer program product comprising instructions which, when the program is executed by a processing unit in an access point, cause the latter to implement the process according to the invention.

[0044] Description of figures and embodiments.

[0045] Other advantages and features of the invention will become apparent from the detailed description of implementations and embodiments, which are by no means limiting, and from the following accompanying drawings:

[0046] [Fig.1] Fig.1 is a schematic view of a house equipped with an access point in the form of an internet gateway and a user's Wi-Fi stations;

[0047] [Fig.2] The [Fig.2] is a flowchart illustrating steps of a process according to the invention;

[0048] [Fig.3] The [Fig.3] is a schematic view illustrating the fields in a standard Wi-Fi management frame of the "Probe Request" type according to the invention;

[0049] [Fig.4] Fig.4 is a simplified schematic view of frames sent by a Wi-Fi station to an access point; and

[0050] [Fig.5] The [Fig.5] is a simplified schematic view of frames sent by a Wi-Fi station to an access point according to the invention.

[0051] The embodiments described below are not in any way limiting; in particular, variants of the invention may be implemented comprising only a selection of the features described below, isolated from the other features described, if this selection of features is sufficient to confer a technical advantage or to differentiate the invention from the prior art. This selection includes at least one preferably functional feature without structural details, or with only a portion of the structural details if this portion alone is sufficient to confer a technical advantage or to differentiate the invention from the prior art.

[0052] The [Fig.1] The [Fig.1] is a schematic view illustrating a house 1 equipped with an access point 2 which is a gateway allowing access to the internet 3 via a wired connection 4 based on coaxial cable or optical fiber.

[0053] The access point 2 includes a processing unit 7, such as a microcontroller for example, to implement the method according to the invention and a Wi-Fi module 8 for wireless communication with equipment.

[0054] Home equipment can connect via wired or wireless means to access point 2 to access the internet 3.

[0055] In the example of [Fig. 1], a television 5 and a Wi-Fi station, such as a smartphone 6, are shown, both connected wirelessly to the gateway 2 via Wi-Fi. When the television 5 is switched on, a digital television service is activated between the television 5 and the access point 2.

[0056] The mobile phone 6 is capable of connecting to the gateway 2 to access the internet by implementing different types of services: web, download, telephony, ...

[0057] The access point 2, television 5 and mobile phone 6 together form a home network.

[0058] The access point 2 comprises conventional hardware and software means for serving as an access point and repeater between equipment and the internet and further comprise one and / or the other a computer program product for implementing the method according to the invention.

[0059] When the mobile phone 6 is activated, it attempts to identify nearby Wi-Fi access points. When an access point is identified, an association attempt is made.

[0060] Fig. 2 is a flowchart illustrating the steps in implementing the process according to the invention.

[0061] A step 9 is distinguished during which the Wi-Fi station transmits a Wi-Fi standard management frame, called a "Probe Request". This frame is received by the access point 2, which is a home gateway to the internet. The frame includes a MAC address and content.

[0062] Figure 3 shows a screenshot of the frame. It is divided into a first part, which is the frame header, and a second part, which is the content according to the invention. The first part comprises fields located from "Type / Subtype:" to "[FCS Status: Unverified]". The content according to the invention comprises all the characteristics entered in the fields from "Tagged parameters" to "Tag: Vendor Specifies: Broadcom".

[0063] In step 10 of [Fig. 2], the access point identifies the content according to the invention. A digital file is then created. In step 11, an MD5 hash is then applied to this digital file to obtain a unique code 12.

[0064] At step 13, the unique code is saved within the gateway.

[0065] In step 14, it is checked whether the Wi-Fi station, i.e. the phone 6, is associated with the access point 2.

[0066] If the answer is "yes", nothing happens in step 16.

[0067] If the answer is "no", we then check in step 15 whether the unique code is The system determines whether the Wi-Fi station associated with that unique code has previously been linked to the access point. Specifically, it tries to determine if phone 6 has been linked to access point 2 at least once in the past.

[0068] In the negative, the "no", nothing happens in step 16.

[0069] If the answer is "yes," an alert signal is generated, for example, via the internet to a remote server of the operator. This alert signal can advantageously remain local to the gateway but can also be propagated throughout the home network or to the cloud via a secure tunnel (MQTT) in both cases.

[0070] When the alert signal is local, it may be a software signal sent to a gateway application for the implementation of corrective actions, and / or a message sent over the local network to other network equipment, such as a Wi-Fi repeater.

[0071] Figure 4 shows an embodiment according to the prior art. Figure 4a illustrates a first association of the Wi-Fi station with the access point. Figure 4b illustrates a second association of the Wi-Fi station with the access point at a later time.

[0072] Figure 4a shows a first phase in which a Wi-Fi station transmits a "Probe Request" frame at time t0. This frame obviously includes the MAC address of the Wi-Fi station. In a second phase, during an association attempt at time t1, the Wi-Fi station also transmits the same MAC address. In such a situation, where the Wi-Fi station uses the same MAC address for both the "Probe Request" and its association, it is easy for the access point to detect the presence of this equipment.

[0073] Figure 4b relates to a second phase in which a Wi-Fi station transmits a "Probe Request" frame at time t0. This frame obviously includes the MAC address of the Wi-Fi station. Subsequently, during an association attempt, at time t1, the Wi-Fi station transmits a MAC address different from the one sent in the "Probe Request". In such a situation, the fact that the Wi-Fi station uses a different MAC address between the "Probe Request" and its association prevents linking the "Probe Request" to the association.

[0074] The MAC address is notably different by implementation of the manufacturer to mask its presence and avoid identification of the station.

[0075] It is therefore necessary to remove the random component of the "Probe Request" due to the fact that the MAC address is sometimes different.

[0076] The MAC address can be random, but not necessarily the data contained in the "Probe Request". By separating the two sets and creating, for example, an MD5 hash of the content, we obtain a unique code for the Wi-Fi station, as will be seen in [Fig. 5].

[0077]

[0078] Figure 5 shows an embodiment according to the invention. Figure 5a illustrates a first association of the Wi-Fi station with the access point. Figure 5b illustrates a second association of the Wi-Fi station with the access point at a later time.

[0079] Figure 5a shows the same steps as Figure 4a, with the addition of calculating the unique code at time t0 upon receipt of the "Probe Request" frame. During the association attempt, at time t1, the Wi-Fi station also transmits the same MAC address. In such a situation, where the Wi-Fi station uses the same MAC address for both the "Probe Request" and its association, it is easy for the access point to detect the presence of this equipment.

[0080]

[0081] Figure 5b relates to the same steps as in Figure 4b, with the addition here of calculating the unique code at time t0 during the transmission of the "Probe Request" frame. Similarly, we consider the case where, during the association attempt, at time t1, the Wi-Fi station transmits a MAC address different from the one sent in the "Probe Request". With the present invention, if the association fails, the unique code is used to identify the Wi-Fi station and to determine that this Wi-Fi station had already associated in the past during the phase described in Figure 5a.

[0082]

[0083] Thus, with the method according to the invention, any connection anomaly of a Wi-Fi station to an access point is detected.

[0085] Of course, the invention is not limited to the examples just described. Numerous modifications can be made to these examples without departing from the scope of the present invention as described.

Claims

Demands

1. A method for detecting an association anomaly of a Wi-Fi station with an access point of a communication network, comprising: - for each transmission, by the Wi-Fi station, of a Wi-Fi standard management frame, called a "Probe Request", including a MAC address and content, carrying out the following steps: - identification of the content, - application of a unique identification algorithm to the content so as to generate a unique content identification code, - storage of the unique code within the access point, - verification if the Wi-Fi station is associated with the access point, - if not associated, verification if the unique code is known in the access point and if the Wi-Fi station linked to this unique code has already been associated with the access point; - if the unique code is known in the access point and if the Wi-Fi station linked to this unique code has already been associated with the access point, generation of an alert signal.

2. A method according to claim 1, characterized in that the unique identification algorithm is a hash function.

3. A method according to claim 1 or 2, characterized in that the unique identification algorithm is an MD5 cryptographic hash function.

4. A method according to any one of the preceding claims, characterized in that the communication network comprises several access points including a gateway and at least one repeater, the steps of storing the unique code and verification being carried out within the gateway.

5. A method according to any one of the preceding claims, characterized in that the content comprises a number of antennas of the Wi-Fi station.

6. A method according to any one of the preceding claims, characterized in that the content comprises a maximum frequency band of the Wi-Fi station.

7. A method according to any one of the preceding claims, characterized in that for communication according to the IEEE 802.11 standard, the content is the part “IEEE 802.11 Wireless management”.

8. A method according to any one of the preceding claims, ca- characterized in that the communication network is a home network, the access point including an internet connection router.

9. Communication network for detecting an association anomaly of a Wi-Fi station to an access point, characterized in that the access point is configured to implement a method according to any one of the preceding claims.

10. Product computer program comprising instructions which, when the program is executed by a processing unit in an access point, cause the processing unit to implement the method according to any one of claims 1 to 8.

Images