Rogue Wireless Access Point Detection via MAC Address Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Rogue wireless access points connected to networks without authorization can bypass security controls, compromising network security by allowing unauthorized access and data interception.
Innovation Solution
A system that detects rogue wireless access points by comparing Media Access Control (MAC) addresses associated with wireless interfaces to those associated with wired interfaces, using a threshold difference to identify potential rogue devices and correlating location information to determine the presence of unauthorized access points, enabling automated detection and remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If wireless access points are authorized and compliant with security policy, then network security is improved, but device complexity increases due to security settings and authentication requirements
Solution Approach 1:
The patent extracts the security verification function from the wireless access point itself and places it in the network infrastructure (authentication server). The access point simply provides wireless connectivity, while the network server handles security policy enforcement, MAC address validation, and rogue detection, thereby reducing complexity at the access point while maintaining security.
Solution Approach 2:
The patent introduces an intermediary authentication server that mediates between wireless access points and the network. This server acts as a trusted third party that validates access point credentials, checks MAC address consistency, and enforces security policies, simplifying the access point design while ensuring network security.
2Reliability
If rogue wireless access points are detected and removed, then network security is improved, but detection accuracy may be reduced due to false positives from legitimate devices
Solution Approach 1:
The patent implements a feedback mechanism where the authentication server continuously monitors wireless connections and compares MAC addresses against authorized device lists. When a discrepancy is detected (indicating a rogue access point), the system provides feedback to block the suspected device. This iterative verification process improves detection accuracy by cross-validating multiple data points.
Solution Approach 2:
The patent performs preliminary actions by maintaining an updated database of authorized MAC addresses before detecting potential rogues. The system proactively validates each wireless connection against this pre-established list, enabling early detection of unauthorized access points before they can compromise network security.
3Difficulty of detecting and measuring
If MAC address comparison is performed to detect rogues, then detection capability is improved, but processing time increases due to data comparison and correlation operations
Solution Approach 1:
The patent performs preliminary action by pre-compiling and storing authorized MAC addresses in a database before runtime analysis. This allows the system to use fast database lookup operations during actual rogue detection, avoiding time-consuming real-time verification and significantly reducing processing time while maintaining high detection capability.
Data Source
AI summary
A method includes, receiving a first set of media access control (MAC) addresses from one or more wireless communication detection devices of a network. The method also includes receiving a second set of MAC addresses from one or more wired devices of the network. The second set of MAC addresses corresponds to devices with wired connections to the network. The method further includes, determining that a wireless device having a first MAC address of the first set of media access control addresses is a potential rogue wireless device when a numeric value of the first MAC address and a numeric value of a second MAC address of the second set of MAC addresses differ by no more than a threshold amount and when a first location associated with a device that detects the first MAC address matches a second location associated with the second MAC address.