Back to results
US 11,057,769 B2Granted
Detecting unauthorized access to a wireless network
AssigneeAT&T Digital Life, Inc.
InventorsPlamen Vanchev, Bashar Abdul-Majeed
Life of this patent
Estimating the term…
Abstract
Systems and methods detect a potential hacking attack by monitoring the number and timing of DELBA (Delete Block Acknowledgement) action frames. When the number and timing of the DELBA action frames correspond to an unauthorized access pattern, an unauthorized access is detected. The potential unauthorized access may be detected by an access point (AP) or by the AP and a backend system. When a potential unauthorized access is detected, the AP may remain in silent mode for a longer period of time and limit access to the network to only trusted devices. In addition, an alarm or other notification of the potential unauthorized access may be provided to a user or other designated contact.
Claims10
A method for managing access to a wireless network, the method comprising:
- receiving, at a wireless access point, a communication from a wireless device;
- processing, by the wireless access point, the communication to determine whether the communication corresponds to a Delete Block Acknowledgement (DELBA) action frame;
- in response to determining that the communication corresponds to a DELBA action frame,
- adjusting, by the wireless access point, a counter of DELBA action frames to account for receipt of the DELBA action frame, wherein the counter of DELBA action frames is maintained by the wireless access point, and
- determining, by the wireless access point, whether a number of DELBA action frames received over a period of time indicated by the counter of DELBA action frames corresponds to a predetermined unauthorized access pattern specifying a threshold number of DELBA action frames received within a predetermined time interval;
- in response to determining that the counter of DELBA action frames corresponds to the predetermined unauthorized access pattern,
- detecting, by the wireless access point, that conditions indicate a potential unauthorized access, and
- moving, by the wireless access point, from operating under normal conditions into a defensive mode, wherein the wireless access point enters a silent mode associated with a default time period while operating under normal conditions and enters a silent mode associated with a defensive time period while operating under the defensive mode, and wherein the default time period of the silent mode while operating under normal conditions is less than the defensive time period of the silent mode while operating under the defensive mode;
- while in the defensive mode, receiving, at the wireless access point, a second communication;
- comparing, by the wireless access point, a Media Access Control (MAC) address associated with the second communication to a list of trusted MAC addresses;
- when the MAC address associated with the second communication corresponds to a MAC address on the list of trusted MAC addresses, allowing, by the wireless access point, access to the wireless network;
- and
- updating the predetermined unauthorized access pattern with at least one of a different threshold number of DELBA action frames, a pattern of DELBA action frames, or a different defensive time period associated with the silent mode while operating under the defensive mode using maximum likelihood criteria based on patterns and behaviors associated with confirmed unauthorized accesses.
10 more elements
A wireless access point comprising:
- a wireless interface for communicating with a plurality of wireless devices;
- a processing device;
- and
- a memory for storing computer-readable instructions that, when executed by the processing device, cause the wireless access point to perform operations comprising
- receiving, via the wireless interface, a communication from a wireless device,
- processing the communication to determine whether the communication corresponds to a Delete Block Acknowledgement (DELBA) action frame,
- in response to determining that the communication corresponds to a DELBA action frame,
- adjusting a counter of DELBA action frames to account for receipt of the DELBA action frame, wherein the counter of DELBA action frames is maintained by the wireless access point, and
- determining whether a number of DELBA action frames received over a period of time indicated by the counter of DELBA action frames corresponds to a predetermined unauthorized access pattern specifying a threshold number of DELBA action frames received within a predetermined time interval,
- in response to determining that the counter of DELBA action frames corresponds to the predetermined unauthorized access pattern,
- detecting that conditions indicate a potential unauthorized access, and
- moving from operating under normal conditions into a defensive mode, wherein the wireless access point enters a silent mode associated with a default time period while operating under normal conditions and enters a silent mode associated with a defensive time period while operating under the defensive mode, and wherein the default time period of the silent mode while operating under normal conditions is less than the defensive time period of the silent mode while operating under the defensive mode,
- sending a message to a backend system that indicates that a potential unauthorized access is detected,
- while in the defensive mode, receiving a second communication via the wireless interface,
- comparing a Media Access Control (MAC) address associated with the second communication to a list of trusted MAC addresses,
- when the MAC address associated with the second communication corresponds to a MAC address on the list of trusted MAC addresses, allowing access to a wireless network, and
- updating the predetermined unauthorized access pattern with at least one of a different threshold number of DELBA action frames, a pattern of DELBA action frames, or a different defensive time period associated with the silent mode while operating under the defensive mode using maximum likelihood criteria based on patterns and behaviors associated with confirmed hacking attacks.
14 more elements
A server in communication with a wireless access point, the server comprising:
- an access point (AP) interface for communicating with the wireless access point;
- a processing device;
- and
- a memory for storing computer-readable instructions that, when executed by the processing device, cause the server to perform operations comprising
- receiving a communication from the wireless access point via the AP interface, wherein the communication indicates the wireless access point has detected a Delete Block Acknowledgement (DELBA) action frame;
- in response to receiving the communication from the wireless access point indicating that a DELBA action frame has been detected,
- adjusting a counter of DELBA action frames to account for the DELBA action frame, wherein the counter of DELBA action frames is maintained by the server, and
- determining whether a number of DELBA action frames received by the wireless access point over a period of time indicated by the counter of DELBA action frames corresponds to a predetermined unauthorized access pattern specifying a threshold number of DELBA action frames received within a predetermined time interval,
- in response to determining that the counter of DELBA action frames corresponds to the predetermined unauthorized access pattern,
- detecting that conditions indicate a potential unauthorized access, and
- sending a communication to the wireless access point to move from operating under normal conditions into a defensive mode, wherein the wireless access point enters a silent mode associated with a default time period while operating under normal conditions and enters a silent mode associated with a defensive time period while operating under the defensive mode, wherein the default time period of the silent mode while operating under normal conditions is less than the defensive time period of the silent mode while operating under the defensive mode, and wherein the wireless access point, while in the defensive mode, receives a communication via a wireless interface, compares a Media Access Control (MAC) address associated with the communication to a list of trusted MAC addresses, and when the MAC address associated with the communication corresponds to a MAC address on the list of trusted MAC addresses, allows access to a wireless network,
- initiating a message to a user system providing notice of the potential unauthorized access, and
- updating the predetermined unauthorized access pattern with at least one of a different threshold number of DELBA action frames, a pattern of DELBA action frames, and a different defensive time period associated with the silent mode while operating under the defensive mode using maximum likelihood criteria based on patterns and behaviors associated with confirmed hacking attacks.
10 more elements
Dependencies are inferred from the claim text.