Back to results
US 11,689,928 B2Granted
Detecting unauthorized access to a wireless network
AssigneeAT&T Capital Services, Inc.
InventorsPlamen Vanchev, Bashar Abdul-Majeed
Life of this patent
Estimating the term…
Abstract
Systems and methods detect a potential hacking attack by monitoring the number and timing of DELBA (Delete Block Acknowledgement) action frames. When the number and timing of the DELBA action frames correspond to an unauthorized access pattern, an unauthorized access is detected. The potential unauthorized access may be detected by an access point (AP) or by the AP and a backend system. When a potential unauthorized access is detected, the AP may remain in silent mode for a longer period of time and limit access to the network to only trusted devices. In addition, an alarm or other notification of the potential unauthorized access may be provided to a user or other designated contact.
Claims20
A method comprising:
- receiving, at a wireless access point, a first communication;
- determining, by the wireless access point, whether the first communication corresponds to a Delete Block Acknowledgement (DELBA) action frame;
- in response to determining that the first communication corresponds to a DELBA action frame,
- adjusting, by the wireless access point, a counter of DELBA action frames to account for receipt of the DELBA action frame, wherein the counter of DELBA action frames is maintained by the wireless access point, and
- determining, by the wireless access point, based at least in part on the counter of DELBA action frames, whether a number of DELBA action frames received over a period of time corresponds to a predetermined unauthorized access pattern;
- in response to determining that the number of DELBA action frames received over the period of time corresponds to the predetermined unauthorized access pattern,
- detecting, by the wireless access point, that conditions indicate a potential unauthorized access, and
- moving, by the wireless access point, from operating under normal conditions into a defensive mode, wherein the wireless access point enters a silent mode associated with a default time period while operating under normal conditions and enters a silent mode associated with a defensive time period while operating under the defensive mode, and wherein the default time period of the silent mode while operating under normal conditions is less than the defensive time period of the silent mode while operating under the defensive mode;
- and
- while in the defensive mode,
- receiving, at the wireless access point, a second communication,
- comparing, by the wireless access point, a Media Access Control (MAC) address associated with the second communication to a list of trusted MAC addresses, and
- when the MAC address associated with the second communication corresponds to a MAC address on the list of trusted MAC addresses, allowing, by the wireless access point, access to a wireless network.
10 more elements
A wireless access point comprising:
- a wireless interface for communicating with a plurality of wireless devices;
- a processing device;
- and
- a memory for storing computer-readable instructions that, when executed by the processing device, cause the wireless access point to perform operations comprising
- receiving, via the wireless interface, a first communication,
- determining whether the first communication corresponds to a Delete Block Acknowledgement (DELBA) action frame,
- in response to determining that the first communication corresponds to a DELBA action frame,
- adjusting a counter of DELBA action frames to account for receipt of the DELBA action frame, wherein the counter of DELBA action frames is maintained by the wireless access point, and
- determining, based at least in part on the counter of DELBA action frames, whether a number of DELBA action frames received over a period of time corresponds to a predetermined unauthorized access pattern,
- in response to determining that the number of DELBA action frames received over the period of time corresponds to the predetermined unauthorized access pattern,
- detecting that conditions indicate a potential unauthorized access, and
- moving from operating under normal conditions into a defensive mode, wherein the wireless access point enters a silent mode associated with a default time period while operating under normal conditions and enters a silent mode associated with a defensive time period while operating under the defensive mode, and wherein the default time period of the silent mode while operating under normal conditions is less than the defensive time period of the silent mode while operating under the defensive mode, and
- while in the defensive mode,
- receiving a second communication via the wireless interface,
- comparing a Media Access Control (MAC) address associated with the second communication to a list of trusted MAC addresses, and
- when the MAC address associated with the second communication corresponds to a MAC address on the list of trusted MAC addresses, allowing, by the wireless access point, access to a wireless network.
13 more elements
A non-transitory computer readable medium having computer readable instructions stored thereon that, when executed by a processing device of a wireless access point, cause the wireless access point to perform operations comprising:
- receiving a first communication;
- determining whether the first communication corresponds to a Delete Block Acknowledgement (DELBA) action frame;
- in response to determining that the first communication corresponds to a DELBA action frame,
- adjusting a counter of DELBA action frames to account for receipt of the DELBA action frame, wherein the counter of DELBA action frames is maintained by the wireless access point, and
- determining, based at least in part on the counter of DELBA action frames, whether a number of DELBA action frames received over a period of time corresponds to a predetermined unauthorized access pattern;
- in response to determining that the number of DELBA action frames received over the period of time corresponds to the predetermined unauthorized access pattern,
- detecting that conditions indicate a potential unauthorized access, and
- moving from operating under normal conditions into a defensive mode, wherein the wireless access point enters a silent mode associated with a default time period while operating under normal conditions and enters a silent mode associated with a defensive time period while operating under the defensive mode, and wherein the default time period of the silent mode while operating under normal conditions is less than the defensive time period of the silent mode while operating under the defensive mode;
- and
- while in the defensive mode,
- receiving a second communication,
- comparing a Media Access Control (MAC) address associated with the second communication to a list of trusted MAC addresses, and
- when the MAC address associated with the second communication corresponds to a MAC address on the list of trusted MAC addresses, allowing, by the wireless access point, access to a wireless network.
10 more elements
Dependencies are inferred from the claim text.