# US 12,113,783 B2 · Wireless-network attack detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,783 B2
- Document ID: US12113783B2
- Status: Granted
- Kind: B2
- Application number: 17/503,007
- Filed: 2021-10-15
- Published: 2022-02-03
- Granted: 2024-10-08
- Earliest claimed: 2019-02-21
- Assignees: T-Mobile USA, Inc.
- Applicants: T-Mobile USA, Inc.
- Inventors: Antoine T. Tran; Emile Minh Tran
- Web page: https://patentgrep.com/patent/US12113783B2

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3271: {using challenge-response}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04W 12/0431: Key distribution or pre-distribution; Key agreement
- H04W 12/069: using certificates or pre-shared keys
- H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W 60/00: Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
- H04L 2209/80: Wireless
- H04L 2463/146: Tracing the source of attacks
- H04W 8/20: Transfer of user or subscriber data
- H04W 8/26: Network addressing or numbering for mobility support
- H04W 12/03: Protecting confidentiality, e.g. by encryption
- H04W 12/71: Hardware identity
- H04W 12/72: Subscriber identity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

In some examples, a terminal can establish wireless communication with a base station. The terminal can determine a challenge, transmit the challenge, receive a response, and determine that the response is valid. The terminal can, in response, establish a secure network tunnel to a network node. In some examples, a terminal can determine a first communication parameter associated with communication with the base station. The terminal can receive data indicating a second communication parameter via a secure network tunnel. The terminal can determine that the communication parameters do not match, and, in response, provide an indication that an attack is under way against the network terminal. Some example terminals transmit a challenge, determine a response status associated with the challenge, and determine that an attack is under way based on the response status.

## Claims

### Claim 1

A network terminal, comprising:
a secure storage unit comprising a non-transitory computer readable medium having stored therein a stored key; and
a control unit configured to perform operations comprising:
attaching to a wireless network using stored network credentials;
determining a challenge for authenticating the wireless network;
establishing secure network tunnel with a network node via the wireless network;
after attaching to the wireless network, transmitting, via the secure network tunnel, the challenge for authenticating the wireless network to the network node via the wireless network;
subsequently, determining a response status associated with the challenge;
determining that an attack is under way based at least in part on the response status;
providing an indication that the attack is under way in response to the determining that the attack is under way; and
wherein at least:
the determining the challenge is based at least in part on the stored key; or
the determining that the attack is under way is based at least in part on the stored key.

### Claim 2 (depends on 1)

The network terminal according to claim 1, the operations further comprising:
receiving a response to the challenge via the wireless network; and
determining the response status comprising the response; and
wherein the determining that the attack is under way further comprises determining that the response is not valid.

### Claim 3 (depends on 1)

The network terminal according to claim 1, the operations further comprising:
setting a timeout associated with the transmitting of the challenge;
subsequently, determining that the timeout has expired and that no response has been received;
in response, determining the response status indicating that no response was received; and
determining that the attack is under way based at least in part on the response status indicating that no response was received.

### Claim 4 (depends on 1)

The network terminal according to claim 1, the operations further comprising:
attaching to a first base station;
determining that a connection should be made to a second, different base station; and
in response, performing the attaching to the wireless network via the second base station.

### Claim 5 (depends on 1)

The network terminal according to claim 1, the operations further comprising:
transmitting an initial message to the wireless network; and
receiving, via the wireless network, authorization to use a network address with a data transport.

### Claim 6

A method comprising, by a network device:
attaching to a wireless network using stored network credentials;
transmitting an initial message to the wireless network;
receiving, via the wireless network, authorization to use a network address with a data transport;
determining a challenge for authenticating the wireless network;
after attaching to the wireless network, transmitting the challenge for authenticating the wireless network to a network node via the wireless network;
subsequently, determining a response status associated with the challenge; and
determining that an attack is under way based at least in part on the response status; and
the method further comprising:
determining the challenge based at least in part on a stored key; or
determining that the attack is under way based at least in part on the stored key.

### Claim 7 (depends on 6)

The method according to claim 6, further comprising:
providing an indication that the attack is under way in response to the determining that the attack is under way.

### Claim 8 (depends on 6)

The method according to claim 6, further comprising:
receiving a response to the challenge via the wireless network; and
determining the response status comprising the response; and
wherein the determining that the attack is under way further comprises determining that the response is not valid.

### Claim 9 (depends on 6)

The method according to claim 6, further comprising:
setting a timeout associated with the transmitting of the challenge;
subsequently, determining that the timeout has expired and that no response has been received;
in response, determining the response status indicating that no response was received; and
determining that the attack is under way based at least in part on the response status indicating that no response was received.

### Claim 10 (depends on 6)

The method according to claim 6, further comprising:
establishing a secure network tunnel with the network node via the wireless network; and
transmitting the challenge via the secure network tunnel.

### Claim 11 (depends on 6)

The method according to claim 6, further comprising:
attaching to a first base station;
determining that a connection should be made to a second, different base station; and
in response, performing the attaching to the wireless network via the second base station.

### Claim 12

At least one tangible, non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations; wherein:
the operations comprise:
attaching to a first base station;
determining that a connection should be made to a second base station that is different from the first base station; and
in response, attaching, via the second base station, to a wireless network using stored network credentials;
determining a challenge for authenticating the wireless network;
after attaching to the wireless network, transmitting the challenge for authenticating the wireless network to a network node via the wireless network;
subsequently, determining a response status associated with the challenge; and
determining that an attack is under way based at least in part on the response status; and
the operations further comprise at least:
determining the challenge based at least in part on a stored key; or
determining that the attack is under way based at least in part on the stored key.

### Claim 13 (depends on 12)

The at least one tangible, non-transitory computer-readable medium according to claim 12, the operations further comprising providing an indication that the attack is under way in response to the determining that the attack is under way.

### Claim 14 (depends on 12)

The at least one tangible, non-transitory computer-readable medium according to claim 12, wherein:
the operations further comprise:
receiving a response to the challenge via the wireless network; and
determining the response status comprising the response; and
the operations for determining that the attack is under way further comprise operations for determining that the response is not valid.

### Claim 15 (depends on 12)

The at least one tangible, non-transitory computer-readable medium according to claim 12, the operations further comprising:
setting a timeout associated with the transmitting of the challenge;
subsequently, determining that the timeout has expired and that no response has been received;
in response, determining the response status indicating that no response was received; and
determining that the attack is under way based at least in part on the response status indicating that no response was received.

### Claim 16 (depends on 12)

The at least one tangible, non-transitory computer-readable medium according to claim 12, the operations further comprising:
establishing a secure network tunnel with the network node via the wireless network; and
transmitting the challenge via the secure network tunnel.

### Claim 17 (depends on 12)

The at least one tangible, non-transitory computer-readable medium according to claim 12, wherein the operations for attaching to the wireless network comprise operations for:
transmitting an initial message to the wireless network; and
receiving, via the wireless network, authorization to use a network address with a data transport.