# US 12,192,771 B2 · Collaborative wireless intrusion protection system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,771 B2 - Document ID: US12192771B2 - Status: Granted - Kind: B2 - Application number: 17/785,519 - Filed: 2020-12-14 - Published: 2023-02-02 - Granted: 2025-01-07 - Earliest claimed: 2020-01-08 - Assignees: Ruckus IP Holdings LLC - Applicants: Ruckus IP Holdings LLC - Inventors: Raghavendra Sadaramachandra; Wen Chen - Web page: https://patentgrep.com/patent/US12192771B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 84/12: WLAN [Wireless Local Area Networks] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A controller may receive information identifying a rogue access point operating on a channel in the WLAN. In response, the controller may provide instructions to at least a subset of the access points, where the instructions indicate that at least the subset of the access points collaboratively attack the rogue access point, and where a given instruction for a given access point specifies a schedule of attacks by the given access point. In some embodiments, the controller selects at least the subset of the access points based at least in part on one or more parameters, including: an ability to receive transmissions from the rogue access point; traffic loading; communication performance; a number of associated electronic devices; proximity to the rogue access point; and/or operating channels. ## Claims ### Claim 1 A controller, comprising: an interface circuit configured to communicate with access points in a wireless local area network (WLAN), wherein the controller is configured to: receive, at the interface circuit, information identifying a rogue access point operating on a channel in the WLAN; and provide, from the interface circuit, instructions addressed to at least a subset of the access points, wherein the instructions indicate that at least the subset of the access points collaboratively attack the rogue access point, and wherein a given instruction for a given access point specifies a schedule of attacks by the given access point. ### Claim 2 (depends on 1) The controller of claim 1, wherein the information is associated with one or more of the access points. ### Claim 3 (depends on 1) The controller of claim 1, wherein the schedule comprises time intervals when the given access point attacks the rogue access point; and wherein, when the given access point attacks the rogue access point, a remainder of the access points in at least the subset of the access points do not attack the rogue access point. ### Claim 4 (depends on 1) The controller of claim 1, wherein the given instruction indicates that, during an instance of an attack, the given access point: transitions from an operating channel of the given access point to the channel; transmits de-authentication messages associated with the rogue access point; and transitions from the channel to the operating channel of the given access point. ### Claim 5 (depends on 1) The controller of claim 1, wherein the controller is configured to select at least the subset of the access points. ### Claim 6 (depends on 5) The controller of claim 5, wherein at least the subset of the access points is selected based at least in part on one of more of: at least the subset of the access points having previously reported receiving transmissions associated with the rogue access point; traffic loading of at least the subset of the access points; communication performance of at least the subset of the access points; a number of electronic devices associated with at least the subset of the access points; or proximity of at least the subset of the access points to the rogue access point. ### Claim 7 (depends on 1) The controller of claim 1, wherein the controller is configured to select at least the subset of the access points having operating channels that are the same as the channel. ### Claim 8 A non-transitory computer-readable storage medium for use in conjunction with a controller, the computer-readable storage medium storing program instructions that, when executed by the controller, cause the controller to perform operations, comprising: receiving, at an interface circuit, information identifying a rogue access point operating on a channel in a wireless local area network (WLAN); and providing, from the interface circuit, instructions addressed to at least a subset of access points, wherein the instructions indicate that at least the subset of the access points collaboratively attack the rogue access point, and wherein a given instruction for a given access point specifies a schedule of attacks by the given access point. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the information is associated with one or more of the access points. ### Claim 10 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the schedule comprises time intervals when the given access point attacks the rogue access point; and wherein, when the given access point attacks the rogue access point, a remainder of the access points in at least the subset of the access points do not attack the rogue access point. ### Claim 11 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the given instruction indicates that, during an instance of an attack, the given access point: transitions from an operating channel of the given access point to the channel; transmits de-authentication messages associated with the rogue access point; and transitions from the channel to the operating channel of the given access point. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the operations comprise selecting at least the subset of the access points. ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein at least the subset of the access points is selected based at least in part on one of more of: at least the subset of the access points having previously reported receiving transmissions associated with the rogue access point; traffic loading of at least the subset of the access points; communication performance of at least the subset of the access points; a number of electronic devices associated with at least the subset of the access points; or proximity of at least the subset of the access points to the rogue access point. ### Claim 14 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the operations comprise selecting at least the subset of the access points having operating channels that are the same as the channel. ### Claim 15 A method for facilitating collaborative attacks on a rouge rogue access point, comprising: by a controller; receiving, at an interface circuit, information identifying a rogue access point operating on a channel in a wireless local area network (WLAN); and providing, from the interface circuit, instructions addressed to at least a subset of access points, wherein the instructions indicate that at least the subset of the access points collaboratively attack the rogue access point, and wherein a given instruction for a given access point specifies a schedule of attacks by the given access point. ### Claim 16 (depends on 15) The method of claim 15, wherein the information is associated with one or more of the access points. ### Claim 17 (depends on 15) The method of claim 15, wherein the schedule comprises time intervals when the given access point attacks the rogue access point; and wherein, when the given access point attacks the rogue access point, a remainder of the access points in at least the subset of the access points do not attack the rogue access point. ### Claim 18 (depends on 15) The method of claim 15, wherein the given instruction indicates that, during an instance of an attack, the given access point: transitions from an operating channel of the given access point to the channel; transmits de-authentication messages associated with the rogue access point; and transitions from the channel to the operating channel of the given access point. ### Claim 19 (depends on 15) The method of claim 15, wherein the method comprises selecting at least the subset of the access points; and wherein at least the subset of the access points is selected based at least in part on one of more of: at least the subset of the access points having previously reported receiving transmissions associated with the rogue access point; traffic loading of at least the subset of the access points; communication performance of at least the subset of the access points; a number of electronic devices associated with at least the subset of the access points; or proximity of at least the subset of the access points to the rogue access point. ### Claim 20 (depends on 15) The method of claim 15, wherein the method comprises selecting at least the subset of the access points having operating channels that are the same as the channel.