History-based downgraded network identification

#Local area networks (LANs) are typically separated into two broad categories: personal/home networks and enterprise/corporate networks. These two categories may also be called, respectively, unmanaged and managed networks. In this context, a managed network may be one comprising one or more network management components such as domain controllers, AAA server (authentication, authorization, and accounting server), or other networking devices which perform network management tasks such as, for example, authentication, whereas unmanaged networks lack such components.

#The two categories of LANs are similar in many respects, but may be implemented differently in their environments. For example, a home LAN typically is a wireless LAN (WLAN) that may have a single wireless access point or a handful of wireless access points, while corporate LANs may have a great number of wireless and/or access points and may be a part of or be connected to a managed network comprising network management components such as domain controllers.

#Conventionally, different types of hardware may be used with the two categories of LANs. This difference may be seen, for example, in the implementation of a gateway for the networks. A gateway is a piece of network equipment which serves to connect two networks by operating as the entry/exit point for data entering or leaving a network. In a home WLAN, a single piece of equipment may act as both a wireless access point and as a gateway, while a corporate LAN may have wireless access points which are connected through a computer network to a gateway separate from the wireless access points.

#The accompanying drawings are not intended to be drawn to scale. In the drawings, each identical or nearly identical component that is illustrated in various figures is represented by a like numeral. For purposes of clarity, not every component may be labeled in every drawing. In the drawings:

#FIG. 1 is a flowchart of an illustrative process of identifying a wireless access point of an unmanaged LAN which may be implemented in accordance with one embodiment of the invention;

#FIG. 2 is a flowchart of an illustrative process of identifying a wireless access point of a managed LAN which may be implemented in accordance with one embodiment of the invention;

#Applicants have appreciated that conventional methods of identifying networks and/or wireless access points suffer from significant risk of networks being spoofed to enable an attack by malicious third parties. A spoofing attack on a computer or computer network is one in which an attacker's device masquerades as a trusted device to gain illegitimate access to the computer or computer network. As an example of such an attack, for a WLAN, while users (e.g., typical users such as end users and/or special users such as administrators) may configure their client devices (e.g., computers) to automatically connect to a WLAN based on a specified SSID, conventional client devices are not capable of verifying that a wireless access point transmitting the specified SSID is the wireless access point to which the user intended to connect. A client device may therefore automatically connect to a wireless access point based on a broadcast SSID without the client device being certain that the wireless access point to which it is connecting is the wireless access point to which it intends to connect and is not, for example, an attacker's device masquerading as the intended or expected wireless access point.

#An attacker may take advantage of this to gain entry to or control of a user's client device, or to obtain information from the user's client device. For example, a user of a client device may configure the client device to automatically connect to a WLAN at a nearby coffee shop when a wireless access point broadcasting the SSID of the “Coffee Shop” is in range (i.e., when the user is in the coffee shop), to automatically connect to a WLAN in the user's home when a wireless access point broadcasting the SSID of “Home” is in range (i.e., when the user is at home), etc. Both WLANs (the coffee shop WLAN and the home WLAN) may be personal/home WLANs, and thus may be identified by a Gateway MAC contained in a publicly-broadcast beacon transmission from the wireless access points. Additionally, the user may configure the client device to adapt different configuration settings, such as security settings, based on the Gateway MAC of the wireless access point to which it is connected or connecting. For example, a client device may be configured to be more “open” or more insecure (e.g., the client device may make more ports available for connection) when connected to the home network where it expects to be in a safe, private environment, and to be more “closed” or secure when connected to the coffee shop network which it expects to be a riskier, public environment.

#Applicants have appreciated that conventional systems make client devices susceptible to attack. For example, an attacker may monitor the beacon transmission of a public (e.g., the coffee shop's) wireless access point and store the public wireless access point's SSID, and then may follow the user home and monitor the beacon transmission of the user's home wireless access point and store the home wireless access point's Gateway MAC. The attacker may then establish a WLAN near the user's home using a wireless access point transmitting in its beacon transmission the SSID of the coffee shop WLAN but with the Gateway MAC of the user's home WLAN. The attacker may then, using known techniques, remotely disconnect the user's client device from the user's home WLAN. After disconnecting, the client device may scan for beacon transmissions from wireless access points within range. Because the client device has been previously configured to connect automatically to the coffee shop WLAN when the coffee shop WLAN is within range, upon recognizing the SSID of the coffee shop (“Coffee Shop”) being broadcast by the attacker's wireless access point, the client device may automatically connect to the attacker's WLAN. This is because, using conventional methods, the client device is only capable of recognizing the coffee shop WLAN based on the SSID of the coffee shop wireless access point, and this SSID is being broadcast by the attacker's wireless access point. The client device may adapt configuration settings for the new connection based on the Gateway MAC presented by the attacker's wireless access point, which the client device will recognize as the Gateway MAC of the home wireless access point. Thus, the client device may adopt relatively low security levels (as it has been previously configured to do when it recognizes the Gateway MAC of the home wireless access point) than when it is connected to a public access point, and thus become more “open” and susceptible to the attacker.