# US 8,787,576 B2 · System and method for detecting unauthorized wireless access points > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,787,576 B2 - Document ID: US8787576B2 - Status: Granted - Kind: B2 - Application number: 13/164,459 - Filed: 2011-06-20 - Published: 2011-12-22 - Granted: 2014-07-22 - Earliest claimed: 2002-06-28 - Assignees: Crimson Corporation - Applicants: Robert Whelan; Lamar Van Wagenen; Roy Morris - Inventors: Robert Whelan; Lamar Van Wagenen; Roy Morris - Web page: https://patentgrep.com/patent/US8787576B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 88/08: Access point devices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Unauthorized wireless access points are detected by configuring authorized access points and mobile units to listen to all wireless traffic in its cell and report all detected wireless devices to a monitor. The monitor checks the reported devices against a list of authorized network devices. If the reported wireless device is not an authorized device, the monitor determines if the reported device is connected to the network. If the reported device is connected to the network and is not an authorized device, the monitor alerts the network operator or network manager of a rogue device connected to the network and attempts to locate and isolate the rogue device. ## Claims ### Claim 1 A system for detecting an access point, comprising: a network segment for which no access point is authorized; and a network monitor that (a) receives mobile unit identification information from a wireless receiver and (b) receives network traffic from the network segment, wherein the network monitor detectors an unauthorized access point by comparing the network traffic from the network segment with the mobile unit identification information, wherein when the network traffic from the network segment includes the mobile unit identification information it is determined that an unauthorized access point is on the network segment because no access point is authorized on the network segment, wherein the wireless receiver receives the mobile unit identification information from a mobile wireless device. ### Claim 2 (depends on 1) The system of claim 1, wherein when the unauthorized access point is detected, the network monitor isolates network communication with the unauthorized access point. ### Claim 3 (depends on 1) The system of claim 1, wherein when the unauthorized access point is detected, the unauthorized access point is reported to a network operator. ### Claim 4 (depends on 1) The system of claim 1, wherein the mobile unit identification information comprises a media access control (MAC) address of the mobile wireless device. ### Claim 5 (depends on 1) The system of claim 1, wherein the wireless receiver is located on the network segment, and wherein the wireless receiver is configured to receive wireless network traffic but not to transmit wireless network traffic. ### Claim 6 (depends on 1) The system of claim 1, wherein the wireless receiver is not located on the network segment, but is located elsewhere on the network. ### Claim 7 (depends on 1) The system of claim 1, wherein the wireless receiver is configured to receive wireless network traffic, and wherein the wireless receiver is unable to transmit wireless network traffic. ### Claim 8 A method for detecting an access point, comprising: receiving mobile unit identification information from a wireless receiver; and monitoring network traffic on a network segment for which no access point is authorized, wherein an unauthorized access point is detected by comparing the network traffic from the network segment with the mobile unit identification information, wherein when the network traffic from the network segment includes the mobile unit identification information it is determined that an unauthorized access point is on the network segment because no access point is authorized on the network segment, wherein the wireless receiver receives the mobile unit identification information from a mobile wireless device. ### Claim 9 (depends on 8) The method of claim 8, wherein when the unauthorized access point is detected, network communication with the unauthorized access point is isolated. ### Claim 10 (depends on 8) The method of claim 8, wherein when the unauthorized access point is detected, the unauthorized access point is reported to a network operator. ### Claim 11 (depends on 8) The method of claim 8, wherein the mobile unit identification information comprises a media access control (MAC) address of the mobile wireless device. ### Claim 12 (depends on 8) The method of claim 8, wherein the wireless receiver is located on the network segment, and wherein the wireless receiver is configured to receive wireless network traffic but not to transmit wireless network traffic. ### Claim 13 (depends on 8) The method of claim 8, wherein the wireless receiver is not located on the network segment, but is located elsewhere on the network. ### Claim 14 (depends on 8) The method of claim 8, wherein the wireless receiver is configured to receive wireless network traffic, and wherein the wireless receiver is unable to transmit wireless network traffic.