Collaboratively locating disconnected clients and rogue access points in a wireless network

Abstract

Methods are described for using collaboration of neighboring wireless devices to enable location of disconnected wireless devices and rogue wireless access points. A central server computes the locations of the neighboring clients and uses those locations to estimate the location of a disconnected client. These techniques may take advantage of the beaconing and probing mechanisms of IEEE 802.11 to ensure that connected clients do not pay unnecessary overheads for detecting disconnected clients. Methods are also described for detecting and locating rogue devices by collaboratively collecting information from neighboring devices and comparing the information to a database.

1 .- 12 . (canceled)  
     
     
         13 . A method for identifying a rogue wireless access point in an infrastructure network, method comprising the steps of: 
 receiving information about a suspicious access point, the information collected by one or more nearby wireless computing devices or access points;    comparing the information with an access point database; and    identifying the suspicious access point as rogue if the information is inconsistent with the access point database.    
     
     
         14 . The method of  claim 13  wherein the information comprises a combination of one or more of: signal strength information; MAC address; SSID; and channel information.  
     
     
         15 . The method of  claim 13  wherein the information comprises a MAC address, and the MAC address is obtained by the one or more nearby wireless devices by listening to a beacon of the suspicious access point.  
     
     
         16 . The method of  claim 13  wherein the information comprises a MAC address, and the MAC address is obtained by the one or more nearby wireless devices by performing a method comprising the steps of: 
 sending a probe request;    receiving a probe response from the suspicious access point; and    retrieving the MAC address from the probe response.    
     
     
         17 . The method of  claim 13  wherein the information comprises signal strength information, the method further comprising the steps of: 
 estimating the location of the suspicious access point using the signal strength information received; and    identifying the suspicious access point as rogue if the estimated location is inconsistent with the access point database.    
     
     
         18 . The method of  claim 17  wherein estimating the location comprises: 
 computing estimates of the locations of the nearby wireless computing devices or access points; and    using the computed estimates and received signal strength information to further estimate the location of the suspicious access point.    
     
     
         19 . The method of  claim 13  wherein the information comprises channel information, the method further comprising the step of: 
 identifying the suspicious access point as rogue if it broadcasts on a channel that does not overlap with the channel indicated in the access point database.    
     
     
         20 . The method of  claim 13  further comprising the step of: 
 updating the access point database with new information in response to receiving an update request from an authenticated access point.