Cisco Technology, Inc.

Mark Krischer

Nancy Cam-Winget

Robert B O'Hara, Jr

Philip J Ryan

Michael J Webb

Nancy Cam Winget

Timothy S Olson

Sheausong Yang

Pauline Shuen

Ajit Sanzgiri

Brian Donald Hart

David Sheldon Stephenson

Patrice R Calhoun

Joseph Salowey

Jeremy Stieglitz

Hao Zhou

Alex C K Lam

Ilan Frenkel

Simon King

Tom Koenig

Saar Gillai

Padmanabha Jakkahalli

Thomas Koenig

Jr Robert B O'HARA

Hau Zhou

In an example embodiment, there is described herein a location based detection technique that determines whether multiple requests from different addresses, such as a Layer 2 MAC (Media Access Control) address and/or layer 3 IP (Internet Protocol) address are being sent form a single device. In particular embodiments, if the device sends more than a predefined threshold number of requests, those requests can be ignored and/or denied.

Location based technique for detecting devices employing multiple addresses

A detection-based defense to a wireless network. Elements of the infrastructure, e.g., access points or scanning-only access points, detect intruders by detecting spoofed frames, such as from rogue access points. Access points include a signature, such as a message integrity check, with their management frames in a manner that enables neighboring access points to be able to validate the management frames, and to detect spoofed frames. When a neighboring access point receives a management frame, obtains a key for the access point sending the frame, and validates the management frame using the key.

Network infrastructure validation of network management frames

Methods and systems for use in a wireless client that includes one or more wireless network interfaces for communicating with at least one access point wherein the method enables the wireless client to validate the authenticity and integrity of received management frames. The method includes receiving a protected wireless network management frame from an access point verifying a message integrity check (MIC) appended to the protected wireless network management frame. One or more security policies are then conditionally applied based on a failure to verify the MIC.

Network client validation of network management frames

In one embodiment, an apparatus includes an intrusion detection arrangement and a location identification arrangement. The intrusion detection arrangement determines when a client without authorization attempts to access a wireless network of which the intrusion detection arrangement is a part. The location identification arrangement identifies at least a first approximate physical location of the client without authorization when the client without authorization attempts to access the wireless network. The location identification arrangement is configured to communicate the first approximate physical location to a surveillance arrangement which monitors the first approximate physical location.

System and method for wireless network and physical system integration

In one embodiment, a method includes receiving security context information relevant to a connection between a wireless network infrastructure component and a wireless client, wherein the security context information comprises at least, an identification of the wireless client, and wherein the security context information identifies any security protocols associated with the connection; validating the connection based on the security context information; and transmitting the security context information to one or more detector wireless access points.

Intrusion prevention system for wireless networks

Method for detecting an attack on a broadcast key shared between an access point and its wireless clients. Upon detection of the attack, actions are implemented to react to the attack as defined in one or more security policies. Detection of the attack is achieved by examining both a link message integrity check and an infrastructure management frame protection (IMFP) message integrity check contained in a broadcast management frame.

Insider attack defense for network client validation of network management frames

A method of wirelessly transmitting or receiving a packet of information, and an apparatus to wirelessly transmit or receive a packet of information. In the case of transmitting, the method includes streaming a data element, including at least some of the contents of the packet, over a network link during transmit time. In the case of receiving, the method includes streaming a data element, including at least some of the contents of the received packet, over a network link during receive time. The transmitting or receiving is by a station of a wireless network and the streaming is to or from the station from or to a network device coupled to the station by the network link.

Method and apparatus to provide data streaming over a network connection in a wireless MAC processor

Methods, apparatuses and systems directed to detecting address spoofing in wireless networks by, after receiving a wireless management frame, transmitting verification messages to determine whether a given wireless node (e.g., a wireless access point, or wireless client) has legitimately lost its connection state.

Detecting address spoofing in wireless network environments

A method and implementation is disclosed for secure communication between two or more parties. A secure tunnel is established between parties using an encryption algorithm. An authentication process is performed between parties over the secured tunnel. The provisioning of credentials is thereafter performed between parties.

Protected dynamic provisioning of credentials

A system and method that supports disjoint authentication server farms and disjoint policy or authorization servers for multi-session establishment. The authentication server has global knowledge of authenticators for additional sessions for a supplicant and can split authentication requests as needed to different authentication servers. The split authentication and authorization requests can be aggregated should the other authentication and authorization servers have the capability to handle multiple requests. In the case of server farms, authentication and implied authorization requests can be split to facilitate load balancing.

System and method for multi-session establishment involving disjoint authentication and authorization servers

A system and method that allows a device to complete a single complete authentication sequence to a AAA server resulting in as many secure sessions required for the different applications or subsystems determined by the client's identity and the AAA server's policy. As the device is authenticated, it is determined where there are other sessions for the device. The sessions are established by generating unique new keying material that is passed to each session. This can be accomplished by (a) the authenticator or AAA server issuing the keys and distributing them to both the supplicant and applications (via their authenticators); or (b) authenticator or the AAA server mutually generating the session unique keys with the supplicant that are then distributed to the applications (via their authenticators).

System and method for multi-session establishment for a single device

A method of wirelessly transmitting or receiving a packet of information, and an apparatus to wirelessly transmit or receive a packet of information. In the case of transmitting, the method includes streaming a data element, including at least some of the contents of the packet, over a network link during transmit time, including encrypting the data element during the streaming in real time prior to the transfer over the network link. In the case of receiving, the method includes streaming a data element, including at least some of the contents of the received packet, over a network link during receive time, including decrypting the data element during the streaming in real time after to the transfer over the network link. The transmitting or receiving is by a station of a wireless network and the streaming is to or from the station from or to a network device coupled to the station by the network link.

Method and apparatus to provide inline encryption and decryption for a wireless station via data streaming over a fast network

A method, apparatus, and software containing computer readable code to implement the method implemented in a first wireless device. The method includes, for a particular network identifier active in a wireless network, transmitting frames configured to advertise the infrastructure network of the particular network identifier. The transmitting of off-channel beacons is in a provided channel different than the channel in which the access point of the infrastructure wireless of the particular network identifier transmits beacon frames. The transmitting of off-channel beacons further is at a rate higher than the beacon rate frame at which the access point of the infrastructure wireless of the particular network identifier transmits beacon frames.

Growing community of inventors

Pymble, Australia

Mark Krischer