Patent ID: 11863985
Assignee: WATCHGUARD TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method for detecting an evil twin access point (AP), comprising:
broadcasting, from a first IEEE 802.11-based AP comprising a trusted AP having a coverage area in which a second AP comprising an IEEE 802.11-based AP is located, a first beacon comprising a trusted beacon including a service set identifier (SSID) for the trusted AP, and containing a security token generated with at least one cryptographic operation employing a secret key and contained in a data field of a vendor-specific information element (IE) in the trusted beacon;
receiving a second beacon broadcast by the second AP including the SSID and second data in a data field of a second vendor-specific IE;
processing the security token with the secret key to generate a first value;
processing the second data in the data field of the second vendor-specific IE of the second beacon with the secret key to generate a second value; and
detecting the second beacon was broadcast by an evil twin AP when the first and second values do not match.