Passenger vehicle wireless access point security system

Techniques are described to detect and/or prevent malicious wireless attacks and/or suspicious wireless activity related to a wireless network in a commercial passenger vehicle. For example, an access point located in the commercial passenger vehicle receives a set of wireless beacon frames from a first wireless device, makes a first determination of a first beacon frame rate of the set of wireless beacon frames, receives a second beacon frame after a first beacon frame, makes a second determination of a second beacon frame rate of the second beacon frame relative to the first beacon frame, makes a third determination that a second wireless device is impersonating the first wireless device upon comparing the first beacon frame rate to the second beacon frame rate, and sends, upon making the third determination, a security alert message to an external input/output (I/O) device in the commercial passenger vehicle.

TECHNICAL FIELD

This document is directed generally to detect and/or prevent security attacks on wireless access point located in a commercial passenger vehicle such as an aircraft.

BACKGROUND

Commercial travel has evolved to provide entertainment options to passengers traveling to their destinations. For example, in an airplane or train, passengers can connect their wireless devices to a wireless access point (AP) located in the airplane or train so that the passengers' wireless devices can browse the Internet, watch movies, or listen to music. A wireless AP can beneficially provide passengers with a positive travel experience. However, wireless AP and/or passenger wireless devices can be susceptible to security attacks that can diminish the wireless AP's capabilities and/or prevent the wireless AP from communicating with wireless devices of the passengers.

SUMMARY

This patent document describes exemplary wireless access point security system to detect and/or prevent security attacks within a wireless network located in a commercial passenger vehicle.

A first exemplary embodiment describes a method of detecting a wireless attack or suspicious wireless activity for a wireless network in a commercial passenger vehicle, where the method comprises receiving, by an access point in the commercial passenger vehicle, a set of wireless beacon frames from a first wireless device, making a first determination of a first beacon frame rate that describes a rate at which the set of wireless beacon frames are received, receiving a second beacon frame after a first beacon frame, where the first beacon frame is received last in time in the set of wireless beacon frames, making a second determination of a second beacon frame rate that describes a rate at which the second beacon frame is receive relative to when the first beacon frame was received, making a third determination that a second wireless device transmitting the second beacon frame is impersonating the first wireless device transmitting the first beacon frame upon comparing the first beacon frame rate to the second beacon frame rate; and sending, upon making the third determination, a security alert message to an external input/output (I/O) device located in the commercial passenger vehicle.

A second exemplary embodiment describes a method of detecting a wireless attack or suspicious wireless activity for a wireless network in a commercial passenger vehicle, where the method comprises receiving, by an access point in the commercial passenger vehicle, a set of wireless frames from a wireless device, making a first determination that the set of wireless frames contains a large time duration value indicative of an attack on the wireless network upon determining that (1) a time duration value indicated in each of the set of wireless frames is greater than a pre-determined threshold value, and (2) the set of wireless frames are received within a pre-determined time period, and sending, upon making the first determination, a security alert message to an external input/output (I/O) device located in the commercial passenger vehicle.

In another exemplary aspect, the above-described methods are embodied in the form of processor-executable code and stored in a non-transitory computer-readable storage medium. The non-transitory computer readable storage includes code that when executed by a processor, causes the processor to implement the methods described in this patent document.

In yet another exemplary embodiment, a device that is configured or operable to perform the methods disclosed in this patent document. For example, an apparatus implemented on a commercial passenger vehicle and comprising a processor configured to perform the methods disclosed in this patent document.

DETAILED DESCRIPTION

Commercial passenger vehicles such as airplanes include a wireless access point (AP) device that can provide Internet access or stream entertainment content to wireless devices connected to the wireless AP. Currently, wireless APs located in commercial passenger vehicles cannot effectively detect and/or prevent malicious attacks on such devices or suspicious activities in a wireless network comprising such devices. For example, an attacker can set up his or her own wireless AP in an airplane to mimic an authorized wireless AP located in the airplane to steal passengers' credit card numbers or passenger personally identifiable information (PII). The passengers may provide their credit card information to an attacker when attempting to connect their wireless devices to the Internet via the attacker's unauthorized AP. In another example, a malicious attack on a wireless AP can disrupt normal functionality of the wireless AP so that passengers' wireless devices may not receive entertainment content and the quality of service may deteriorate.

To address at least these technical problem among others, this patent document describes several techniques that can detect and/or prevent attacks on an AP located in commercial passenger vehicles and/or on the wireless network comprising the AP while minimizing the impact of such attacks to regular AP functionality. In an exemplary embodiment, as further described inFIG. 1, a dedicated wireless AP can employ the techniques described herein to detect malicious attacks on one or more wireless interfaces such as the Wi-Fi 2.4 GHz range, 5 GHz range, and/or 5G spectrum (e.g., millimeter wave spectrum). The dedicated wireless AP located in the commercial passenger vehicle may be a separate device from the AP to which passengers' wireless device may connect.

FIG. 1shows an exemplary wireless security system installed in an airplane102. The wireless security system includes a dedicated wireless AP104installed in the airplane102. The dedicated wireless AP104can implement techniques described in this patent document to detect and/or prevent malicious attacks and/or suspicious activities in the wireless security system. The wireless security system includes one or more in-vehicle wireless APs106installed in the airplane102, where personal electronic devices PEDs108(e.g., passenger's mobile devices) can connect to and obtain entertainment content (e.g., Internet webpages, movies, music) from the in-vehicle wireless AP(s)106.

In some embodiments, the dedicated wireless AP104may be a separate device from the in-vehicle wireless AP(s)106. One technical benefit of having a dedicated wireless AP104as a separate device from the in-vehicle wireless AP(s)106is that the dedicated wireless AP104can be easily installed to existing wireless systems of commercial passenger vehicles without much interruption in service. Another technical benefit of having a separate dedicated wireless AP104is that such a device may devote exclusive computational resources to perform the security related detection and/or prevention techniques described herein while the in-vehicle wireless AP(s)106can perform operations to provide entertainment content to passengers' wireless device without interruption of service. Thus, the amount of computations that need to be performed to provide security and entertainment content within a wireless security system can be distributed and better managed by two or more wireless APs. In some other embodiments, the dedicated wireless AP104and an in-vehicle wireless AP106can be the same device so that the in-vehicle wireless AP106can perform the techniques described herein to detect and/or prevent malicious attacks and/or suspicious activities.

In an example implementation, a dedicated wireless AP104may be installed in a narrow-body or a wide-body aircraft excluding two deck aircrafts such as B747 and A380s, where two or more dedicated wireless AP(s)104may be installed.

The dedicated wireless AP104can detect and/or prevent malicious attacks and/or suspicious activities. The dedicated wireless AP104may also generate and store security event logs associated with a detection of malicious attacks and/or suspicious activity. The dedicated wireless AP104can send the security event logs to a ground server114, which is a fixed location server to via an antenna110,112(and optionally via the satellite118) using, for example, an offboard connectivity interface such as a Ku or Cell Modem. The ground server114can store the security event log in a database116so that further data analytics can be performed by the ground server114to determine, for example, the types of security issues that were detected, the frequency with which the malicious attacks and/or suspicious activity were performed, etc.,

In some embodiments, the dedicated wireless AP104may detect a malicious attack or a suspicious activity and generate and send a security alert message in real-time to an external input/output device such as a cabin terminal120. A cabin terminal120may include a display or monitor that can display the message sent by the dedicated wireless AP104. The displayed message can inform the flight crew about an on-going security issue with the wireless security system so that the flight crew can perform an action, such as providing a public announcement (PA) over the PA system to warn the attacker that his or her actions are being detected. In another example, the action performed by the flight crew can include turning off the in-vehicle access point(s) and warning passengers over the PA system of a security issue with the wireless network so that if a passenger's wireless device is still connected to an AP the passenger may deduce that his or her wireless device is connected to an unauthorized AP.

Often, commercial passenger vehicles' wireless systems are not easily serviceable when the commercial passenger vehicles are in transit to its destination. Thus, the real-time detection of malicious attack or suspicious activity and the generation of the security alert message displayed on the cabin terminal120is a technical benefit at least because a attacks on a wireless network in commercial passenger vehicles can be identified and remedial action can be performed to mitigate against such attacks or suspicious activities.

The exemplary techniques to detect and/or prevent malicious attacks and/or suspicious activity are further described in the various sections below. The example headings for the various sections below are used to facilitate the understanding of the disclosed subject matter and do not limit the scope of the claimed subject matter in any way. Accordingly, one or more features of one example section can be combined with one or more features of another example section.

I. Access Point Frame Spoofing

FIG. 2Ashows an example access point spoofing scenario where an unauthorized wireless AP is setup to mimic an authorized wireless AP. Access Point spoofing can involve an attacker setting up an unauthorized wireless AP206to mimic the authorized in-vehicle wireless AP(s)204. An attacker may setup the unauthorized wireless AP206to act as an access point with spoofed service set identifier (SSID), media access control (MAC) address, and/or spoofed network information to make it seem as an authorized wireless access point to which passenger wireless devices can connect. For example, the unauthorized wireless AP206may be setup with an SSID of “airline-wifi” which is similar to the authorized AP's204SSID of “airplane #1234-WiFi” and the unauthorized wireless AP206may setup its own MAC address to be the same as the authorized AP's204MAC address. As shown inFIG. 2A, the passenger PEDs208may unknowingly connect to the unauthorized wireless AP206instead of connecting to the authorized in-vehicle wireless AP(s)204. The unauthorized wireless AP206may setup a fake portal webpage to capture the passenger's sensitive personal information, such as credit card information.

In some embodiments, the unauthorized wireless AP206can be setup to forge frames of the in-vehicle wireless AP204to make it seem to the in-vehicle wireless AP204or a client device208that the unauthorized wireless AP206is a legitimate system wireless AP. A Denial of Service (DoS) attack may include the unauthorized wireless AP206forging unencrypted management or control frames of the in-vehicle wireless AP(s)204while setting up a man-in-the-middle attack to forge data frames as well.

The dedicated wireless AP202includes a security module (shown as325inFIG. 3) that can detect an unauthorized or illegitimate wireless AP206that sends forged or spoofed frames made to look like an authorized wireless AP. As shown inFIG. 2A, the security module of the dedicated wireless AP202can detect the unauthorized wireless AP206by surveying the wireless data continuously to detect, for example, a presence of a new wireless AP with an unknown SSID and having a same MAC address as the MAC address of the in-vehicle wireless AP204. In an example implementation, the dedicated wireless AP202may store in a non-volatile memory a list of authorized wireless AP(s)'s204SSID(s) and/or MAC addresses. The security module of the dedicated wireless AP202can compare information (e.g., SSID and/or MAC address) received in a wireless frame to the list of authorized SSID(s) and/or MAC addresses to determine whether a wireless frame is generated from a unauthorized wireless AP.

In some embodiments, if the security module of the dedicated wireless AP202detects in a spoofed wireless frame of an unauthorized wireless AP206an unknown SSID having a same MAC address as the in-vehicle wireless AP's204MAC address, the security module can generate a security event log with any one or more of the following example information:

Type of Detection (e.g., AP frame spoofing)

Date and/or time of the detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

Detected forged frame type (e.g., management, control or data)

Detected forged frame sub-type (e.g., dependent upon frame type, such as defined by 802.11).

In some other embodiments, the security module of the dedicated wireless AP202detects in a spoofed wireless frame of an unauthorized wireless AP206an unknown SSID and an unknown MAC address, the security module can generate a security event log with the above described example information.

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for AP frame spoofing type detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

The security module of the dedicated wireless AP202can be configurable to be enabled or disabled. For example, if a same wireless AP can be designed with the functionality of the in-vehicle wireless AP204and the dedicated wireless AP202, then the security module related features can be disabled for such a wireless AP if another dedicated wireless AP is installed in the commercial passenger vehicle to detect and/or prevent malicious attacks and/or suspicious activity. The security module of the dedicated wireless AP202can support the 802.11w protected management frames specification.

FIG. 2Bshows an example deauthentication scenario for an attempted Denial of Service (DoS) attack. In the deauthentication scenario, an unauthorized wireless AP206can generate and transmit a deauthentication broadcast to attempt to disconnect passenger PEDs208wirelessly connected to in-vehicle wireless AP(s)204in range. The unauthorized wireless AP206can generate and send a frame to a broadcast address rather than sending a spoofed deauthentication message to a specific MAC address.

The security module of the dedicated wireless AP202can detect an attempt broadcast deauthentication attack by monitoring the broadcast frames from an unauthorized or illegitimate wireless AP206that sends a deauthentication frames to a broadcast address (e.g., FF:FF:FF:FF:FF:FF). If the security module detects a broadcast frame broadcast deauthentication attempt from an illegitimate AP, the security module can generate a security event log with any one or more of the following example information:

Type of Detection (e.g., broadcast deauthentication)

Date and/or time of detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the broadcast deauthentication type detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

FIG. 2Balso shows an example disassociation scenario for an attempted DoS attack. In the disassociation scenario, an unauthorized wireless AP206can generate and transmit disassociation frame(s) to a broadcast address (e.g., FF:FF:FF:FF:FF:FF) to disconnect to attempt to disconnect passenger PEDs208wirelessly connected to in-vehicle wireless AP(s)204on a network for a widespread DoS.

The security module of the dedicated wireless AP202can detect an attempt broadcast disassociation attack by monitoring the broadcast frames from an unauthorized or illegitimate wireless AP204that sends disassociation frames to a broadcast address. If the security module detects a broadcast disassociation attempt, the security module can generate a security event log with any one or more of the following example information:

Type of Detection (e.g., broadcast disassociation)

Date and/or time of detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the broadcast disassociation type detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

IV. Ad Hoc Network Using a Valid SSID

If an unauthorized wireless AP sets up an ad-hoc network using the same SSID as an authorized wireless AP, a client device may be tricked into connecting to the wrong network. If a client connects to a malicious ad-hoc network, security breaches or attacks can occur. The security module of the dedicated wireless AP can detect an spoofed illegitimate or unauthorized wireless AP that is using a configured SSID that is identical or the same as the one configured for the authorized wireless AP but where the unauthorized wireless AP has a different MAC address than the authorized wireless AP.

If the security module detects an authorized SSID associated with an unknown MAC address, the security module can generate a security event log with any one or more of the following example information:

Type of Detection (e.g., Ad Hoc with valid SSID)

Date and/or time of detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the Ad Hoc with valid SSID type detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

FIG. 2Cshows an example virtual carrier-sense attack scenario. The unauthorized wireless device210can implement a virtual carrier-sense attack by modifying the 802.11 MAC layer implementation to allow random or large duration values to be sent periodically. This attack can be carried out on the acknowledgement (ACK) frame, data frame, request to send (RTS) frame, and/or clear to send (CTS) frame by using large duration values. As shown inFIG. 2C, the unauthorized wireless device210can wirelessly connect to the in-vehicle wireless AP204and send malformed frames with large duration values in ACK frame, data frame, RTS frame and/or CTS frame on the 802.11 MAC layer. This attack can prevent the in-vehicle wireless PA204from providing channel access to PEDs208. For example, the in-vehicle wireless AP204may spend a large amount of time incorrectly responding to the unauthorized wireless device210which reduces the channel utilization efficiency and result in interruptions or loss of service between the in-vehicle wireless AP204and PEDs208.

The security module of the dedicated wireless AP202can monitor a PED's208and in-vehicle wireless device's210traffic to the in-vehicle wireless AP204for ACK frame, data frame, RTS frame and/or CTS frame. In an example implementation, the in-vehicle wireless AP204may send the ACK frame, data frame, RTS frame and/or CTS frame received from a PED to the dedicated wireless AP202. The security module can inspect the duration values in the ACK frame, data frame, RTS frame and/or CTS frame to determine whether a number of wireless frames contain a large duration value within a pre-determined time period.

In some embodiments, if the security module determines that a number of wireless frames from PED received within a pre-determined time period contain a duration value that exceeds a pre-determined threshold value, then the security module can generate a security event log that indicates that the dedicated wireless AP202detected a large duration malformed frame type attack. In some embodiments, the security module can generate a security event log indicating that the dedicated wireless AP202has detected a large duration malformed frame type attack if the security module determines that a number of wireless frames from PED received within a pre-determined time period contain a same duration value that exceeds a pre-determined threshold value

A technical benefit of determining a number of wireless frames having a large duration value over a pre-determined time period is that it can filter out false positive scenarios where a legitimate PED may include a large duration in a wireless frame. Another technical benefit of determining a number of wireless frames having a same large duration value over a pre-determined time period is that it can also filter out false positives scenarios at least because wireless network conditions change often and it is unusual for a wireless devices to request a same large duration value over a pre-determined time period with changing wireless network conditions.

If the security module detects that a wireless device's traffic in the ACK frame, data frame, RTS frame and/or CTS frame contains a large duration value greater than a pre-determined threshold value and over a pre-determined time period, then the security module can generate a security event log with any one or more of the following example information:

Type of Detection (e.g., large duration malformed frame)

Date and/or time of the detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

Detected large duration frame sub-type

Detected duration value in frame

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the large duration malformed frame detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

VI. System Wireless AP Impersonation

In an AP impersonation attack scenario, an attacker sets up an unauthorized wireless AP that assumes the BSSID and/or ESSID of the in-vehicle wireless AP. The AP impersonation attacks can be done for man-in-the-middle attacks, a rogue AP attempting to bypass detection, or a honeypot attack.

The security module of the dedicated wireless AP can detect an AP impersonation attack scenario by monitoring the beacon frames associated with a specific BSSID or SSID and determining if the rate of beacon frames from one or more access points in the commercial passenger vehicle has been increasing uncharacteristically. The wireless beacon frames can be used by a wireless AP to announce the presence and/or capability of the wireless AP. The unauthorized and in-vehicle wireless APs can generate and transmit a beacon frame to broadcast SSID availability and capability of the APs. By analyzing the beacon frame rate, the security module of the dedicated wireless AP can determine that an in-vehicle wireless AP is being impersonated and counter measures may be able to be taken. For example, the security module can monitor the beacon interval (e.g., every 100 ms) and if the beacon interval changes in variation by a configurable percentage, then the security module can determine that there are one or more unauthorized wireless APs in addition to the authorized APs operating with the same BSSID and/or SSID.

FIG. 4shows a timeline of beacon frames of an unauthorized wireless device interspersed with beacon frames of an authorized in-vehicle wireless AP. The security module of the dedicated wireless AP can monitor the beacon frames associated with a BSSID or SSID to determine a rate at which the beacon frames are received. As shown inFIG. 4, the beacon frames transmitted by the in-vehicle wireless AP are shown as402a-402e, and the beacon frames transmitted by an unauthorized wireless device having the same BSSID or SSID as the in-vehicle wireless AP is shown as404a-404b. If the security module determines that the increase in the beacon frame rate is greater than or equal to a pre-determined threshold value (e.g., 50%), then the security module can generate a security event log. In an example scenario shown inFIG. 4, the security module determines that beacon frames402a-402dfrom a BSSID/SSID are detected by the dedicated wireless AP every 1 second on average for the past 4 seconds, however if the security module determines that a next beacon frame404afrom the same BSSID/SSID is received within 0.25 seconds of a previous beacon frame402d, then the security module determines that the rate of increase of the beacon frame rate exceeds a pre-determined threshold value of 50% rate increase and the security module generates a security event log.

The security module can determine an average beacon frame rate of a set of previous beacon frames received by the dedicated wireless AP. For example, the security module can receive the initial set of beacon frames (e.g., 10) and obtain an average beacon frame rate, and then the security module can determine a rolling average of the beacon frame rate from receiving a number of previous beacon frames (e.g., previous 10 or 15). A first beacon frame rate obtained from a set of previous beacon frames can be used to compare to a second beacon frame rate that can be determined based a comparison of when a new beacon frame rate is received relative to when a previous beacon frame was received. The security module can determine a rate at which the beacon frame rate increases from the first beacon frame rate to the second beacon frame rate using the following example equation: (second beacon frame rate−first beacon frame rate)/first beacon frame rate. If the security module determines that a rate at which the beacon frame rate is increased is greater than or equal to a pre-determined threshold value, then the security module can determine that an unauthorized wireless bridge may be setup up or an unauthorized wireless AP may be transmitting beacon frames on the same SSID and generate a security event log.

The security event log generated by the security module can include any one or more of the following example information:

Type of Detection (e.g., wireless AP impersonation)

Date and/or time of the detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

Pre-determined threshold value for the beacon frame rate

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the wireless AP impersonation detection once within a configurable time interval (e.g., between 3 seconds to 60 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 3 seconds for each impersonator AP detected.

In some embodiments, the security module can determine variances in measured received signal strength indicator (RSSI) or received signal code power (RSCP) of the beacon frames. For example, the security module can perform full-frame measurements for RSCP or preamble measurements for RSSI. If the security module determines that a variance of the RSSI or RSCP exceeds a pre-determined threshold value, then the security module can generate a security event log and determine that an unauthorized wireless bridge may be setup up or an unauthorized wireless AP may be transmitting beacon frames on the same SSID and generate a security. In some embodiments, the security module can measure using link measurement information (e.g., RSSI or RSCP of a beacon frame) to determine an approximate location of an attacking or unauthorized wireless bridge or AP.

VII. Wireless Bridge Detection

FIG. 2Dshows an example wireless bridge attack scenario. In a wireless bridge scenario, an attacker sets up an unauthorized wireless AP206as a wireless bridge to the in-vehicle wireless AP204so that the PED208can connect to the unauthorized wireless AP206. This allows the attacker to act as a man in the middle (MIM) which allows the attacker's wireless AP206to inspect passengers' sensitive personal information (e.g., credit card number) to possibly steal such information. In some cases, the attacker may set up a wireless bridge to possibly redirect the victim's PEDs208to malicious content or websites to steal the passengers' sensitive personal information.

Wireless bridges can be different from rogue APs, in that they may not use beacons and may have no concept of association. Most wireless networks in commercial passenger vehicles do not use bridges, thus in such networks, the presence of a wireless bridge is a signal that a security problem exists.

The security module of the dedicated wireless AP can monitor wireless traffic and inspect wireless frames which have both the ToDS field and FromDS field set to a bit value of 1. The ToDS and FromDS field are used in normal wireless traffic however they are not normally both set. When both ToDS and FromDS fields have a bit value set to 1, this signifies a wireless bridge is set up between the in-vehicle wireless AP204and the PEDs208. Values for the ToDS field and FromDS field are further described below:If ToDS=0 and FromDS=0, this indicates that a data frame is sent from one client to another clientIf ToDS=0 and FromDS=1, this indicates that a data frame is sent from an AP to a client device such as PED (e.g., normal WiFi traffic)If ToDS=1 and FromDS=0, this indicates that a data frame is sent from the client device to an AP (e.g., normal WiFi traffic)If ToDS=1 and FromDS=1, this indicates that a data frame is sent from one AP to another AP, which can possibly indicate a network bridge setup.

If the security module detects a wireless frame which has both ToDS and FromDS field set to a value (e.g., 1) in the wireless frame's MAC header that includes a MAC address, the security module can generate a system security event to include any one or more of the following information:

Type of Detection (e.g., wireless bridge detection)

Date and/or time of the detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

Detected MAC address for FromDS field

Detected MAC address for ToDS field

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the wireless bridge detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

In some scenarios, if a client device (e.g., PED) sets a high throughput (HT) capability intolerant bit to indicate that it is unable to participate in a 40 MHz basic service set (BSS), the wireless AP can lower the data rates associated with all of the client devices connected to the wireless AP. Thus, a performance of a Wi-Fi network can be less than optimal if a device sets and sends an HT 40 MHz intolerant bit.

The security module of the dedicated wireless AP can monitor the wireless traffic packet associated with client devices (e.g., PEDs) which have a 40 MHz HT intolerant bit set 1 in the HT capabilities information field if the in-vehicle wireless AP is configured to broadcast with a 40 MHz channel width on its 5 GHz radio. For example, the packet transmitted by a client device can include a HT capabilities field, MAC address of the client device, and LAN IP address of the client device. If the security module determines that an HT capability intolerant bit is set to 1, the security module can generate a security event log with any one or more of the following information:

Type of Detection (e.g., HT intolerance bit set)

Date and/or time of the detection

Commercial Passenger Vehicle information (e.g., aircraft tail number, flight number, etc.,)

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the HT intolerance bit set detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

In some embodiments, if the security module detects a client device with an intolerance capability bit set, the security module can sent a message to the in-vehicle wireless AP configured to use 40 MHz channel at 5 GHz to move the client device to a 2.4 GHz radio having a 20 MHz channel.

IX. Noise Generator

In some scenarios, an attacker may configure his or her wireless device to generate and transmit noise at frequencies at which the in-vehicle wireless AP may operate. For example, an attacker may use a software defined radio (SDR) device within a commercial passenger vehicle to generate and transmit noise at Wi-Fi frequencies such as within the 2.4 GHz Wi-Fi range and/or 5 GHz Wi-Fi range. In some embodiments, the security module can measure the amount of noise at the frequencies at which the in-vehicle wireless AP operates. If the security module determines that the measured noise is greater than a threshold value, the security module can generate a security event log that includes any one or more of the following information:Type of Detection (e.g., noise generator detected)

Date and/or time of the detection

Measured noise value

In some embodiments, the security module can prevent a flooding of repeated security event logs by creating a security event log for the noise generator detection once within a configurable time interval (e.g., between 60 seconds and 360000 seconds inclusive). For example, if a security module detects two same types of malicious attacks or suspicious activity are detected within a configurable time interval, the security module can generate a security event log for the detection that happened first in time and prevent the generation of the security event log for the detection that happened second in time. In an example implementation, the configurable time interval to generate a security event log may have a default value of 900 seconds.

In some embodiments, the security module can measure a received signal to noise indicator (RSNI) value for the beacon frames transmitted by the authorized AP and unauthorized SDR. For example, before an unauthorized SDR begins transmitting noise, the security module can measure a first noise value associated with the beacon frames transmitted on one or more frequencies by an authorized AP. If the unauthorized SDR transmits noise on the one or more frequencies on which the authorized AP operates, then the security module can measure a second noise value for the associated with the beacon frames transmitted by an authorized AP. If the security module determines that a variance between the first noise value and the second noise value exceeds a pre-defined threshold noise value, then the security module can send a security alert message to the external I/O device and can generate a security event log that includes any one or more of the following information:

Type of Detection (e.g., noise generator detected)

Date and/or time of the detection

Measured first noise value and measured second noise value.

FIG. 3shows an exemplary block diagram of a dedicated wireless AP that is part of an exemplary wireless security system. The dedicated wireless AP300includes at least one processor310and a memory305having instructions stored thereupon. The instructions upon execution by the processor310configure the dedicated wireless AP300to perform the operations described forFIGS. 1 to 2D and 4 to 5, and to perform the operations described for the security module325. The instructions upon execution by the processor310can also configure the dedicated wireless AP300to perform the operations described in the various embodiments described in this patent document. The transmitter315transmits or sends information or data to another device (e.g., cabin terminal in the commercial passenger vehicle). The receiver320receives information, wireless frames, or data transmitted or sent by another device (e.g., in-vehicle wireless AP, attacker's wireless AP/wireless device, and/or PEDs).

This patent document describes the exemplary techniques to detect and/or prevent malicious attacks and/or suspicious activities in the context of a commercial passenger vehicle such as an airplane for ease of description. The exemplary techniques could be employed in other types of commercial passenger vehicle such as a train, a ship, or a bus.

FIG. 5shows an exemplary flowchart detecting a wireless attack or suspicious wireless activity for a wireless network in a commercial passenger vehicle. At the receiving operation502, a security module of an access point in the commercial passenger vehicle receives a set of wireless frames from a wireless device. At the first determination operation504, the security module makes a first determination that the set of wireless frames contains a large time duration value indicative of an attack on the wireless network upon determining that (1) a time duration value indicated in each of the set of wireless frames is greater than a pre-determined threshold value, and (2) the set of wireless frames are received within a pre-determined time period. At the sending operation506, the security module sends, upon making the first determination, a security alert message to an external input/output (I/O) device (e.g., cabin computer terminal) located in the commercial passenger vehicle.

In some embodiments, the method ofFIG. 5further comprises the security module generating, upon making the first determination, a security event log that identifies at least the wireless device as a source of the attack on the wireless network. In some embodiments, the method ofFIG. 5further comprises the security module receiving a second set of wireless frames from the wireless device, where the second set of wireless frames are different from the set of wireless frames; making a second determination that the second set of wireless frames have a time duration value greater than the pre-determined threshold value and that the second set of wireless frames are received within the pre-determined time period; making a third determination that a time when the second determination is made is within a configuration time interval of a time when the first determination was made; and preventing, in response to making the third determination, an additional security event log to be generated for the second set of wireless frames having a large time duration value.

In some embodiments, the security event log includes any one or more of: (1) a type of the attack that indicates that the set of wireless frames contain large time duration value, (2) a date and/or time of the attack, (3) information identifying the commercial passenger vehicle, (4) information identifying a wireless access point that performed the method of detecting the wireless attack or suspicious wireless activity, where the wireless AP is located in the commercial passenger vehicle, (5) information identifying the wireless device that performed the attack, (6) one or more types of the received set of wireless frames, and (7) the time duration value. In some embodiments, the wireless frame includes an acknowledgement (ACK) frame, a data frame, a request to send (RTS) frame, or a clear to send (CTS) frame.

In some embodiments, method ofFIG. 5further comprises measuring a received signal strength indicator (RSSI) or a received signal code power (RSCP) of a wireless frame from the set of wireless frames, and determining an approximate location of the wireless device based on the RSSI or the RSCP. In some embodiments, method ofFIG. 5further comprises measuring a noise value associated with one or more frequencies on which the set of wireless beacon frames are received, and sending a second security alert message to the external I/O device upon determining that the measured noise value exceeds a pre-defined noise threshold value. In some embodiments, method ofFIG. 5further comprises generating, upon determining that the measured noise value exceeds the pre-defined noise threshold value, a security event log that includes any one or more of: (1) a type of the attack that indicates that a noise generator device is detected, (2) a date and/or time of the attack, and (3) the measured noise value.

FIG. 6shows another exemplary flowchart for detecting a wireless attack or suspicious wireless activity for a wireless network in a commercial passenger vehicle. At the receiving operation602, a security module of an access point located in the commercial passenger vehicle receives a set of wireless beacon frames from a first wireless device. At the first determination operation604, the security module makes a first determination of a first beacon frame rate that describes a rate at which the set of wireless beacon frames are received. At the receiving operation606, the security module receiving a second beacon frame after a first beacon frame, where the first beacon frame is received last in time in the set of wireless beacon frames.

At the second determination operation608, the security module makes a second determination of a second beacon frame rate that describes a rate at which the second beacon frame is receive relative to when the first beacon frame was received. At the third determination operation610, the security module makes a third determination that a second wireless device transmitting the second beacon frame is impersonating the first wireless device transmitting the first beacon frame upon comparing the first beacon frame rate to the second beacon frame rate. At the sending operation612, the security module sends, upon making the third determination, a security alert message to an external input/output (I/O) device located in the commercial passenger vehicle.

In some embodiments, the first beacon frame rate and the second beacon frame rate are compared by the security module by determining that a rate of increase from the first beacon frame rate to the second beacon frame rate exceeds a pre-determined threshold value.

In some embodiments, the method further comprises the security module generating, upon making the third determination, a security event log that identifies at least a type of the attack on the wireless network. In some embodiments, the method comprises the security module receiving a third beacon frame after the second beacon frame; making a fourth determination of a third beacon frame rate that describes a rate at which the third beacon frame is receive relative to when the second beacon frame was received; making a fifth determination that a rate of increase from the second beacon frame rate to the third beacon frame rate exceeds a pre-determined threshold value; making a sixth determination that a time when the fifth determination is made is within a configuration time interval of a time when the third determination was made; and preventing, in response to making the sixth determination, an additional security event log to be generated for the third beacon frame that causes the rate of increase from the second beacon frame rate to the third beacon frame rate.

In some embodiments, the security event log includes any one or more of: (1) a type of the attack that indicates that the first wireless device is being impersonated, (2) a date and/or time of the attack, (3) information identifying the commercial passenger vehicle, (4) information identifying a wireless access point that performed the method of detecting the wireless attack or suspicious wireless activity, where the wireless AP is located in the commercial passenger vehicle, and (5) the pre-determined threshold value. In some embodiments, the first beacon frame rate is an average of beacon frame rates that describes a rate at which each beacon frame in the set of wireless beacon frames is received relative to an adjacent beacon frame in the set of wireless beacon frames.

In some embodiments, method ofFIG. 6further comprises measuring a first received signal strength indicator (RSSI) or a first received signal code power (RSCP) of a wireless beacon frame from the set of wireless beacon frames, measuring a second RSSI or a second RSCP of the second beacon frame, determining that a variance between the first RSSI and the second RSSI or between the first RSSI and the second RSSI exceeds a pre-defined value, and sending, upon determining that the variance exceeds the pre-defined value, a second security alert message to the external I/O device. In some embodiments, method ofFIG. 6further comprises determining an approximate location of the second wireless device based on the second RSSI or the second RSCP.

In some embodiments, method ofFIG. 6further comprises measuring a noise value associated with one or more frequencies on which the set of wireless beacon frames are received, and sending a second security alert message to the external I/O device upon determining that the measured noise value exceeds a pre-defined noise threshold value. In some embodiments, method ofFIG. 6further comprises generating, upon determining that the measured noise value exceeds the pre-defined noise threshold value, a security event log that includes any one or more of: (1) a type of the attack that indicates that a noise generator device is detected, (2) a date and/or time of the attack, and (3) the measured noise value.

In some embodiments, method ofFIG. 6further comprises measuring a first noise value associated with one or more frequencies on which the set of wireless beacon frames are received at a first point in time, measuring a second noise value associated with one or more frequencies on which the set of wireless beacon frames are received at a second point in time after the first point in time, and sending a second security alert message to the external I/O device upon determining that a variance between the first noise value and the second noise value exceeds a pre-defined noise threshold value.

In some embodiments, method ofFIG. 6further comprises generating, upon determining that the variance of between the first noise value and the second noise value exceeds the pre-defined noise threshold value, a security event log that includes any one or more of: (1) a type of the attack that indicates that a noise generator device is detected, (2) a date and/or time of the attack, and (3) the measured first noise value and the measured second noise value

An exemplary wireless system includes a dedicated wireless AP configured to detect malicious attack and/or suspicious activity with regards to a wireless network in a commercial passenger vehicle, in-vehicle wireless AP configured to provide audio/video entertainment content to PEDs located in the commercial passenger vehicle, and a wireless device that performs a malicious attack and/or suspicious activity with regards to the wireless network in the commercial passenger vehicle. The dedicated wireless AP includes a security module configured to perform the operations described inFIGS. 1, 2A to 2D, 4, 5, and/or6to detect malicious attack and/or suspicious activity with regards to a wireless network.