Abstract:
Poisoning attacks by spoofing location beacons in a WLAN are detected using silence periods. A location beacon identifier is received from a mobile device allegedly within range of a location device transmitting location beacons, along with a timestamp of transmission for each of the location beacons. Also silence periods associated with the location device, during which transmissions of location beacons are temporarily discontinued, and which are unknown to the public, are determined or retrieved. The location beacon transmission time is compared to the silence periods. Responsive to the location beacon transmission time corresponding to at least one of the silence periods, the location device flagged as poisoned.

Description:
FIELD OF THE INVENTION 
       [0001]    The invention relates generally to Wi-Fi computer networking, and more specifically, to detecting poisoning attacks for location beacons. 
       BACKGROUND 
       [0002]    iBeacon location technology is a protocol developed by Apple and as a platform has opened up a myriad of application development. Generally, a mobile device within range of an iBeacon tag receives an identification that is uploaded to an access point or other network device. A location of the iBeacon is known, so the reception by a particular mobile device provides a location. Based on the location, passive applications can maintain statistics. For example, a consumer can be tracked around a store for shopping behavior analysis alone, or in the aggregate. Active applications can offer the consumer coupons based on a real-time location determination. 
         [0003]    Unfortunately, with new technology platforms comes new vulnerabilities for unscrupulous persons and processes. In more detail, because the iBeacon technology is inherently open an unsecure format, spoofing iBeacon signals is easily accomplished. In one example, the transmissions of an iBeacon tag can be recorded and replicated at a different location, thereby poisoning data collection with invalid information. 
         [0004]    What is needed is a robust technique for detecting poisoning attacks on iBeacons and other location beacons with periods of transmission silence that would not be known to malicious parties observing iBeacons just for tags. 
       SUMMARY 
       [0005]    The above-mentioned shortcomings are addressed by systems, methods and computer-readable medium (non-transitory) for detecting spoofed location beacons using silence periods. 
         [0006]    In one embodiment, a location beacon identifier is received from a mobile device allegedly within range of a location device transmitting location beacons, along with a timestamp of transmission for each of the location beacons. Also silence periods associated with the location device, during which transmissions of location beacons are temporarily discontinued, and which are unknown to the public, are determined or retrieved. The location beacon transmission time is compared to the silence periods. Responsive to the location beacon transmission time corresponding to at least one of the silence periods, the location device flagged as poisoned. 
         [0007]    Advantageously, computer devices are more reliable by having locations determine with more integrity and reliability. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]    In the following drawings, like reference numbers are used to refer to like elements. Although the following figures depict various examples of the invention, the invention is not limited to the examples depicted in the figures. 
           [0009]      FIG. 1  is a block diagram illustrating a system for detecting location beacon spoofs, according to an embodiment. 
           [0010]      FIG. 2  is a more detailed block diagram of an location server of  FIG. 1 , according to an embodiment. 
           [0011]      FIG. 3  is a flow chart illustrating a method for detecting location beacon spoofs, according to an embodiment. 
           [0012]      FIG. 4  is a block diagram illustrating an exemplary computing device, according to one embodiment. 
       
    
    
     DETAILED DESCRIPTION 
       [0013]    Hand-off control systems, computer-implemented methods, and (non-transitory) computer-readable mediums for handing-off calls from a cellular network to a data network, are described. iBeacons are generally referred to herein, however, one of ordinary skill in the art will recognize application of the techniques described herein to any location beacon (e.g., Eddystone by Google or near field communication). 
         [0014]    Systems for Location Spoof Detection ( FIG. 1-3 ) 
         [0015]      FIG. 1  is a block diagram illustrating a system  100  for detecting location beacon spoofs, according to an embodiment. The system  100  comprises a location server  110 , mobile device  120 , beacon device  140 , and spoofing beacon device  101 , communicatively coupled through a network  188 . The location server  110  and the spoofing beacon device  101  are preferably connected to the network  199  with a wired connection, while the mobile device  120  and the beacon device  130  can be wirelessly connected (the mobile device  120  can connect through an access point). Additional network components can also be part of the system  100 , such as firewalls, virus scanners, routers, switches, application servers, databases, as well as controllers, access points, access switches, stations, and the like. For instance, embodiments of the system  100  can be implemented in conjunction with a network security system, for example, the FortiGate Network Security platform by Fortinet of Sunnyvale, CA. The network components can be implemented as hardware, software, or a combination of both. 
         [0016]    Wireless components preferably use communication protocols such as IEEE 802.11 n and IEEE 802.11 ac wave 2, in addition to other protocols such as other IEEE 802.11s, IEEE 802.3, Bluetooth, 3G and 4G. The enterprise network can serve, for example, a business enterprise, a hospital or system of hospital, school, building, a private network, or the like. The enterprise network  101  can provide access to a wide area network or the Internet in some embodiments. Alternatively, the enterprise network  101  can be distributed over the Internet, in other embodiments. A combination of wired and wireless devices can be connected, as well as only wireless devices or only wired devices. The enterprise network can be, for example, the Internet, a cellular network, a larger enterprise network to which the enterprise network is a smaller component of, or a combination of network types. 
         [0017]    The location server  110  includes a spoof detection module  112  which uses silence periods for iBeacon transmissions to detect the spoofing beacon device  101 . When receiving iBeacon identifiers along with a time stamp, the location server  110  refers to silence periods in which no iBeacons from the beacon device  130 . If a transmission was made during a silence period, the spoof detection module  132  flags as spoofed. The silence periods can be unique for each device or uniform across a certain network or a specific entity or user. Alerts can be sent out or the location server  110  can ignore additional messages with the spoofed identifier. The location server  110  can be owned by a single entity or be a third party service that has many different secured user accounts, for example. The location server  110  is described in further detail below with respect to  FIG. 2 . 
         [0018]    The mobile device  120  senses location beacons being broadcast from the beacon device  130 , and extracts an identifier. Responsive to sending the identifier to the location server  110 , a location in the form of coordinates or otherwise are returned to the mobile device  120 . Many applications within the mobile device  120  can make use of the location information, including the operating system and applications. For example, a scavenger hunt mobile app can receive locations from the operating system or derive locations directly from the location server  110 . 
         [0019]    The beacon device  130  periodically broadcasts location beacons or iBeacons from a static location. The beacons include an identifier of the beacon device  130  which can be looked up on the location sever  110 . The identifier can be several byes long and universally unique. Silence periods are programmed into the beacon periods, and synchronized with the location server  110 . The silence periods can be produced based on an algorithm, a key available to both the beacon device  130  and the location server  110  or by other techniques that deviate from the assumed periodic broadcasts. Specific silence periods can also be downloaded or programmed to the beacon device  130 . In some cases, the beacon device  130  is a full-fledged computing device. But in other cases, the beacon device  130  is a low-power active or passive tag. The beacon device  130  can operate from a battery that lasts several months to several years. 
         [0020]    The spoofing beacon device  101  can be operated by a malicious entity or process. To configure, the beacon device  130  is observed for legitimate location beacons that are then replicated by the spoofing beacon device  101 . iBeacons are typically not secured to encourage wide deployment. Many location systems broadcast location beacons in a periodic manner, and thus, the spoofing beacon device  101  assumes the same operation. However, time stamps generated by the spoofing beacon device  101  will be outside of the shared algorithm of the legitimate locationing. In one case, the spoofing beacon device  101  generates bogus location identification information and time stamps to send to the location server  110 . In yet another case, the spoofing beacon device  101 , configured with a location broadcasting application, misleads stations within range by broadcasting fake beacons that are sent to the location server  110  by unknowing mobile devices. The spoofing beacon device  101  includes a transmitter such a Bluetooth low energy device. Processing can be optimized for beacon broadcasting with low power. 
         [0021]      FIG. 2  is a more detailed block diagram of the location server  110  of  FIG. 1 , according to an embodiment. The location server  110  comprises an identifier database  210 , a synchronizing engine  220 , and a spoof alert module  230 . 
         [0022]    The identifier database  210  tracks locations of the beacon device  130  and many other beacon devices. Locations can be updated from time to time, but the identifier remains constant. In one case, a mobile scanner with a GPS location scans the beacon device  130  and uploads a location. In other cases, locations are managed manually through an interface. 
         [0023]    The synchronizing engine  220  relies upon a timing algorithm that matches the beacon device  130 . In real-time or batch, legitimate broadcast times can be calculated for comparison. 
         [0024]    The spoof alert module  230  compares legitimate broadcast times against actual time stamps for broadcast received from applications. When an anomaly occurs, the spoof alert system  230  can respond in various manners to remediate any potential damage. A user of the mobile device  120  can be alerted through the operating system or app. A network administrator for the network  199  can be sent a message by e-mail or SMS text. Further messages from the spoofing beacon device  101  can be ignored. Some embodiments can shut down locationing services altogether to quarantine the system  100 . 
         [0025]    Methods for Location Spoof Detection ( FIG. 3 ) 
         [0026]      FIG. 3  is a flow chart illustrating a method  300  for detecting location beacon spoofs, according to an embodiment. One of ordinary skill in the art will recognize that the method  300  is non-limiting as other embodiments can have more or less steps and can be performed in a different order. The method  300  can be implemented in the system  100  of  FIG. 1  or in other components. 
         [0027]    Location beacon identifiers are received from a mobile device, along with timestamps (step  310 ). Silence periods associated with the location device are determined (step  320 ). In some cases, the silence periods are predetermined and stored as a list, and in other cases the silence periods are calculated from a formula or algorithm. The silence periods are compared to time stamps (step  330 ). A single anomaly or several events may be required to mismatch. Either way, a location device is flagged as poisoned when the threshold is met. A spoofing location device can also be marked by saving a MAC address, profile, or other unique identifier (step  340 ). 
         [0028]    Generic Computing Device ( FIG. 4 ) 
         [0029]      FIG. 4  is a block diagram illustrating an exemplary computing device  400  for use in the system  100  of  FIG. 1 , according to one embodiment. The computing device  400  is an exemplary device that is implementable for each of the components of the system  100 , including the location server  110  and the mobile device  120 . The computing device  400  can be a mobile computing device, a laptop device, a smartphone, a tablet device, a phablet device, a video game console, a personal computing device, a stationary computing device, a server blade, an Internet appliance, a virtual computing device, a distributed computing device, a cloud-based computing device, or any appropriate processor-driven device. 
         [0030]    The computing device  400 , of the present embodiment, includes a memory  410 , a processor  420 , a storage drive  440 , and an I/O port  440 . Each of the components is coupled for electronic communication via a bus  499 . Communication can be digital and/or analog, and use any suitable protocol. 
         [0031]    The memory  410  further comprises network applications  412  and an operating system  414 . The network applications  412  can include a web browser, a mobile application, an application that uses networking, a remote application executing locally, a network protocol application, a network management application, a network routing application, or the like. 
         [0032]    The operating system  414  can be one of the Microsoft Windows® family of operating systems (e.g., Windows 95, 98, Me, Windows NT, Windows 2000, Windows XP, Windows XP x64 Edition, Windows Vista, Windows CE, Windows Mobile, Windows 8 or Windows 10), Linux, HP-UX, UNIX, Sun OS, Solaris, Mac OS X, Alpha OS, AIX, IRIX42, or IRIX64. Other operating systems may be used. Microsoft Windows is a trademark of Microsoft Corporation. 
         [0033]    The processor  420  can be a network processor (e.g., optimized for IEEE 802.11), a general purpose processor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a reduced instruction set controller (RISC) processor, an integrated circuit, or the like. Qualcomm Atheros, Broadcom Corporation, and Marvell Semiconductors manufacture processors that are optimized for IEEE 802.11 devices. The processor  420  can be single core, multiple core, or include more than one processing elements. The processor  420  can be disposed on silicon or any other suitable material. The processor  420  can receive and execute instructions and data stored in the memory  410  or the storage drive  440   
         [0034]    The storage drive  440  can be any non-volatile type of storage such as a magnetic disc, EEPROM, Flash, or the like. The storage drive  440  stores code and data for applications. 
         [0035]    The I/O port  440  further comprises a user interface  442  and a network interface  444 . The user interface  442  can output to a display device and receive input from, for example, a keyboard. The network interface  444  (e.g. RF antennae) connects to a medium such as Ethernet or Wi-Fi for data input and output. 
         [0036]    Many of the functionalities described herein can be implemented with computer software, computer hardware, or a combination. 
         [0037]    Computer software products (e.g., non-transitory computer products storing source code) may be written in any of various suitable programming languages, such as C, C++, C#, Oracle® Java, JavaScript, PHP, Python, Perl, Ruby, AJAX, and Adobe® Flash®. The computer software product may be an independent application with data input and data display modules. Alternatively, the computer software products may be classes that are instantiated as distributed objects. The computer software products may also be component software such as Java Beans (from Sun Microsystems) or Enterprise Java Beans (EJB from Sun Microsystems). 
         [0038]    Furthermore, the computer that is running the previously mentioned computer software may be connected to a network and may interface to other computers using this network. The network may be on an intranet or the Internet, among others. The network may be a wired network (e.g., using copper), telephone network, packet network, an optical network (e.g., using optical fiber), or a wireless network, or any combination of these. For example, data and other information may be passed between the computer and components (or steps) of a system of the invention using a wireless network using a protocol such as Wi-Fi (IEEE standards 802.11, 802.11a, 802.11b, 802.11e, 802.11g, 802.11i, 802.11n, and 802.11ac, just to name a few examples). For example, signals from a computer may be transferred, at least in part, wirelessly to components or other computers. 
         [0039]    In an embodiment, with a Web browser executing on a computer workstation system, a user accesses a system on the World Wide Web (WWW) through a network such as the Internet. The Web browser is used to download web pages or other content in various formats including HTML, XML, text, PDF, and postscript, and may be used to upload information to other parts of the system. The Web browser may use uniform resource identifiers (URLs) to identify resources on the Web and hypertext transfer protocol (HTTP) in transferring files on the Web. 
         [0040]    This description of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form described, and many modifications and variations are possible in light of the teaching above. The embodiments were chosen and described in order to best explain the principles of the invention and its practical applications. This description will enable others skilled in the art to best utilize and practice the invention in various embodiments and with various modifications as are suited to a particular use. The scope of the invention is defined by the following claims.