Patent ID: 7716740

Claim:
A method for a mobile station (MS) to detect a rogue access point (AP) in a wireless access network containing legitimate APs, comprising: maintaining at each legitimate AP of said wireless access network, a neighbor database containing AP data for all legitimate APs in a service area; requesting, from said MS roaming in said service area, a handover from a serving AP to one of a list of candidate APs in said service area; collecting, at the MS, AP presence information from all of said candidate APs, and reporting said AP presence information to said serving AP; calculating an effective path loss value for each candidate AP; determining whether a distance between the MS and a particular candidate AP is known, and, when the distance is known: calculating an expected path loss value for the particular candidate AP; comparing the effective oath loss value to the expected path loss value for the particular candidate AP; and determining that the particular candidate AP is a rogue AP when the effective path loss value and the expected path loss value have a mismatch greater than a threshold when the distance is unknown; determining, at said serving AP, if said AP presence information is consistent with said AP data maintained at said serving AP; when said AP presence information and said AP data are inconsistent, randomly removing one candidate AP from the list of candidate APs, and repeating the removal step until the AP presence information is consistent with the AP data maintained at the serving AP; and identifying the last removed candidate AP as the rogue AP.