WO2014080170A1 - Intrusion prevention and detection in a wireless network - Google Patents
Intrusion prevention and detection in a wireless network Download PDFInfo
- Publication number
- WO2014080170A1 WO2014080170A1 PCT/GB2013/052856 GB2013052856W WO2014080170A1 WO 2014080170 A1 WO2014080170 A1 WO 2014080170A1 GB 2013052856 W GB2013052856 W GB 2013052856W WO 2014080170 A1 WO2014080170 A1 WO 2014080170A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- traffic
- wireless
- mac
- computer program
- allowed
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W12/122—Counter-measures against attacks; Protection against rogue devices
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/125—Protection against power exhaustion attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/16—Implementing security features at a particular protocol layer
Definitions
- the invention relates to an intrusion prevention and detection system, computer program and method operable in a device or devices of a wireless network.
- wireless networks such as wireless local area networks (WLANs) / WiFi networks
- WLANs wireless local area networks
- WiFi networks WiFi networks
- POS mobile point of sale
- the security of wireless networks is an important issue.
- hackers that succeed in breaking into a wireless network can use various attack types to, for example, compromise network functionality and steal information from users of the network.
- Approaches to wireless security have included provision of a plurality of sensors in the wireless network, which monitor wireless traffic for attacks. Such an approach, however, requires a complex overlay network, which often proves too expensive for many wireless network providers.
- an intrusion detection and prevention computer program which, when executed provides a security element situated between a receiver and a media access control (MAC) element of a device of a wireless network, which security element performs the steps of:
- the intrusion detection and prevention computer program may output one or more signals to the MAC element which cause the MAC element to disconnect from the wireless traffic.
- the intrusion detection and prevention computer program may output one or more signals to one or more further devices of the wireless network to prevent one or more types of attack on the devices.
- an intrusion detection and prevention system comprising a security element which is situated between a receiver and a media access control (MAC) element of a device of a wireless network, and which receives wireless traffic from the receiver of the device, and detects that the traffic is allowed according to one or more rules and passes the traffic to the MAC element of the device, or detects that the traffic is not allowed according to the one or more rules and prevents the traffic from passing to the MAC element of the device.
- the security element may comprise software.
- the intrusion detection and prevention system may output one or more signals to the MAC element which cause the MAC element to disconnect from the wireless traffic.
- the intrusion detection and prevention system may output one or more signals to one or more further devices of the wireless network to prevent one or more types of attack on the devices.
- wireless traffic received by the device of the wireless network is passed to the security element and using the intrusion detection and prevention system and computer program of the invention, 'unallowed' traffic such as malicious traffic is detected and prevented from passing to the MAC element.
- 'unallowed' traffic such as malicious traffic is detected and prevented from passing to the MAC element.
- attacks can be detected and prevented before they reach the MAC element of the device, i.e. this is protected from beneath.
- Elements of the device situated beyond the MAC element from the receiver are also protected by the intrusion detection and prevention system and computer program of the invention. This therefore increases the security of the device and of the wireless network, and does so without the need for any additional security sensors in the network.
- Detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for a denial of service (DoS) attack.
- Analysing the wireless traffic for a DoS attack may comprise determining if the traffic comprises spoofed MAC frames.
- Analysing the wireless traffic for a DoS attack may comprise determining an arrival rate of the wireless traffic and comparing this with an acceptable threshold arrival rate.
- Analysing the wireless traffic for a DoS attack may comprise determining an arrival rate of wireless traffic comprising any of device authentication traffic, device de-authentication traffic, device association traffic, device disassociation traffic.
- Analysing the wireless traffic for a DoS attack may further comprise analysing any of address resolution protocol (ARP) data of the traffic , Internet control message protocol (ICMP) data of the traffic, transport control protocol (TCP) data of the traffic, Internet protocol (IP) data of the traffic, probe request data of the traffic, probe response data of the traffic, extensible authentication protocol (EAP) data of the traffic.
- ARP address resolution protocol
- ICMP Internet control message protocol
- TCP transport control protocol
- IP Internet protocol
- probe request data of the traffic probe response data of the traffic
- EAP extensible authentication protocol
- detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for a man-in-the-middle (MiTM) attack.
- Analysing the wireless traffic for a man-in-the- middle attack may comprise determining if the traffic comprises spoofed or forged traffic.
- Analysing the wireless traffic for a man-in-the-middle attack may comprise determining if the traffic comprises any of spoofed MAC layer frames, spoofed address resolution protocol (ARP) data, spoofed domain name system (DNS) data, spoofed dynamic host configuration protocol (DHCP) data.
- ARP address resolution protocol
- DNS domain name system
- DHCP dynamic host configuration protocol
- detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for an encryption attack.
- the encryption attack may be a wired equivalent privacy (WEP) attack or a WiFi protected access (WPA) attack.
- detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic by validating sequence numbers thereof.
- Analysing the wireless traffic by validating sequence numbers thereof may comprise validating sequence numbers of any of extensible authentication protocol (EAP) data of the traffic, extensible authentication protocol over local area network (EAPoL) data of the traffic, address resolution protocol (ARP) data of the traffic, deauthentication frames of the traffic, disassociation frames of the traffic.
- EAP extensible authentication protocol
- EAPoL extensible authentication protocol over local area network
- ARP address resolution protocol
- detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for exploitation of vulnerabilities in processing of MAC management frames. Analysing the wireless traffic for exploitation of vulnerabilities in the processing of MAC management frames may comprise determining an authentication mechanism for protecting MAC management frames. The authentication mechanism for protecting MAC management frames may comprise adding an authentication field to the MAC management frames. Such an approach will allow prevention of disassociation and deauthentication DoS attacks. Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for Internet control message protocol (ICMP) attacks.
- ICMP Internet control message protocol
- Analysing the wireless traffic for ICMP attacks may comprise any of detecting attacks based on ICMP size to prevent Ping of Death attacks, detecting attacks by checking ICMP destination addresses to prevent ICMP Smurf attacks, detecting attacks by validating ICMP port fields to prevent universal datagram protocol (UDP) ICMP port unreachable scanning attacks.
- ICMP size to prevent Ping of Death attacks
- UDP universal datagram protocol
- detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for transport control protocol (TCP) attacks.
- Analysing the wireless traffic for TCP attacks may comprise any of detecting TCP SYN attacks, detecting TCP connect scanning attacks, detecting TCP FIN scanning attacks, detecting attacks based on TCP SYN/FIN arrival rate to prevent TCP/SYN/FIN scanning attacks.
- detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for Internet protocol (IP) attacks.
- Analysing the wireless traffic for IP attacks may comprise any of detecting attacks by sequence validation and received signal strength indication (RSSI) to prevent IP spoofing attacks, detecting attacks by comparing IP addresses in IP headers to prevent Land attacks.
- RSSI received signal strength indication
- detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for received signal strength indication (RSSI). This may prevent spoofing attacks such as IP spoofing attacks, MAC spoofing attacks, beacons and probes.
- RSSI received signal strength indication
- Detecting that the traffic is allowed according to the one or more rules may comprise marking the traffic for further inspection by the MAC element of the device or another element of the device. Preventing the traffic from passing to the MAC element of the device may comprise destroying the traffic. Preventing the traffic from passing to the MAC element of the device may further comprise releasing memory used to store the traffic. Preventing the traffic from passing to the MAC element of the device may comprise detecting that traffic from a source is not allowed and dropping subsequent traffic from the source for a period of time.
- the intrusion detection and prevention system and computer program may perform further functions comprising any of sending alerts to an administrator of the wireless network, logging activity on the wireless network, conducting authentication of devices of the wireless network, reporting one or more conditions within the network e.g. RSSI values and beacon rates.
- the intrusion detection and prevention system and computer program may detect and prevent a plurality of attacks from the wireless traffic.
- an intrusion detection and prevention method comprising the steps of:
- a device of a wireless network comprising:
- a receiver configured to receive wireless traffic from the network
- MAC media access control
- an intrusion detection and prevention computer program providing a security element situated between the receiver and the MAC element and configured, when executed, to:
- the intrusion detection and prevention computer program may provide a security element situated between a driver of the receiver of the device and the MAC element of the device.
- the device may comprise an access point (AP) of the wireless network.
- the device may comprise a base station of the wireless network.
- the device may comprise any of a wireless terminal, a wireless station, a client of the wireless network, such as any of a desktop computer, a laptop computer, a notebook computer, a tablet computer, a smartphone, a PDA, a point of sale (POS) device, a device incorporating a wireless interface and a MAC element.
- AP access point
- the device may comprise a base station of the wireless network.
- the device may comprise any of a wireless terminal, a wireless station, a client of the wireless network, such as any of a desktop computer, a laptop computer, a notebook computer, a tablet computer, a smartphone, a PDA, a point of sale (POS) device, a device incorporating a wireless interface and a MAC element.
- POS point of sale
- the device may be an existing device of a wireless network.
- the device may be a new device of a wireless network.
- the intrusion detection and prevention computer program/system may be retro-fitted to an existing wireless network or may be provided as part of a new wireless network.
- a wireless network comprising one or more devices according to the fourth aspect of the invention.
- the wireless network may comprise any of a WLAN, a wireless metropolitan area network (WMAN), a WiFi network, a WiMax network, a 3G network, a 4G network.
- the wireless network may comprise any wireless network installed and/or managed by mobile network operators (MNOs).
- MNOs mobile network operators
- the wireless network may comprise any wireless network installed and/or managed by an end user of the network.
- the wireless network may comprise one or more devices comprising access points and one or more devices comprising any of a wireless terminal, a wireless station, a client.
- the wireless network may comprise one or more devices comprising access points and one or more devices comprising POS devices.
- PCI payment card industry
- an intrusion detection and prevention computer program embodied in a computer readable medium which, when executed on one or more computers, performs the steps of:
- MAC media access control
- Figure 1 is a schematic representation of a device according to the fourth aspect of the invention comprising an intrusion detection and prevention system / computer program according to the first and second aspects of the invention;
- Figure 2 is a schematic representation of a first intrusion detection and prevention method according to the third aspect of the invention carried out by the device of Figure 1
- Figure 3 is a schematic representation of a second intrusion detection and prevention method according to the third aspect of the invention carried out by the device of Figure 1.
- Figure 1 illustrates a device 1 of a wireless network (not shown).
- the device comprises an access point (AP) of the wireless network and receives and transmits wireless traffic from and to a plurality of point of sale (POS) devices of the network.
- the wireless network is located in a restaurant and is used to enable staff of the restaurant to provide a security-enhanced mobile payment service to customers.
- the device 1 has an intrusion detection and prevention system / computer program according to the invention and, on its own, is able to protect the network against at least MiTM and rogue device attacks.
- one or more of the POS devices may also have an intrusion detection and prevention system / computer program according to the invention and, together with the AP 1, are able to protect the network against at least DoS, MiTM and rogue device attacks.
- the security of data transferred by the customer to a POS device to the network is increased.
- the device 1 of Figure 1 comprises a receiver 3, a media access control (MAC) element 5 and a security element 7 situated between the receiver 3 and the MAC element 5.
- the receiver 3 may be part of a transceiver, capable of receiving and sending wireless traffic from and to a network.
- the receiver 3 comprises an antenna 9 connected to a wireless network interface card 11 which has a driver 13.
- the antenna 9 and the network interface card 11 are configured to receive wireless traffic from the network via the antenna 9, and pass the wireless traffic to the security element 7.
- the security element 7 has an intrusion detection and prevention system / computer program according to the invention embedded as software therein.
- the intrusion detection and prevention system / computer program software is configured, when executed, to receive the wireless traffic from the receiver 3 and either detect that the traffic is allowed according to one or more rules and pass the traffic to the MAC element 5 or detect that the traffic is not allowed according to the one or more rules and prevent the traffic from passing to the MAC element 5.
- the MAC element 5 receives allowed wireless traffic and carries out standard MAC layer protocol functions on the traffic and passes the traffic to higher protocol layer elements of the device 1 (not shown).
- the intrusion detection and prevention system / computer program software embedded in the security element 7 is able to detect and prevent various attacks on the device 1 carried out by means of the wireless traffic received by the device 1. Two examples of such attack detection and prevention will now be described, with reference to Figures 2 and 3. It will appreciated however that the intrusion detection and prevention system / computer program of the invention is able to carry out many more examples of intrusion detection and prevention.
- the security element 7 receives wireless traffic from the receiver 3 of the AP device 1 (step 20).
- the intrusion detection and prevention system / computer program software embedded in the security element 7 receives the traffic and detects that the traffic is allowed or not allowed according to one or more rules by analysing the traffic for a DoS attack (step 22). In this embodiment, this comprises determining an arrival rate of device authentication traffic of the wireless traffic and comparing this rate with an acceptable threshold arrival rate (step 24).
- the device authentication traffic may comprise any of extensible authentication protocol over local area networks (EAPoL) Start traffic, EAPoL LogOff traffic, EAP-SUCCESS traffic, EAP-FAILURE traffic.
- EAPoL extensible authentication protocol over local area networks
- the intrusion detection and prevention system / computer program of the invention enables protection of devices in the network from these unwanted effects. Furthermore, the intrusion detection and prevention system / computer program allows detection and protection of a device without unduly affecting the throughput performance of the device.
- the security element 7 receives wireless traffic from the receiver 3 of the AP device 1 (step 30).
- the intrusion detection and prevention system / computer program software embedded in the security element 7 receives the traffic and detects that the traffic is allowed or not allowed according to one or more rules by analysing the traffic for exploitation of vulnerabilities in processing of MAC management frames (step 32).
- analysing the wireless traffic for exploitation of vulnerabilities in the processing of MAC management frames comprises determining an authentication mechanism for protecting MAC management frames, which comprises adding an authentication field in the form of an information element (IE) to the MAC management frames (step 34). If the authentication field information element is detected from analysis of the MAC management frames, the traffic is deemed to be allowed and is passed to the MAC element 5 of the device 1 (step 36). If the authentication field information element is not detected from analysis of the MAC management frames, the traffic is deemed to be not allowed and is prevented from passing to the MAC element 5 of the device 1 by destroying the traffic (step 38).
- IE information element
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides an intrusion detection and prevention system and computer program which, when operated or executed by a security element (7) situated between a receiver (3) and a media access control (MAC) element (5) of a device (1) of a wireless network, performs the steps of receiving wireless traffic from the receiver of the device, and detecting that the traffic is allowed according to one or more rules and passing the traffic to the MAC element of the device, or detecting that the traffic is not allowed according to the one or more rules and preventing the traffic from passing to the MAC element of the device.
Description
Intrusion Prevention and Detection in a Wireless Network
The invention relates to an intrusion prevention and detection system, computer program and method operable in a device or devices of a wireless network.
The popularity of wireless networks, such as wireless local area networks (WLANs) / WiFi networks, has had a profound growth in the last decade. It has become the norm, for example, for cafes to use WiFi networks, or 'hotspots', to provide their customers with access to the Internet, and the use of such networks by stores and restaurants to provide mobile point of sale (POS) devices is increasing. As with wired networks, the security of wireless networks is an important issue. Hackers that succeed in breaking into a wireless network can use various attack types to, for example, compromise network functionality and steal information from users of the network. Approaches to wireless security have included provision of a plurality of sensors in the wireless network, which monitor wireless traffic for attacks. Such an approach, however, requires a complex overlay network, which often proves too expensive for many wireless network providers.
According to a first aspect of the invention there is provided an intrusion detection and prevention computer program which, when executed provides a security element situated between a receiver and a media access control (MAC) element of a device of a wireless network, which security element performs the steps of:
receiving wireless traffic from the receiver of the device, and
detecting that the traffic is allowed according to one or more rules and passing the traffic to the MAC element of the device, or
detecting that the traffic is not allowed according to the one or more rules and preventing the traffic from passing to the MAC element of the device.
The intrusion detection and prevention computer program may output one or more signals to the MAC element which cause the MAC element to disconnect from the
wireless traffic.
The intrusion detection and prevention computer program may output one or more signals to one or more further devices of the wireless network to prevent one or more types of attack on the devices.
According to a second aspect of the invention there is provided an intrusion detection and prevention system comprising a security element which is situated between a receiver and a media access control (MAC) element of a device of a wireless network, and which receives wireless traffic from the receiver of the device, and detects that the traffic is allowed according to one or more rules and passes the traffic to the MAC element of the device, or detects that the traffic is not allowed according to the one or more rules and prevents the traffic from passing to the MAC element of the device. The security element may comprise software.
The intrusion detection and prevention system may output one or more signals to the MAC element which cause the MAC element to disconnect from the wireless traffic. The intrusion detection and prevention system may output one or more signals to one or more further devices of the wireless network to prevent one or more types of attack on the devices.
Thus wireless traffic received by the device of the wireless network is passed to the security element and using the intrusion detection and prevention system and computer program of the invention, 'unallowed' traffic such as malicious traffic is detected and prevented from passing to the MAC element. Using the intrusion detection and prevention system and computer program of the invention, attacks can be detected and prevented before they reach the MAC element of the device, i.e. this is protected from beneath. Elements of the device situated beyond the MAC element
from the receiver are also protected by the intrusion detection and prevention system and computer program of the invention. This therefore increases the security of the device and of the wireless network, and does so without the need for any additional security sensors in the network.
Detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for a denial of service (DoS) attack. Analysing the wireless traffic for a DoS attack may comprise determining if the traffic comprises spoofed MAC frames. Analysing the wireless traffic for a DoS attack may comprise determining an arrival rate of the wireless traffic and comparing this with an acceptable threshold arrival rate. Analysing the wireless traffic for a DoS attack may comprise determining an arrival rate of wireless traffic comprising any of device authentication traffic, device de-authentication traffic, device association traffic, device disassociation traffic. Analysing the wireless traffic for a DoS attack may further comprise analysing any of address resolution protocol (ARP) data of the traffic , Internet control message protocol (ICMP) data of the traffic, transport control protocol (TCP) data of the traffic, Internet protocol (IP) data of the traffic, probe request data of the traffic, probe response data of the traffic, extensible authentication protocol (EAP) data of the traffic. These analyses are performed before the wireless traffic is passed to the MAC element.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for a man-in-the-middle (MiTM) attack. Analysing the wireless traffic for a man-in-the- middle attack may comprise determining if the traffic comprises spoofed or forged traffic. Analysing the wireless traffic for a man-in-the-middle attack may comprise determining if the traffic comprises any of spoofed MAC layer frames, spoofed address resolution protocol (ARP) data, spoofed domain name system (DNS) data, spoofed dynamic host configuration protocol (DHCP) data.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for traffic from an unauthorised device connected to the network. Analysing the wireless traffic for traffic from an unauthorised device connected to the network may comprise analysing for traffic from any of an unauthorised access point, an unauthorised client.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for an encryption attack. The encryption attack may be a wired equivalent privacy (WEP) attack or a WiFi protected access (WPA) attack.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic by validating sequence numbers thereof. Analysing the wireless traffic by validating sequence numbers thereof may comprise validating sequence numbers of any of extensible authentication protocol (EAP) data of the traffic, extensible authentication protocol over local area network (EAPoL) data of the traffic, address resolution protocol (ARP) data of the traffic, deauthentication frames of the traffic, disassociation frames of the traffic.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for exploitation of vulnerabilities in processing of MAC management frames. Analysing the wireless traffic for exploitation of vulnerabilities in the processing of MAC management frames may comprise determining an authentication mechanism for protecting MAC management frames. The authentication mechanism for protecting MAC management frames may comprise adding an authentication field to the MAC management frames. Such an approach will allow prevention of disassociation and deauthentication DoS attacks.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for Internet control message protocol (ICMP) attacks. Analysing the wireless traffic for ICMP attacks may comprise any of detecting attacks based on ICMP size to prevent Ping of Death attacks, detecting attacks by checking ICMP destination addresses to prevent ICMP Smurf attacks, detecting attacks by validating ICMP port fields to prevent universal datagram protocol (UDP) ICMP port unreachable scanning attacks.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for transport control protocol (TCP) attacks. Analysing the wireless traffic for TCP attacks may comprise any of detecting TCP SYN attacks, detecting TCP connect scanning attacks, detecting TCP FIN scanning attacks, detecting attacks based on TCP SYN/FIN arrival rate to prevent TCP/SYN/FIN scanning attacks.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for Internet protocol (IP) attacks. Analysing the wireless traffic for IP attacks may comprise any of detecting attacks by sequence validation and received signal strength indication (RSSI) to prevent IP spoofing attacks, detecting attacks by comparing IP addresses in IP headers to prevent Land attacks.
Additionally or alternatively, detecting that the traffic is allowed or not allowed according to the one or more rules may comprise analysing the wireless traffic for received signal strength indication (RSSI). This may prevent spoofing attacks such as IP spoofing attacks, MAC spoofing attacks, beacons and probes.
Detecting that the traffic is allowed according to the one or more rules may comprise marking the traffic for further inspection by the MAC element of the device or another element of the device.
Preventing the traffic from passing to the MAC element of the device may comprise destroying the traffic. Preventing the traffic from passing to the MAC element of the device may further comprise releasing memory used to store the traffic. Preventing the traffic from passing to the MAC element of the device may comprise detecting that traffic from a source is not allowed and dropping subsequent traffic from the source for a period of time.
The intrusion detection and prevention system and computer program may perform further functions comprising any of sending alerts to an administrator of the wireless network, logging activity on the wireless network, conducting authentication of devices of the wireless network, reporting one or more conditions within the network e.g. RSSI values and beacon rates.
It will be appreciated that the intrusion detection and prevention system and computer program may detect and prevent a plurality of attacks from the wireless traffic.
According to a third aspect of the invention there is provided an intrusion detection and prevention method comprising the steps of:
receiving wireless traffic from a receiver of a device of a wireless network, and detecting that the traffic is allowed according to one or more rules and passing the traffic to a MAC element of the device, or
detecting that the traffic is not allowed according to the one or more rules and preventing the traffic from passing to the MAC element of the device. According to a fourth aspect of the invention there is provided a device of a wireless network comprising:
a receiver configured to receive wireless traffic from the network,
a media access control (MAC) element, and
an intrusion detection and prevention computer program according to the first aspect of the invention, providing a security element situated between the receiver and the
MAC element and configured, when executed, to:
receive wireless traffic from the receiver of the device, and
detect that the traffic is allowed according to one or more rules and pass the traffic to the MAC element of the device, or
detect that the traffic is not allowed according to the one or more rules and prevent the traffic from passing to the MAC element of the device.
The intrusion detection and prevention computer program may provide a security element situated between a driver of the receiver of the device and the MAC element of the device.
The device may comprise an access point (AP) of the wireless network. The device may comprise a base station of the wireless network. The device may comprise any of a wireless terminal, a wireless station, a client of the wireless network, such as any of a desktop computer, a laptop computer, a notebook computer, a tablet computer, a smartphone, a PDA, a point of sale (POS) device, a device incorporating a wireless interface and a MAC element.
The device may be an existing device of a wireless network. The device may be a new device of a wireless network. Thus the intrusion detection and prevention computer program/system may be retro-fitted to an existing wireless network or may be provided as part of a new wireless network.
According to a fifth aspect of the invention there is provided a wireless network comprising one or more devices according to the fourth aspect of the invention.
The wireless network may comprise any of a WLAN, a wireless metropolitan area network (WMAN), a WiFi network, a WiMax network, a 3G network, a 4G network. The wireless network may comprise any wireless network installed and/or managed by mobile network operators (MNOs). The wireless network may comprise any wireless
network installed and/or managed by an end user of the network.
The wireless network may comprise one or more devices comprising access points and one or more devices comprising any of a wireless terminal, a wireless station, a client. In a particular embodiment, the wireless network may comprise one or more devices comprising access points and one or more devices comprising POS devices. Such a network would be able to provide the security needed to meet the payment card industry (PCI) requirements. According to a sixth aspect of the invention there is provided an intrusion detection and prevention computer program embodied in a computer readable medium which, when executed on one or more computers, performs the steps of:
receiving wireless traffic from a receiver of a device of a wireless network, and detecting that the traffic is allowed according to one or more rules and passing the traffic to a media access control (MAC) element of the device, or
detecting that the traffic is not allowed according to the one or more rules and preventing the traffic from passing to the MAC element of the device.
Embodiments of the invention will now be described by way of example only, with reference to the accompanying drawings, in which:
Figure 1 is a schematic representation of a device according to the fourth aspect of the invention comprising an intrusion detection and prevention system / computer program according to the first and second aspects of the invention;
Figure 2 is a schematic representation of a first intrusion detection and prevention method according to the third aspect of the invention carried out by the device of Figure 1, and Figure 3 is a schematic representation of a second intrusion detection and prevention
method according to the third aspect of the invention carried out by the device of Figure 1.
Figure 1 illustrates a device 1 of a wireless network (not shown). In this embodiment, the device comprises an access point (AP) of the wireless network and receives and transmits wireless traffic from and to a plurality of point of sale (POS) devices of the network. The wireless network is located in a restaurant and is used to enable staff of the restaurant to provide a security-enhanced mobile payment service to customers. The device 1 has an intrusion detection and prevention system / computer program according to the invention and, on its own, is able to protect the network against at least MiTM and rogue device attacks. Additionally one or more of the POS devices may also have an intrusion detection and prevention system / computer program according to the invention and, together with the AP 1, are able to protect the network against at least DoS, MiTM and rogue device attacks. Thus the security of data transferred by the customer to a POS device to the network is increased.
The device 1 of Figure 1 comprises a receiver 3, a media access control (MAC) element 5 and a security element 7 situated between the receiver 3 and the MAC element 5. The receiver 3 may be part of a transceiver, capable of receiving and sending wireless traffic from and to a network.
The receiver 3 comprises an antenna 9 connected to a wireless network interface card 11 which has a driver 13. The antenna 9 and the network interface card 11 are configured to receive wireless traffic from the network via the antenna 9, and pass the wireless traffic to the security element 7. The security element 7 has an intrusion detection and prevention system / computer program according to the invention embedded as software therein. The intrusion detection and prevention system / computer program software is configured, when executed, to receive the wireless traffic from the receiver 3 and either detect that the traffic is allowed according to one or more rules and pass the traffic to the MAC element 5 or detect that the traffic is not
allowed according to the one or more rules and prevent the traffic from passing to the MAC element 5. The MAC element 5 receives allowed wireless traffic and carries out standard MAC layer protocol functions on the traffic and passes the traffic to higher protocol layer elements of the device 1 (not shown).
The intrusion detection and prevention system / computer program software embedded in the security element 7 is able to detect and prevent various attacks on the device 1 carried out by means of the wireless traffic received by the device 1. Two examples of such attack detection and prevention will now be described, with reference to Figures 2 and 3. It will appreciated however that the intrusion detection and prevention system / computer program of the invention is able to carry out many more examples of intrusion detection and prevention.
Referring to Figure 2, the security element 7 receives wireless traffic from the receiver 3 of the AP device 1 (step 20). The intrusion detection and prevention system / computer program software embedded in the security element 7 receives the traffic and detects that the traffic is allowed or not allowed according to one or more rules by analysing the traffic for a DoS attack (step 22). In this embodiment, this comprises determining an arrival rate of device authentication traffic of the wireless traffic and comparing this rate with an acceptable threshold arrival rate (step 24). The device authentication traffic may comprise any of extensible authentication protocol over local area networks (EAPoL) Start traffic, EAPoL LogOff traffic, EAP-SUCCESS traffic, EAP-FAILURE traffic. If a DoS attack is not detected from analysis of the authentication traffic, the traffic is deemed to be allowed and is passed to the MAC element 5 of the device 1 (step 26). If a DoS attack is detected from analysis of the authentication traffic, the traffic is deemed to be not allowed and is prevented from passing to the MAC element 5 of the device 1 by destroying the traffic (step 28). DoS attacks can be used to destroy device connectivity in the network and to reduce network performance. Thus the intrusion detection and prevention system / computer program of the invention enables protection of devices in the network from these unwanted effects. Furthermore, the
intrusion detection and prevention system / computer program allows detection and protection of a device without unduly affecting the throughput performance of the device.
Referring to Figure 3, the security element 7 receives wireless traffic from the receiver 3 of the AP device 1 (step 30). The intrusion detection and prevention system / computer program software embedded in the security element 7 receives the traffic and detects that the traffic is allowed or not allowed according to one or more rules by analysing the traffic for exploitation of vulnerabilities in processing of MAC management frames (step 32). In this embodiment, analysing the wireless traffic for exploitation of vulnerabilities in the processing of MAC management frames comprises determining an authentication mechanism for protecting MAC management frames, which comprises adding an authentication field in the form of an information element (IE) to the MAC management frames (step 34). If the authentication field information element is detected from analysis of the MAC management frames, the traffic is deemed to be allowed and is passed to the MAC element 5 of the device 1 (step 36). If the authentication field information element is not detected from analysis of the MAC management frames, the traffic is deemed to be not allowed and is prevented from passing to the MAC element 5 of the device 1 by destroying the traffic (step 38).
Claims
CLAI MS
1. An intrusion detection and prevention (I DS) computer program which, when executed provides a security element situated between a receiver and a media access control (MAC) element of a device of a wireless network, which security element performs the steps of:
receiving wireless traffic from the receiver of the device, and
detecting that the traffic is allowed according to one or more rules and passing the traffic to the MAC element of the device, or
detecting that the traffic is not allowed according to the one or more rules and preventing the traffic from passing to the MAC element of the device.
2. A I DS computer program according to claim 1 which outputs one or more signals to the MAC element which ca use the MAC element to disconnect from the wireless traffic.
3. A I DS computer program according to claim 1 or claim 2 which outputs one or more signals to one or more further devices of the wireless network to prevent one or more types of attack on the devices.
4. A I DS computer program according to any preceding claim in which detecting that the traffic is allowed or not allowed according to the one or more pre determined rules comprises analysing the wireless traffic for a denial of service (DoS) attack. 5. A I DS computer program according to claim 4 in which analysing the wireless traffic for a DoS attack comprises determining if the traffic comprises spoofed MAC frames.
6. A I DS computer program according to claim 4 in which analysing the wireless traffic for a DoS attack comprises determining an arrival rate of the wireless traffic and
comparing this with an acceptable threshold arrival rate.
7. A IDS computer program according to claim 4 in which analysing the wireless traffic for a DoS attack comprises determining an arrival rate of wireless traffic comprising any of device authentication traffic, device de-authentication traffic, device association traffic, device disassociation traffic.
8. A IDS computer program according to any preceding claim in which detecting that the traffic is allowed or not allowed according to the one or more pre determined rules comprises analysing the wireless traffic for a man-in-the-middle (MiTM) attack.
9. A IDS computer program according to claim 8 in which analysing the wireless traffic for a man-in-the-middle attack comprises determining if the traffic comprises spoofed or forged traffic.
10. A IDS computer program according to any preceding claim in which detecting that the traffic is allowed or not allowed according to the one or more pre determined rules comprises analysing the wireless traffic for traffic from an unauthorised device of the network.
11. A IDS computer program according to any preceding claim in which detecting that the traffic is allowed or not allowed according to the one or more pre determined rules comprises analysing the wireless traffic by validating sequence numbers thereof. 12. A IDS computer program according to any preceding claim in which detecting that the traffic is allowed or not allowed according to the one or more pre determined rules comprises analysing the wireless traffic for exploitation of vulnerabilities in processing of MAC management frames.
A IDS computer program according to claim 12 in which analysing the wireless
traffic for exploitation of vulnerabilities in the processing of MAC management frames comprises determining an authentication mechanism for protecting MAC management frames. 14. A IDS computer program according to claim 13 in which the authentication mechanism for protecting MAC management frames comprises adding an authentication field to the MAC management frames.
15. A IDS computer program according to any preceding claim in which preventing the traffic from passing to the MAC element of the device comprises destroying the traffic.
16. A IDS computer program according to any preceding claim in which preventing the traffic from passing to the MAC element of the device comprises detecting that traffic from a source is not allowed and dropping subsequent traffic from the source for a period of time.
17. A IDS computer program according to any preceding claim which performs further functions comprising any of sending alerts to an administrator of the wireless network, logging activity on the wireless network, conducting authentication of devices of the wireless network.
18. An intrusion detection and prevention system comprising a security element which is situated between a receiver and a media access control (MAC) element of a device of a wireless network, and which receives wireless traffic from the receiver of the device, and detects that the traffic is allowed according to one or more rules and passes the traffic to the MAC element of the device, or detects that the traffic is not allowed according to the one or more rules and prevents the traffic from passing to the MAC element of the device.
19. An intrusion detection and prevention method comprising the steps of:
receiving wireless traffic from a receiver of a device of a wireless network, and detecting that the traffic is allowed according to one or more rules and passing the traffic to a MAC element of the device, or
detecting that the traffic is not allowed according to the one or more rules and preventing the traffic from passing to the MAC element of the device.
20. A device of a wireless network comprising:
a receiver configured to receive wireless traffic from the network,
a media access control (MAC) element, and
an intrusion detection and prevention computer program according to any of claims 1 to 17, providing a security element situated between the receiver and the MAC element and configured, when executed, to:
receive wireless traffic from the receiver of the device, and
detect that the traffic is allowed according to one or more rules and pass the traffic to the MAC element of the device, or
detect that the traffic is not allowed according to the one or more rules and prevent the traffic from passing to the MAC element of the device. 21. A device according to claim 20 in which the security element is situated between a driver of the receiver of the device and the MAC element of the device.
22. A device according to claim 20 or claim 21 which comprises an access point (AP) of the wireless network.
23. A device according to any of claims 20 to 22 which comprises any of a wireless terminal, a wireless station, a client of the wireless network, such as any of a desktop computer, a laptop computer, a notebook computer, a tablet computer, a smartphone, a PDA, a point of sale (POS) device.
24. A wireless network comprising one or more devices according to any of claims 20 to 23.
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP13786729.7A EP2923476B1 (en) | 2012-11-21 | 2013-11-01 | Intrusion prevention and detection in a wireless network |
US14/646,441 US10171421B2 (en) | 2012-11-21 | 2013-11-01 | Intrusion prevention and detection in a wireless network |
ES13786729T ES2934130T3 (en) | 2012-11-21 | 2013-11-01 | Prevention and detection of intrusions in a wireless network |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB1220957.3 | 2012-11-21 | ||
GB1220957.3A GB2508166B (en) | 2012-11-21 | 2012-11-21 | Intrusion prevention and detection in a wireless network |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2014080170A1 true WO2014080170A1 (en) | 2014-05-30 |
Family
ID=47521514
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/GB2013/052856 WO2014080170A1 (en) | 2012-11-21 | 2013-11-01 | Intrusion prevention and detection in a wireless network |
Country Status (5)
Country | Link |
---|---|
US (1) | US10171421B2 (en) |
EP (1) | EP2923476B1 (en) |
ES (1) | ES2934130T3 (en) |
GB (1) | GB2508166B (en) |
WO (1) | WO2014080170A1 (en) |
Families Citing this family (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9621579B2 (en) | 2014-11-21 | 2017-04-11 | Symantec Corporation | Systems and methods for protecting against unauthorized network intrusions |
US10230740B2 (en) * | 2015-04-21 | 2019-03-12 | Cujo LLC | Network security analysis for smart appliances |
US10135633B2 (en) * | 2015-04-21 | 2018-11-20 | Cujo LLC | Network security analysis for smart appliances |
US10356045B2 (en) | 2015-12-18 | 2019-07-16 | Cujo LLC | Intercepting intra-network communication for smart appliance behavior analysis |
US10243974B2 (en) | 2016-02-19 | 2019-03-26 | Hewlett Packard Enterprise Development Lp | Detecting deauthentication and disassociation attack in wireless local area networks |
CN107204991A (en) * | 2017-07-06 | 2017-09-26 | 深信服科技股份有限公司 | A kind of server exception detection method and system |
EP3846412A1 (en) * | 2020-01-02 | 2021-07-07 | Siemens Aktiengesellschaft | Method for forwarding data packets |
CN111405548B (en) * | 2020-04-08 | 2023-07-21 | 国家电网有限公司信息通信分公司 | Fishing wifi detection method and device |
US20240214811A1 (en) * | 2022-12-21 | 2024-06-27 | Qualcomm Incorporated | Wi-fi deauthentication attack detection and prevention |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20060070122A1 (en) * | 1999-06-30 | 2006-03-30 | Bellovin Steven M | Method and apparatus for a distributed firewall |
US20070025265A1 (en) * | 2005-07-22 | 2007-02-01 | Porras Phillip A | Method and apparatus for wireless network security |
WO2012065632A1 (en) * | 2010-11-16 | 2012-05-24 | Abb Research Ltd | Electronic device for communication in a data network including a protective circuit for identifying unwanted data |
Family Cites Families (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7266130B2 (en) * | 2001-12-28 | 2007-09-04 | Samsung Electronics Co., Ltd. | Apparatus and method for multiplexing multiple end-to-end transmission links in a communication system |
CN1268093C (en) * | 2002-03-08 | 2006-08-02 | 华为技术有限公司 | Distribution method of wireless local area network encrypted keys |
KR100456635B1 (en) * | 2002-11-14 | 2004-11-10 | 한국전자통신연구원 | Method and system for defensing distributed denial of service |
US7409715B2 (en) * | 2003-12-10 | 2008-08-05 | Alcatel Lucent | Mechanism for detection of attacks based on impersonation in a wireless network |
US20060168273A1 (en) * | 2004-11-03 | 2006-07-27 | Ofir Michael | Mechanism for removing data frames or packets from data communication links |
CA2496231A1 (en) * | 2005-02-04 | 2006-08-04 | Shopplex.Com Corporation | System and method for controlling and monitoring an application in a network |
US7609625B2 (en) * | 2005-07-06 | 2009-10-27 | Fortinet, Inc. | Systems and methods for detecting and preventing flooding attacks in a network environment |
US20070140121A1 (en) * | 2005-12-21 | 2007-06-21 | Chris Bowman | Method of preventing denial of service attacks in a network |
TWI324455B (en) * | 2005-12-23 | 2010-05-01 | Arcadyan Technology Corp | Method for determining the status of a wireless network communication device |
US7593409B2 (en) * | 2005-12-29 | 2009-09-22 | Honeywell International Inc. | Apparatus and methods for monitoring network traffic |
TWI307230B (en) * | 2006-05-12 | 2009-03-01 | Hon Hai Prec Ind Co Ltd | Wireless device and method for identifying management frames |
WO2010006035A2 (en) * | 2008-07-08 | 2010-01-14 | Interdigital Patent Holdings, Inc. | Support of physical layer security in wireless local area networks |
CN102474444B (en) * | 2009-07-02 | 2014-10-15 | Abb研究有限公司 | A method of limiting the amount of network traffic reaching a local node operating according to an industrial Ethernet protocol |
US20110030055A1 (en) * | 2009-07-31 | 2011-02-03 | Rajini Balay | Detecting Spoofing in Wireless Digital Networks |
US8392990B2 (en) * | 2010-06-28 | 2013-03-05 | Symbol Technologies, Inc. | Mitigating excessive operations attacks in a wireless communication network |
US9100285B1 (en) * | 2012-12-18 | 2015-08-04 | Juniper Networks, Inc. | Dynamic control channel establishment for software-defined networks having centralized control |
-
2012
- 2012-11-21 GB GB1220957.3A patent/GB2508166B/en active Active
-
2013
- 2013-11-01 WO PCT/GB2013/052856 patent/WO2014080170A1/en active Application Filing
- 2013-11-01 ES ES13786729T patent/ES2934130T3/en active Active
- 2013-11-01 EP EP13786729.7A patent/EP2923476B1/en active Active
- 2013-11-01 US US14/646,441 patent/US10171421B2/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20060070122A1 (en) * | 1999-06-30 | 2006-03-30 | Bellovin Steven M | Method and apparatus for a distributed firewall |
US20070025265A1 (en) * | 2005-07-22 | 2007-02-01 | Porras Phillip A | Method and apparatus for wireless network security |
WO2012065632A1 (en) * | 2010-11-16 | 2012-05-24 | Abb Research Ltd | Electronic device for communication in a data network including a protective circuit for identifying unwanted data |
Also Published As
Publication number | Publication date |
---|---|
ES2934130T3 (en) | 2023-02-17 |
US10171421B2 (en) | 2019-01-01 |
US20150304280A1 (en) | 2015-10-22 |
GB201220957D0 (en) | 2013-01-02 |
GB2508166A (en) | 2014-05-28 |
EP2923476B1 (en) | 2022-09-28 |
EP2923476A1 (en) | 2015-09-30 |
GB2508166B (en) | 2018-06-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP2923476B1 (en) | Intrusion prevention and detection in a wireless network | |
US7640585B2 (en) | Intrusion detection sensor detecting attacks against wireless network and system and method of detecting wireless network intrusion | |
US7970894B1 (en) | Method and system for monitoring of wireless devices in local area computer networks | |
US9503463B2 (en) | Detection of threats to networks, based on geographic location | |
US8973151B2 (en) | Portable security device and methods for secure communication | |
US20150040194A1 (en) | Monitoring of smart mobile devices in the wireless access networks | |
US10505967B1 (en) | Sensor-based wireless network vulnerability detection | |
CN112243507A (en) | Abnormal access point detection | |
US10498758B1 (en) | Network sensor and method thereof for wireless network vulnerability detection | |
CN106878992B (en) | Wireless network security detection method and system | |
KR101540343B1 (en) | System and method for detecting rogue ap | |
US20240154995A1 (en) | Detection of vulnerable wireless networks | |
WO2010027121A1 (en) | System and method for preventing wireless lan intrusion | |
Guo | Survey on WiFi infrastructure attacks | |
KR100874015B1 (en) | WLAN intrusion prevention system and method | |
US20160164889A1 (en) | Rogue access point detection | |
KR101447469B1 (en) | System and method of wireless intrusion prevention and wireless service | |
Muthalagu et al. | Evil twin attack mitigation techniques in 802.11 networks | |
KR20140105280A (en) | Apparatus for analyzing vulnerableness of wireless lan | |
VanSickle et al. | Effectiveness of tools in identifying rogue access points on a wireless network | |
KR101186873B1 (en) | Wireless intrusion protecting system based on signature | |
Amoordon et al. | Characterizing Wi-Fi Man-In-the-Middle Attacks | |
Hsu et al. | A passive user‐side solution for evil twin access point detection at public hotspots | |
Timofte | Wireless intrusion prevention systems | |
Shourbaji et al. | Wireless intrusion detection systems (WIDS) |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 13786729 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 14646441 Country of ref document: US |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2013786729 Country of ref document: EP |