New wireless intrusion defense uses location tracking

AirPatrol is a company that made its name in wireless intrusion detection. But it's a name you've probably never heard of because the software and radio frequency sensors usually carry the brands of resellers and OEMs.

Now the company is introducing its own branded product line, called WiVision, openly competing with enterprise network rivals such as AirDefense, AirMagnet and AirTight (and joining the group often dubbed the "Air Brothers"). The original software has been extensively reworked, adding new features. And, as part of the introduction, the company is announcing two wireless sensors for tracking Wi-Fi and cellular telephone signals, and plans for a third, to track sources of radio interference.

As do its competitors, AirPatrol sells wireless intrusion detection/prevention systems, but it adds two features intended to mark it out. One is software algorithms for location tracking, to identify where a radio is. The other, new with this product release, is integration with Check Point Software's firewalls at the network's edge and core, to block traffic from that radio based on its IP address.

In broad terms, AirPatrol is recreating an approach pioneered by Newbury Networks, which originally offered a product called Wi-Fi Watchdog, consisting of separate radio sensors and software that used radio signal data to identify, locate and categorize wireless threats to an enterprise wireless LAN. Newbury has since expanded and refocused the technology on WLAN-based location tracking and asset management. (Compare wireless LAN security products.)

The AirPatrol WiVision products include WiVision Enterprise Platform, which consists of server code (optionally available on a network appliance) and separate RF sensors; WiVision Client, which is a laptop application giving administrators more control over the laptop's wireless connectivity; and WiVision Policy Manager, which is also a server application for administering and tracking thousands of radio devices.

Location is a key element in AirPatrol's approach to managing wireless threats. "We can grant or deny access [to the WLAN] based on where people are in the site," say Nicholas Miller, AirPatrol president and CEO. An administrator can define a boundary around an area or entire building, creating what's called a geo-fence: the AirPatrol software, through the wireless RF sensors, can track the movement of wireless device over that boundary, trigger alerts and block traffic as needed.

Client code on corporate laptops enables the AirPatrol server to protect those devices from being used by a wireless attacker to bridge across to the LAN. As a stand-alone application, the AirPatrol client will limit a laptop to connect to just the authorized corporate WLAN, and will shut off the wireless adapter when the laptop plugs into the LAN.

Also part of the new release is a redesigned Java GUI for administrators. Previously, the software ran as a Windows application.

The two new sensors include one only for Wi-Fi, while the other can detect cell phone signals as well as Wi-Fi. Near June 2008, AirPatrol will introduce new software and a new sensor that will use the underlying location capabilities to quickly find sources of RF interference.