Detecting unauthorized devices

• US 10,078,746 B2
• Filed: 11/17/2016
• Issued: 09/18/2018
• Est. Priority Date: 04/11/2014
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Patel, Mehul, Monnerat, Edward David
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US15/354,073
• Publication Number:
  US 20170293752A1
• Time in Patent Office: 670 Days
• Field of Search: 726 29
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Methods and systems are disclosed that, in some aspects, provide for receiving a provisioning request from a requesting device, and identifying one or more other devices proximate to or co-located with the requesting device. The methods and systems may include determining a location and other information of the one or more other devices and using the information to determine a location of and other information related to the requesting device. It may be determined whether to grant the provisioning request based on the determined location of the requesting device.

Claims

1. A method comprising:

receiving, by a first computing device and from a second computing device, data comprising an indication that the second computing device detected a third computing device;

determining whether the data comprises an indication that the third computing device provided a credential to the second computing device;

determining a location of the second computing device;

using the determination of the location of the second computing device to determine a location of the third computing device; and

determining whether to provision the third computing device based on the location of the third computing device and the determination of whether the data comprises the indication that the third computing device provided the credential to the second computing device.

2. The method of claim 1, further comprising determining an account associated with the second computing device, wherein the determining whether to provision the third computing device is based on whether the account associated with the second computing device is associated with the third computing device.

3. The method of claim 1, further comprising:

determining an account associated with the second computing device; and

determining whether the account is authorized to use the third computing device.

4. The method of claim 1, further comprising:

determining an account associated with the second computing device;

determining that the account is not associated with the third computing device; and

raising an alert indicating that the third computing device is not associated with the account.

5. The method of claim 1, wherein the data indicates that the third computing device did not provide the credential to the second computing device.

6. The method of claim 5, further comprising blacklisting the third computing device.

7. A method comprising:

receiving, by a computing device and from a local device that is local to the computing device, a report comprising an indication that the local device detected a network access computing device;

determining whether the report comprises an indication that the network access computing device provided a credential to the local device;

determining whether the network access computing device and the local device are associated with a same account;

determining whether to provision the network access computing device based on whether the network access computing device and the local device are associated with the same account and whether the report comprises the indication that the network access computing device provided the credential to the local device; and

after determining to provision the network access computing device, providing a service to the local device using the network access computing device.

8. The method of claim 7, the method further comprising:

receiving, by the computing device and from the network access computing device, a provisioning request comprising information indicating one or more other devices; and

using the information indicating the one or more other devices to determine whether to approve the provisioning request.

9. The method of claim 8, further comprising:

determining an account associated with the local device; and

determining an account indicated in the provisioning request.

10. The method of claim 7, further comprising:

determining a location of the local device; and

determining a location of the network access computing device based on the location of the local device.

11. The method of claim 10, further comprising determining whether to grant network access to the network access computing device based on the location of the local device.

12. The method of claim 7, further comprising after determining that the network access computing device and the local device are not associated with the same account, flagging the network access computing device as a suspect device.

13. The method of claim 7, further comprising receiving a plurality of device detection messages from a plurality of different devices associated with the same account, wherein the device detection messages each comprises information indicating a new device that has been connected to a network of the plurality of different devices.

14. The method of claim 13, further comprising using the plurality of device detection messages to indicate unauthorized network access.

15. An apparatus comprising:

one or more processors; and

memory storing computer-executable instructions that, when executed by the one or more processors, cause the apparatus to;

receive, from a first network device, a provisioning request to provide network access to a second network device;

receive, from the second network device, data comprising information indicating devices with which the second network device has exchanged credentials;

determine whether the data comprises an indication that the first network device provided a credential to the second network device;

after determining that the first network device has exchanged credentials with the second network device, determine whether to grant the provisioning request; and

after determining to grant the provisioning request, provide a service to the second network device using the first network device.

16. The apparatus of claim 15, wherein the instructions, when executed by the one or more processors, cause the apparatus to determine to retrieve the data from the second network device based on the second network device being indicated in the provisioning request.

17. The apparatus of claim 15, wherein the instructions, when executed by the one or more processors, cause the apparatus to:

determine an account associated with the first network device; and

determine a plurality of network devices other than the first network device that are associated with the account.

18. The apparatus of claim 17, wherein the instructions, when executed by the one or more processors, cause the apparatus to:

receive, from the plurality of network devices, data indicating devices with which the plurality of network devices have exchanged credentials; and

after determining that the data does not indicate the first network device, flag the first network device as a suspect device.

19. The apparatus of claim 15, wherein the instructions, when executed by the one or more processors, cause the apparatus to:

determine an account associated with the first network device; and

determine a plurality of network devices other than the first network device that are associated with the account.

20. The apparatus of claim 19, wherein the instructions, when executed by the one or more processors, cause the apparatus to:

determine a plurality of locations respectively for the plurality of network devices other than the first network device;

determine a location of the first network device based on the plurality of locations; and

determine whether to grant the provisioning request based on the location of the first network device.