Detection of an unauthorized wireless communication device

• US 10,152,715 B2
• Filed: 11/01/2017
• Issued: 12/11/2018
• Est. Priority Date: 03/25/2014
• Status: Active Grant

• Current Assignee: Symbol Technologies, LLC (Zebra Technologies Corporation)
• Original Assignee: Symbol Technologies, LLC (Zebra Technologies Corporation)
• Inventors: Batta, Puneet, Miranda, Trevor, Thomas, Jacob
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/800,616
• Publication Number:
  US 20180089686A1
• Time in Patent Office: 405 Days
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04K 3/822 by detecting the presence of a surveillance, interception or detection
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A technique for the detection of an unauthorized wireless communication device includes monitoring of Bluetooth® communications activity by a Bluetooth® capable communication device. Any monitored communication activity is analyzed against parameters that are predefined to detect suspected illegal activity. If illegal activity is suspected by the analysis, an alert is generated for a system administrator. The predefined parameters associate illegal activity with; data that includes credit card numbers and expiration dates, credit card transaction logging information, non-discoverable devices, activity after store hours, exceedingly long activity, etc.

Claims

1. An apparatus for the detection of an unauthorized wireless communication device comprising:

a communications monitor operable to monitor wireless communications activity;

a processor communicatively coupled with the communication monitor and operable to analyze monitored wireless communications activity against parameters that are predefined to detect suspected illegal activity by a skimming device; and

a user interface communicatively coupled with the processor and operable to generate an alert for a system administrator when illegal activity by the skimming device is suspected by the processor, wherein one of the predefined parameters associates illegal activity with detecting a Bluetooth®

non-discoverable communication device by cycling through a set of Media Access Control addresses to find any non-discoverable devices.

2. The apparatus of claim 1, wherein another one of the predefined parameters includes a series of dates and time-stamps.

3. The apparatus of claim 1, wherein another one of the predefined parameters includes a class of operation field set to miscellaneous.

4. The apparatus of claim 1, wherein another one of the predefined parameters associates illegal activity with a determination that the timing of monitored wireless communications activity coincides with updates from a point-of-sale terminal.

5. The apparatus of claim 1, wherein another one of the predefined parameters associates illegal activity with detecting a Bluetooth®

discoverable communication device.

6. The apparatus of claim 1, wherein another one of the predefined parameters associates illegal activity with wireless communications activity that is longer compared to normal communications activity.

7. The apparatus of claim 1, wherein another one of the predefined parameters associates illegal activity with wireless communications activity of devices that are not moving.

8. A network access point comprising:

a communications monitor operable to monitor wireless communications activity;

a processor communicatively coupled with the communications monitor and operable to analyze monitored wireless communications activity against parameters that are predefined to indicate suspected illegal activity by a skimming device;

wherein the processor is operable to generate an alert when illegal activity by the skimming device is suspected based at least in part on one of the predefined parameters associating illegal activity with detecting a Bluetooth®

non-discoverable communication device by cycling through a set of Media Access Control addresses to find any non-discoverable devices.

9. The network access point of claim 8, wherein another one of the predefined parameters includes a series of dates and time-stamps.

10. The network access point of claim 8, wherein another one of the predefined parameters includes a class of operation field set to miscellaneous.

11. The network access point of claim 8, wherein another one of the predefined parameters associates illegal activity with a determination that the timing of monitored wireless communications activity coincides with updates from a point-of-sale terminal.

12. A method for the detection of an unauthorized wireless communication device, comprising:

monitoring wireless communications activity;

analyzing monitored wireless communications activity against parameters that are predefined to indicate suspected illegal activity by the unauthorized wireless communication device; and

generating an alert when illegal activity by the unauthorized wireless communication device is suspected based at least in part on associating illegal activity with detecting a Bluetooth®

non-discoverable communication device by cycling through a set of Media Access Control addresses to find any non-discoverable devices.

13. The method of claim 12, wherein the parameters include a series of dates and time-stamps.