Mobile risk assessment

• US 10,701,098 B2
• Filed: 08/17/2015
• Issued: 06/30/2020
• Est. Priority Date: 10/17/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Basavapatna, Prasanna Ganapathi, Gaddala, Satish Kumar, Schrecker, Sven, Goldschlag, David Moshe
• Primary Examiner(s): Powers, William S
• Application Number:
  US14/827,829
• Publication Number:
  US 20160112450A1
• Time in Patent Office: 1,779 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A query is received from a particular endpoint device identifying a particular wireless access point encountered by the particular endpoint device. Pre-existing risk assessment data is identified for the identified particular wireless access point and query result data is sent to the particular endpoint device characterizing pre-assessed risk associated with the particular wireless access point. In some instances, the query result data is generated based on the pre-existing risk assessment data. In some instances, pre-existing risk assessment data can be the result of an earlier risk assessment carried-out at least in part by an endpoint device interfacing with and testing the particular wireless access point.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, wherein the instructions, when executed on a machine, cause the machine to:

receive a query from an endpoint device identifying a wireless access point, wherein the query identifies a name of the wireless access point and further identifies location information of the endpoint device, and the location information includes geo-positional data indicating a location of at least one of the endpoint device and the wireless access point;

determine whether risk assessment data exists for the wireless access point based at least in part on a determination whether the name and the location information correspond to one or more known wireless access points;

generate query result data based at least in part on the risk assessment data and the location identified in the geo-positional data;

send the query result data to the endpoint device identifying a risk profile associated with the wireless access point, wherein the query result data comprises a request for the endpoint device to participate in a risk assessment of the wireless access point, and the query result data indicates a risk score of the wireless access point; and

direct at least a portion of the participation of the endpoint device in the risk assessment.

2. The at least one non-transitory machine accessible storage medium of claim 1, wherein the risk assessment includes:

directing the endpoint device to attempt to communicate with a trusted endpoint over the wireless access point; and

monitoring the attempted communication with the trusted endpoint over the wireless access point to assess risk.

3. The at least one non-transitory machine accessible storage medium of claim 2, wherein attempting to communicate with the trusted endpoint includes attempting to establish a secured connection between the endpoint device and the trusted endpoint, establishing the secured connection includes receiving expected trust verification data from the trusted endpoint;

and

receipt of data other than the expected trust verification data indicates that the wireless access point is untrustworthy suggesting higher risk associated with the wireless access point.

4. The at least one non-transitory machine accessible storage medium of claim 3, wherein participating in the risk assessment of the wireless access point includes facilitating communication of the expected trust verification data to the endpoint device in advance of the endpoint device attempting to communicate with the trusted endpoint over the wireless access point.

5. The at least one non-transitory machine accessible storage medium of claim 2, wherein participating in the risk assessment of the wireless access point includes identifying, to the endpoint device, a trusted endpoint device from a plurality of available trusted endpoint devices in advance of the endpoint device attempting to communicate with the trusted endpoint over the wireless access point.

6. The at least one non-transitory machine accessible storage medium of claim 1, wherein the risk assessment data for the wireless access point is identified from risk assessment records including pre-existing risk assessment data for a plurality of wireless access points identified by wireless-enabled endpoint devices.

7. The at least one non-transitory machine accessible storage medium of claim 1, wherein the instructions, when executed, further cause the machine to calculate a risk profile for the endpoint device based on a set of device attributes including risk associated with wireless access points accessed by the endpoint device.

8. The at least one non-transitory machine accessible storage medium of claim 1, wherein the query is sent over a secure connection other than a wireless network associated with the wireless access point.

9. The at least one non-transitory machine accessible storage medium of claim 8, wherein the secure connection is implemented over at least one of a wireless mobile broadband connection and a VLAN tunnel.

10. A method comprising:

receiving a query from an endpoint device identifying a wireless access point, wherein the query identifies a name of the wireless access point and further identifies location information of the endpoint device, and the location information includes geo-positional data indicating a location of at least one of the endpoint device and the wireless access point;

determining whether risk assessment data exists for the wireless access point based at least in part on a determination whether the name and the location information correspond to one or more known wireless access points;

generating query result data based at least in part on the risk assessment data and the location identified in the geo-positional data;

sending the query result data to the endpoint device identifying a risk status associated with the wireless access point, wherein the query result data comprises a request for the endpoint device to participate in a risk assessment of the wireless access point, and the query result data indicates a risk score of the wireless access point; and

directing at least a portion of the participation of the endpoint device in the risk assessment.

11. The method of claim 10, further comprising:

receiving risk assessment feedback data from the endpoint device in connection with at least one assessment task performed by the endpoint device.

12. The method of claim 11, further comprising:

using the received risk assessment feedback data to determine an updated risk profile for the wireless access point.

13. The method of claim 12, wherein the risk assessment data determined to be associated with the wireless access point is considered in the determination of the updated risk profile.

14. The method of claim 11, wherein the risk assessment feedback data includes at least one of a service set identifier (SSID), data describing encryption used by the wireless access point, splash page information, and wireless access point password information.

15. The method of claim 10, wherein the risk assessment data for the wireless access point was generated in connection with at least one previous encounter with the wireless access point by an endpoint device.

16. The method of claim 15, wherein the previous encounter with the wireless access point was made by an endpoint device other than the endpoint device.

17. The method of claim 10, wherein the instructions, when executed, further cause the machine to cause a graphical indicator of risk associated with the wireless access point to be presented at the endpoint device.

18. The method of claim 10, further comprising

calculating a risk profile for the endpoint device based on a set of device attributes including risk associated with wireless access points accessed by the endpoint device.

19. The method of claim 10, wherein the query is received from the endpoint device over a connection that avoids the wireless access point.

20. The method of claim 10, further comprising:

receiving a service set identifier (SSID) of the wireless access point from the endpoint device; and

determining whether the wireless access point is likely trustworthy, based on the SSID.

21. A system comprising:

at least one processor device;

at least one memory element; and

a wireless access point risk assessor, adapted, when executed by the at least one processor device, to

receive a query from an endpoint device identifying a wireless access point, wherein the query identifies a name of the wireless access point and further identifies location information of the endpoint device, and the location information includes geo-positional data indicating a location of at least one of the endpoint device and the wireless access point;

determine whether risk assessment data exists for the wireless access point based at least in part on a determination whether the name and the location information correspond to one or more known wireless access points;

generate query result data based at least in part on the risk assessment data and the location identified in the geo-positional data;

send the query result data to the endpoint device identifying a risk status associated with the wireless access point, wherein the query result data comprises a request for the endpoint device to participate in a risk assessment of the wireless access point, and the query result data indicates a risk score of the wireless access point; and

direct at least a portion of the participation of the endpoint device in the risk assessment.