Method and system for tracing missing network devices using hardware fingerprints

• US 20030153328A1
• Filed: 02/14/2002
• Published: 08/14/2003
• Est. Priority Date: 02/14/2002
• Status: Active Grant

• Current Assignee: Rakuten Group, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Kumhyr, David Bruce, Booth, Yvonne Watters
• Granted Patent: US 7,181,195 B2
• Time in Patent Office: Days
• US Class Current: 455/456.1
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

When a piece of network equipment is determined to be stolen or missing, a hardware tracing tool mounted within the network detects the distinctive hardware fingerprints of the missing hardware within Internet traffic and extracts the device'"'"'s IP address to trace the location of the missing equipment. As Internet messages or data packets cross through servers containing the tracing tool, the data packets are decompiled to retrieve unique identifier indicia (hardware fingerprints), such as a computer'"'"'s MAC address, for example. The extracted fingerprints are then compared with fingerprints stored in a database of missing hardware using a hashing or mapping function, and the server system is alerted to a match. The IP address of the device transmitting the matching indicia is then extracted to determine the location of the missing or stolen network hardware. In this way, a method of tracing missing network hardware is provided that does not increase the cost of network equipment or unnecessarily effect network bandwidth.

Claims

1. A method for tracing an electronic device transmitting identifying indicia over a global network, the electronic device connectable to a network server through the global network, the method comprising the steps of:

determining identifying indicia for the electronic device that are transmitted by the electronic device during communications over the global network;

automatically monitoring communications over the global network to identify data transmitted through the global network that contains the identifying indicia; and

upon identification of data transmitted through the global network that contains the identifying indicia, determining the location of the electronic device by tracing the source of the identifying indicia within the global network.

2. The method of claim 1, wherein the global network includes Internet.

3. The method of claim 1, further comprising determining the identifying indicia by extracting the identifying indicia from data previously transmitted by the electronic device and stored on the global network.

4. The method of claim 3, wherein the identifying indicia is the MAC address of the electronic device.

5. The method of claim 1, wherein the identifying indicia is determined by indexing a known hostname or IP address of the electronic device contained within data previously transmitted by the electronic device and stored on the global network.

6. The method of claim 1, further comprising providing the network server with one or more global network communication links used to enable transmission between the electronic device and the network server, wherein the transmission via the communication links is used for determining the location of the electronic device.

7. The method of claim 1, further comprising entering the identifying indicia into a database stored in the network server and performing a matching function on the network server that compares the data transmitted over the global network with the database to identify transmitted data containing the identifying indicia.

8. The method of claim 1, further comprising, upon identification of data transmitted through the global network that contains the identifying indicia, notifying a responsible party that data transmitted through the global network contains the identifying indicia.

9. A system for tracing an electronic device transmitting identifying indicia over a global network, the system comprising:

a hardware fingerprint server that can determine identifying indicia for the electronic device that are transmitted by the electronic device during communications over the global network;

a monitoring server, wherein the electronic device connectable to the monitoring server through the global network, that monitors communications over the global network to identify data transmitted through the global network that contains the identifying indicia;

a tracing server that, upon identification of data transmitted through the global network that contains the identifying indicia, determines the location of the electronic device by tracing the source of the identifying indicia within the global network.

10. A system according to claim 9, wherein the global network includes Internet.

11. A system according to claim 9, wherein the hardware fingerprint server determines the identifying indicia by extracting the identifying indicia from data previously transmitted by the electronic device and stored on the global network.

12. A system according to claim 9, wherein the identifying indicia is the MAC address of the electronic device.

13. A system according to claim 9, wherein the hardware fingerprint server determines the identifying indicia by indexing a known hostname or IP address of the electronic device contained within data previously transmitted by the electronic device and stored on the global network.

14. A system according to claim 9, wherein the monitoring server contains a database storing identifying indicia and performs a matching function that compares data transmitted over the global network with the database to identify transmitted data containing the identifying indicia.

15. A program product for tracing an electronic device transmitting identifying indicia over a global network, the electronic device connectable to a network server through the global network, comprising:

a computer-readable medium;

a controller function encoded in the computer-readable medium, the controller function comprising the steps of;

determining identifying indicia for the electronic device that are transmitted by the electronic device during communications over the global network;

automatically monitoring communications over the global network to identify data transmitted through the global network that contains the identifying indicia; and

upon identification of data transmitted through the global network that contains the identifying indicia, determining the location of the electronic device by tracing the source of the identifying indicia within the global network.

16. A program product according to claim 15, the controller function further comprising determining the identifying indicia by extracting the identifying indicia from data previously transmitted by the electronic device and stored on the global network.

17. A program product according to claim 15, the controller function further comprising determining the identifying indicia by indexing a known hostname or IP address of the electronic device contained within data previously transmitted by the electronic device and stored on the global network.

18. A program product according to claim 15, the controller function further comprising providing the network server with one or more global network communication links used to enable transmission between the electronic device and the network server, wherein the transmission via the communication links is used for determining the location of the electronic device.

19. A program product according to claim 15, the controller function further comprising entering the identifying indicia into a database stored in the network server and performing a matching function on the network server that compares the data transmitted over the global network with the database to identify transmitted data containing the identifying indicia.

20. A program product according to claim 15, the controller function further comprising, upon identification of data transmitted through the global network that contains the identifying indicia, notifying a responsible party that data transmitted through the global network contains the identifying indicia.