Methods, apparatus and program product for monitoring network security

• US 20030186679A1
• Filed: 03/27/2002
• Published: 10/02/2003
• Est. Priority Date: 03/27/2002
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stafford, David Robert, Van Doorn, Leendert Peter, Challener, David Carroll
• Application Number:
  US10/107,794
• Publication Number:
  US 20030186679A1
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04M 1/68 Circuit arrangements for preventing eavesdropping
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Methods, apparatus and program products which monitor access points through which data can be exchanged with a network, identify an unauthorized access point, and determine the location of the identified unauthorized access point.

Claims

1. A method comprising the steps of:

monitoring access points through which data can be exchanged with a network,

identifying an unauthorized access point, and

determining the location of the identified unauthorized access point.

2. A method according to claim 1 wherein the step of monitoring comprises equipping each of a plurality of computer devices to detect access points accessible to the device and to report to a server computer system the identity of detected access points.

3. A method according to claim 1 wherein the step of monitoring comprises intermittently and periodically determining the availability of access points.

4. A method according to claim 3 wherein the step of intermittently and periodically determining the availability of access points comprises monitoring at predetermined regular intervals.

5. A method according to claim 3 wherein the step of intermittently and periodically determining the availability of access points comprises monitoring at random irregular intervals.

6. A method according to claim 1 wherein the step of identifying an unauthorized access point comprises comparing the identity of monitored access points with a database of authorized access points.

7. A method according to claim 1 wherein the step of determining the location of an identified unauthorized access point comprises comparing the locations of a plurality of computer devices all of which report detection of the identified unauthorized access point.

8. A method comprising the steps of:

monitoring with a suitably equipped computer device access points through which data can be exchanged with a network and gathering information about a monitored access point,

reporting through the network to a server computer system the information gathered by monitoring, and

identifying an unauthorized access point by operation of the server system.

9. A method according to claim 8 wherein the step of monitoring comprises equipping each of a plurality of computer devices to detect access points accessible to the device and to report to the server computer system the identity of detected access points.

10. A method according to claim 8 wherein the step of monitoring comprises intermittently and periodically determining the availability of access points.

11. A method according to claim 10 wherein the step of intermittently and periodically determining the availability of access points comprises monitoring at predetermined regular intervals.

12. A method according to claim 10 wherein the step of intermittently and periodically determining the availability of access points comprises monitoring at random irregular intervals.

13. A method according to claim 8 wherein the step of identifying an unauthorized access point comprises comparing the identity of monitored access points with a database of authorized access points.

14. A method according to claim 8 further comprising determining the location of an identified unauthorized access point by comparing the locations of a plurality of computer devices all of which report detection of the identified unauthorized access point.

15. A method comprising the steps of:

equipping each of a plurality of computer devices to detect access points accessible to the device through which data can be exchanged with a network and to report to a server computer system the identity of detected access points;

comparing the identity of reported access points with a list of authorized access points and identifying an unauthorized access point; and

comparing the locations of a plurality of computer devices all of which report detection of an identified unauthorized access point.

16. A method according to claim 15 wherein the step of equipping computer devices comprises providing each computer devices with a wireless local area network connection device.

17. A method according to claim 16 further comprising the steps of reporting the signal strength at which each computer device links with each detected access point and analyzing the relative signal strengths of pairs of authorized and unauthorized access points to determine access point locations.

18. Apparatus comprising:

a workstation computer system;

a network interface connected to said system and providing a communication channel between said system and a network;

an access point identification program stored accessibly to said system and cooperating therewith when executing on said system to identify points accessible through said interface; and

a reporting program stored accessibly to said system and cooperating with said identification program and with said system when executing on said system to report through said interface to a remote server computer system the identity of accessed points.

19. Apparatus according to claim 18 wherein said network interface comprises a wireless connection capability.

20. Apparatus according to claim 18 wherein said workstation computer system is a mobile computing device.

21. Apparatus according to claim 20 wherein said mobile computing device is a notebook computer system.

22. Apparatus according to claim 18 wherein said workstation computer system is a desktop computing device.

23. Apparatus comprising:

a server computer system,

a network interface connected to said system and providing a communication channel between said system and a network,

an access point identification program stored accessibly to said system and cooperating therewith when executing to identify nodes accessible through said interface, and

a node identification database stored accessibly to said system and said program and cooperating therewith when said program is executing on said system to identify unauthorized access points accessible to said system through said interface.

24. Apparatus according to claim 23 further comprising an access point location program stored accessibly to said system and cooperating therewith when executing to identify the location of any unauthorized access point accessible through said interface.

25. A program product comprising:

a computer readable medium; and

a program stored on said medium accessibly to a computer system, said program when executing on a system;

monitoring access points through which data can be exchanged with a network,

identifying an unauthorized access point, and

determining the location of the identified unauthorized access point.

26. A program product comprising:

a computer readable medium; and

a program stored on said medium accessibly to a computer system, said program when executing on a system;

monitoring access points through which data can be exchanged with a network,

identifying an access point, and

reporting to a remote server computer system the identified access point.