Method and System for Generating An Advisory Message for an Endpoint Device

• US 20070113080A1
• Filed: 08/22/2006
• Published: 05/17/2007
• Est. Priority Date: 11/11/2005
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Shankar, Rohit, Gudipudi, Srinivas, Zhu, Yidong, Purushothaman, Abhilash, Pore, Ravi, Short, Theodore, Deshpande, Sumit
• Granted Patent: US 9,203,858 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

According to one embodiment of the invention, a method for generating an advisory message for an endpoint device includes determining a threat level for the endpoint device by identifying a connection type between the endpoint device and the wireless network. The method also includes determining a second threat level for the endpoint device by identifying a security policy of the endpoint device. The method further includes generating an advisory message for the endpoint device based on the threat levels. The advisory message indicates vulnerability of the endpoint device.

Claims

1. A method for generating an advisory message for an endpoint device in a wireless network, comprising:

determining a first threat level for the endpoint device in the wireless network by identifying a connection type between the endpoint device and the wireless network, the connection type selected from the group consisting of;

open with IEEE 802.1x disabled;

open with IEEE 802.1x enabled;

Wi-Fi Protected Access (WPA);

Wi-Fi Protected Access Pre-shared key (WPA-PSK);

Wi-Fi Protected Access 2(WPA2); and

Wi-Fi Protected Access 2 Pre-shared key(WPA2-PSK); and

determining a second threat level for the endpoint device by identifying a security policy of the endpoint device, the security policy comprising a plurality of states of the endpoint device, the plurality of states comprising a state indicative of whether the endpoint device allows internet sharing, a state indicative of whether the endpoint device allows dual homing, a state indicative of whether the endpoint device allows network file sharing, and a state indicative of whether the endpoint device allows ad-hoc connections; and

based on the first threat level and the second threat level, generating an advisory message for the endpoint device that indicates vulnerability of the endpoint device.

2. A method for generating an advisory message for an endpoint device in a wireless network, comprising:

determining a first threat level for the endpoint device in the wireless network by identifying a connection type between the endpoint device and the wireless network;

determining a second threat level for the endpoint device by identifying a security policy of the endpoint device; and

based on the first threat level and the second threat level, generating an advisory message for the endpoint device that indicates vulnerability of the endpoint device.

3. The method of claim 2, wherein the connection type comprises a type selected from the group consisting of:

open with IEEE 802.1x disabled;

open with IEEE 802.1x enabled;

Wi-Fi Protected Access (WPA);

Wi-Fi Protected Access Pre-shared key (WPA-PSK);

Wi-Fi Protected Access 2(WPA2); and

Wi-Fi Protected Access 2 Pre-shared key(WPA2-PSK).

4. The method of claim 2, wherein the security policy comprises a plurality of states of the endpoint device.

5. The method of claim 4, wherein the plurality of states comprises a state indicative of whether the endpoint device allows dual homing.

6. The method of claim 4, wherein the plurality of states comprises a state indicative of whether the endpoint device allows internet sharing.

7. The method of claim 4, wherein the plurality of states comprises a state indicative of whether the endpoint device allows network file sharing.

8. The method of claim 4, wherein the plurality of states comprises a state indicative of whether the endpoint device allows ad-hoc connections.

9. A system for generating an advisory message, comprising:

a wireless network, the wireless network comprising one or more access points; and

an endpoint device operable to connect to the wireless network, the endpoint device comprising;

a processor; and

a storage device, readable by the endpoint device, embodying a program of instructions executable by the processor to perform steps for generating an advisory message, the steps comprising;

determining a first threat level for the endpoint device in the wireless network by identifying a connection type between the endpoint device and the wireless network;

determining a second threat level for the endpoint device by identifying a security policy of the endpoint device; and

based on the first threat level and the second threat level, generating an advisory message for the endpoint device that indicates vulnerability of the endpoint device.

10. The system of claim 9, wherein the connection type comprises a type selected from the group consisting of:

open with IEEE 802.1x disabled;

open with IEEE 802.1x enabled;

Wi-Fi Protected Access (WPA);

Wi-Fi Protected Access Pre-shared key (WPA-PSK);

Wi-Fi Protected Access 2(WPA2); and

Wi-Fi Protected Access 2 Pre-shared key(WPA2-PSK).

11. The system of claim 9, wherein the security policy comprises a plurality of states of the endpoint device.

12. The system of claim 11, wherein the plurality of states comprises a state indicative of whether the endpoint device allows dual homing.

13. The system of claim 11, wherein the plurality of states comprises a state indicative of whether the endpoint device allows internet sharing.

14. The system of claim 11, wherein the plurality of states comprises a state indicative of whether the endpoint device allows network file sharing.

15. The system of claim 11, wherein the plurality of states comprises a state indicative of whether the endpoint device allows ad-hoc connections.

16. Logic encoded in media, the logic being operable to:

determine a first threat level for an endpoint device in a wireless network by identifying a connection type between the endpoint device and the wireless network;

determine a second threat level for the endpoint device by identifying a security policy of the endpoint device; and

based on the first threat level and the second threat level, generate an advisory message for the endpoint device that indicates vulnerability of the endpoint device.

17. The logic of claim 16, wherein the connection type comprises a type selected from the group consisting of:

open with IEEE 802.1x disabled;

open with IEEE 802.1x enabled;

Wi-Fi Protected Access (WPA);

Wi-Fi Protected Access Pre-shared key (WPA-PSK);

Wi-Fi Protected Access 2(WPA2); and

Wi-Fi Protected Access 2 Pre-shared key(WPA2-PSK).

18. The logic of claim 16, wherein the security policy comprises a plurality of states of the endpoint device.

19. The logic of claim 18, wherein the plurality of states comprises a state indicative of whether the endpoint device allows dual homing.

20. The logic of claim 18, wherein the plurality of states comprises a state indicative of whether the endpoint device allows internet sharing.

21. The logic of claim 18, wherein the plurality of states comprises a state indicative of whether the endpoint device allows network file sharing.

22. The logic of claim 18, wherein the plurality of states comprises a state indicative of whether the endpoint device allows ad-hoc connections.