Method and system for providing wireless vulnerability management for local area computer networks

• US 8,032,939 B2
• Filed: 12/14/2007
• Issued: 10/04/2011
• Est. Priority Date: 11/06/2007
• Status: Active Grant

• Current Assignee: Arista Networks, Inc.
• Original Assignee: Airtight Networks Incorporated (Arista Networks, Inc.)
• Inventors: Bhagwat, Vivek, Palnitkar, Samir
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US11/956,357
• Publication Number:
  US 20090119776A1
• Time in Patent Office: 1,390 Days
• Field of Search: None
• US Class Current: 726/25
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/145 Payments according to the detected use or quantity
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A Software-as-a-Service (SaaS) based method for providing wireless vulnerability management for local area computer networks. The method includes providing a security server being hosted by a service provider entity to provide analysis of data associated with wireless vulnerability management for a plurality of local area computer networks of a plurality of customer entities, respectively. The method includes creating a workspace for wireless vulnerability management for a customer entity on the security server and receiving configuration information associated with the workspace. The method also includes supplying one or more sniffers to the customer entity. The method includes receiving at the security server information associated with wireless activity monitored by the one or more sniffers at premises of the customer entity and processing the received information within the workspace for the customer entity using the security server. The method includes metering usage of the workspace for wireless vulnerability management for the customer entity.

Claims

1. A Software-as-a-Service (SaaS) based method for providing wireless vulnerability management for local area computer networks, the method comprising:

providing a security server, the security server being hosted by a service provider entity, the security server being coupled to the Internet and having an address in the Internet, the security server being adapted to provide analysis of data associated with wireless vulnerability management, concurrently for a plurality of local area computer networks of a plurality of distinct customer entities, respectively;

creating a first workspace for wireless vulnerability management for a first customer entity and a second workspace for wireless vulnerability management for a second customer entity on the security server, the creating the workspace being responsive to a first request from the first customer entity and a second request from the second customer entity to subscribe to wireless vulnerability management, the first and the second customer entities being distinct from one another;

receiving configuration information associated with the first workspace for the first customer entity at the security server, the configuration information including identification of a first physical location hierarchy associated with premises of the first customer entity;

receiving configuration information associated with the second workspace for the second customer entity at the security server, the configuration information including identification of a second physical location hierarchy associated with premises of the second customer entity;

associating identities of a first one or more sniffers to be utilized for wireless vulnerability management for the first customer entity with the first workspace and identities of a second one or more sniffers to be utilized for wireless vulnerability management for the second customer entity with the second workspace;

supplying the first one or more sniffers to the first customer entity and the second one or more sniffers to the second customer entity;

receiving a plurality of connection requests at the security server over the Internet from a plurality of sniffers, respectively, subsequent to the plurality of sniffers being deployed at premises of their respective customer entities;

identifying automatically from the plurality of connection requests a first set of connection requests associated with the first customer entity based at least upon the identities of the first one or more sniffers associated with the first workspace and a second set of connection requests associated with the second customer entity based at least upon the identities of the second one or more sniffers associated with the second workspace;

displaying the first one or more sniffers as active within the first workspace for the first customer entity and the second one or more sniffers as active within the second workspace for the second customer entity, based at least upon the identified first and second set of connection requests;

receiving input from the first customer entity for associating the first one or more sniffers with one or more locations, respectively, in the first physical location hierarchy associated with the first workspace for the first customer entity;

receiving input from the second customer entity for associating the second one or more sniffers with one or more locations, respectively, in the second physical location hierarchy associated with the second workspace for the second customer entity;

receiving at the security server a first information associated with wireless activity monitored by the first one or more sniffers at premises of the first customer entity, the receiving being receiving over the Internet;

processing the received first information associated with wireless activity within the first workspace for the first customer entity using the security server;

receiving at the security server a second information associated with wireless activity monitored by the second one or more sniffers at premises of the second customer entity, the receiving being receiving over the Internet;

processing the received second information associated with wireless activity within the second workspace for the second customer entity using the security server; and

metering usage of the first workspace and the second workspace for wireless vulnerability management for the first customer entity and the second customer entity, respectively.

2. The method of claim 1 wherein the service provider entity, the second customer entity, and the first customer entity being business entities separate from one another.

3. The method of claim 1 wherein the metering the usage of the workspace for the first customer entity and the second customer entity comprising:

tracking usage of the first and the second one or more sniffers at premises of the first customer entity and the second customer entity, respectively, for monitoring of wireless activity; and

charging the first customer entity and the second customer entity periodically based at least upon the usage of the first and the second one or more sniffers, respectively.

4. The method of claim 1 wherein the metering the usage of the workspace for the first customer entity and the second customer entity comprising:

tracking vulnerabilities detected during a first selected period within the first workspace and a second selected period within the second workspace; and

charging the first customer entity and the second customer entity based at least upon the vulnerabilities detected during the first selected period and the second selected period, respectively.

5. The method of claim 1, and further comprising receiving a selection of one or more modules associated with the first workspace for the first customer entity at the security server.

6. The method of claim 5 wherein the metering the usage of the workspace for the first customer entity comprising charging the first customer entity based at least upon the selection of the one or more modules.

7. The method of claim 5 wherein the one or more modules comprise at least one module selected from the group consisting of scanning module, threat assessment module, remediation module, location tracking module, reporting module, RF visualization module, and managed services module.

8. The method of claim 5 wherein the receiving the selection of the one or more modules associated with the first workspace for the first customer entity at the security server comprising:

receiving a request to initiate logging into the first workspace for the first customer entity from a computer, the request being initiated over the Internet;

transferring information associated with a listing of modules comprising the one or more modules to the computer over the Internet; and

receiving the selection of the one or more modules at the security server over the Internet, the selection being inputted by a person operating the computer using the listing of the modules.

9. The method of claim 5 wherein the processing the received first information associated with wireless activity within the first workspace for the first customer entity using the security server comprising:

authenticating the received first information using a digital secret shared between the security server and the first customer entity;

accessing the configuration information associated with the workspace for the first customer entity;

accessing the module selection information associated with the workspace for the first customer entity;

processing the received information based at least upon the configuration information and the module selection information to generate a result information; and

triggering one or more actions based at least upon the result information.

10. The method of claim 1 wherein the receiving the configuration information associated with the first workspace for the first customer entity at the security server further comprising receiving identity information associated with one or more authorized wireless devices within the local area network of the first customer entity.

11. The method of claim 1 wherein the receiving the configuration information associated with the first workspace for the first customer entity at the security server further comprising receiving information associated with notification of one or more wireless vulnerabilities to the first customer entity.

12. The method of claim 1 wherein the receiving the configuration information associated with the workspace for the first customer entity at the security server further comprising receiving information associated with a selection of one or more reports, the one or more reports to be generated based upon the first information associated with wireless activity received at the security server.

13. The method of claim 1 wherein the receiving the configuration information associated with the first workspace for the first customer entity at the security server comprising:

receiving a request to initiate logging into the first workspace of the first customer entity from a computer, the request being initiated over the Internet;

transferring information associated with one or more configuration screens to the computer over the Internet;

displaying the one or more configuration screens on the computer; and

receiving the configuration information at the security server over the Internet, the configuration information being inputted by a person operating the computer using the one or more configuration screens displayed on the computer.

14. The method of claim 1 wherein a username, a password, and an administrative privilege being associated with the first workspace for a plurality of administrators belonging to the first customer entity on the security server, wherein a first administrator having a configuration modification privilege, a second administrator having a viewing privilege, and a third administrator having a module selection privilege.

15. The method of claim 1 wherein the first information associated with wireless activity monitored by the first one or more sniffers at premises of the first customer entity including identities of one or more wirelessly active access points and one or more wirelessly active clients within and/or in a vicinity of the premises of the first customer entity.

16. The method of claim 1 wherein the first information associated with wireless activity monitored by the first one or more sniffers at premises of the first customer entity including information associated with wireless connections among a plurality of wireless devices within and/or in a vicinity of the premises of the first customer entity.

17. The method of claim 1 wherein the first information associated with wireless activity monitored by the first one or more sniffers at the premises of the first customer entity including information associated with radio signal strength parameters associated with wireless activity at the premises of the first customer entity.

18. A server computer apparatus for providing wireless vulnerability management, the apparatus comprising:

a memory unit storing computer executable instructions;

a processor unit for executing the computer executable instructions; and

a communication interface for coupling the server computer device to the Internet and having an address in the Internet;

wherein the computer executable instructions are programmed to provide analysis of data associated with wireless vulnerability management, concurrently for a plurality of local area computer networks of a plurality of distinct customer entities, respectively, by performing the steps of;

creating a first workspace for wireless vulnerability management for a first customer entity and a second workspace for wireless vulnerability management for a second customer entity on the security server, the creating the workspace being responsive to a first request from the first customer entity and a second request from the second customer entity to subscribe to wireless vulnerability management, the first and the second customer entities being distinct from one another;

receiving configuration information associated with the first workspace for the first customer entity at the security server, the configuration information including identification of a first physical location hierarchy associated with premises of the first customer entity;

receiving configuration information associated with the second workspace for the second customer entity at the security server, the configuration information including identification of a second physical location hierarchy associated with premises of the second customer entity;

associating identities of a first one or more sniffers to be utilized for wireless vulnerability management for the first customer entity with the first workspace and identities of a second one or more sniffers to be utilized for wireless vulnerability management for the second customer entity with the second workspace;

receiving a plurality of connection requests at the security server over the Internet from a plurality of sniffers, respectively, subsequent to the plurality of sniffers being deployed at premises of their respective customer entities;

identifying automatically from the plurality of connection requests a first set of connection requests associated with the first customer entity based at least upon the identities of the first one or more sniffers associated with the first workspace and a second set of connection requests associated with the second customer entity based at least upon the identities of the second one or more sniffers associated with the second workspace;

displaying the first one or more sniffers as active within the first workspace for the first customer entity and the second one or more sniffers as active within the second workspace for the second customer entity, based at least upon the identified first and second set of connection requests;

receiving input from the first customer entity for associating the first one or more sniffers with one or more locations, respectively, in the first physical location hierarchy associated with the first workspace for the first customer entity;

receiving input from the second customer entity for associating the second one or more sniffers with one or more locations, respectively, in the second physical location hierarchy associated with the second workspace for the second customer entity;

receiving at the security server a first information associated with wireless activity monitored by the first one or more sniffers at premises of the first customer entity, the receiving being receiving over the Internet;

processing the received first information associated with wireless activity within the first workspace for the first customer entity using the security server;

receiving at the security server a second information associated with wireless activity monitored by the second one or more sniffers at premises of the second customer entity, the receiving being receiving over the Internet;

processing the received second information associated with wireless activity within the second workspace for the second customer entity using the security server; and

metering usage of the first workspace and the second workspace for wireless vulnerability management for the first customer entity and the second customer entity, respectively.

19. The system of claim 18 wherein the server computer apparatus is hosted by a service provider entity, wherein the service provider entity, the second customer entity, and the first customer entity being business entities separate from one another.