Detection of an unauthorized wireless communication device

• US 9,525,689 B2
• Filed: 03/25/2014
• Issued: 12/20/2016
• Est. Priority Date: 03/25/2014
• Status: Active Grant

• Current Assignee: Symbol Technologies, LLC (Zebra Technologies Corporation)
• Original Assignee: Symbol Technologies, LLC (Zebra Technologies Corporation)
• Inventors: Batta, Puneet, Miranda, Trevor, Thomas, Jacob
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/224,110
• Publication Number:
  US 20150281236A1
• Time in Patent Office: 1,001 Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04K 3/822 by detecting the presence of a surveillance, interception or detection
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals

Abstract

A technique for the detection of an unauthorized wireless communication device includes monitoring of Bluetooth® communications activity by a Bluetooth® capable communication device. Any monitored communication activity is analyzed against parameters that are predefined to detect suspected illegal activity. If illegal activity is suspected by the analysis, an alert is generated for a system administrator. The predefined parameters associate illegal activity with; data that includes credit card numbers and expiration dates, credit card transaction logging information, non-discoverable devices, activity after store hours, exceedingly long activity, etc.

Claims

1. An apparatus for the detection of an unauthorized wireless communication device comprising:

a communications monitor operable to monitor communications activity;

a processor communicatively coupled with the communication monitor and operable to analyze any monitored communications activity against parameters that are predefined to detect suspected illegal activity; and

a user interface communicatively coupled with the processor and operable to generate an alert for a system administrator if illegal activity is suspected by the processor, wherein one of the predefined parameters associates illegal activity with monitoring of any communications activity after a store has closed.

2. The apparatus of claim 1, wherein the communications monitor is operable to monitor Bluetooth®

communications activity.

3. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with data within any monitored communications activity that includes sixteen-digit credit card numbers and credit card expiration dates.

4. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with data within any monitored communications activity that includes a series of dates and time-stamps.

5. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with data within any monitored communications activity that includes a class of operation field set to miscellaneous.

6. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with a determination that the timing of monitored communications activity coincides with updates from a point-of-sale terminal.

7. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with detecting a discoverable communication device.

8. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with detecting a non-discoverable communication device by cycling through a set of Media Access Control addresses to find any non-discoverable devices.

9. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with a starting of communications activity after the store has closed.

10. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with communications activity that is longer compared to normal communications activity.

11. The apparatus of claim 1, wherein one of the predefined parameters associates illegal activity with communications activity of devices that are not moving.

12. The apparatus of claim 1, further comprising a central server operable to analyze the communications activity.

13. A method for the detection of an unauthorized wireless communication device, comprising:

monitoring of communications activity by a communication device;

analyzing any monitored communication activity against parameters that are predefined to detect suspected illegal activity; and

if illegal activity is suspected by the analysis, generating an alert for a system administrator wherein one of the predefined parameters associates illegal activity with monitoring of any communications activity after a store has closed.

14. The method of claim 13, wherein the communication activity is Bluetooth®

communications activity monitored by a Bluetooth®

capable communications device.

15. A method for the detection of an unauthorized wireless communication device, comprising:

monitoring of communications activity by a communication device;

analyzing any monitored communication activity against parameters that are predefined to detect suspected illegal activity; and

if illegal activity is suspected by the analysis, generating an alert for a system administrator, wherein one of the predefined parameters associates illegal activity with a starting of communications activity after a store has closed.

16. The method of claim 15, wherein the communication activity is Bluetooth®

communications activity monitored by a Bluetooth®

capable communications device.

17. The method of claim 15, wherein one of the predefined parameters associates illegal activity with data within any monitored communications activity that includes at least one of credit card numbers and credit card expiration dates.

18. The method of claim 15, wherein one of the predefined parameters associates illegal activity with data within any monitored communications activity that includes a series of dates and time-stamps.

19. The method of claim 15, wherein one of the predefined parameters associates illegal activity with data within any monitored communications activity that includes a class of operation field set to miscellaneous.