Detecting unauthorized devices

• US 9,537,870 B2
• Filed: 04/11/2014
• Issued: 01/03/2017
• Est. Priority Date: 04/11/2014
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Patel, Mehul S., Monnerat, Edward David
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US14/250,437
• Publication Number:
  US 20150295940A1
• Time in Patent Office: 998 Days
• Field of Search: 713168-174, 713182-186, 713/202, 709/206, 709/225, 709/229, 709/249, 709/389, 726 2- 8
• US Class Current: 1/1
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Methods and systems are disclosed that, in some aspects, provide for receiving a provisioning request from a requesting device, and identifying one or more other devices proximate to or co-located with the requesting device. The methods and systems may include determining a location and other information of the one or more other devices and using the information to determine a location of and other information related to the requesting device. It may be determined whether to grant the provisioning request based on the determined location of the requesting device.

Claims

1. A method comprising:

receiving, by a first computing device and from a second computing device, a provisioning request;

receiving, by the first computing device and from a third computing device, a report comprising an indication that the third computing device detected the second computing device;

determining whether the report comprises an indication that the second computing device refused to provide a credential to the third computing device;

determining a location of the third computing device;

using the determination of the location of the third computing device to determine a location of the second computing device; and

determining whether to provision the second computing device based on the location of the second computing device and the determination of whether the report comprises the indication that the second computing device refused to provide the credential to the third computing device.

2. The method of claim 1, further comprising:

determining an account associated with the third computing device; and

determining whether to provision the second computing device based on whether the account associated with the third computing device is associated with the second computing device.

3. The method of claim 1, further comprising:

determining an account associated with the third computing device; and

determining whether the account is authorized to use the second computing device.

4. The method of claim 1, further comprising:

determining an account associated with the third computing device;

determining that the account is not associated with the second computing device; and

raising an alert indicating that the second computing device is not associated with the account.

5. A method comprising:

receiving, by a computing device and from a network access computing device, a provisioning request;

receiving, by the computing device and from a local device, a report comprising an indication that the local device detected the network access computing device;

determining whether the report comprises an indication that the network access computing device refused to provide a credential to the local device;

determining whether the network access computing device and the local device are associated with a same account;

determining whether to provision the network access computing device based on whether the network access computing device and the local device are associated with the same account and whether the report comprises the indication that the network access computing device refused to provide the credential to the local device; and

in response to determining to provision the network access computing device, sending a response to the provisioning request to the network access computing device and providing a service to the local device using the network access computing device.

6. The method of claim 5, wherein the provisioning request comprises information indicating one or more other devices, and wherein the method further comprises using the information indicating the one or more other devices to determine whether to approve the provisioning request.

7. The method of claim 5, further comprising:

determining an account associated with the local device; and

determining an account indicated in the provisioning request.

8. The method of claim 5, further comprising:

determining a location of the local device; and

determining a location of the network access computing device based on the location of the local device.

9. The method of claim 8, further comprising:

determining whether to grant network access to the network access computing device based on the location of the local device.

10. The method of claim 5, further comprising:

in response to determining that the network access computing device and the local device are not associated with the same account, flagging the network access computing device as a suspect device.

11. The method of claim 5, further comprising receiving a plurality of device detection messages from a plurality of different devices associated with the same account, wherein the device detection messages each comprises information indicating a new device that has been connected to a network of the plurality of different devices.

12. The method of claim 11, further comprising using the plurality of device detection messages to indicate unauthorized network access.

13. An apparatus comprising:

a processor; and

a memory storing computer-executable instructions that, when executed by the processor, cause the apparatus to;

receive, from a first network device, a provisioning request to provide network access to a second network device;

receive, from the second network device, a report comprising information indicating devices with which the second network device has exchanged credentials;

determine whether the report comprises an indication that the first network device refused to provide a credential to the second network device;

if the report comprises the indication that the first network device refused to provide the credential to the second network device, reject the provisioning request;

if the first network device has exchanged credentials with the second network device based on the report, determine whether to grant the provisioning request; and

in response to determining to grant the provisioning request, provide a service to the second network device using the first network device.

14. The apparatus of claim 13, wherein the memory stores one or more additional computer-executable instructions that, when executed by the processor, cause the apparatus to:

in response to determining that the report does not indicate the first network device, flag the first network device as a suspect device.

15. The apparatus of claim 13, wherein the memory stores one or more additional computer-executable instructions that, when executed by the processor, cause the apparatus to:

determine to retrieve the report from the second network device based on the second network device being indicated in the provisioning request.

16. The apparatus of claim 13, wherein the memory stores one or more additional computer-executable instructions that, when executed by the processor, cause the apparatus to:

determine an account associated with the first network device;

determine a plurality of network devices other than the first network device that are associated with the account;

receive, from the plurality of network devices, a plurality of reports indicating devices with which the plurality of network devices have exchanged credentials; and

in response to determining that none of the plurality of reports indicate the first network device, flag the first network device as a suspect device.

17. The apparatus of claim 13, wherein the memory stores one or more additional computer-executable instructions that, when executed by the processor, cause the apparatus to:

determine an account associated with the first network device;

determine a plurality of network devices other than the first network device that are associated with the account;

determine a plurality of locations respectively for the plurality of network devices other than the first network device;

determine a location of the first network device based on the plurality of locations; and

determine whether to grant the provisioning request based on the location of the first network device.