Method and system for determining trusted wireless access points

• US 9,742,769 B2
• Filed: 06/24/2014
• Issued: 08/22/2017
• Est. Priority Date: 05/26/2014
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Borovikov, Nikolay V., Yablokov, Victor V.
• Primary Examiner(s): Abyaneh, Ali
• Application Number:
  US14/312,838
• Publication Number:
  US 20150341358A1
• Time in Patent Office: 1,155 Days
• Field of Search: 726 27
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

Disclosed are systems and method for determining trusted wireless access points. An example method includes identifying, by a mobile device, one or more wireless access points are available to connect to a network resource; obtaining a plurality of access point characteristics of the one or more wireless access points; obtaining a plurality of network resource characteristics for connecting to the network resource; comparing the plurality of access point characteristics and the plurality of network resource characteristics; determining based on the comparison at least one trusted wireless access points that is acceptable for establishing a connection to the network resource; and establishing a connection to the network resource via the trusted wireless access point.

Claims

1. A method for determining trusted wireless access points, the method comprising:

identifying, by a mobile device, one or more wireless access points available to connect to a network to access a data hosted on a computer in the network;

calculating an access point coefficient for each of the one or more identified wireless access points based on values representing a plurality of access point characteristics and further based on significance factors corresponding to the access point characteristics, wherein the plurality of access point characteristics include at least one of a period of operation of each of the one or more wireless access points, an existence of security incidents for each of the one or more wireless access points, a trust level for each of the one or more wireless access points, and a frequency of changing setup parameters of each of the one or more wireless access points; and

calculating a network resource coefficient for the data hosted on the computer based on values representing a plurality of network resource characteristics and further based on significance factors corresponding to the network resource characteristics, wherein the plurality of network resource characteristics include network security requirements and authentication requirements to access the data;

comparing, by the mobile device, each calculated access point coefficient to the calculated network resource coefficient;

determining, based on the comparison of each calculated access point coefficient to the calculated network resource coefficient, at least one trusted wireless access point of the one or more identified wireless access points that is acceptable for establishing a connection to access the data hosted on the computer in the network responsive to the calculated access point coefficient of the trusted wireless access point being equal to or greater than the calculated network resource coefficient; and

establishing a connection to the network via the trusted wireless access points to access the data hosted on the computer.

2. The method of claim 1, wherein the access point characteristics include at least one of an address of an access point, an identifier of the access point, a cell identifier, a service set identification (SSID), a base service identification (BSID), a control scheme for encryption keys, a network protection technology, a hidden SSID, a channel traffic capacity of the access point, a number of unique users having connected to the access point during existence of the access point, a physical location of the access point, a type of wireless network served by the access point, an identifier of a communications operator of the access point, a firmware version of the access point, a period of operation of the access point, a number of security incidents at the access point, a level of trust of users of the access point, and a frequency of changing of setup parameters of the access point.

3. The method of claim 1, wherein comparing the access point characteristics and the network resource characteristics further comprises:

assigning a first value to an access point characteristic and a second value to a corresponding network resource characteristics; and

attributing a significance factor to the access point characteristic and the corresponding network resource characteristics, wherein a value of the significance factor is based on an importance of the characteristic to the data hosted on the computer.

4. The method of claim 3, wherein the access point coefficient is calculated based on a product of the first value and the significance factor, and wherein the network resource coefficient is calculated based on a product of the second value and the significance factor.

5. The method of claim 4, wherein an access point is determined to be unacceptable for establishing a connection to access the data hosted on the computer in the network if the access point coefficient is less than the network resource coefficient.

6. The method of claim 5, wherein if a plurality of access points is determined to be acceptable for establishing a connection to access the data hosted on the computer in the network, then selecting an access point of the plurality of access points with a highest access point coefficient to establish the connection to the network.

7. The method of claim 1, further comprising:

determining that the at least one trusted wireless access point is acceptable for establishing the connection to access the data if the comparing of the calculated access point coefficient to the calculated network resource coefficient indicates that the at least one trusted wireless access point satisfies the network security requirements and authentication requirements to access the data.

8. A system for determining trusted wireless access points, the system comprising:

a hardware processor configured to;

identify one or more wireless access points available to connect to a network to access a data hosted on a computer in the network;

calculate an access point coefficient for each of the one or more identified wireless access points based on values representing a plurality of access point characteristics and further based on significance factors corresponding to the access point characteristics, wherein the plurality of access point characteristics include at least one of a period of operation of each of the one or more wireless access points, an existence of security incidents for each of the one or more wireless access points, a trust level for each of the one or more wireless access points, and a frequency of changing setup parameters of each of the one or more wireless access points; and

calculate a network resource coefficient for the data hosted on the computer based on values representing a plurality of network resource characteristics and further based on significance factors corresponding to the network resource characteristics, wherein the plurality of network resource characteristics include network security requirements and authentication requirements to access the data;

compare each calculated access point coefficient to the calculated network resource coefficient;

determine based on the comparison of each calculated access point coefficient to the calculated network resource coefficient, at least one trusted wireless access point of the one or more identified wireless access points that is acceptable for establishing a connection to access the data hosted on the computer in the network responsive to the calculated access point coefficient of the trusted wireless access point being equal to or greater than the calculated network resource coefficient; and

establish a connection to the network via the trusted wireless access points to access the data hosted on the computer.

9. The system of claim 8, wherein the access point characteristics include at least one of an address of an access point, an identifier of the access point, a cell identifier, a service set identification (SSID), a base service identification (BSID), a control scheme for encryption keys, a network protection technology, a hidden SSID, a channel traffic capacity of the access point, a number of unique users having connected to the access point during existence of the access point, a physical location of the access point, a type of wireless network served by the access point, an identifier of a communications operator of the access point, a firmware version of the access point, a period of operation of the access point, a number of security incidents at the access point, a level of trust of users of the access point, and a frequency of changing of setup parameters of the access point.

10. The system of claim 8, wherein to compare the access point characteristics and the network resource characteristics, the processor further configured to:

assign a first value to an access point characteristic and a second value to a corresponding network resource characteristics; and

attribute a significance factor to the access point characteristic and the corresponding network resource characteristics, wherein a value of the significance factor is based on an importance of the characteristic to the data hosted on the computer.

11. The system of claim 10, wherein the access point coefficient is calculated based on a product of the first value and the significance factor, and wherein the network resource coefficient is calculated based on a product of the second value and the significance factor.

12. The system of claim 11, wherein an access point is determined to be unacceptable for establishing a connection to access the data hosted on the computer in the network if the access point coefficient is less than the network resource coefficient.

13. The system of claim 12, wherein if a plurality of access points is determined to be acceptable for establishing a connection to access the data hosted on the computer in the network, then selecting an access point of the plurality of access points with a highest access point coefficient to establish the connection to the network.

14. The system of claim 8, wherein the processor further configured to:

determine that the at least one trusted wireless access point is acceptable for establishing the connection to access the data if the comparing of the calculated access point coefficient to the calculated network resource coefficient indicates that the at least one trusted wireless access point satisfies the network security requirements and authentication requirements to access the data.

15. A computer program product stored on a non-transitory computer readable medium, for determining trusted wireless access points, wherein the computer program product includes computer executable instructions for:

identifying one or more wireless access points available to connect to a network to access a data hosted on a computer in the network;

calculating an access point coefficient for each of the one or more identified wireless access points based on values representing a plurality of access point characteristics and further based on significance factors corresponding to the access point characteristics, wherein the plurality of access point characteristics that include at least one of a period of operation of each of the one or more wireless access points, an existence of security incidents for each of the one or more wireless access points, a trust level for each of the one or more wireless access points, and a frequency of changing setup parameters of each of the one or more wireless access points; and

calculating a network resource coefficient for the data hosted on the computer based on values representing a plurality of network resource characteristics and further based on significance factors corresponding to the network resource characteristics, wherein the plurality of network resource characteristics include network security requirements and authentication requirements to access the data;

comparing each calculated access point coefficient to the calculated network resource coefficient;

determining based on the comparison of each calculated access point coefficient to the calculated network resource coefficient, at least one trusted wireless access point of the one or more identified wireless access points that is acceptable for establishing a connection to access the data hosted on the computer in the network responsive to the calculated access point coefficient of the trusted wireless access point being equal to or greater than the calculated network resource coefficient; and

establishing a connection to the network via the trusted wireless access points to access the data hosted on the computer.

16. The computer program product of claim 15, wherein comparing the access point characteristics and the network resource characteristics further comprises:

assigning a first value to an access point characteristic and a second value to a corresponding network resource characteristics; and

attributing a significance factor to the access point characteristic and the corresponding network resource characteristics, wherein a value of the significance factor is based on an importance of the characteristic to the data hosted on the computer.

17. The computer program product of claim 16, wherein the access point coefficient is calculated based on a product of the first value and the significance factor, and wherein the network resource coefficient is calculated based on a product of the second value and the significance factor.

18. The computer program product of claim 17, wherein an access point is determined to be unacceptable for establishing a connection to access the data hosted on the computer in the network if the access point coefficient is less than the network resource coefficient.

19. The computer program product of claim 18, wherein if a plurality of access points is determined to be acceptable for establishing a connection to access the data hosted on the computer in the network, then selecting an access point of the plurality of access points with a highest access point coefficient to establish the connection to the network.

20. The computer program product of claim 15, wherein the computer program product further includes computer executable instructions for:

determining that the at least one trusted wireless access point is acceptable for establishing the connection to access the data if the comparing of the calculated access point coefficient to the calculated network resource coefficient indicates that the at least one trusted wireless access point satisfies the network security requirements and authentication requirements to access the data.