SECURITY SCANNING SYSTEM AND METHOD

• US 20160080409A1
• Filed: 11/10/2015
• Published: 03/17/2016
• Est. Priority Date: 03/21/2006
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Howcroft, Jerald Robert, Markley, John J., Del Carmine, Rocco A.
• Granted Patent: US 10,044,743 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04N 21/24 Monitoring of processes or resources, e.g. monitoring of server load, available bandwidth, upstream requests monitoring of server performance or load G06F11/34; arrangements for observation, testing or troubleshooting for broadcast or for distribution combined with broadcast H04H20/12
• CPC Class Codes: H04N 21/442 Monitoring of processes or resources, e.g. detecting the failure of a recording device, monitoring the downstream bandwidth, the number of times a movie has been viewed, the storage space available from the internal hard disk arrangements for monitoring broadcast services or broadcast-related services H04H60/29; arrangements for identifying or recognising characteristics with a direct linkage to broadcast information H04H60/35; monitoring of user activities for profile generation for accessing a video database G06F16/739; monitoring in wireless networks H04W24/00
• CPC Class Codes: H04N 21/443 OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
• CPC Class Codes: H04N 21/8166 involving executable data, e.g. software arrangements for executing specific programs G06F9/44; broadcasting computer programmes in broadcast systems H04H20/91; involving the movement of software or configuration parameters H04L67/34
• CPC Class Codes: H04N 21/854 Content authoring
• CPC Class Codes: H04N 7/173 with two-way working, e.g. subscriber sending a programme selection signal

Abstract

The present disclosure provides a computer-readable medium, method and system for determining security vulnerabilities for a plurality of application programs used to provide television services to a customer device over a communications network. The method includes running a first scanning program against a first application program relating to a control panel for the customer device; running a second scanning program against a second application program that provides Internet content to the customer device; running a third scanning program against a third application program that relates to a component management system of customer premises equipment; and correlating security vulnerabilities identified utilizing the first, second, and third scanning programs.

Claims

1. A non-transitory computer-readable storage medium including processor executable instructions that, when executed by a processor, cause the processor to perform operations comprising:

scanning, by a server, a set-top-box control panel application program with a web level scanning program configured to access a set-top-box via a broadband connection to a residential gateway locally coupled to the set-top-box;

scanning, by the server, the set-top-box control panel application program with an operating system level scanning program;

scanning a second application program that provides Internet content to the set-top-box with the web level scanning program;

scanning the second application program with the operating system level scanning program;

scanning a third application program that relates to a component management system with a third scanning program; and

correlating security vulnerabilities identified by the web level scanning program, the operating system level scanning program, and the third scanning program.

2. The computer-readable storage medium of claim 1, wherein scanning the set-top-box control panel application program with the web level scanning program comprises initiating, by a back bone server, execution of the web level scanning program on a web server.

3. The computer-readable storage medium of claim 2, wherein access to the web level scanning program is secured by a firewall and wherein the operations include:

obtaining access to the web level application program.

4. The computer-readable storage medium of claim 1, wherein the broadband connection includes a cable connection.

5. The computer-readable storage medium of claim 1, wherein the broadband connection includes a satellite connection.

6. The computer-readable storage medium of claim 1, wherein the operations include:

assigning risk levels to the security vulnerabilities; and

providing a report indicative of the risk levels.

7. The computer-readable storage medium of claim 1, wherein the web level scanning program accesses the set-top-box using a pass through connection to the residential gateway.

8. A method of determining security vulnerabilities associated with providing television services to a set-top-box over a communications network, comprising:

scanning, by a server, a set-top-box control panel application program with a web level scanning program configured to access a set-top-box via a broadband connection to a residential gateway locally coupled to the set-top-box;

scanning, by the server, the set-top-box control panel application program with an operating system level scanning program;

scanning a second application program that provides Internet content to the set-top-box with the web level scanning program;

scanning the second application program with the operating system level scanning program;

scanning a third application program that relates to a component management system with a third scanning program; and

correlating security vulnerabilities identified by the web level scanning program, the operating system level scanning program, and the third scanning program.

9. The method of claim 8, wherein scanning the set-top-box control panel application program with the web level scanning program comprises initiating, by a back bone server, execution of the web level scanning program on a web server.

10. The method of claim 9, wherein access to the web level scanning program is secured by a firewall and wherein the method further comprises:

obtaining access to the web level application program.

11. The method of claim 8, wherein the broadband connection includes a cable connection.

12. The method of claim 8, wherein the broadband connection includes a satellite connection.

13. The method of claim 8, wherein the method further comprises:

assigning risk levels to the security vulnerabilities; and

providing a report indicative of the risk levels.

14. The method of claim 8, wherein the web level scanning program accesses the set-top-box using a pass through connection to the residential gateway.

15. A server, comprising:

a processor; and

a storage medium including a database to store information relating to security vulnerabilities for a plurality of application programs associated with a customer device and processor executable program instructions that, when executed by the processor, cause the processor to perform operations comprising;

scanning, by a server, a set-top-box control panel application program with a web level scanning program configured to access a set-top-box via a broadband connection to a residential gateway locally coupled to the set-top-box;

scanning, by the server, the set-top-box control panel application program with an operating system level scanning program;

scanning a second application program that provides Internet content to the set-top-box with the web level scanning program;

scanning the second application program with the operating system level scanning program;

scanning a third application program that relates to a component management system with a third scanning program; and

correlating security vulnerabilities identified by the web level scanning program, the operating system level scanning program, and the third scanning program.

16. The server of claim 15, wherein scanning the set-top-box control panel application program with the web level scanning program comprises initiating, by a back bone server, execution of the web level scanning program by a web server.

17. The server of claim 16, wherein access to the web level scanning program is secured by a firewall and wherein the operations include:

obtaining access to the web level application program.

18. The server of claim 15, wherein the broadband connection includes a cable connection.

19. The server of claim 15, wherein the broadband connection includes a satellite connection.

20. The server of claim 15, wherein the operations include:

assigning risk levels to the security vulnerabilities; and

providing a report indicative of the risk levels.