Personal wireless monitoring agent

• US 8,196,199 B2
• Filed: 10/19/2005
• Issued: 06/05/2012
• Est. Priority Date: 10/19/2004
• Status: Active Grant

• Current Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Original Assignee: AirDefense Incorporated (Motorola Solutions, Inc.)
• Inventors: Hrastar, Scott E., Viswanathan, Subra
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US11/253,316
• Publication Number:
  US 20060085543A1
• Time in Patent Office: 2,421 Days
• Field of Search: 709/224, 726/22, 726/23, 726/24, 726/25
• US Class Current: 726/22
• CPC Class Codes: H04K 2203/18 for wireless local area networks or WLAN
• CPC Class Codes: H04K 3/226 Selection of non-jammed channel for communication spectrum sharing arrangements H04W16/14; selection of wireless resources by user or terminal H04W72/02
• CPC Class Codes: H04K 3/28 with jamming and anti-jamming mechanisms both included in a same device or system, e.g. wherein anti-jamming includes prevention of undesired self-jamming resulting from jamming
• CPC Class Codes: H04K 3/45 characterized by including monitoring of the target or target signal, e.g. in reactive jammers or follower jammers for example by means of an alternation of jamming phases and monitoring phases, called "look-through mode"
• CPC Class Codes: H04K 3/86 related to preventing deceptive jamming or unauthorized interrogation or access, e.g. WLAN access or RFID reading record carriers with integrated circuit chips including means for preventing undesired reading or writing from or to record carriers by hindering electromagnetic reading or writing G06K19/07318; arrangements for sensing record carriers including arrangements for protecting the interrogation against piracy attacks G06K7/10257
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements

Abstract

An agent for monitoring a wireless device is provided. The agent compares communications against policy guidelines and determines whether a violation of the policy guidelines has been committed, and communicates information about the violation to an authorized user.

Claims

1. A processor based method for monitoring use of a wireless device with respect to communications that are received at a wireless interface, the method comprising the steps of:

loading a personal wireless monitoring agent on the wireless device, wherein the wireless device comprises an authorized device on a wireless network, and wherein the personal wireless monitoring agent is configured to examine behavior on the wireless device on which it is installed;

accessing on the wireless device one or more policy guidelines through the personal wireless monitoring agent;

determining locally on the wireless device through the personal wireless monitoring agent whether a violation exists with respect to the one or more policy guidelines by analysis of the communication attributes based upon the policy guidelines, the analysis comprises using the personal wireless monitoring agent in a combination of passive monitoring and active monitoring of a wireless local area network driver of the wireless device, wherein the active monitoring comprises monitoring data, management, and control frames associated with the wireless local area network driver, the policy guidelines comprising a configurable set of activity rules related to the wireless device and authorized activity on the wireless network for the wireless device, and the determining based on wireless communication associated with the wireless device, wherein the violation comprises a deviation in communications being sent to or from the wireless device from the one or more policy guidelines;

logging any policy violations from the scanning step to a log file; and

sending the log file to a server responsive to the wireless device having an available connection to the server.

2. The method of claim 1, further comprising the step of:

sending an alert to a display associated with the wireless device responsive to a policy violation.

3. The method of claim 1, wherein the plurality of policies are defined using an extensible markup language format.

4. The method of claim 3, further comprising the step of periodically updating the plurality of policies by receiving from the server a plurality of updated policies for use in the scanning step;

wherein the plurality of updated policies are pushed from the server to a plurality of wireless devices.

5. The method of claim 1, wherein the wireless device intercepts a communication sent over the wireless network to which the wireless device is connected;

wherein the intercepted communications are analyzed for policy violations.

6. The method of claim 1, wherein the communications received at the device'"'"'s wireless interface are communications originated by or provided to the wireless device.

7. The method of claim 1, further comprising the step of filtering the communications via the wireless interface to attempt to prevent a policy violation from occurring due to the communication;

wherein the filtering step comprises blocking communications in violation of the plurality of policies.

8. The method of claim 1, wherein policy violations comprise unauthorized access of the wireless network, attempts to send sensitive information, or detection of a wireless attack;

wherein an alarm is sent to the server responsive to determining that a policy violation has occurred.

9. The method of claim 1, wherein the wireless interface comprises a wireless network interface card configured to operate using one of the 802.11 standards.

10. The method of claim 1, wherein the availability of the connection to the server comprises one of the server having enough bandwidth to handle the connection to the wireless device and the wireless interface having an available wireless network to transmit the log file to the server.

11. One or more non-transitory computer readable media storing instructions that upon execution by a computer cause the computer to monitor the use of a wireless device with respect to communications that are received at a wireless interface by performing the steps of claim 1.

12. The method of claim 1, wherein the personal wireless monitoring agent on the wireless device is utilized with a plurality of additional personal wireless monitoring agent to form a distributed system.

13. The method of claim 1, further comprising:

utilizing the personal wireless monitoring agent to analyze historical wireless activity of the wireless device through checking audit files and log files on the wireless device; and

utilizing the personal wireless monitoring agent to analyze current wireless activity of the wireless device through checking registry files and configuration files on the wireless device.

14. The method of claim 1, further comprising:

operating as one of a roaming sensor and a store-and-forward sensor in a wireless intrusion detection system using the personal wireless monitoring agent.

15. A computer system having a wireless monitoring agent, the system comprising:

a wireless communication interface operable to receive and transmit communications on a wireless network on which the computer system is an authorized device;

a data store operable to store policy guidelines associated with the computer system and a log file associated with analysis of the communication attributes; and

a system processor comprising one or more processing elements, wherein the system processor is in communication with the system data store and the wireless communication interface and wherein the system processor is programmed or adapted to;

load a personal wireless monitoring agent, wherein the computer system comprises an authorized device on the wireless network, and wherein the personal wireless monitoring agent is configured to examine behavior on the computer system on which it is installed;

execute via the personal wireless monitoring agent policy analysis instructions configured to analyze communication attributes both passively and actively to determine whether a violation has occurred at the computer system based upon the policy guidelines, wherein active analysis comprises monitoring data, management, and control frames associated with an IEEE 802.11 network driver associated with the wireless communication interface;

check locally via the personal wireless monitoring agent registry, audit, log, or configuration files in the data store regarding compliance to the policy guidelines for wireless communications of the computer system; and

alert a centralized server via the wireless network based upon the analysis of communication attributes with respect to the policy guidelines;

wherein the computer system comprises one of a mobile computer system or a notebook computer.

16. The system of claim 15, wherein the log file stored in the data store;

wherein the log file that is stored in the data store is sent to the server responsive to the wireless device having an available connection to the server.

17. The system of claim 15, further comprising a display operable to communicate information to a user of the computer system, wherein the system processor is further programmed or adapted to:

determine whether an alarm should be sent to the display; and

send an alarm to the display responsive to the determining step.

18. The system of claim 15, wherein the wireless device intercepts a communication sent over a wireless network to which the wireless device is connected;

and

wherein the intercepted communications are analyzed for policy violations.

19. The system of claim 15, wherein the log files contain information associated with activities performed by a user of the computer system.

20. The system of claim 15, wherein the system processor is further programmed or adapted to:

periodically request an updated policy; and

replace the stored policy with the updated policy;

wherein the stored policy is defined using an extensible markup language (XML) format, thereby enabling the policy to be dynamically modified.

21. The system of claim 15, wherein the system processor is further programmed or adapted to:

filter the communications via the wireless interface to attempt to prevent a policy violation from occurring due to the communication.

22. A processor based method for monitoring use of a wireless device with respect to communications that are received at a wireless interface, the method comprising the steps of:

operating the wireless device as an authorized device on a wireless network;

installing a personal wireless monitoring agent on the wireless device, wherein the personal wireless monitoring agent is configured to examine behavior on the wireless device on which it is installed;

receiving on the wireless device for the personal wireless monitoring agent one or more policy guidelines comprising approved wireless communication attributes comprising a configurable set of activity rules for a wireless network;

accessing on the wireless device the one or more policy guidelines for the personal wireless monitoring agent;

monitoring using the personal wireless monitoring agent wireless network behavior of the wireless device through a combination of passive monitoring reviewing various configuration files and activity logs created on the wireless device and monitoring of a network driver on the wireless device to analyze IEEE 802.11 data, management, and control frames, wherein the monitoring is performed locally on the wireless device, and wherein the monitoring is based on data transmitted associated with the wireless device;

determining on the wireless device whether a violation exists with respect to the one or more policy guidelines by analysis of the communication attributes based upon the policy guidelines, wherein the violation comprises a deviation from the approved wireless communication attributes;

logging on the wireless device any policy violations from the scanning step to a log file; and

communicating the log file to an authorized user.