Mobile risk assessment

• US 8,949,993 B2
• Filed: 12/28/2011
• Issued: 02/03/2015
• Est. Priority Date: 10/17/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Basavapatna, Prasanna Ganapathi, Gaddala, Satish Kumar, Schrecker, Sven, Goldschlag, David Moshe
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US13/339,194
• Publication Number:
  US 20130097710A1
• Time in Patent Office: 1,133 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

At least one available wireless access point is identified at a particular location and a connection is established with the available wireless access point. Communication is attempted with a trusted endpoint over the wireless access point and the attempted communication with the trusted endpoint over the wireless access point is monitored to assess risk associated with the wireless access point. Results of the assessment, in some instances, can be reported to an access point risk manager and risk associated with future attempts to use the wireless access point can be assessed based at least in part on the reported assessment results.

Claims

1. A method comprising:

identifying, at a user device, at least one available wireless access point at a particular location;

receiving a request to participate in a security assessment of the available wireless access point;

participating in the security assessment, wherein the security assessment comprises;

establishing a connection to the available wireless access point;

attempting to communicate with a trusted endpoint over the wireless access point; and

monitoring the attempted communication with the trusted endpoint over the wireless access point to assess risk associated with the wireless access point.

2. The method of claim 1, wherein attempting to communicate with the trusted endpoint includes attempting to establish a secured connection with the trusted endpoint, wherein establishing the secured connection includes receiving expected trust verification data from the trusted endpoint;

wherein receipt of data other than the expected trust verification data is presumed to indicate that the available wireless access point is untrustworthy suggesting higher risk associated with the wireless access point.

3. The method of claim 2, wherein the expected trust verification data includes at least one of a certificate, hash data, or token.

4. The method of claim 2, wherein the expected trust verification data is determined prior to attempting to establish a secured connection with the trusted endpoint.

5. The method of claim 4, wherein determining the expected trust verification data includes receiving the expected trust verification data from a trusted source over a mobile broadband connection.

6. The method of claim 2, wherein the trusted endpoint is identified from a plurality of available trusted endpoints by a trusted source prior to attempting to establish a secured connection with the trusted endpoint.

7. The method of claim 1, further comprising:

querying a remote security database for pre-existing risk assessment data relating to the wireless access point prior to establishing a connection to the available wireless access point.

8. The method of claim 7, wherein querying includes:

sending a query request to a remote security tool over a secure connection; and

receiving query results over the secure connection.

9. The method of claim 7, further comprising causing a risk status indicator to be presented on an endpoint device, the risk status indicator suggesting a level of risk associated with the wireless access point and based at least in part on the pre-existing risk assessment data.

10. The method of claim 7, wherein the risk assessed from the monitoring of the attempted communication is further based on the pre-existing risk assessment data.

11. The method of claim 1, wherein feedback data is collected during the monitoring of the attempted communication, the method further comprising sending the feedback data to a remote security tool.

12. The method of claim 11, wherein risk associated with the available wireless access point is assessed at least in part by the remote security tool.

13. The method of claim 1, further comprising collecting data from the available wireless access point, wherein assessing risk associated with the available access point includes assessment of the collected data.

14. The method of claim 13, further comprising:

sending the collected data to a remote risk profile calculator, wherein risk associated with the available wireless access point is assessed by the remote risk profile calculator; and

receiving risk profile information for the available wireless access point from the remote risk profile calculator.

15. The method of claim 13, wherein the collected data includes at least one of a service set identifier (SSID), data describing encryption used by the wireless access point, splash page information, and wireless access point password information.

16. The method of claim 1, wherein the available wireless access point is a first wireless access point in a plurality of available wireless access points, the method further comprising assessing risk of each of the plurality of available wireless access points.

17. The method of claim 1, wherein an autoconnect option for connecting to the available wireless access point is automatically disabled in response to assessing risk for the available wireless access point.

18. The method of claim 1, further comprising connecting to a VPN tunnel established in response to assessing risk for the available wireless access point.

19. The method of claim 18, wherein risk assessment data for the available wireless access point is communicated over the established VPN tunnel to a remote security tool.

20. The method of claim 1, wherein risk assessed for the available wireless access point is considered in an overall risk profile calculated for a particular endpoint device accessing the available wireless access point.

21. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify, at a user device, at least one available wireless access point at a particular location;

receive a request for the user device to participate in a security assessment of the available wireless access point; and

participate in the security assessment, wherein the security assessment comprises;

establish a connection to the available wireless access point;

attempt to communicate with a trusted endpoint over the wireless access point; and

monitor the attempted communication with the trusted endpoint over the wireless access point to assess risk associated with the wireless access point.

22. A system comprising:

at least one processor device;

at least one memory element; and

a user device comprising a wireless access point monitor, adapted when executed by the at least one processor device to;

identify at least one available wireless access point at a particular location;

receive a request for the user device to participate in a security assessment of the available wireless access point; and

participate in the security assessment, wherein the security assessment comprises;

establish a connection to the available wireless access point;

attempt to communicate with a trusted endpoint over the wireless access point; and

monitor the attempted communication with the trusted endpoint over the wireless access point to assess risk associated with the wireless access point.

23. The system of claim 22, further comprising a wireless-enabled endpoint device.