US 10,764,755 B2Granted

Systems and methods for providing wireless access security by interrogation

Assignee802 Secure, Inc.

InventorsKonrad Grutzmacher, Clifford Fernandez, Michael Raggo, Garry Drummond

Life of this patent

Estimating the term…

Loading patent…

Abstract

Security is provided for enterprise local area networks (LANs) by pre-vetting and identifying the security characteristic and actions of any new wireless networks that tries to connect to a secure LAN network. The disclosure herein provides for identification and classification of IEEE 802.11 wireless networks by using monitoring sensor system within and managed by a centralized cloud. The monitoring sensors interrogate the network mimicking the behavior of known platforms, such as an end-user's workstation or mobile device followed by random actions simulating a human person. The response characteristics of the wireless network including the behavior patterns relating to the LAN system and human behavior are collected. The security system uses methods of classification provided through analysis of the collected information using methods including data science approaches, correlation analysis, and machine learning classification methods to determine the security classification of the newly detected wireless network.

Claims21

Dependent claims

A system comprising:

a sensor to identify and flag a connection request from a new network through at least one access point of a secured local area network (SLAN), and to collect data and information regarding the new network;
and
a central console coupled to the sensor to identify at least one marker for classification of the new network, to request the sensor to extract a query package for classification of the new network from a query database to evaluate operational security of the new network, the query package including queries and answers,
wherein the sensor is further to establish a new pseudo-network to directly engage with the new network and to establish an authenticated connection with the new pseudo-network, and to collect data and information regarding the new pseudo-network,
wherein the sensor is further to use the queries and answers included in the query package to interrogate the new network,
wherein the central console uses the collected data and information regarding the new pseudo-network and results of the interrogation to evaluate operational security of the new network, and transmits a result of the evaluation to the sensor,
wherein, based on the result of the evaluation, the sensor enables or denies the connection request of the new network to the SLAN,
wherein the central console is further to determine whether the identified marker of the new network falls within one of a plurality of existing classifications stored in a historic database, and
in a case where the identified marker of the new network is not determined to fall within one of the plurality of existing classifications stored in the historic database, the central console is further to:
based on the collected data and information by the sensor regarding the new network and relevant historic data stored in the historic database, generate a new query package for interrogation of the new network, and
store the new query package in the query database associated with the SLAN with reference to a new classification.

8 more elements

A method comprising:

identifying and flagging, by a sensor, a connection request from a new network through at least one access point of a secured local area network (SLAN) to collect data and information regarding the new network;
and
identifying, by a central console coupled to the sensor, at least one marker for classification of the new network, requesting, by the central console, the sensor to extract a query package for classification of the new network from a query database to evaluate operational security of the new network, the query package including queries and answers,
establishing, by the sensor, a new pseudo-network to directly engage with the new network and to establish an authenticated connection with the new pseudo-network, and collecting, by the sensor, data and information regarding the new pseudo-network;
using, by the sensor, the queries and answers included in the query package to interrogate the new network,
using, by the central console, the collected data and information regarding the new pseudo-network and results of the interrogation to evaluate operational security of the new network, and transmits a result of the evaluation to the sensor,
based on the result of the evaluation, enabling or denying, by the sensor, the connection request of the new network to the SLAN,
determining, by the central console, whether the identified marker of the new network falls within one of a plurality of existing classifications stored in a historic database, and
in a case where the identified marker of the new network is not determined to fall within one of the plurality of existing classifications stored in the historic database:
based on the collected data and information by the sensor regarding the new network and relevant historic data stored in the historic database, generating, by the central console, a new query package for interrogation of the new network, and
storing, by the central console, the new query package in the query database associated with the SLAN with reference to a new classification.

8 more elements

A non-transitory computer-readable storage medium storing computer-executable instructions, the instructions causing a machine to execute a process, the process comprising:

identifying and flagging, by a sensor, a connection request from a new network through at least one access point of a secured local area network (SLAN) to collect data and information regarding the new network;
and
identifying, by a central console coupled to the sensor, at least one marker for classification of the new network, requesting, by the central console, the sensor to extract a query package for classification of the new network from a query database to evaluate operational security of the new network, the query package including queries and answers,
establishing, by the sensor, a new pseudo-network to directly engage with the new network and to establish an authenticated connection with the new pseudo-network, and collecting, by the sensor, data and information regarding the new pseudo-network;
using, by the sensor, the queries and answers included in the query package to interrogate the new network,
using, by the central console, the collected data and information regarding the new pseudo-network and results of the interrogation to evaluate operational security of the new network, and transmits a result of the evaluation to the sensor,
based on the result of the evaluation, enabling or denying, by the sensor, the connection request of the new network to the SLAN,
determining, by the central console, whether the identified marker of the new network falls within one of a plurality of existing classifications stored in a historic database, and
in a case where the identified marker of the new network is not determined to fall within one of the plurality of existing classifications stored in the historic database:
based on the collected data and information by the sensor regarding the new network and relevant historic data stored in the historic database, generating, by the central console, a new query package for interrogation of the new network, and
storing, by the central console, the new query package in the query database associated with the SLAN with reference to a new classification.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/877,274Filed 22 Jan 2018 · us provisional application
Priority: 7 Sep 2017
Published: US 2019/0075465 A17 Mar 2019
Granted: 1 Sep 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04W 12/08
Security arrangements; Authentication; Protecting privacy or anonymity: access security
H04L 63/0876
For authentication of entities: based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or…
H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general