US 11,540,130 B2Granted

Zero trust wireless monitoring-system and method for behavior based monitoring of radio frequency environments

Assignee802 Secure, Inc.

InventorsKonrad Grutzmacher, Clifford Fernandez

Life of this patent

Estimating the term…

Loading patent…

Abstract

A System and Method is provided that enable identifying cyber security attacks using observation and monitoring of end point activity. By following and monitoring the wireless connection related activities of endpoint devices as they cycle through various steps leading to establishing a connection to the secure network, a knowledge base is established in the cloud by analysis of the actions, and communication to build the confidence that the users of the network are where they should be. In one embodiment, no access is provided until a user presents valid credentials. Based on these credentials the network then builds a specific path based on access controls, tunnels or other techniques to control the user's communication and access to specific targets within the network.

Claims16

Dependent claims

A method of monitoring a wireless client device accessing a network, comprising:

scanning, by a radio frequency scanning device, a defined radio frequency air space for communication between the wireless client device and the network;
determining, by the radio frequency scanning device, that the wireless client device has connected to the network based on the scanned defined radio frequency air space, wherein the network is one of an approved network or an unapproved network;
collecting, by the radio frequency scanning device, data on communication activities between the wireless client device and the network, the collected data for storage and analysis of a behavior pattern of the wireless client device;
generating, by the radio frequency scanning device, a knowledge base of behavior patterns based on the analysis of the behavior pattern and the collected data on communication activities between the wireless client device and the network, wherein the knowledge base of behavior patterns is used to establish access control for a connection between the wireless client device and the network;
when the network is an approved network, recognizing, by the radio frequency scanning device, the wireless client device and the network for connection of the wireless client device to the network;
and
when the network is an unapproved network, extracting, by the radio frequency scanning device, a behavior pattern from the collected data on the communication activities between the wireless client device and the network, and comparing, by the radio frequency scanning device, the extracted behavior pattern to behavior patterns in the knowledge base of behavior patterns.

4 more elements

A non-transitory computer readable medium having instructions stored therein, which when executed by one or more processors, cause the one or more processors to:

scan a defined radio frequency air space for communication between a wireless client device and a network;
determine that the wireless client device has connected to the network based on the scanned defined radio frequency air space, wherein the network is one of an approved network or an unapproved network;
collect data on communication activities between the wireless client device and the network, the collected data for storage and analysis of a behavior pattern of the wireless client device;
generate a knowledge base of behavior patterns based on the analysis of the behavior pattern and the collected data on communication activities between the wireless client device and the network, wherein the knowledge base of behavior patterns is used to establish access control for a connection between the wireless client device and the network;
when the network is an approved network, recognize the wireless client device and the network for connection of the wireless client device to the network;
and
when the network is an unapproved network, extract a behavior pattern from the collected data on the communication activities between the wireless client device and the network, and compare the extracted behavior pattern to behavior patterns in the knowledge base of behavior patterns.

4 more elements

A server system comprising:

at least one storage device;
at least one processor coupled to the at least one storage device, the at least one processor configured to:
receive, from a monitoring device over a secure communication channel, first data of a wireless client device connecting to an approved network;
analyze the received first data to determine a normal behavior pattern of the wireless client device's connection to the approved network;
store the received first data and normal behavior pattern in the at least one storage device;
receive, from the monitoring device over the secure communication channel, second data of the wireless client device connecting to an unapproved network;
analyze the received second data to determine an abnormal behavior pattern of the wireless client device's connection to the unapproved network;
store the received second data and abnormal behavior pattern in the at least one storage device;
generate a knowledge base of behavior patterns based on the stored first data, the stored second data, the stored normal behavior pattern, and the stored abnormal behavior pattern, wherein the knowledge base of behavior patterns is used to establish access control for a connection between the wireless client device and the approved or unapproved network;
recognize the wireless client device and the approved network for connection of the wireless client device to the approved network;
and
extract a behavior pattern from collected data on communication activities between the wireless client device and the unapproved network, and compare the extracted behavior pattern to behavior patterns in the knowledge base of behavior patterns;
and
a security manager coupled to the processor, the security manager configured to:
generate a remedial action for the wireless client device based on an access control policy after the abnormal behavior pattern is determined.

12 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/365,393Filed 26 Mar 2019 · us provisional application
Priority: 4 Feb 2019
Published: US 2020/0252800 A16 Aug 2020
Granted: 27 Dec 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04W 12/08
Security arrangements; Authentication; Protecting privacy or anonymity: access security
H04W 24/02
Supervisory, monitoring or testing arrangements: arrangements for optimising operational condition
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04W 12/122
Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]: counter-measures against attacks; Protection against…