Security appliance for protecting power-saving wireless devices against attack
AssigneeBitdefender IPR Management Ltd.
InventorsCristian Munteanu, Balint Szente, Gyula Farkas
Life of this patent
Estimating the term…
Abstract
Described systems and methods allow protecting multiple wireless Internet-of-things (IoT) devices against impersonation attacks. In some embodiments, a security appliance detects an availability notification (e.g., a Bluetooth® Low Energy advertisement) emitted as part of a protocol of establishing a wireless connection between two devices. The security appliance may then determine whether the detected notification fits a baseline notification pattern of the apparent sender. When no, the security appliance may attack the sender device by replying to the respective availability notification and initiating a handshake.
Claims23
A security appliance configured to protect a client device against computer security threats, the security appliance comprising at least one hardware processor configured to:
- detect a first wireless communication comprising an availability notification emitted in preparation for establishing a peer-to-peer connection with an administration device;
- in response to detecting the first wireless communication, determine whether the first wireless communication fits a notification pattern specific to the client device, the notification pattern comprising a pattern of hopping between carrier signal frequency bands;
- in response, when the first wireless communication does not fit the notification pattern, transmit a second wireless communication configured to mimic a response by the administration device to the first wireless communication;
- and
- in response to transmitting the second wireless communication, perform a security action to protect the client device or the administration device.
A method of protecting a client device against computer security threats, the method comprising employing at least one hardware processor of a security appliance to:
- detect a first wireless communication comprising an availability notification emitted in preparation for establishing a peer-to-peer connection with an administration device;
- in response to detecting the first wireless communication, determine whether the first wireless communication fits a notification pattern specific to the client device, the notification pattern comprising a pattern of hopping between carrier signal frequency bands;
- in response, when the first wireless communication does not fit the notification pattern, transmit a second wireless communication configured to mimic a response by the administration device to the first wireless communication;
- and
- in response to transmitting the second wireless communication, perform a security action to protect the client device or the administration device.
A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a security appliance, cause the security appliance to:
- detect a first wireless communication comprising an availability notification emitted in preparation for establishing a peer-to-peer connection with an administration device;
- in response to detecting the first wireless communication, determine whether the first wireless communication fits a notification pattern specific to a selected client device, the notification pattern comprising a pattern of hopping between carrier signal frequency bands;
- in response, when the first wireless communication does not fit the notification pattern, transmit a second wireless communication configured to mimic a response by the administration device to the first wireless communication;
- and
- in response to transmitting the second wireless communication, perform a security action to protect the client device or the administration device.
Dependencies are inferred from the claim text.