# US 2019/0174252 A1 · Method and Apparatus for Wireless Client-to-Network Host Association > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0174252 A1 - Document ID: US20190174252A1 - Status: Published application - Kind: A1 - Application number: 15/834,020 - Filed: 2017-12-06 - Published: 2019-06-06 - Earliest claimed: 2017-12-06 - Assignees: Rapid Focus Security, LLC - Applicants: Rapid Focus Security, LLC - Inventors: Ellery Crane; Richard Daniel Farina - Web page: https://patentgrep.com/patent/US20190174252A1 ## CPC - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - G06F 21/44: Program or device authentication - H04L 41/12: Discovery or management of network topologies - H04L 43/0817: by checking functioning - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04W 12/00: Security arrangements; Authentication; Protecting privacy or anonymity - H04W 12/12: Detection or prevention of fraud - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 63/168: {above the transport layer} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A wireless device association apparatus includes a sensor having a wireless traffic analyzer that is configured to detect a wireless signal from a first wireless device. A wireless interface is configured to send a first fingerprinted data sequence to the first wireless device and is configured to detect a second fingerprinted data sequence received at a second wireless device. A processor is configured to correlate a first signature derived from the first fingerprinted data sequence and the second signature derived from the second fingerprinted data sequence to determine an association between the first and second devices. ## Claims ### Claim 1 A method of wireless device association, the method comprising: a) detecting a wireless signal from a first wireless device by wirelessly scanning a monitored network with a sensor device; b) generating a first fingerprinted data sequence and a first signature of the first fingerprinted data sequence; c) wirelessly sending the first fingerprinted data sequence to the first wireless device; d) detecting a second wireless signal from a second wireless device and receiving a second fingerprinted data sequence; e) generating a second signature from the received second fingerprinted data sequence; and f) correlating the first signature of the first fingerprinted data sequence and second signature of the second fingerprinted data sequence to determine an association between the first and second wireless device. ### Claim 2 (depends on 1) The method of wireless device association of claim 1 wherein the first wireless device is a host device. ### Claim 3 (depends on 1) The method of wireless device association of claim 1 wherein the first and second wireless device are the same device. ### Claim 4 (depends on 1) The method of wireless device association of claim 1 wherein the sensor device comprises a security device. ### Claim 5 (depends on 1) The method of wireless device association of claim 1 wherein the sensor device comprises a tablet device. ### Claim 6 (depends on 1) The method of wireless device association of claim 1 wherein correlating the first and second signature comprises correlating with a software as a service platform executing on a cloud. ### Claim 7 (depends on 1) The method of wireless device association of claim 1 wherein generating the first fingerprinted data sequence comprises generating the first fingerprinted data sequence using a rolling hash. ### Claim 8 (depends on 1) The method of wireless device association of claim 1 further comprising generating a network topology based on the association. ### Claim 9 (depends on 1) The method of wireless device association of claim 1 further comprising identifying a vulnerability exploitation of the second device based on the association. ### Claim 10 A wireless device association apparatus comprising: a) a sensor comprising: i) a wireless traffic analyzer configured to detect a first wireless signal from a first wireless device; ii) a wireless interface configured to send a first fingerprinted data sequence to the first wireless device and configured to detect a second fingerprinted data sequence received at a second wireless device; and iii) a processor configured to correlate a first signature derived from the first fingerprinted data sequence and a second signature derived from the second fingerprinted data sequence to determine an association between the first and second wireless devices. ### Claim 11 (depends on 10) The wireless device association apparatus of claim 10 wherein the first wireless device comprises a host device. ### Claim 12 (depends on 10) The wireless device association apparatus of claim 10 wherein the first and second wireless device are the same device. ### Claim 13 (depends on 10) The wireless device association apparatus of claim 10 wherein the sensor comprises a security device. ### Claim 14 (depends on 10) The wireless device association apparatus of claim 10 wherein the sensor comprises a tablet device. ### Claim 15 (depends on 10) The wireless device association apparatus of claim 10 wherein the processor is located remotely from the wireless interface. ### Claim 16 (depends on 10) The wireless device association apparatus of claim 10 wherein the first fingerprinted data sequence performs a rolling hash. ### Claim 17 (depends on 10) The wireless device association apparatus of claim 10 wherein the sensor is configured to generate a network topology based on the association. ### Claim 18 (depends on 10) The wireless device association apparatus of claim 10 wherein the sensor is configured to identify a vulnerability exploitation of the second device based on the association.