Patent Application
20070117593
The present invention relates, in general, to wireless network security and, more particularly, to systems and methods for detecting improper access of a wireless device and alerting users of other wireless devices of such improper access.
The growing power of wireless devices, such as personal digital assistants (PDAs), cellular telephones and computers, and the increasing capability of these devices to communicate directly to other wireless devices in physical proximity to them over a Personal Area Network (PAN) established over a short range wireless data link, such as Bluetooth™ and Infrared Data Association (IrDA™) links, has created new security concerns. Hackers have discovered that they can improperly access a wireless device directly over a PAN and steal potentially confidential information, such as passwords, financial records and conversations. Furthermore, creators of malware, e.g. viruses, Trojan horses, worms, logic bombs, backdoors, key loggers, spam and adware, have discovered that they can infect a wireless device directly from another wireless device over a PAN without passing through an intermediary, such as a network or removable media.
Hackers and malware have been a problem for computer users since the dawn of the computer age. The first recorded virus infected Univac machines in the 1970's through the use of magnetic tape. Hackers have been around since the 19th century, first breaking into telephone systems and then into computer systems. The advent of computer networks and the Internet have increased the average computer user's risk of being attacked by a hacker or malware.
The damage caused by a hacker or malware attack can be severe. Hackers attempt to infiltrate a computer or a network by finding a security flaw through which they can infiltrate. Once inside, they can steal valuable information, such as addresses, phone numbers, social security numbers, financial records and confidential documents. They can also damage or delete files and file systems. Malware can be equally destructive. It can damage or destroy files and file systems, collect sensitive data and replicate itself to other computers, thereby clogging networks and, in the case of portable wireless devices, draining battery life. Even malware that is not destructive, such as adware or spam, can still result in lost productivity and added frustration.
In response to the danger posed by hacker and malware attacks, tools to combat such attacks have been developed. Individual computers can be equipped with firewalls to limit their connectivity to the network so as to reduce their vulnerability to hackers. A typical firewall acts as an Internet Protocol (IP) packet filter by not allowing packets to pass through the firewall unless they match predefined rules. These rules can be related to the source IP, destination IP or port, domain name of the source and other attributes. Another tool is anti-malware software that detects malware on a computer and deletes or contains it. Traditional anti-malware software generally uses pattern matching to look for malware in files and emails. When it detects a malware in a file or an email, it will attempt to either remove the malware from the infected file or email or quarantine the infected file or email. In addition to being installed on a single computer system, firewalls and anti-malware software can be installed on dedicated network devices or other computers acting as gateways, thus providing security for an entire network.
An Intrusion Detection System (IDS) provides another level of security to a computer or a network. An IDS generally detects attacks through one of two methods: (1) signature detection, wherein the IDS compares network traffic and system activity patterns to those of known attacks, and (2) anomaly detection, wherein the IDS distinguishes abnormal network traffic and system activity behavior from predefined “normal” behavior. A host based IDS (HIDS) can monitor file system integrity, the state of the system registry, logon attempts, network activity and other system aspects of its host computer. It runs on the host computer, but it may also report to a central console. A network based IDS (NIDS) can monitor traffic over an entire network. The advantage of an IDS is that it can locate suspicious activity that may be caused by a previously unknown type of hacker or malware attack and alert other computers on the network of an attack.
As the threat to wireless devices from hacker and malware attacks has grown, the traditional defenses have been adapted for use against such attacks. Many vendors sell anti-malware software for wireless devices. An example of a network anti-malware solution for wireless devices is described in U.S. Published patent application 2005/0138395 A1 ('395 A1). The '395 A1 reference describes an anti-virus protection system for wireless devices using a network based anti-virus system that monitors data streams to wireless devices and removes malicious code.
However, a hacker or malware attack that propagates from wireless device to wireless device over a PAN presents a problem that cannot be solved via the traditional defenses against hacker and malware attacks. An attack of this type bypasses any traditional network (with its attendant defenses) to which a wireless device is connected. For example, a hacker can access a mobile phone through a PAN and then steal or delete valuable information, or hijack the mobile phone to make calls. In another example, a malware can be uploaded to a wireless device over an PAN. Such a malware can then replicate itself to other wireless devices that come into physical proximity with the infected wireless device by establishing new PANs between the infected wireless device and the other wireless devices. Installing a firewall, IDS, and anti-malware software on a wireless device can provide some protection to that specific wireless device, but it cannot provide protection against, or notification of, the improper access to other wireless devices in the geographic vicinity of an attack.
Accordingly, there is a need in the art to detect improper access of a wireless device and warn other wireless devices of the improper access.
A system and method for detection and notification of an improper access of a wireless device is disclosed. In one embodiment, the system includes a wireless device in communication with a personal area network and data network, adapted to detect improper access of itself over the personal area network and transmit data representative of the improper access over the data network. The system further includes a control center in communication with the data network to receive data representative of the improper access, generate alerts based at least in part on the data, and transmit the alerts to wireless devices.
Other aspects, features, and techniques of the invention will be apparent to one skilled in the relevant art in view of the following detailed description of the invention.
One aspect of the invention is to detect improper access of a wireless device over a personal area network and notify other wireless devices of the improper access. In one embodiment, the detection of improper access is accomplished by an originating wireless device that includes anti-malware software and/or an Intrusion Detection System. The wireless device may notify a control center of the improper access. The control center may then generate and provide alerts to one or more target wireless devices, which may then take action to protect themselves from a similar improper access.
Continuing to refer to
Still referring to the embodiment in
Improper access 120 may consist of a malware or a hacker attack. A malware attack may consist of a virus, Trojan horse, worm, logic bomb, backdoor, spyware, spam, adware, keylogger or any other type of malicious or nuisance program or communication. A hacker attack may consist of any unauthorized access of originating wireless device 110, such as an unauthorized login or an unauthorized file access, whether or not the intent of the unauthorized access is malicious. Furthermore, an attack need not be successful in order to be considered an improper access 120. One or more attempts by an unauthorized user to access originating wireless device 110 may constitute an improper access 120. Similarly, one or more attempts to propagate a malware to originating wireless device 110 may constitute an improper access 120.
In one embodiment, the data 140 may include information regarding the attack such as the contents of the transmission, a portion of the contents of the transmission, and/or a description of the attack. A description of the attack may include one or more of an attack signature, damage to files or file systems on originating wireless device 110, successful or attempted logons, successful or attempted file or file system access, and an identity of the attack variant. Other information relevant to the improper access 120 may be included in the data 140 including, but not limited to, location of the originating wireless device 110 and the time of the improper access 120. The location and time may be determined by the originating wireless device 110 or by another device connected to data network 150. For example, the location of a cellular phone may be determined by the base station with which it is in communication. Alternatively, the location of a cellular phone may be determined by the cellular phone itself (e.g. GPS) or by the cellular phone in conjunction with a base station (e.g. assisted GPS), if the cellular phone is so equipped. Similarly, the location of a computer may be determined by the network node with which it is in communication. The previous examples are listed here for their exemplary value and should not be read as a limitation on the invention. In addition to being configured to transmit the data 140, originating wireless device 110 in one embodiment may be configured to display a message on an internal and/or external display to inform the user of originating wireless device 110 of the improper access 120.
Still referring to the embodiment in
Control center 160 in
Still referring to the embodiment in
In
Still referring to
Network transceiver 260 is configured to provide originating wireless device 110 with connectivity to data network 150. It may contain a separate receiver and transmitter or an integrated unit. It may be a wireless or wired network transceiver. In one embodiment, it may be a telecommunication network transceiver, such as a GSM, CDMA, TDMA, iDEN or PSTN transceiver. In another embodiment, it may be an Ethernet, Wi-Fi (such as 802.11b, 802.11g, etc.), Wi-Max, cable, DSL, satellite telephony, or other suitable network transceiver. In certain embodiments, device 110 may contain more than one network transceiver (e.g. a laptop computer containing Wi-Fi and Ethernet transceivers).
Still referring to
Location receiver 250 is configured to receive location data 270 from an external source such as the Global Positioning System (GPS) or Global Navigation Satellite System (GLNSS). Although it is not shown, it should be appreciated that network transceiver 260 may also be configured to receive all or a portion of location data 270, such as GPS or GNSS sensitivity assistance, cellular base station location or identity, and network node location and/or identity. While in this embodiment, location receiver 250 is present, it should be appreciated that in other embodiments location receiver 250 may be omitted if the location data 270 is to be determined from a source outside of originating wireless device 110 or received through network transceiver 260.
Still referring to the embodiment depicted in
Attack database 320 may be configured to record at least a portion of data 140. In another embodiment, attack database 320 may be configured to record information derived from data 140. In addition to being configured to receive data from attack server 310, attack database may be configured to receive data from other sources, such as other components of control center 160, other computer systems, or manual data entry. Attack database 320 may contain information regarding past attacks as reported by originating wireless device 110 or other similar wireless devices, such as location, time, intensity, and variants of past attacks. Attack database 320 may further contain information regarding attack defenses, such as attack signatures, normal behavior patterns and software updates.
Although it is not shown here, in one embodiment control center 160 may include a defense server. In one embodiment, the defense server may be configured to analyze data 140 and generate new attack defenses. In another embodiment, defense server may be in communication with another system that may analyze data 140 and generate new attack defenses. The defenses may be stored in attack database 320, a defense database and/or another database.
User database 340 may contain the location of target wireless devices 180. User database 340 may also contain a plurality of the settings of one or more of the target wireless devices 180, such as the latest operating system, IDS and/or malware software (if any) installed, the type of target wireless devices 180 (e.g. PDA, cell phone, etc.), and the capabilities of target wireless devices 180 (e.g. the ability to limit PAN connectivity, receive SMS messages, etc.). General user account information and addresses to use for sending alerts may be stored in user database 340. Addresses may consist of telephone numbers, email addresses, instant messenger user names, IP addresses and/or any other addresses suitable to transmit alerts 170 to target wireless devices 180. In one embodiment, one or more target wireless devices 180 may have multiple addresses to which alerts 170 can be sent. This list of information contained in user database 340 is exemplary and should not be read as a limitation on the current invention, as user database 340 may contain other information consistent with the principles of the invention.
Continuing with the embodiment in
In one embodiment, alert server 350 may be configured to generate alerts 170. Alert server 350 may also be configured to transmit alerts 170 over data network 150 or another network to target wireless devices 180.
In addition to the aforementioned components, control center 160 in this embodiment contains reporting server 360. Reporting server 360 may be configured to generate a report 370. A report 370 may include descriptions of reported attacks, maps of reported attack activity, lists of alerts 170 sent to target wireless devices 180, defenses generated in response to reported attacks or any other data consistent with the principles of the current invention. A report 370 may be encoded in any suitable data format, such as HTML, XML, ASCII or Unicode. Reporting server 360 may further be configured to store report 370 in a report database (not shown) or another database. In one embodiment, report server 360 may be configured to transmit report 370 to another computer over a network and/or to display report 370 on a display coupled to control center 160. In another embodiment, report server 360 may be connected to a network, such as the internet, a LAN or a WAN, to allow viewing of the report 370 from another device connected to the network.
At block 440, according to the embodiment of
At block 460, in the embodiment shown in
Not shown in
While detection process 400 has been described in the above embodiments, it should be appreciated that these are for exemplary value only and other embodiments are applicable to the current invention. For example, in one embodiment alert detection process 400 may not include blocks 440 and 450. In another embodiment, the order of the blocks constituting detection process 400 may vary. For example, blocks 440 and 450 (limiting PAN connectivity) may be performed subsequent to block 460 (reporting data representative of improper access). For the sake of simplicity, detection process 400 has been defined in general steps and it should be appreciated that other steps consistent with the principles of the invention may be included.
Referring now to
At block 540 in the current embodiment, the locations of the target wireless devices (e.g. wireless devices 180) may be determined. The locations of the target wireless devices may be recorded in a user database (e.g. user database 340) in the control center or in another database. In certain embodiments the locations of the target wireless devices may be determined by the target wireless devices, alone or assisted by other devices, or they may be determined by the data network. In one embodiment, the location of a particular target wireless device may be updated upon a change of location of the target wireless device as determined by the wireless device and/or the data network. In another embodiment, the location may be updated when the target wireless device connects to another node of the data network, such as when a cellular telephone connects to a new cell.
Referring still to the embodiment in
At block 560, the alerts are transmitted to the target wireless devices. In one embodiment, the alerts may be transmitted to target wireless devices that are in physical proximity to the originating wireless device. Other factors in addition to, or in lieu of, physical proximity may be used to determine which target wireless devices to send alerts to, such as subscription information and/or installed operating systems on target wireless devices. Alternatively, the alert may be transmitted to all target wireless devices. It should be appreciated that the originating wireless device may also be considered a target wireless device.
Physical proximity of the target wireless devices to the originating wireless device may be determined in several ways. In one embodiment, physical proximity may be determined based on the distance between the originating wireless device and the target wireless devices. In another embodiment, physical proximity may be determined based on the communication range of the data network nodes to which the originating wireless device and the target wireless device are connected. For example, a cellular telephone that detects an improper access may be located in a particular cell. Target wireless devices located in that particular cell or in adjacent cells may be considered to be in physical proximity to the cellular telephone that detected the improper access, while target wireless devices outside of that particular cell and adjacent cells may not be considered to be in physical proximity to the cellular telephone that detected the improper access. The aforementioned example is for explanatory purposes only and should not be considered to be a limitation on the current invention as the definition of physical proximity may be altered during operation of the system.
The alert process 500 then proceeds to block 570 where a report is generated. The report may contain descriptions of attacks, maps of attack activity, lists of alerts transmitted to target wireless devices, defenses generated in response to reported attacks and/or other data consistent with the principle of the invention. The control center may store the report in a database and/or transmit the report over a network to another computer. In one embodiment, the report may be viewable on a display coupled to the control center. In another embodiment, the report may be viewable remotely. Reports may be viewed using a web browser or any suitable viewing software. In certain embodiments, the report may be for internal viewing only. In other embodiments, the report may be accessible by the general public or by a selected group of persons, such as subscribers to an alert service or subscribers to a cellular telephone service.
While alert process 500 has been described in the above embodiments, it should be appreciated that these are for exemplary value only and other embodiments are applicable to the current invention. For example, in one embodiment alert process 500 may not include blocks 520, 530 and/or 540. In another embodiment, the order of the blocks constituting alert process 500 may vary. For example, block 540 (determining the locations of other wireless devices) may be performed subsequent to block 550 (generating the alert). For the sake of simplicity, alert process 500 has been defined in general steps and it should be appreciated that other steps consistent with the principles of the invention may be included.
If the target wireless device includes an IDS or anti-malware software, the process continues to block 630 where it is determined whether the alert contains a new defense, such as an attack signature, normal behavior rules and/or software. This determination may be made by comparing the defense contained in the alert, if any, with defenses contained in the target wireless device. If the alert does not have a new defense, then the process jumps to block 650. If the alert contains a new defense, then the target wireless device may update the applicable software and/or data files. For example, if an alert contains a new malware attack signature and the target wireless device contains anti-malware software, the target wireless device may update the malware attack signature database with the new malware attack signature. In another embodiment, the alert may not contain a new defense, but instead direct the target wireless device to update its defenses via a third party, such as an anti-malware software developer.
Referring still to
In the displayed embodiment, the process moves to block 670 where the target wireless device may display the applicable contents of the alert. This is to notify the user of the target wireless device of the possibility of improper access of the target wireless device in the geographic area in which it is located. While in this embodiment the applicable contents of the alert are displayed, in other embodiments it may not be. For example, a user may have an IDS and/or anti-malware software installed on the target wireless device and may have entered preferences indicating a desire to not be notified of an alert, instead preferring the installed software to automatically process the alert.
While protection process 600 has been described in the above embodiments, it should be appreciated that these are for exemplary value only and other embodiments are applicable to the current invention. For example, in one embodiment protection process 600 may not include blocks 620, 630, 650, 660 and/or 670. In another embodiment, the order of the blocks constituting alert process 600 may vary. For example, blocks 650 and 660 (limit PAN connectivity) may be performed subsequent to block 670 (display alert). For the sake of simplicity, protection process 600 has been defined in general steps and it should be appreciated that other steps consistent with the principles of the invention may be included.
While the invention has been described in connection with various embodiments, it should be understood that the invention is capable of further modifications. This application is intended to cover any variations, uses or adaptation of the invention following, in general, the principles of the invention, and including such departures from the present disclosure as come within the known and customary practice within the art to which the invention pertains.
