Systems and methods for network security

Patent metadata

Field	Value
Publication number	US-10068089-B1
Application number	US-201514864947-A
Country	US
Kind code	B1
Filing date	Sep 25, 2015
Priority date	Sep 25, 2015
Publication date	Sep 4, 2018
Grant date	Sep 4, 2018

Abstract

A computer-implemented method for network security may include (1) obtaining initial information that at least partially identifies an initial access point for connecting to a network, (2) after obtaining the initial information, obtaining subsequent information that at least partially identifies a subsequent access point for connecting to the same network, (3) comparing, by a security program, the initial information and the subsequent information in an attempt to detect whether the initial access point and the subsequent access point are the same, (4) detecting, based on the comparison, an indication that the initial access point and the subsequent access point are different, and (5) performing, by the security program in response to detecting the indication that the initial access point and the subsequent access point are different, a remedial action to protect a user. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for network security, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
obtaining initial information that at least partially identifies an initial access point for connecting to a network, the initial information comprising—an initial manufacturer identifier;
after obtaining the initial information, obtaining from a centralized backend security server, subsequent information that comprises a subsequent manufacturer identifier and that at least partially identifies a subsequent access point for connecting to the same network, the subsequent manufacturer identifier having been initially obtained by a different client device than the computing device and uploaded by the different client device to the centralized backend security server of a software security product vendor for aggregating telemetry information from different client devices in a field of client devices corresponding to separate purchases of a security program;
comparing, by the security program, the initial-manufacturer identifier that was obtained by the computing device and the subsequent manufacturer identifier that was initially obtained by the different client device than the computing device in an attempt to detect whether the initial access point and the subsequent access point are the same;
detecting, based on the comparison, an indication that the initial access point and the subsequent access point are different; and
performing, by the computing device in response to detecting the indication that the initial access point and the subsequent access point are different, a remedial action to protect a user, the remedial action comprising:
warning the user by transmitting a message that indicates to the user that there is a potential for an intruder to snoop network traffic when connected to the initial access point; and
preventing a successful attempt by the user to connect to the network through the initial access point.

2. The method of claim 1 , wherein:
the network comprises a wireless network; and
the initial access point and the subsequent access point comprise wireless access points.

3. The method of claim 1 , wherein obtaining the initial information that at least partially identifies the initial access point for connecting to the network further comprises interrogating the initial access point.

4. The method of claim 1 , wherein detecting, based on the comparison, the indication that the initial access point and the subsequent access point are different comprises detecting an indication that an initial media access control address and a subsequent media access control address are different.

5. The method of claim 1 , wherein detecting, based on the comparison, the indication that the initial access point and the subsequent access point are different comprises detecting an indication that a field of an initial network packet transmitted by the initial access point specifies a value that differs from the same field of a subsequent network packet transmitted by the subsequent access point.

6. The method of claim 5 , wherein the field of the initial network packet and the field of the subsequent network packet are located at the data link layer of the open systems interconnection model.

7. The method of claim 5 , wherein:
the field specifies at least one hardware capability supported by a corresponding access point; and
detecting, based on the comparison, the indication that the initial access point and the subsequent access point are different comprises detecting an indication that hardware capabilities supported by the initial access point and hardware capabilities supported by the subsequent access point are different.

8. The method of claim 1 , wherein detecting, based on the comparison, the indication that the initial access point and the subsequent access point are different comprises detecting an indication that an identity of a wireless radio of the initial access point and an identity of a wireless radio of the subsequent access point are different.

9. The method of claim 1 ,
further comprising the centralized backend security server indexing the telemetry information according to a key value that indicates a corresponding wireless network, the key value including at least one of a SERVICE SET IDENTIFIER and a password.

10. The method of claim 1 , wherein the initial information is obtained at least in part from a web configuration homepage for configuring the initial access point.

11. A system for network security, the system comprising: an obtaining module, stored in memory of a computing device, that:
obtains initial information that at least partially identifies an initial access point for connecting to a network, the initial information comprising an initial identifier;
after obtaining the initial information, obtains from a centralized backend security server, subsequent information that comprises a subsequent manufacturer identifier and that at least partially identifies a subsequent access point for connecting to the same network, the subsequent manufacturer identifier having been initially obtained by a different client device than the computing device and uploaded by the different client device to the centralized backend security server of a software security product vendor for aggregating telemetry information from different client devices in a field of client devices corresponding to separate purchases of a security program;
a comparison module, stored in the memory of the computing device, that compares, as part of the security program, the initial manufacturer identifier that was obtained by the computing device and the subsequent manufacturer identifier that was initially obtained by the different client device than the computing device in an attempt to detect whether the initial access point and the subsequent access point are the same;
a detection module, stored in the memory of the computing device, that detects, based on the comparison, an indication that the initial access point and the subsequent access point are different;
a performance module, stored in the memory of the computing device, that performs, as part of the security program in response to detecting the indication that the initial access point and the subsequent access point are different, a remedial action to protect a user, the remedial action comprising:
warning the user by transmitting a message that indicates to the user that there is a potential for an intruder to snoop network traffic when connected to the initial access point; and
preventing a successful attempt by the user to connect to the network through the initial access point; and
at least one physical processor configured to execute the obtaining module, the comparison module, the detection module, and the performance module.

12. The system of claim 11 , wherein:
the network comprises a wireless network; and
the initial access point and the subsequent access point comprise wireless access points.

13. The system of claim 11 , wherein the obtaining module obtains the initial information that at least partially identifies the initial access point for connecting to the network at least in part by interrogating the initial access point.

14. The system of claim 11 , wherein the detection module detects, based on the comparison, the indication that the initial access point and the subsequent access point are different by detecting an indication that an initial media access control address and a subsequent media access control address are different.

Assignees

• Symantec Corp

Inventors

• Shavell Michael
• Boucher Matt
• Jiang Kevin

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04W12/00

  Security arrangements; Authentication; Protecting privacy or anonymity · CPC title