Mobile risk assessment

Patent metadata

Field	Value
Publication number	US-2016112450-A1
Application number	US-201514827829-A
Country	US
Kind code	A1
Filing date	Aug 17, 2015
Priority date	Oct 17, 2011
Publication date	Apr 21, 2016
Grant date	—

Abstract

A query is received from a particular endpoint device identifying a particular wireless access point encountered by the particular endpoint device. Pre-existing risk assessment data is identified for the identified particular wireless access point and query result data is sent to the particular endpoint device characterizing pre-assessed risk associated with the particular wireless access point. In some instances, the query result data is generated based on the pre-existing risk assessment data. In some instances, pre-existing risk assessment data can be the result of an earlier risk assessment carried-out at least in part by an endpoint device interfacing with and testing the particular wireless access point.

First claim

What is claimed is:

1 . A method comprising:
receiving a query from a particular endpoint device identifying a particular wireless access point encountered by the particular endpoint device; identifying pre-existing risk assessment data for the identified particular wireless access point; and sending query result data to the particular endpoint device characterizing pre-assessed risk associated with the particular wireless access point.

2 . The method of claim 1 , further comprising participating in a risk assessment of the particular wireless access point with the particular endpoint device.

3 . The method of claim 2 , further comprising receiving risk assessment feedback data from the endpoint device in connection with at least one assessment task performed by the particular endpoint device.

4 . The method of claim 3 , further comprising using the received risk assessment feedback data to determine a risk profile for the particular wireless access point.

5 . The method of claim 4 , wherein the pre-assessed risk associated with the particular wireless access point is considered in the determination of the risk profile.

6 . The method of claim 3 , wherein the feedback data includes at least one of a service set identifier (SSID), data describing encryption used by the wireless access point, splash page information, and wireless access point password information.

7 . The method of claim 2 , wherein the risk assessment includes:
the particular endpoint device attempting to communicate with a trusted endpoint over the particular wireless access point; and monitoring the attempted communication with the trusted endpoint over the particular wireless access point to assess risk associated with the particular wireless access.

8 . The method of claim 7 , wherein attempting to communicate with the trusted endpoint includes attempting to establish a secured connection between the particular endpoint device and the trusted endpoint, and establishing the secured connection includes receiving expected trust verification data from the trusted endpoint;
wherein receipt of data other than the expected trust verification data is presumed to indicate that the particular wireless access point is untrustworthy suggesting higher risk associated with the particular wireless access point.

9 . The method of claim 8 , wherein participating in the risk assessment of the particular wireless access point includes facilitating communication of the expected trust verification data to the particular endpoint device in advance of the particular endpoint device attempting to communicate with the trusted endpoint over the particular wireless access point.

10 . The method of claim 7 , wherein participating in the risk assessment of the particular wireless access point includes identifying, to the particular endpoint device, the trusted endpoint device from a plurality of available trusted endpoint devices in advance of the particular endpoint device attempting to communicate with the trusted endpoint over the particular wireless access point.

11 . The method of claim 1 , wherein pre-existing risk assessment data for the identified particular wireless access point was generated in connection with at least one previous encounter with the particular wireless access point by an endpoint device.

12 . The method of claim 11 , wherein the previous encounter with the particular wireless access point was made by an endpoint device other than the particular endpoint device.

13 . The method of claim 1 , wherein the pre-existing risk assessment data for the identified particular wireless access point is identified from risk assessment records including pre-existing risk assessment data for a plurality of wireless access points identified by wireless-enabled endpoint devices.

14 . The method of claim 1 , wherein the query includes geo-positional data indicating a location of at least one of the particular endpoint device and the particular wireless access point.

15 . The method of claim 14 , further comprising generating the query result data based at least in part on the pre-existing risk assessment data for the identified particular wireless access point and location identified in the geo-positional data.

16 . The method of claim 1 , further comprising calculating a risk profile for the particular endpoint device based on a set of device attributes including risk associated with wireless access points accessed by the particular endpoint device.

17 . The method of claim 1 , further comprising causing a graphical indicator of risk associated with the particular wireless access point to be presented at the particular endpoint device.

18 . The method of claim 1 , wherein the query is sent over a secure connection other than a wireless network associated with the particular wireless access point.

19 . The method of claim 18 , wherein the secure connection is implemented over at least one of a wireless mobile broadband connection and a VLAN tunnel.

20 . Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:
receiving a query from a particular endpoint device identifying a particular wireless access point encountered by the particular endpoint device; identifying pre-existing risk assessment data for the identified particular wireless access point; and sending query result data to the particular endpoint device characterizing pre-assessed risk associated with the particular wireless access point.

21 . A system comprising:
at least one processor device; at least one memory element; and a wireless access point risk assessor, adapted when executed by the at least one processor device to:
receive a query from a particular endpoint device identifying a particular wireless access point encountered by the particular endpoint device;
identify pre-existing risk assessment data for the identified particular wireless access point; and
send query result data to the particular endpoint device characterizing pre-assessed risk associated with the particular wireless access point.

22 . The system of claim 21 , further comprising a device risk assessment tool adapted to calculate a risk profile for the particular endpoint device based on a set of device attributes including risk associated with wireless access points accessed by the particular endpoint device.

Assignees

• Mcafee Inc

Inventors

• Basavapatna Prasanna Ganapathi
• Gaddala Satish Kumar
• Schrecker Sven
• Goldschlag David Moshe

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04W4/029

  Location-based management or tracking services · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title