Method and system for generating an advisory message for an endpoint device

According to one embodiment of the invention, a method for generating an advisory message for an endpoint device includes determining a threat level for the endpoint device by identifying a connection type between the endpoint device and the wireless network. The method also includes determining a second threat level for the endpoint device by identifying a security policy of the endpoint device. The method further includes generating an advisory message for the endpoint device based on the threat levels. The advisory message indicates vulnerability of the endpoint device.

TECHNICAL FIELD OF THE INVENTION

This invention relates generally to wireless networks, and more particularly, to a method and system for generating an advisory message for an endpoint device.

BACKGROUND OF THE INVENTION

Recently, various wireless network technologies have emerged to enable portable endpoint devices (such as laptops, personal digital assistants, cellular telephones, etc.) to communicate both with each other and with wireless networking environments. However, wireless networks are inherently less secure than wired networks, because wired networks may be at least partially located inside a building that can be protected from unauthorized access. Wireless networks do not have the same physical protection and therefore are more vulnerable to attacks. An attacker may use a number of strategies to exploit this vulnerability to pierce network security, corrupt network communications, infiltrate network participants, or compromise routing of network traffic. Accordingly, it is generally desirable to provide an effective security mechanism in wireless networks.

OVERVIEW OF EXAMPLE EMBODIMENTS

According to one embodiment of the invention, a method for generating an advisory message for an endpoint device includes determining a threat level for the endpoint device by identifying a connection type between the endpoint device and a wireless network. The method also includes determining another threat level for the endpoint device by identifying a security policy of the endpoint device. The method further includes generating an advisory message for the endpoint device based on the threat levels. The advisory message indicates vulnerability of the endpoint device.

Technical advantages of particular embodiments of the present invention include a method and system for generating an advisory message for an endpoint device that alerts a user of the vulnerability of the endpoint device. Thus, a user can take measures to prevent an unauthorized connection from being established.

Another technical advantage of particular embodiments of the present invention includes a method and system for generating an advisory message for an endpoint device that updates the advisory message using a security policy-driven mechanism. Accordingly, changes to the security policy may update the advisory message in approximately real-time, giving a user an updated vulnerability assessment.

DESCRIPTION OF EXAMPLE EMBODIMENTS

FIG. 1illustrates one embodiment of a system10for generating an advisory message for an endpoint device according to the teachings of the present invention. As shown inFIG. 1, system10generally includes a network12, one or more wireless access points14, and one or more endpoint devices16. System10is particularly adapted for alerting a user of endpoint device16of the vulnerability of endpoint device16.

Network12may refer to any interconnecting system capable of transmitting audio, video, signals, data, messages, or any combination of the preceding. Network12may comprise all or a portion of a public switched telephone network (PSTN), a public or private data network, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a local, regional, or global communication or computer network such as the Internet, a wireline or wireless network, an enterprise intranet, other suitable communication link, or any combination of the preceding.

Network12may transmit information in packet flows, in one embodiment. A packet flow includes one or more packets sent from a source to a destination. A packet may comprise a bundle of data organized in a specific way for transmission, and a frame may comprise the payload of one or more packets organized in a specific way for transmission. A packet-based communication protocol such as Internet Protocol (IP) may be used to communicate the packet flows.

A packet flow may be identified in any suitable manner. As an example, a packet flow may be identified by a packet identifier giving the source and destination of the packet flow. A source may be given by an address such as the IP address, port, or both. Similarly, a destination may be given by an address such as the IP address, port, or both.

Network12may utilize protocols and technologies to transmit information. Example protocols and technologies include those described by the Institute of Electrical and Electronics Engineers, Inc. (IEEE) 802.xx standards such as 802.11, 802.16, or WiMAX standards, the International Telecommunications Union (ITU-T) standards, the European Telecommunications Standards Institute (ETSI) standards, Internet Engineering Task Force (IETF) standards, the third generation partnerships project (3GPP) standards, or other standards.

Access point14may be any network point suitable to couple a wireless device, such as endpoint device16, to a network, such as network12. According to one embodiment of the invention, access point14may have a wired connection to network12. According to another embodiment of the invention, access point14may have a wireless connection to network12. According to another embodiment of the invention, access point14may include a receiver or transmitter or both a receiver and a transmitter. As an example, access point14may include an omni-directional antenna operable to communicate with one or more endpoints.

In particular embodiments of the invention, communications between access point14and endpoint device16are communicated according to one or more secure wireless communication protocols or WLAN protocols, such as portions or all of the Wired Equivalent Privacy (WEP) protocol, the Robust Security Network (RSN) associated with the IEEE 802.11i protocol, the IEEE 802.1x protocol, the Advanced Encryption Standard (AES), the Temporal Key Integrity Protocol (TKIP), Extensible Authentication Protocol over LAN (EAPOL) algorithms or protocols (such as EAP-TTLS, PEAP, or CISCO's LEAP or EAP-FAST protocols, for example), WiFi Protected Access (WPA) protocol, WiFi Protected Access Pre-shared key (WPA-PSK) protocol, WiFi Protected Access Version 2 (WPA2) protocol, or WiFi Protected Access Version 2 Pre-shared key (WPA2-PSK) protocol, for example.

Endpoint device16may refer to any suitable device operable to communicate with network12through access point14. In general, a device may include any suitable arrangement of components operable to perform the operations of the device, and may comprise logic. Logic may refer to hardware, software, other logic, or any suitable combination of the preceding. Endpoint device16may execute with any of the well-known MS-DOS, PC-DOS, OS-2, MAC-OS, WINDOWS™, UNIX, or other appropriate operating systems, including future operating systems. Endpoint device16may include, for example, a personal digital assistant, a computer such as a laptop, a cellular telephone, a mobile handset, or any other device operable to communicate with network12through access point14.

In various embodiments of the invention, an attacker18may attempt to gain access to system10. Attacker18may attempt to gain unauthorized access to pierce network security, corrupt network communications, infiltrate network participants, or compromise routing of network traffic. For example, if access point14is not password protected, it may be relatively easy for attacker18to gain access to network12through access point14. As another example, attacker18may attempt to detect, or “sniff,” security information, such as password information, from wireless signals being communicated between endpoint device16and access point14. Attacker18may use these, or other similar methods, in order to gain unauthorized connections to endpoint device16.

According to one embodiment of the invention, a system and method are provided that alert a user of an endpoint device of the vulnerability of the endpoint device. Thus, a user can take measures to prevent an unauthorized connection from being established. This is effected by determining various threat levels at the endpoint device such as a security policy threat level and a connection type threat level and communicating that information to a user. Additional details of example embodiments of the invention are described in greater detail below in conjunction with portions ofFIG. 1,FIG. 2, andFIG. 3.

According to the illustrated embodiment of the invention, endpoint device16includes a processor20, a storage device22, an input device24, a memory device26, a communication interface28, an output device30, and an advisory manager40.

Processor20may refer to any suitable device operable to execute instructions and manipulate data to perform operations for endpoint device16. Processor22may include, for example, any type of central processing unit (CPU).

Storage device22may refer to any suitable device operable for storing data and instructions. Storage device22may include, for example, a magnetic disk, flash memory, or optical disk, or other suitable data storage device.

Input device24may refer to any suitable device operable to input, select, and/or manipulate various data and information. Input device24may include, for example, a keyboard, mouse, graphics tablet, joystick, light pen, microphone, scanner, or other suitable input device.

Memory device26may refer to any suitable device operable to store and facilitate retrieval of data, and may comprise Random Access Memory (RAM), Read Only Memory (ROM), a magnetic drive, a disk drive, a Compact Disk (CD) drive, a Digital Video Disk (DVD) drive, removable media storage, any other suitable data storage medium, or a combination of any of the preceding.

Communication interface28may refer to any suitable device operable to receive input for endpoint device16, send output from endpoint device16, perform suitable processing of the input or output or both, communicate to other devices, or any combination of the preceding. Communication interface28may include appropriate hardware (e.g. modem, network interface card, etc.) and software, including protocol conversion and data processing capabilities, to communicate through a LAN, WAN, or other communication system that allows endpoint device16to communicate to other devices. Communication interface28may include one or more ports, conversion software, or both.

Output device30may refer to any suitable device operable for displaying information to a user. Output device30may include, for example, a video display, a printer, a plotter, or other suitable output device.

Advisory manager40may refer to any suitable logic embodied in computer-readable media, and when executed operable to generate an advisory message that indicates vulnerability of endpoint device16. In the illustrated embodiment of the invention, advisory manager40resides in storage device22. In other embodiments of the invention, advisory manager40may reside in memory device26, or any other suitable device operable to store and facilitate retrieval of data and instructions.

According to one embodiment of the invention, various criteria are considered by advisory manager40in generating an advisory message. The various criteria may include, but are not limited to, whether encryption is being used at endpoint device16and a connection type between endpoint device16and access point14. For example, Table 1 describes such connection types between endpoint device16and access point14, as well as a corresponding threat level that indicates vulnerability of the connection type.

According to another embodiment of the invention, other criteria may also be used such as a security policy enforced at endpoint device16. A security policy may include a variety of states at endpoint device16. For example, one state may be whether internet sharing is allowed at endpoint device16. Internet sharing may include any act of one endpoint device allowing others to connect to the endpoint device using an internet browser. Another state may be whether network file sharing is allowed at endpoint device16. Network file sharing may include any act of making files on one endpoint device accessible to others on a network. Yet another state may be whether dual homing is allowed at endpoint device16. Dual homing may include any act of connecting an endpoint device to a network in which there is a primary connection and a secondary connection. Still another state may be whether ad-hoc connections are allowed at endpoint device16. Ad-hoc connections may include any connection where endpoint devices communicate directly with one another rather than through an access point. For example, Table 2 describes such states, as well as a corresponding security policy based on the variety of states.

According to one embodiment of the invention, each security policy may have a corresponding threat level. Table 3 lists such security policies, as well as a corresponding threat level based on the security policy.

According to another embodiment of the invention, the threat levels of various factors may be used in determining a an advisory message that indicates vulnerability of endpoint device16. The various advisory messages for endpoint device16may include, but are not limited to, “Critical,” “Warning,” and “Low.” For example, if advisory manager40determined a connection threat level of “Medium,” and a security policy threat level of “Medium,” advisory manager40may generate a “Warning” advisory message for endpoint device16. As another example, if advisory manager40determined a connection threat level of “High,” and a security policy threat level of “High,” advisory manager40may generate a “Critical” advisory message for endpoint device16. As another example, if advisory manager40determined a connection threat level of “Low,” and a security policy threat level of “Low,” advisory manager40may generate a “Normal” advisory message for endpoint device16. For example, Table 4 describes such threat levels using the connection and security policy threat levels.

FIG. 2is a simplified diagram200of an example advisory message202for an endpoint device16. Advisory message202reflects a “Critical” level of vulnerability for endpoint device16. Advisory message202may be displayed using, for example, a window in a graphical application, a pop-up window, a dialog box, or any other suitable visual area operable to inform a user of vulnerability so that the user may take measures to secure endpoint device16, and prevent an unauthorized connection from being established. Additionally, the present disclosure contemplates many types of levels to represent vulnerability of an endpoint device16. Various embodiments may include some, all, or none of the enumerated levels.

FIG. 3is a flow diagram illustrating example acts associated with generating an advisory message for an endpoint device. At step302, a connection type of an endpoint device is identified by the advisory message system. In particular embodiments of the invention, the connection type may depend on whether encryption is being used, and the strength of the encryption used at the endpoint device. For example, if encryption is not used at the endpoint device, the connection type may be Open without 802.1x. As another example, if encryption is used at the endpoint device, the connection type may be WPA.

At step304, a connection threat level is determined by the wireless network managing system. In particular embodiments of the invention, the connection threat level indicates vulnerability of the connection type identified in step302. The connection threat level may range from “High,” to “Medium,” to “Low,” or other similar measurements. The connection threat level is determined by the security of the connection type. For example, if the connection type is Open without 802.1x, the connection threat level may be “High.” As another example, if the connection type is WPA, the connection threat level may be “Low.”

At step306, a security policy of the endpoint device is identified by the advisory message system. In particular embodiments of the invention, the security policy may include a variety of states at an endpoint device. The settings of the various states may indicate a level of protection of the endpoint device. For example, one state may be whether ad-hoc connections are allowed at the endpoint device. If ad-hoc connections are allowed at the endpoint device, the security policy may be a “Low Security” policy, indicating that the endpoint device is not well-protected. Alternatively, if ad-hoc connections are prevented at the endpoint device, the security policy may be a “High Security” policy, indicating that the endpoint device is highly protected.

At step308, a security policy threat level is determined by the wireless network managing system. In particular embodiments of the invention, the security policy threat level indicates vulnerability of the security policy identified in step306. The security policy threat level may range from “High,” to “Medium,” to “Low,” or other similar measurements. For example, if the security policy is a “Low Security” policy, the security policy threat level may be “High.” As another example, if the security policy is a “High Security” policy, the security policy threat level may be “Low.”

At step310, an advisory message is generated by the advisory message system. In particular embodiments of the invention, the advisory message is generated based on the connection threat level and the security policy threat level. The advisory message indicates vulnerability of the endpoint device. For example, if the advisory message is “Critical,” the endpoint device may be highly vulnerable to attacks. As another example, if the advisory message is “Normal,” the endpoint device may be operating at a standard level of vulnerability.

In particular embodiments of the invention, the advisory message may be displayed to a user of the endpoint device so the user can take measures to prevent an unauthorized connection from being established. For example, an advisory message of “Critical” may alert a user that the endpoint device is highly vulnerable to attacks. Thus, the user may change the either the security policy or the connection type of the endpoint device to provide a higher level of protection and avoid attacks.

Although the present invention has been described in several embodiments, a myriad of changes, variations, alterations, transformations, and modifications may be suggested to one skilled in the art, and it is intended that the present invention encompass such changes, variations, alterations, transformations, and modifications as falling within the spirit and scope of the appended claims.