Patent Publication Number: US-11025636-B2

Title: Security of shared credentials in crowdsourced wireless networks

Description:
CROSS REFERENCE TO RELATED APPLICATION 
     This application is a continuation of copending application Ser. No. 15/450,845, filed Mar. 6, 2017, the entire content and disclosure of which are hereby incorporated herein by reference. 
    
    
     BACKGROUND 
     This invention generally relates to crowd sourced wireless networks, and more specifically, to improved security in crowd sourced wireless networks. 
     Crowd sourced networking, in which wireless networks are shared by multiple users, has become common. The shared network may be a public network or a restricted network that is accessible to, for example, customers in a store, or people in a particular location such as a hotel or airport. 
     Individuals who own or administer their own wireless networks, for example in their home or residence, may also share their networks with others. Typically, in order to allow access to such a network, the owner or administrator of the network give a password to a person and that person inputs the password using his or her own computer in order to log onto the network. 
     Systems and procedures have been recently developed that allow people to share their wireless networks, or wireless networks to which they are connected, with other people without requiring these other people to input manually any password to log onto the networks. With this technology, if a particular social media relationship or connection exists between two users, the computer system of a first user may automatically grant to the computer system of the second user access to a wireless network that the first user owns or is connected to. 
     SUMMARY 
     Embodiments of the invention provide a method, system and computer program product for sharing a crowd sourced wireless network, wherein a first user uses a first device to access a specified wireless network, and the first device includes an application to grant automatically access to the specified wireless network to all of a defined group of people. In an embodiment, the method comprises restricting said automatic grant of access to the specified wireless network by, when one person of said group of people requests access to the specified wireless network, a network control obtaining a determined strength of a defined relationship between the first user and said one person, and granting said one person access to the specified wireless network only if the determined strength of the defined relationship meets one or more set criteria. 
     In an embodiment, the first device uploads a series of relationship strength scores to a server; and obtaining the determined strength of a defined relationship between the first user and said one person of the group of people includes the network control receiving said series of relationship strength scores from said server. 
     Embodiments of the invention allow users of devices having automated crowd sourced networking features to use additional information for the purpose of determining the strength of a relationship with a contact, before sharing a wireless network with that contact. 
     In embodiments of the invention, this additional information is used to calculate a relationship score, which is uploaded to cloud service connected to a router or wireless access point via the Internet. The router or access point downloads and caches a table of relationship scores which are used to evaluate requests for network access. 
     Embodiments of the invention determine which of a person&#39;s social media friends should be included in an automated crowd sourced networking technology. 
     Embodiments of the invention allow wireless network administrators, or end users, to set required threshold values to be met in order to give other users automated access to the wireless network. 
     Embodiments of the invention provide advances to ensure that all social network connections are not viewed as equally valid. In embodiments of the invention, when an authentication credential exchange is considered between two users, factors such as personal communication history, depth of shared social network, etc, are referenced. When the richness of this relationship is deemed to be above the required threshold, the authentication is granted. However, when the same examination is performed between two users, where the second user&#39;s social network invitation was accepted by the first user, although that first user did not know the second user, the examination may now determine that the relationship between the users does not meet the required threshold. Thus, the shared authentication credentials will not be provided. 
     Embodiments of the invention provide a means of balancing security and convenience. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
         FIG. 1  illustrates a method and system in accordance with an embodiment of the invention. 
         FIG. 2  shows a relationship strength table that may be used in the method and system of  FIG. 1   
         FIG. 3  depicts a computer network environment that may be used in embodiments of the invention. 
     
    
    
     DETAILED DESCRIPTION 
     This invention relates to improved security in crowd sourced wireless networks. As discussed above, crowd sourced networks, in which wireless networks are shared by multiple users, have become common; and recently, systems and procedures have been developed that allow people to share their wireless networks, or wireless networks to which they are connected, with other people without requiring that these other people manually input any password to access the networks. If a particular relationship or connection exists between two users, the computer system of a first user may automatically grant to the computer system of the second user access to a wireless network that the first user owns, administers, or is connected to. This may be done by automatically passing authentication credentials or an authentication key from the computer system of the first user to the computer system of the second user. 
     This raises security concerns for many users about providing network access too broadly. For instance, two users who may be acquaintances at best, or simply strangers who have connected on social media at worst, can in effect provide network authentication capabilities to each other without knowledge of how this network will be used. The acceptance of a social network connection without personal knowledge of a person&#39;s intent or goodwill, followed by the exchange of a network credential can result in malicious activity being conducted on the network that the first user owns or is connected to. 
       FIG. 1  illustrates a method and system  100  having controlled automated crowd sourced networking in accordance with an embodiment of the invention. Generally,  FIG. 1  shows a user  102 , a user device  104 , a router  106  that controls access to a wireless network  110 , a cloud service  112 , relationship table  114 , and a group  116  of friends or contacts of user  102 .  FIG. 1  also shows a group of communication devices  120  that these friends or contact may use. 
     System  100  allows users of devices having an automated crowd sourced networking feature to use additional information for the purpose of determining the strength of a relationship with a contact, before sharing a wireless network with that contact. 
     In system  100 , this additional information is used to calculate a relationship score, which is uploaded to a cloud service  112  connected to a router  106  or wireless access point via the Internet. The router  106  or access point downloads and caches a table  114  of relationship scores which are used to evaluate requests for network access. 
     Embodiments of the invention enhance service providers&#39; capabilities to store and process additional data points about a user so as to evaluate the strength of relationships between people. This information will be used to determine whether a relationship exceeds the threshold for sharing of WiFi authentication keys. 
     More specifically, at step  1  of  FIG. 1 , social relationship strength scores are uploaded to cloud service  112 , and at step  2 , device  104  connects to Wifi router  106 . At step  3 , router  106  queries cloud service  112  for relationship strength entries; at step  4 , the cloud service  112  sends the table  114  to router  106 ; and the router, at step  5 , adds entries to its cache. At step  6 , friends  116  of user  102  request access to network  110  via an automated crowd source networking feature. The router  106  allows this access only if the entry in the router cache is above the allowed threshold. Router  106  includes or is provided with the processing memory ability needed to perform the processing and data storage described herein. 
     As will be understood by those of ordinary skill in the art, a variety of devices may be used as first user device  104 . For example, this device may be a laptop computer, a notebook computer, a cellular phone, a personal digital assistant, or other suitable mobile communication or entertainment device. For illustrative purposes, the user device  104  is shown as a mobile computing device, although it is understood that the device  104  can be different types of devices; and for example, the first device  104  can also be a non-mobile computing device such as a server, a desktop computer, or a workstation. 
     Second user devices  120  may also comprise or include a wide range of specific devices. For instance, these devices may also include a laptop computer, a notebook computer, a cellular phone, a personal digital assistant, or other suitable mobile communication or entertainment device. Second user devices can include mobile and non-mobile computing devices such as a server, a desktop computer, or a workstation. 
     Wireless network  110  can span and represent a variety of specific types of networks. Satellite communication, cellular communication, Bluetooth, Infrared Data Association standard (IrDA), wireless fidelity (WiFi) and worldwide interoperability for microwave access (Wi MAX) are examples of wireless communications that can be included or used in embodiments of the invention. Further, network  110  can traverse a number of network topologies and distances. For example, network  110  can include direct connection personal area network (PAN), local area network (LAN), metropolitan area network (MAN), wide area network (WAN), or combinations thereof. 
     A wide range of data and algorithms may be used as, or to determine, the relationship strength entries. For example, in embodiments of the invention, the types of data may include:
     1. email message headers;   2. contacts for services other than Facebook, Skype, and outlook.com via a standard API (e.g., Google, Yahoo, Linked In, iCloud);   3. SMS/MMS headers; and   4. device location data (GPS information from smart phones, wearable devices, laptop computers, tablets).   

       FIG. 2  shows a table  200  identifying a multitude of data types  202  and a number of devices, represented at  204 . This table also includes, for each of these devices, scores  206  for these data types and a relationship strength  210  determined from these scores. 
     A wide range of algorithms and procedures may be used to calculate a relationship strength value. 
     For a service provider (e.g., the automatic crowd sourced network feature) to determine whether to grant access, the system evaluates the data described above, as well as other data the crowd sourced network feature has access to, to see if a threshold of interactions is met. In embodiments of the invention, the method may take into account the following metrics:
     1. email message headers;   2. SMS/MMS headers;   3. Shared Facebook connection (existing);   4. Mutual Skype contacts (existing);   5. Mutual outlook.com contacts (existing);   6. Recency of the connection or mutual state of contact (newer relationships may have lower value);   7. Shared location data (frequently being in the same location at the same time may have higher value);   8. Frequency of interaction via Facebook, Skype, email, SMS, other electronic means (more frequent communication and communication over multiple means may have higher value; in embodiments of the invention, communications must be bidirectional to prevent spammers from overcoming the threshold).   

     The system assigns point values to each of these interactions, with the sum of these point values being evaluated as the strength of the relationship. The system then stores this table and caches the table locally on the network router or access point. 
     Embodiments of the invention also provide a method for network administrator or users to set the required threshold value to be met. The system allows the owner of the wireless network to set the minimum required relationship strength threshold value to be met before sharing the network key. Optionally, the system could be configured to allow the end user to set the strength threshold. In the case that both the user and the network administrator have set conflicting relationship strength thresholds, the owner of the network (network administrator) setting would take precedence. 
       FIG. 3  shows components of an exemplary computer network environment  300  that may be used in embodiments of the invention. Not all the illustrated components may be required to practice the invention, and variations in the arrangement and type of the components may be made without departing from the spirit or scope of the invention. As shown, system  300  of  FIG. 3  includes local area networks (“LANs”)/wide area network  306 , wireless network  310 , mobile devices  302 - 304 , client device  305 , and application services  308 - 309 . 
     Generally, mobile devices  302 - 304  may include virtually any portable computing device that is capable of receiving and sending a message over a network, such as networks  306  and wireless network  310 . Such devices include portable devices, such as cellular telephones, smart phones, display pagers, radio frequency (RF) devices, infrared (IR) devices, Personal Digital Assistants (PDAs), handheld computers, laptop computers, wearable computers, tablet computers, integrated devices combining one or more of the preceding devices, and the like. As such, mobile devices  302 - 304  typically range widely in terms of capabilities and features. 
     A web-enabled mobile device may include a browser application that is configured to receive and to send web pages, web-based messages, and the like. The browser application may be configured to receive and display graphics, text, multimedia, and the like, employing virtually any web based language, including a wireless application protocol messages (WAP), and the like. In one embodiment, the browser application is enabled to employ Handheld Device Markup Language (HDML), Wireless Markup Language (WML), WMLScript, JavaScript, Standard Generalized Markup Language (SMGL), HyperText Markup Language (HTML), eXtensible Markup Language (XML), and the like, to display and send a message. 
     Mobile devices  302 - 304  may each receive messages sent from AS  308 - 309 , from one of the other mobile devices  302 - 304 , or even from another computing device. Mobile devices  302 - 304  may also send messages to one of application services  308 - 309 , to other mobile devices, or to client device  305 , or the like. Mobile devices  302 - 304  may also communicate with non-mobile client devices, such as client device  305 , or the like. 
     Wireless network  310  is configured to couple mobile devices  302 - 304  and its components with network  306 . Wireless network  310  may include any of a variety of wireless sub-networks that may further overlay stand-alone ad-hoc networks, and the like, to provide an infrastructure-oriented connection for mobile devices  302 - 304 . Such sub-networks may include mesh networks, Wireless LAN (WLAN) networks, cellular networks, and the like. 
     Network  306  is enabled to employ any form of computer readable media for communicating information from one electronic device to another. Also, network  206  can include the Internet in addition to local area networks (LANs), wide area networks (WANs), direct connections, such as through a universal serial bus (USB) port, other forms of computer-readable media, or any combination thereof. 
     Application services  308 - 309  include virtually any device that may be configured to provide an application service. Such application services or simply applications include, but are not limited to, email applications, search applications, video applications, audio applications, graphic applications, social networking applications, text message applications, or the like. In one embodiment, application services  308 - 309  may operate as a web server. However, application services  308 - 309  are not limited to web servers. 
     Those of ordinary skill in the art will appreciate that the architecture and hardware depicted in  FIG. 3  may vary. 
     The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention. 
     The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire. 
     Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device. 
     Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user&#39;s computer, partly on the user&#39;s computer, as a stand-alone software package, partly on the user&#39;s computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user&#39;s computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention. 
     Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions. 
     These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks. 
     The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks. 
     The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions. 
     The description of the invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or to limit the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the invention. The embodiments were chosen and described in order to explain the principles and applications of the invention, and to enable others of ordinary skill in the art to understand the invention. The invention may be implemented in various embodiments with various modifications as are suited to a particular contemplated use.