Mobile application identification and control through WiFi access points
View Patent ↗A network access point secures a WiFi network, and acts as a picocell, by identifying applications running on computer-based devices, such as mobile phones, tablet computers, and the like, that seek to access the Internet (or another network) via the access point and applying network access policies to data communications by those applications according to application, location, context, device and/or user characteristics.
1. A method of securing a WiFi computer network communicatively coupled to a second computer network via a WiFi network access point, the WiFi network access point managing access of one or more of a wireless device, a user of the wireless device and an application executing on the wireless device to the second computer network, the method comprising:
identifying by the WiFi network access point one or more of (i) the application, (ii) the wireless device, (iii) a context within which the WiFi network access point is deployed, and (iv) the user;
enforcing, at a WiFi network access point, network access policies, said network access policies dependent upon one or more of (i) an identity of the application, (ii) an identity of the wireless device, (iii) the context within which the WiFi network access point is deployed, and (iv) an identity of the user, as identified by the WiFi network access point;
in response to the WiFi network access point recognizing the application executing on the wireless device as potentially malicious, sending an alert, by the WiFi network access point, to the wireless device so as to alert the user of the potentially malicious application; and
preventing, by the WiFi network access point, out-of-band data communications from within a network coverage zone of the WiFi network access point from bypassing policy enforcements by the WiFi network access point, wherein the out-of-band data communications comprise data communications through a channel other than a WiFi communication channel for which the WiFi network access point provides policy enforcement.
2. The method of claim 1 , wherein the network access policies enforced by the WiFi network access point are dependent on a location of the WiFi network access point.
3. The method of claim 1 , further comprising reporting, by the WiFi network access point to a server communicatively coupled thereto, one or more of identifications of applications seeking to access the second computer network via the WiFi network access point, signatures of applications seeking to access the second computer network via the WiFi network access point, and behaviors of applications seeking to access the second computer network via the WiFi network access point.
4. The method of claim 1 , further comprising receiving, by the WiFi network access point from a server communicatively coupled thereto, application signatures for use in connection with policy enforcement decisions regarding applications seeking to access the second computer network via the WiFi network access point.
5. The method of claim 1 , wherein preventing the out-of-band data communications from bypassing policy enforcements comprises subjecting the out-of-band data communications to said policy enforcements.
6. A system, comprising an analytics engine communicatively coupled to a plurality of network access points, each respective network access point configured (i) to enforce policies on communications traversing the respective network access point, (ii) to provide information to the analytics engine concerning applications running on wireless devices associated with said communications and behaviors of said applications, (iii) to receive policy updates from said analytics engine, said policy updates being informed by said information concerning the applications and the behaviors of said applications, (iv) send an alert to at least one of the wireless devices so as to alert a user of a potentially malicious application executing on the at least one wireless device; and (v) prevent out-of-band data communications from within a network coverage zone of the network access point from bypassing policy enforcements by the network access point, wherein the out-of-band data communications comprise data communications through a channel other than a WiFi communication channel for which the network access point provides policy enforcement.
7. The system of claim 6 , wherein each respective network access point is further configured to enforce policies according to said communications according to one or more of application identity, knowledge of the application identity and origin of an application publisher, security rating of the application publisher, application category, application popularity, known released versions or variants of an application, past histories of known compromises and rates of compromise of an application, application attributes, location of the respective network access point, context within which the respective network access point is accessed by an associated device, identity or kind of device accessing the respective network access point, and characteristics of a user of a device accessing the respective network access point.
8. The system of claim 6 , wherein each respective network access point is configured to pull policy updates from said analytics engine.
9. The system of claim 6 , wherein each respective network access point is configured to receive policy updates pushed from said analytics engine.
10. The method of claim 1 , wherein sending an alert comprises sending an alert through an in-band communication to the wireless device.
11. The method of claim 1 , wherein sending an alert comprises sending an alert through an out-of-band communication to the wireless device.
12. The method of claim 1 , wherein sending an alert comprises sending a pop up message for display on a web browser of the wireless device.
13. The method of claim 1 , wherein sending an alert comprises sending a text to the wireless device.