Granted Patent B1

US 9,843,934 · App. 14/968,939 · Granted Dec 12, 2017

Abstract

Claims (71)

1. A computer-implemented method for detecting public networks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

calculating, based on packet information collected from a set of client devices, a count of unique client devices communicating with a local area wireless network over a period of time;

determining that the count of unique client devices exceeds a predefined security threshold number of unique client devices;

estimating that the local area wireless network corresponds to a public wireless network based on:

determining that the count of unique client devices exceeds the predefined security threshold number;

fingerprinting an access point wireless network frame to identify at least one of a manufacturer and a configuration setting for a corresponding access point; and

determining that the at least one of the manufacturer and the configuration setting is associated with public wireless network installations;

receiving a request for information indicating whether the local area wireless network corresponds to a public wireless network; and

transmitting, in response to the request, a network packet indicating that the local area wireless network has been flagged as the public wireless network, wherein:

a security server collects the packet information from the set of client devices for the local area wireless network; and

the security server stores the packet information within a centralized security vendor database that stores parallel packet information for different local area wireless networks across different geographic areas.

2. The method of claim 1 , wherein:

estimating that the local area wireless network corresponds to the public wireless network is based on a security profile comprising criteria corresponding to the predefined security threshold number; and

the criteria distinguish between:

a number of unique client devices indicating a private wireless network; and

a number of unique client devices indicating a public wireless network.

3. The method of claim 1 , wherein the public wireless network comprises one of:

an open wireless network that lacks a user password to establish a network connection; and

a password protected wireless network for an establishment that provides public guests free access to a corresponding user password.

4. The method of claim 3 , wherein the password protected wireless network is configured according to one of:

the WI-FI PROTECTED ACCESS protocol; and

the WI-FI PROTECTED ACCESS II protocol.

5. The method of claim 1 , wherein the packet information collected from the set of client devices comprises at least one of:

information indicating a geographic location; and

a service set identifier.

6. The method of claim 1 , wherein determining that the count of unique client devices exceeds the predefined security threshold number of unique client devices comprises factoring a length of the period of time into the determining.

7. The method of claim 1 , wherein estimating that the local area wireless network corresponds to the public wireless network is further based on detecting a presence of a captive portal when first connecting to the local area wireless network.

8. The method of claim 1 , wherein the packet information collected from the set of client devices comprises at least one media access control address for an access point for a service set identifier.

9. The method of claim 1 , further comprising notifying, by a client device that receives the network packet, a user that the local area wireless network has been flagged as the public wireless network.

10. The method of claim 1 , wherein the packet information collected from the set of client devices comprises at least one media access control address for a client device communicating with an access point.

11. A system for detecting public networks, the system comprising:

a calculation module, stored in memory, that calculates, based on packet information collected from a set of client devices, a count of unique client devices communicating with a local area wireless network over a period of time;

a determination module, stored in memory, that determines that the count of unique client devices exceeds a predefined security threshold number of unique client devices;

an estimation module, stored in memory, that estimates that the local area wireless network corresponds to a public wireless network based on:

determining that the count of unique client devices exceeds the predefined security threshold number;

fingerprinting an access point wireless network frame to identify at least one of a manufacturer and a configuration setting for a corresponding access point; and

determining that the at least one of the manufacturer and the configuration setting is associated with public wireless network installations;

a reception module, stored in memory, that receives a request for information indicating whether the local area wireless network corresponds to a public wireless network;

a transmission module, stored in memory, that transmits, in response to the request, a network packet indicating that the local area wireless network has been flagged as the public wireless network; and

at least one physical processor configured to execute the calculation module, the determination module, the estimation module, the reception module, and the transmission module, wherein:

a security server collects the packet information from the set of client devices for the local area wireless network; and

the security server stores the packet information within a centralized security vendor database that stores parallel packet information for different local area wireless networks across different geographic areas.

12. The system of claim 11 , wherein:

the estimation module estimates that the local area wireless network corresponds to the public wireless network based on a security profile comprising criteria corresponding to the predefined security threshold number; and

the criteria distinguish between:

a number of unique client devices indicating a private wireless network; and

a number of unique client devices indicating a public wireless network.

13. The system of claim 11 , wherein the public wireless network comprises one of:

an open wireless network that lacks a user password to establish a network connection; and

a password protected wireless network for an establishment that provides public guests free access to a corresponding user password.

14. The system of claim 13 , wherein the password protected wireless network is configured according to one of:

the WI-FI PROTECTED ACCESS protocol; and

the WI-FI PROTECTED ACCESS II protocol.

15. The system of claim 11 , wherein the packet information collected from the set of client devices comprises at least one of:

information indicating a geographic location; and

a service set identifier.

16. The system of claim 11 , wherein the determination module determines that the count of unique client devices exceeds the predefined security threshold number of unique client devices by factoring a length of the period of time into the determining.

17. The system of claim 11 , wherein the estimation module estimates that the local area wireless network corresponds to the public wireless network based on detecting a presence of a captive portal when first connecting to the local area wireless network.

18. The system of claim 11 , wherein the packet information collected from the set of client devices comprises at least one media access control address for an access point for a service set identifier.

19. The system of claim 11 , wherein the transmission module notifies a user that the local area wireless network has been flagged as the public wireless network.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

calculate, based on packet information collected from a set of client devices, a count of unique client devices communicating with a local area wireless network over a period of time;

determine that the count of unique client devices exceeds a predefined security threshold number of unique client devices;

estimate that the local area wireless network corresponds to a public wireless network based on:

determining that the count of unique client devices exceeds the predefined security threshold number;

fingerprinting an access point wireless network frame to identify at least one of a manufacturer and a configuration setting for a corresponding access point; and

determining that the at least one of the manufacturer and the configuration setting is associated with public wireless network installations;

receive a request for information indicating whether the local area wireless network corresponds to a public wireless network; and

transmit, in response to the request, a network packet indicating that the local area wireless network has been flagged as the public wireless network, wherein:

a security server collects the packet information from the set of client devices for the local area wireless network; and

the security server stores the packet information within a centralized security vendor database that stores parallel packet information for different local area wireless networks across different geographic areas.

Assignments (6)