Real-time mobile security posture

• US 10,021,137 B2
• Filed: 12/27/2014
• Issued: 07/10/2018
• Est. Priority Date: 12/27/2014
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, LLC
• Inventors: Chahal, Sudip, Tatourian, Igor
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US14/583,687
• Publication Number:
  US 20160191567A1
• Time in Patent Office: 1,291 Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

In an example, a system and method for real-time mobile security posture updates is provided. A mobile device management (MDM) agent may run on the mobile device, and may register with the operating system one or more mobile security posture change events that may affect the mobile security posture. These may include, for example, installation of an MDM agent, uninstallation of a program, connecting to a secured or unsecured network, or similar. When any such event occurs, the OS lodges the event with the MDM agent, which then communicates with an MDM server engine to potentially receive new security instructions. Lodging the event may include providing a joint user-and-device authentication to the MDM server, such as via SAML.

Claims

1. A non-enterprise computing device for accessing enterprise computing resources, comprising:

a network interface;

an operating system; and

logic, including at least a processor and a memory, comprising a mobile device management (MDM) agent operable for providing the non-enterprise computing device conditional access to enterprise resources, comprising;

registering with an MDM server of an enterprise the non-enterprise computing device as a non-enterprise computing device lacking enterprise control of software installation, and receiving a certificate configured to provide access to resources of the enterprise;

receiving from the MDM server instructions regarding a security posture to monitor;

registering a security posture event with the operating system;

entering a sleep mode;

waking after receiving from the operating system a notification of a security posture change event;

notifying the MDM server of the security posture change event;

receiving a security modification instruction from the MDM server; and

enforcing the security modification instruction on the computing apparatus.

2. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the MDM agent is further operable for providing a joint user-and-device authentication token to an identity provider.

3. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the MDM agent is further operable for receiving notification of the security posture change event from the operating system.

4. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the MDM agent is further operable to run as a background process.

5. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the MDM agent is further operable to run as a background process with elevated privileges.

6. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the MDM agent is further operable to run within a trusted execution environment (TEE).

7. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the security posture change event is installation of a program.

8. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the security posture change event is uninstallation of a program.

9. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the security posture change event is encountering a candidate malicious object.

10. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the security posture change event is a change in location.

11. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the security posture change event is connecting to an unsecured network.

12. The non-enterprise computing device for accessing enterprise computing resources of claim 1, wherein the security posture change event is a change in biometric authentication.

13. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for a computing apparatus to provide a mobile device management (MDM) agent operable for providing the non-enterprise computing device conditional access to enterprise resources, comprising:

registering with an MDM server of an enterprise the non-enterprise computing device as a non-enterprise computing device lacking enterprise control of software installation, and receiving a certificate configured to provide access to resources of the enterprise, via a network interface;

receiving from the MDM manager server instructions regarding a security posture to monitor;

registering a security posture event with an operating system;

entering a sleep mode;

waking after receiving from the operating system a notification of a security posture change event;

notifying the MDM server of the security posture change event via the network interface;

receiving a security modification instruction from the MDM server; and

enforcing the security modification instruction on the computing apparatus.

14. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the MDM agent is further operable for providing a joint user-and-device authentication token to an identity provider.

15. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the MDM agent is further operable for receiving notification of the security posture change event from the operating system.

16. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the MDM agent is further operable to run as a background process.

17. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the MDM agent is further operable to run as a background process with elevated privileges.

18. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the MDM agent is further operable to run within a trusted execution environment (TEE).

19. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the security posture change event is installation of a program.

20. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the security posture change event is uninstallation of a program.

21. The one or more tangible, non-transitory computer-readable mediums of claim 13, wherein the security posture change event is encountering a candidate malicious object.

22. A computer-implemented method of providing mobile device management (MDM), comprising:

registering with an MDM server of an enterprise a non-enterprise computing device as a non-enterprise computing device lacking enterprise control of software installation, and receiving a certificate configured to provide access to resources of an enterprise, via a network interface;

receiving from the MDM server instructions regarding a security posture to monitor;

registering a security posture event with the operating system;

entering a sleep mode;

waking after receiving from the operating system a notification of a security posture change event;

notifying the MDM server of the security posture change event via the network interface;

receiving a security modification instruction from the MDM server; and

enforcing the security modification instruction.

23. The method of claim 22, further comprising providing a joint user-and-device authentication token to an identity provider.