Security policy enforcement for mobile devices based on device state

• US 10,200,412 B2
• Filed: 06/05/2017
• Issued: 02/05/2019
• Est. Priority Date: 07/12/2013
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Jacobsen, Michael Soren, Menon, Joby, Wang, Song
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US15/614,505
• Publication Number:
  US 20170353500A1
• Time in Patent Office: 610 Days
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Techniques for network-based security for mobile devices based on device state are disclosed. In some embodiments, network-based security for mobile devices based on device state includes receiving a Host Information Profile (HIP) report for a mobile device from a mobile device management (MDM) service at the security device, in which the HIP report includes device state information for the mobile device; applying a policy based on the HIP report for the mobile device and the device state; and performing access control at the security device based on the policy based on the HIP report for the mobile device.

Claims

1. A system, comprising:

a processor configured to;

receive a Host Information Profile (HIP) report for a mobile device from a mobile device management (MDM) service at a security device, wherein the HIP report includes device state information for the mobile device;

apply a policy based on the HIP report for the mobile device, comprising to;

determine whether the HIP report matches one of a plurality of policy reports, the one policy report including disk encryption not being enabled on the mobile device; and

in response to a determination that the HIP report matches the one policy report, remove a required certificate for accessing an enterprise resource; and

perform access control at the security device based on the policy based on the HIP report for the mobile device, comprising to;

determine whether the required certificate for accessing the enterprise resource has been removed; and

in response to a determination that the required certificate for accessing the enterprise resource has been removed, deny the mobile device access to the enterprise resource; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the security device includes a firewall.

3. The system recited in claim 1, wherein the security device comprises an access gateway.

4. The system recited in claim 1, wherein the HIP report for the mobile device includes one or more of the following device state information:

a type of the mobile device, software installed on the mobile device, and configuration information of the mobile device.

5. The system recited in claim 1, wherein performing access control at the security device based on the policy based on the HIP report for the mobile device includes allowing restricted access to an enterprise network.

6. A method, comprising:

receiving a Host Information Profile (HIP) report for a mobile device from a mobile device management (MDM) service at a security device, wherein the HIP report includes device state information for the mobile device;

applying a policy based on the HIP report for the mobile device, comprising;

determining whether the HIP report matches one of a plurality of policy reports, the one policy report including disk encryption not being enabled on the mobile device; and

in response to a determination that the HIP report matches the one policy report, removing a required certificate for accessing an enterprise resource;

and

performing access control at the security device based on the policy based on the HIP report for the mobile device, comprising;

determining whether the required certificate for accessing the enterprise resource has been removed; and

in response to a determination that the required certificate for accessing the enterprise resource has been removed, denying the mobile device access to the enterprise resource.

7. The method recited in claim 6, wherein the security device includes a firewall.

8. The method recited in claim 6, wherein the security device comprises an access gateway.

9. The method recited in claim 6, wherein the HIP report for the mobile device includes one or more of the following device state information:

a type of the mobile device, software installed on the mobile device, and configuration information of the mobile device.

10. The method recited in claim 6, wherein performing access control at the security device based on the policy based on the HIP report for the mobile device includes allowing restricted access to an enterprise network.

11. A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

receiving a Host Information Profile (HIP) report for a mobile device from a mobile device management (MDM) service at a security device, wherein the HIP report includes device state information for the mobile device;

applying a policy based on the HIP report for the mobile device, comprising;

determining whether the HIP report matches one of a plurality of policy reports, the one policy report including disk encryption not being enabled on the mobile device; and

in response to a determination that the HIP report matches the one policy report, removing a required certificate for accessing an enterprise resource;

and

performing access control at the security device based on the policy based on the HIP report for the mobile device, comprising;

determining whether the required certificate for accessing the enterprise resource has been removed; and

in response to a determination that the required certificate for accessing the enterprise resource has been removed, denying the mobile device access to the enterprise resource.

12. The computer program product recited in claim 11, wherein the security device includes a firewall.

13. The computer program product recited in claim 11, wherein the security device comprises an access gateway.

14. The computer program product recited in claim 11, wherein the HIP report for the mobile device includes one or more of the following device state information:

a type of the mobile device, software installed on the mobile device, and configuration information of the mobile device.