User interface for security protection and remote management of network endpoints

• US 10,375,572 B2
• Filed: 12/11/2015
• Issued: 08/06/2019
• Est. Priority Date: 12/11/2014
• Status: Active Grant

• Current Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Original Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Inventors: Achim, Alexandru I., Padina, Mirela L., Miron, Monica M., Cebere, Bogdan C., Stan, Cosmin C., Albisteanu, Catalina, Berte, Dan, Dumitrache, Bogdan, Mircescu, Daniel A., Novac, Alex
• Primary Examiner(s): Lagor, Alexander
• Assistant Examiner(s): Ahsan, Syed M
• Application Number:
  US14/966,315
• Publication Number:
  US 20160173447A1
• Time in Patent Office: 1,334 Days
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 12/2834 Switching of information between an external network and a home network access arrangements H04L12/2856
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0809 Plug-and-play configuration
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5061 Pools of addresses
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/088 : using filters or firewalls
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 76/12 : Setup of transport tunnels
• CPC Class Codes: H04W 76/32 : Release of transport tunnels
• CPC Class Codes: H04W 88/12 : Access point controller devices
• CPC Class Codes: H04W 88/16 : Gateway arrangements

Abstract

In some embodiments, a network regulator device protects a local network of client systems (e.g. Internet-of-things devices such as smartphones, home appliances, wearables, etc.) against computer security threats. Various aspects of the operation of the network regulator may be managed remotely via a graphical user interface (GUI) executing on an administration device, such as a mobile phone. The GUI is further configured to display a security notification to a user of the administration device, the security notification indicating the occurrence of a security event caused by an action of a protected client system.

Claims

1. A computing system comprising a hardware processor and a memory, the memory storing instructions which, when executed by the hardware processor, cause the computing system to:

receive data from a remote server, the data selected by the server for transmission to the computing system according to a subscription associated with a network regulator protecting a plurality of client systems against computer security threats, wherein the plurality of client systems are connected to the network regulator over a local network; and

perform a display of a graphical user interface (GUI) of a device administration application according to the data, the GUI configured to;

generate at least one device management view enabling a user of the computing system to remotely configure a client system of the plurality of client systems by selecting a device group from a predetermined plurality of device groups to indicate a membership of the client system in the selected device group, wherein members of each device group have group-specific values of configuration parameters; and

generate at least one security notification view displaying an indicator of a computer security event caused by an action of the client system,

wherein the network regulator is configured, in response to connecting to a router providing a service of supplying local network addresses to the plurality of client systems, to automatically take over the service of supplying local network addresses from the router.

2. The computing system of claim 1, wherein the at least one device management view displays an interactive element enabling a user to select an entry from an address book of the computing system to designate an owner of the client system.

3. The computing system of claim 1, wherein the computer security event comprises detecting malicious software executing on the client system.

4. The computing system of claim 1, wherein the computer security event comprises detecting an attempt by the client system to access a resource located outside the local network, wherein accessing the resource constitutes a computer security threat to the client system.

5. The computing system of claim 1, wherein the indicator of the computer security event comprises an indicator of a category of computer security threats indicated by the computer security event, and further comprises a text definition of the category.

6. The computing system of claim 1, wherein the computing system comprises a mobile telephone.

14. The computing system of claim 1, wherein the predetermined plurality of device groups comprises a family group and a guest group.

15. The computing system of claim 14, wherein the device administration application is further configured to:

in response to the user selecting the family group, allow the user to configure a set of device management parameters for the client system; and

in response to the user selecting the guest group, not allow the user to configure the set of device management parameters.

16. The computing system of claim 15, wherein the set of device management parameters includes an owner name and an owner icon indicative of an owner of the client system.

17. The computing system of claim 1, wherein the at least one device management view is further configured to display a device icon representing the client system, an owner icon representing an owner of the client system, an indicator of the selected device group of the client system, and an indicator of a current security status of the client system.

18. The computing system of claim 17, wherein the at least one device management view is further configured to display an item selected from a group of items consisting of an indicator of a network connection speed of the client system, an indicator of an amount of storage space currently available on a storage device of the client system, and an indicator of a quality of a password set for the client system.

19. The computing system of claim 17, wherein the at least one security notification view is configured to display the device icon and the owner icon, and wherein:

the at least one device management view is configured to visually emphasize the device icon with respect to the owner icon; and

the at least one security notification view is configured to visually emphasize the owner icon with respect to the device icon.

20. The computing system of claim 1, wherein the at least one device management view displays an interactive element enabling a user to select an image from a plurality of images stored on a storage device of the computing system, and wherein the GUI is further configured to display a rendition of the selected image to represent an owner of the client system.

21. The computing system of claim 1, wherein the at least one security notification view is configured to display an owner icon indicative of an owner of the client system, and wherein the device administration application is configured, in response to receiving an input indicating a user interaction with the owner icon, to invoke a telephone interface of the computing system.

22. The computing system of claim 1, wherein automatically taking over the service of supplying local network addresses to the plurality of client systems comprises the network regulator performing the steps of:

detecting an address availability probe transmitted by the client system over the local network, the address availability probe configured to enable the client system to determine whether a first network address is available, wherein the first network address is distinct from a current network address of the network regulator;

in response to detecting the address availability probe, transmitting a reply over the local network, the reply indicating that the first network address is currently in use; and

transmitting a local network address offer to the client system.

7. A method comprising:

employing a network regulator to protect a plurality of client systems against computer security threats, wherein the plurality of client systems are connected to the network regulator over a local network;

employing the network regulator, in response to connecting to a router providing a service of supplying local network addresses to the plurality of client systems, to automatically take over the service of supplying local network addresses from the router;

in response to the network regulator taking over the network service, employing a hardware processor of a computing system to receive data from a remote server, the data selected by the server for transmission to the computing system according to a subscription associated with the network regulator; and

in response to the network regulator taking over the network service, employing the hardware processor to perform a display of a graphical user interface (GUI) of a device administration application according to the data, the GUI configured to;

generate at least one device management view enabling a user of the computing system to remotely configure a client system of the plurality of client systems by selecting a device group from a predetermined plurality of device groups to indicate a membership of the client system in the selected device group, wherein members of each device group have group-specific values of configuration parameters; and

generate at least one security notification view displaying an indicator of a computer security event caused by an action of the client system.

8. The method of claim 7, wherein the at least one device management view displays an interactive element enabling a user to select an entry from an address book of the computing system to designate an owner of the client system.

9. The method of claim 7, wherein the computer security event comprises detecting malicious software executing on the client system.

10. The method of claim 7, wherein the computer security event comprises detecting an attempt by the client system to access a resource located outside the local network, wherein accessing the resource constitutes a computer security threat to the client system.

11. The method of claim 7, wherein the indicator of the computer security event comprises an indicator of a category of computer security threats indicated by the computer security event, and further comprises a text definition of the category.

12. The method of claim 7, wherein the computing system comprises a mobile telephone.

13. A non-transitory computer-readable medium storing instructions which, when executed by a hardware processor of a computing system, cause the computing system to:

receive data from a remote server, the data selected by the server for transmission to the computing system according to a subscription associated with a network regulator protecting a plurality of client systems against computer security threats, wherein the plurality of client systems are connected to the network regulator over a local network; and

perform a display of a graphical user interface (GUI) of a device administration application according to the data, the GUI configured to;

generate at least one device management view enabling a user of the computing system to remotely configure a client system of the plurality of client systems by selecting a device group from a predetermined plurality of device groups to indicate a membership of the client system in the selected device group, wherein members of each device group have group-specific values of configuration parameters; and

generate at least one security notification view displaying an indicator of a computer security event caused by an action of the client system,

wherein the network regulator is configured, in response to connecting to a router providing a service of supplying local network addresses to the plurality of client systems, to automatically take over the service of supplying local network addresses from the router.