Coordinating multiple security components

• US 10,452,447 B2
• Filed: 06/12/2017
• Issued: 10/22/2019
• Est. Priority Date: 06/29/2015
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: LaMantia, Matthew John Joseph, Buck, Brian James, Edwards, Stephen J., Robinson, William Neil
• Primary Examiner(s): Sough, S.
• Assistant Examiner(s): Hoang, Phuong N
• Application Number:
  US15/620,784
• Publication Number:
  US 20170277570A1
• Time in Patent Office: 862 Days
• CPC Class Codes: G06F 9/5038 considering the execution order of a plurality of tasks, e.g. taking priority or time dependency constraints into consideration scheduling strategies G06F9/4881 and subgroups
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A system and method for coordinating security components, including: determining, by an application executing on a client device, a need to perform a sharable functional task; identifying a first security component and a second security component installed on the client device and capable of performing variations of the sharable functional task, where variations of the sharable functional task are functionally overlapping and not identical; identifying a set of characteristics characterizing the first security component and the second security component; selecting the second security component as a primary security component for performing a variation of the sharable functional task based on the set of characteristics; delegating, by one or more processors, performance of the sharable functional task to the primary security component; and instructing the processors to cause functionality associated with the first security component to be at least partially suspended.

Claims

1. A method, implemented by one or more processors, comprising:

determining, by a first security component of a first application executing on a client device, a need to perform a sharable functional task;

identifying a set of software components installed on the client device and capable of performing variations of the sharable functional task, wherein variations of the sharable functional task are functionally overlapping and not identical;

establishing inter-app communication between the first security component and at least a second security component of the set of software components;

identifying a set of characteristics characterizing both the first security component and the second security component;

selecting, using the first security component and the second security component, the second security component as a primary security component for performing a variation of the sharable functional task based on the set of characteristics, wherein the set of characteristics includes at least a version number;

delegating, by the one or more processors, performance of the sharable functional task to the primary security component; and

instructing the one or more processors to cause functionality associated with the first security component to be at least partially suspended.

2. The method of claim 1, wherein the sharable functional task is a security scan of a resource associated with the client device.

3. The method of claim 2, further comprising:

determining, by the primary security component, that a problem condition is present, wherein the problem condition represents at least one selected from a group consisting of a privacy violation, a permissions violation, and a network request involving a malicious entity.

4. The method of claim 2, wherein the resource is at least one selected from a group consisting of a storage device, a file, an application, a remote entity identified by a black list, firmware, a sensor, and a device driver.

5. The method of claim 1, wherein the sharable functional task comprises:

performing safe browsing monitoring for malware based on at least one selected from a group consisting of known white lists, known black lists, and content inspection.

6. The method of claim 1, wherein the sharable functional task is a security scan of a second application, and the method further comprising:

detecting initiation of an installation process for installing the second application;

determining, by the primary security component, that the second application includes malware; and

reporting that the second application includes malware.

7. The method of claim 1, wherein the sharable functional task is a security scan of a resource;

and the method further comprising;

detecting a network request associated with the resource;

using the network request to identify the resource;

determining, by the primary security component, that a problem condition is present; and

denying execution of the network request in response to the problem condition.

8. The method of claim 7, wherein the problem condition represents one selected from a group consisting of an incoming network request, an outgoing network request, a Hypertext Transfer Protocol (HTTP) request, an authentication request, a remote connection request, and a remote resource access request.

9. The method of claim 1, further comprising:

defining a set of predefined events defining actions associated with the client device; and

detecting, by an operating system of the client device, execution of an event of the set of predefined events, wherein determining the need to perform the sharable functional task is based on detection of the event.

10. The method of claim 9, wherein the sharable functional task is one selected from a group consisting of performing device data backup, performing a data loss prevention (DLP) function, locking the client device, wiping data from the client device, and performing a modification of security settings on the client device.

11. The method of claim 9, wherein the event is one selected from a group consisting of detection of a location coordinate based on a tracking function, detection of a location coordinate based on a signal flare function, incorrect passcode entry, airplane mode enablement, device power down, password disablement, a loss protection function, a predefined theft alert, a subscriber identification module (SIM) card removal, and low battery detection.

12. The method of claim 1:

wherein the first security component continues a minimal execution to monitor an execution status of the primary security component; and

further comprising resuming, by the first security component, a regular execution upon detecting that the primary security component is no longer installed or executing.

13. The method of claim 1, further comprising:

receiving result data from the primary security component, wherein the result data includes information about the execution of the second security component as the primary security component; and

providing the result data to the first security component.

14. The method of claim 1, wherein instructing the one or more processors to cause functionality associated with the first security component to be at least partially suspended comprises:

instructing the one or more processors to cause a first set of functionality associated with the first security component to be suspended and to cause a second set of functionality associated with the first security component to continue executing, wherein the second set of functionality associated with the first security component is not duplicative with the sharable functional task.

15. The method of claim 1, wherein:

the set of characteristics comprises an identifier for the first security component and the second security component; and

determining the primary security component further comprises comparing the identifier of the first security component and the second security component with a presence list including priority information associated with each identifier.

16. The method of claim 1, wherein the first security component and the second security component overlap in performing different versions of an authentication function.

17. A system comprising:

a computer processor; and

a manager module executing on the computer processor and configured to cause the computer processor to;

determine a need to perform a sharable functional task;

identify a set of software components installed on the client device and capable of performing variations of the sharable functional task, wherein variations of the sharable functional task are functionally overlapping and not identical;

identify a set of characteristics characterizing both a first security component and a second security component of the set of software components;

select the second security component as a primary security component for performing a variation of the sharable functional task based on the set of characteristics, wherein the set of characteristics includes at least a version number;

delegate, using the computer processor, performance of the sharable functional task to the primary security component; and

instruct the computer processor to cause functionality associated with the first security component to be at least partially suspended.

18. A non-transitory computer-readable storage medium comprising a plurality of instructions configured to execute on at least one computer processor to cause the computer processor to:

determine, using a first security component of a first application, a need to perform a sharable functional task;

identify a set of software components installed on the client device and capable of performing variations of the sharable functional task, wherein variations of the sharable functional task are functionally overlapping and not identical;

establish communication with the first security component and at least a second security component of the set of software components;

identify a set of characteristics characterizing both the first security component and the second security component;

select, using the first security component and the second security component, the second security component as a primary security component for performing a variation of the sharable functional task based on the set of characteristics, wherein the set of characteristics includes at least a version number;

instruct the at least one computer processor to delegate performance of the sharable functional task to the primary security component; and

instruct the at least one computer processor to cause functionality associated with the first security component to be at least partially suspended.

19. A method, implemented by one or more processors, comprising:

determining, using a first security component of a first application, a need to perform a sharable functional task;

identifying a first set of software components capable of performing variations of the sharable functional task, wherein variations of the sharable functional task are functionally overlapping and not identical, and wherein the first set of software components comprises at least a second security component;

identifying a set of characteristics characterizing each software component of the first set of software components;

selecting, using the first security component and the second security component, the second security component as a primary security component for performing a variation of the sharable functional task based on a rank value of each of the first set of software components, wherein the rank values are calculated using the set of characteristics;

delegating, by the one or more processors, performance of the sharable functional task to the primary security component; and

suspending, by the one or more processors, functionality associated with the first security component.

20. The method of claim 19, wherein the sharable functional task is a security scan of a resource associated with the client device, the method further comprising:

determining, by the primary security component, that a problem condition is present, wherein the problem condition represents at least one selected from a group consisting of a privacy violation, a permissions violation, and a network request involving a malicious entity.

21. The method of claim 19, wherein the sharable functional task is a security scan of a second application associated with the client device, the method further comprising:

detecting initiation of an installation process for installing the second application;

determining, by the primary security component, that the second application includes malware; and

reporting that the second application includes malware.

22. The method of claim 19, wherein the sharable functional task is a security scan of a resource, the method further comprising:

detecting a network request associated with the resource;

using the network request to identify the resource;

determining, by the primary security component, that a problem condition is present; and

denying execution of the network request in response to the problem condition.

23. The method of claim 19, further comprising:

defining a set of predefined events defining actions associated with the client device; and

detecting, by an operating system of the client device, execution of an event of the set of predefined events, wherein determining the need to perform the sharable functional task is based on detection of the event.

24. The method of claim 19, further comprising:

ranking the first set of software components according to ranking criteria; and

selecting the primary security component based on a highest ranking, wherein the ranking criteria is used to rank each software component of the first set of software components based on the set of characteristics of each software component.

25. The method of claim 24, further comprising:

upon detecting that the primary security component is no longer installed or executing, instructing the one or more processors to cause functionality associated with a third security component with a second to highest ranking to be re-enabled.

26. The method of claim 19, further comprising:

upon detecting that the primary security component is no longer installed or executing, instructing the one or more processors to cause functionality associated with a third security component to be re-enabled.

27. The method of claim 19, further comprising upon detecting that the primary security component is no longer installed or executing:

identifying a second set of software components, wherein the second set of software components is different from the first set of software components;

identifying a set of characteristics characterizing each software component of the second set of software components;

selecting a third security component from the second set of software components based on the set of characteristics of the second set of software components; and

instructing the one or more processors to cause functionality associated with the third security component to be enabled.

28. The method of claim 19, further comprising:

receiving result data from the primary security component, wherein the result data includes information about the execution of the primary security component; and

providing the result data to at least one software component of the first set of software components.

29. The method of claim 19, wherein an application container includes a subset of the first set of software components, the method further comprising:

resuming, by the one or more processors, execution of the first security component within the application container after completion of the sharable functional task by the primary security component.