Enterprise-wide security system for computer devices

• US 20070186275A1
• Filed: 05/26/2006
• Published: 08/09/2007
• Est. Priority Date: 08/27/2002
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: Digital Trust Incorporated
• Inventors: Shahbazi, Majid
• Granted Patent: US 7,865,938 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A system and method for securing data in mobile devices (104) includes a computing mode (102) and a plurality of mobile devices (104). A node security program (202) executed in the computing node (102) interfaces with a device security program (204) executed at a mobile device (104). The computing node (102) is responsible for managing the security based on a node security profile (208) interpreted by a node security program (202) executed in the computing node (102). A device discovery method and arrangement (106) also detects and locates various information (120) about the mobile devices (104) based on a scan profile (206).

Claims

1. A method for securing a computer system that includes one or more mobile devices and one or more computing nodes, comprising:

executing a node security program in one of the computing nodes to implement a node security profile;

determining at least one security parameter from the implementation of the node security profile;

transferring a device security profile from the computing node to at least one of the mobile devices, the device security profile being based on the at least one security parameter;

executing a device security program in the at least one mobile device to implement the device security profile; and

managing at least one security process between the computing node and the at least one mobile device in accordance with the device security profile.

2. The method of claim 1, wherein the at least one security process comprises a step of securing at least one of a storage area, data, file, program, process and application in at least one of the computing nodes, the mobile devices, and a resource device.

3. The method of claim 2, wherein the step of securing comprises at least one of authorizing, denying, preventing, disabling, locking and password protecting at least one of a data synchronization, data transfer, data query, data collection, network access, program execution, data manipulation, process initialization, execution and termination.

4. The method of claim 1, wherein the node security profile comprises at least one of a text, .ini and binary, XML format.

5. The method of claim 1, wherein at least one of the security parameters comprises an attribute relating to at least one of a data, file, security profile, application, process, communication and program.

6. The method of claim 5, wherein the attribute is expressed in terms of at least one of a size and type.

7. The method of claim 1, wherein at least one of the security parameters comprises at least one of a temporal or a position attribute.

8. The method of claim 7, wherein the temporal attribute is expressed in terms of at least one of a date, minute, hour, week, month and a year.

9. The method of claim 7, wherein the position attribute is expressed in terms of a position determined by at least one of a positioning technique, a zip code, an address, a region, and a location.

10. The method of claim 1, wherein at least one of the security parameters is expressed in terms of at least one of a serial number, a model number, and a software license number.

11. The method of claim 1, wherein at least one of the security parameters is expressed in terms of at least one of a mobile device type, a computing node type, a connection type, resource type and a network type.

12. The method of claim 11, wherein the network type comprises at least one of a wired and a wireless network type.

13. The method of claim 11, wherein the connection type includes at least one of a direct connection and an off-line connection between the computing node and the one or more mobile devices.

14. The method of claim 1, wherein at least one of the security parameters is expressed in terms of at least one of a physical address, a network resource ID, an IP address, a domain name, a client station ID, a mobile device ID or a server ID.

15. The method of claim 1, wherein at least one of the security parameters relates to handling at least one of a guest and unknown device.

16. The method of claim 1, wherein at least one of the security parameters relates to managing a VPN.

17. The method of claim 1, wherein the step of transferring the device security profile requires at least one of a direct link and off-line link with the at least one mobile device.

18. The method of claim 1, further comprising at least one of locking and denying access to an unauthorized mobile device attempting to access the system.

19. The method of claim 1, further comprising a step of locking an authorized mobile device attempting to access the network.

20. The method of claim 19, wherein the locking step comprises transmitting security software to the station.

21. The method of claim 1, further including discovering at least one of the mobile devices and one or more resource devices.

22. The method of claim 21, wherein at least one of the mobile devices and resource devices are discovered remotely by running a discovery program at a central station.

23. The method of claim 21, wherein at least one of the mobile devices and resource devices are discovered locally by running a discovery program at at least one of the computing nodes.

24. The method of claim 21, wherein the discovering includes detecting at least one of a device type, connection profile, or location of at least one of the mobile devices and resource devices.

25. The method of claim 21, wherein at least one of the mobile devices and resource devices are detected based on at least one of a registry resource, a file resource, a process resource, a network management parameter, a data format, a packet format, a synchronization log entry, a directory structure, or a database entry.