TEAM SECURITY FOR PORTABLE INFORMATION DEVICES

• US 20110289308A1
• Filed: 07/09/2010
• Published: 11/24/2011
• Est. Priority Date: 05/18/2010
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Polyakov, Dmitry A., Kashchenko, Nadezhda V., Kalkuhl, Magnus, Tikhomirov, Anton V., Sobko, Andrey V.
• Granted Patent: US 9,552,478 B2
• Time in Patent Office: Days
• US Class Current: 713/100
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A portable information device (PID) having a security module that conducts security-related functionality. At least some of the security-related functionality for the benefit of the PID is provided by a security team of at least one other PID. In one type of arrangement, when configured in a team processing mode, certain ones of the security functions or components operating for the benefit of the PID can be processed on one or more of the security team member devices. In another type of arrangement, the team of devices exchanges security-related information determined as a result of a single team member device'"'"'s processing of one or more security-related tasks.

Claims

1. A portable information device having a dynamically configurable security arrangement, the device comprising:

computer circuitry, including a processor operatively coupled to a data store;

a user interface, including display and user input devices;

wireless communications circuitry; and

a power supply that provides power to the computer circuitry, user interface, and wireless communications circuitry, the power supply including an on-board energy source;

wherein the computer circuitry includes a security arrangement comprising;

a configurable security module adapted to facilitate security services in the portable information device, wherein the configurable security module is configurable to operate in a first mode wherein certain ones of the security services are selectively provided locally on the portable information device by only the security module, and in a second mode wherein at least one other portable computing device provides certain ones of the security services, the at least one other portable computing device being communicatively coupled to the portable information device via an ad hoc wireless network using the wireless communication circuitry;

a computing capacity determining module adapted to re-assess computing capacity availability relating to usage and performance expectations for operation of the information device; and

a security configuration module adapted to reconfigure the operational settings of the security module such that the security module changes from operating in the first mode to operating in the second mode in response to a change in a computing capacity indication from the computing capacity determining module.

2. The portable information device of claim 1, further comprising:

a risk profiling module adapted to re-assess a current set of security risks to which the information device is exposed;

wherein the security configuration module adapted to dynamically reconfigure the operational settings of the security module such that the security module changes from operating in the first mode to operating in the second mode in response to a change in an indication of the current set of security risks from the risk profiling module.

3. A portable information device having a security arrangement adapted for team-assisted security functionality, the device comprising:

computer circuitry, including a processor operatively coupled to a data store;

a user interface, including display and user input devices;

wireless communications circuitry; and

a power supply that provides power to the computer circuitry, user interface, and wireless communications circuitry, the power supply including an on-board energy source;

wherein the computer circuitry includes a security module adapted to provide team-assisted security services in the portable information device, the security module including;

a thick client security portion adapted to locally process security-related tasks on the computer circuitry;

a security team connection module adapted to facilitate local wireless connectivity via the wireless communication circuitry between the portable information device and a security team of at least one other portable information device;

wherein the security module is adapted to conduct an exchange of security-related information between the thick client security portion and the at least one other portable information device via the security team connection module; and

wherein the security module is configured to process, via the thick client security portion, a first security task of the security-related tasks on the computer circuitry to produce a first security task output, and to transmit, via the security team connection module, the first security task output to at least one portable information device of the security team.

4. The portable information device of claim 3, wherein the first security task is processed in response to a remotely-generated request by at least one portable information device of the security team.

5. The portable information device of claim 3, wherein the first security task is processed in response to a locally-determined need by the security module.

6. The portable information device of claim 3, wherein the first security task includes at least one security function selected from the group consisting of:

a scan of a data object for a presence of malware, a security update, an identification of a security risk, and an intrusion detection function.

7. The portable information device of claim 3, further comprising:

a security task coordinator module adapted to determine which of the security-related tasks is to be processed remotely by the security team in lieu of being processed locally on the portable information device using the computer circuitry.

8. The portable information device of claim 3, wherein the security team connection module is adapted to participate in an ad hoc wireless network with the a plurality of other portable information devices of the security team.

9. The portable information device of claim 3, wherein the security module further includes a computing capacity determining module adapted to dynamically re-assess current computing capacity availability relating to usage and performance expectations for operation of the portable information device;

and

wherein the security module is adapted to transmit the first security task output based on the current computing capacity availability re-assessed by the computing capacity determining module.

10. The portable information device of claim 3, wherein the thick client security portion is adapted to respond to a receipt of security-related information from the security team via the security team connection module by increasing a level of security protection being provided for the benefit of the portable information device.

11. In a portable information device (PID) having a dynamically self-configuring security module, a method for distributing security-related processing to a team of at least one other portable information device communicatively coupled to the PID, the method comprising:

maintaining, by the PID, a list of the at least one other portable information device that is authorized to process security-related tasks for the benefit of the PID;

determining, by the PID, whether to distribute a security-related task to be processed by a device of the team that is different than the PID, wherein the determining is based on a characteristic of the task and on current available computing capacity of the PID;

in response to a determination to distribute the security-related task, posting, by the PID, the task to a task list that is accessible to devices of the team; and

receiving, by the PID, an output generated at least one device of the team in response to a completion of processing of the task.

12. The method of claim 11, wherein maintaining the list of the at least one other portable information device that is authorized to process security-related tasks for the benefit of the PID includes maintaining dynamic information relating to each device, the dynamic information including at least one parameter selected from the group consisting of:

risk profile information, current computing capacity information, trust level information, location information, or any combination thereof.

13. The method of claim 11, wherein maintaining the list of the at least one other portable information device that is authorized to process security-related tasks for the benefit of the PID includes identifying devices in the list that are portable infrastructure devices.

14. The method of claim 11, wherein posting the task to the task list includes associating the task with a priority level.

15. The method of claim 11, wherein posting the task to the task list includes associating the task with a computational load.

16. The method of claim 11, wherein determining whether to distribute a security-related task includes determining whether a device of the team satisfies trust requirements corresponding to a sensitivity of the task.

17. The method of claim 11, further comprising:

in response to a task having been posted to the task list for a predetermined time limit, adjusting a priority level associated with the task.

18. The method of claim 11, further comprising:

analyzing, by the PID, whether to process a task posted to the task list by another device of the team for the benefit of that other device, wherein the analyzing includes checking a current computing capacity availability of the PID and a load level associated with the task posted by the other device of the team.

19. The method of claim 11, further comprising:

analyzing, by the PID, whether to process a task posted to the task list by another device of the team for the benefit of that other device, wherein the analyzing includes checking whether security resources available on the PID are suitable for processing the task posted by the other device of the team.

20. The method of claim 11, further comprising:

in response to receiving a security update by the PID, sharing, by the PID, the security update with at least one other device of the team.