SYSTEM AND METHOD FOR MONITORING AND ANALYZING MULTIPLE INTERFACES AND MULTIPLE PROTOCOLS

• US 20120042382A1
• Filed: 10/28/2011
• Published: 02/16/2012
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin
• Granted Patent: US 8,505,095 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

The present invention is a system and method for providing security for a mobile device by analyzing data being transmitted or received by multiple types of networks. The invention can provide security for many types of network interfaces on a mobile device, including: Bluetooth, WiFi, cellular networks, USB, SMS, infrared, and near-field communication. Data is gathered at multiple points in a given processing pathway and linked by a protocol tracking component in order to analyze each protocol present in the data after an appropriate amount of processing by the mobile device. Protocol analysis components are utilized dynamically to analyze data and are re-used between multiple data pathways so as to be able to support an arbitrary number of network data pathways on a mobile device without requiring substantial overhead.

Claims

1. A method comprising:

on a mobile communications device capable of receiving data in the form of one or more protocols, the mobile communications device having a data gathering component for gathering data received by the mobile communications device and sending the gathered data to a protocol tracking component, a protocol tracking component for receiving data from the data gathering component, and at least one protocol analysis component for analyzing the data gathered by the data gathering component, receiving data on the mobile communications device;

identifying, by the data gathering component, a first protocol for the received data;

sending the received data to the protocol tracking component for selecting one of the at least one protocol analysis components based upon the identified first protocol for the received data;

sending the received data to the selected protocol analysis component for further analysis.

2. The method of claim 1, further comprising:

identifying, by the protocol analysis component, a second protocol for the received data;

sending the received data to the protocol tracking component for selecting one of the at least one protocol analysis components based upon the identified second protocol for the received data; and

sending the received data to the selected protocol analysis component for further analysis.

3. The method of claim 1, wherein the second sending step further comprises, as part of the further analysis, determining whether the received data is safe or malicious.

4. A method comprising:

on a mobile communications device capable of transmitting data in the form of one or more protocols, the mobile communications device having a data gathering component for gathering data for transmitting from the mobile communications device and sending the gathered data to a protocol tracking component, a protocol tracking component for receiving data from the data gathering component, and at least one protocol analysis component for analyzing the data gathered by the data gathering component, providing data for transmitting from the mobile communications device;

identifying, by the data gathering component, a first protocol for the transmitting data;

sending the transmitting data to the protocol tracking component for selecting one of the at least one protocol analysis components based upon the identified first protocol for the transmitting data;

sending the transmitting data to the selected protocol analysis component for further analysis.

5. The method of claim 4, further comprising:

identifying, by the protocol analysis component, a second protocol for the transmitting data;

sending the transmitting data to the protocol tracking component for selecting one of the at least one protocol analysis components based upon the identified second protocol for the transmitting data; and

sending the transmitting data to the selected protocol analysis component for further analysis.

6. The method of claim 4, wherein the second sending step further comprises, as part of the further analysis, determining whether the data is safe or malicious.

7. A method comprising:

on a mobile communications device capable of receiving or transmitting data in the form of one or more communications protocols, the mobile communications device having a plurality of data gathering components for gathering data received or transmitted by the mobile communications device, and a plurality of protocol analysis components for analyzing the data gathered by at least one of the plurality of data gathering components, wherein each of the plurality of protocol analysis components corresponds to at least one communication protocol providing data received by or for transmitting from the mobile communications device, selecting, by one of the plurality of data gathering components, a first protocol for the received or transmitting data;

sending the received or transmitting data to one of the plurality of a protocol tracking components;

selecting, by one of the plurality of protocol tracking components, one of the plurality of protocol analysis components corresponding to the identified first protocol for the received or transmitting data;

sending, by one of the plurality of the protocol tracking components, the received or transmitting data to one of the plurality of protocol analysis components corresponding to the selected first protocol;

identifying by one of the plurality of protocol analysis components to determine if there is a second protocol for the received or transmitting data;

if there is a second protocol for the received or transmitting data, selecting, by one of the plurality of protocol tracking components, one of the plurality of protocol analysis components corresponding to the identified second protocol; and

sending the received or transmitting data to the one of the plurality of protocol analysis components corresponding to the identified second protocol.

8. The method of claim 7, further comprising:

analyzing, by one of the plurality of protocol analysis components corresponding to the identified first protocol, the received or transmitting data to determine whether it is safe or malicious; and

if there is a second protocol for the received or transmitting data, analyzing, by one of the plurality of protocol analysis components corresponding to the identified second protocol, the received or transmitting data to determine whether it is safe or malicious.

9. A system comprising:

a mobile communications device capable of receiving or transmitting data in the form of one or more communications protocols;

at least one data gathering component resident on the mobile communications device for gathering data received or transmitting by the mobile communications device, for identifying a first communications protocol for the gathered data, and for sending the gathered data and identified first communications protocol to a protocol tracking component;

at least one protocol tracking component resident on the mobile communications device for identifying at least one protocol analysis component, wherein the at least one protocol analysis component corresponds to one of the one or more communications protocol; and

at least one protocol analysis component for analyzing gathered data, wherein the at least one protocol analysis component corresponds to one of the one or more communications protocols.