System, Method and Device for Cloud-Based Content Inspection for Mobile Devices

• US 20120324581A1
• Filed: 06/17/2011
• Published: 12/20/2012
• Est. Priority Date: 06/17/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ismailov, Vadim, Economos, George Jr.
• Granted Patent: US 8,621,630 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/08 Access security

Abstract

A content inspection system provides cloud-based content inspection for mobile devices. The content inspection system includes a content inspection server for receiving a request providing a digital fingerprint of content for evaluation for threats and a data reputation services server for maintaining a threat database. The content inspection system communicates with the mobile device using a service oriented architecture web services based on exchanges of messages between agents of the content inspection system and the mobile device. The content inspection server authenticates the received request belongs to a subscriber, and once the request is authenticated, the data reputation services server operates on the request to determine whether content identified by the digital fingerprint matches pre-existing claims in the threat database. The content inspection system generates a threat evaluation response for the mobile device based on reviewing the threat database for pre-existing claims.

Claims

1. A cloud-based content inspection system for mobile devices, comprising:

a content inspection system, accessible by a remotely located mobile device, for providing cloud-based content inspection for the remotely located mobile device, the content inspection system including;

a content inspection server for receiving from the mobile device a request providing a digital fingerprint of content for evaluation for threats; and

a data reputation services server for maintaining a threat database;

wherein the content inspection system communicates with the remotely located mobile device using a service oriented architecture web services based on exchanges of messages between agents of the content inspection system and the remotely located mobile device, the content inspection server authenticating the received request belongs to a subscriber, once the request is authenticated the data reputation services server operates on the request to determine whether content identified by the digital fingerprint matches pre-existing claims in the threat database, wherein the content inspection system generates a threat evaluation response to be provided to the mobile device based on reviewing the threat database for pre-existing claims.

2. The cloud-based content inspection system of claim 1, wherein the request is implemented as a HTTP request, HTTP headers storing service specific data for performing the evaluation for threats.

3. The cloud-based content inspection system of claim 2, wherein the service specific data stored in the HTTP headers include threat types to look for, a timestamp for ensuring the request is not received by the content inspection server after a predetermined limit, a subscription key providing a unique identifier of the mobile device, and the digital signature comprising signed hash of select headers of the request.

4. The cloud-based content inspection system of claim 1, wherein the content inspection server registers a mobile device for a subscription service and provides a unique subscription key for the mobile device based on the registering of the mobile device.

5. The cloud-based content inspection system of claim 4, wherein a secret key is associated with the unique subscription key, the content inspection server using the secret key to authenticate a subscribed mobile device when a request is received by the content inspection.

6. The cloud-based content inspection system of claim 4, wherein the subscription comprises a flat fee model.

7. The cloud-based content inspection system of claim 4, wherein the subscription comprises a pay per scan model.

8. The cloud-based content inspection system of claim 4, wherein the content inspection server retrieves an associated secret key based on inspection of the request to identify the subscription key of the mobile device, performs a hash using the retrieved associated secret key and verifies that a resulting digital fingerprint matches the digital fingerprint associated with the request.

9. The cloud-based content inspection system of claim 1, wherein the service oriented architecture web services comprises a representational state transfer (REST) architecture for providing web services.

10. The cloud-based content inspection system of claim 1, wherein the threat evaluation response provided to the mobile device indicates the digital fingerprint of the content matched an entry in the threat database and includes threat information obtained from the threat database.

11. The cloud-based content inspection system of claim 1, wherein the threat evaluation response provided to the mobile device indicates the digital fingerprint of the content did not matched a entry in the threat database and requests actual content to be provided for evaluation for threats.

12. The cloud-based content inspection system of claim 1, wherein the content inspection server scans content received in response to the threat evaluation response provided to the mobile device for threats, transmits the results of the scan for threats to the mobile device and provides the data reputation service an update for the threat database based on the scan for threats.

13. A method for providing cloud-based content inspection for mobile devices, comprising:

providing a content inspection system, accessible by a remotely located mobile device, for performing cloud-based content inspection for the remotely located mobile device, wherein the providing the content inspection system further comprises providing a content inspection server for receiving a request from the mobile device providing a digital fingerprint of content for evaluation for threats and providing a data reputation services server for maintaining a threat database;

authenticating, at the content inspection server, that the received request belongs to a subscriber;

operating on the request, by the data reputation server once the request is authenticated, to determine whether content identified by the digital fingerprint matches pre-existing claims in the threat database; and

generating a threat evaluation response to be provided to the mobile device based on reviewing the threat database for pre-existing claims.

14. The method of claim 13 further comprising storing service specific data for performing the evaluation for threats in HTTP headers of a HTTP request, wherein the storing service specific data comprises storing threat types to look for, a timestamp for ensuring the request is not received by the content inspection server after a predetermined limit, a subscription key providing a unique identifier of the mobile device, and the digital signature comprising signed hash of select headers of the request.

15. The method of claim 13 further comprising registering the mobile device for a subscription service and providing a unique subscription key for the mobile device based on the registering of the mobile device and associating a secret key with the unique subscription key, using the secret key to authenticate a subscribed mobile device when a request is received by the content inspection.

16. The method of claim 13 further comprising retrieving, by the content inspection server, an associated secret key based on inspection of the request to identify the subscription key of the mobile device, performing a hash using the retrieved associated secret key and verifying that a resulting digital fingerprint matches the digital fingerprint associated with the request.

17. The method of claim 13 further comprising indicating in the threat evaluation response provided to the mobile device that the digital fingerprint of the content matched an entry in the threat database and includes threat information obtained from the threat database.

18. The method of claim 13 further comprising indicating in the threat evaluation response provided to the mobile device that the digital fingerprint of the content did not matched a entry in the threat database, requesting actual content to be provided for evaluation for threats, scanning content received in response to the threat evaluation response provided to the mobile device, transmitting the results of the scan for threats to the mobile device and providing the data reputation service an update for the threat database based on the scan for threats.

19. The method of claim 13 further comprising sending and receiving messages between agents of the content inspection system and the remotely located mobile device using a service oriented architecture web services.

20. A computer readable storage device having stored therein data representing instructions executable by a computer to implement cloud-based content inspection for mobile devices, comprising:

providing a content inspection system, accessible by a remotely located mobile device, for performing cloud-based content inspection for the remotely located mobile device, wherein the providing the content inspection system further comprises providing a content inspection server for receiving a request from the mobile device providing a digital fingerprint of content for evaluation for threats and providing a data reputation services server for maintaining a threat database;

authenticating, at the content inspection server, that the received request belongs to a subscriber;

operating on the request, by the data reputation server once the request is authenticated, to determine whether content identified by the digital fingerprint matches pre-existing claims in the threat database; and

generating a threat evaluation response to be provided to the mobile device based on reviewing the threat database for pre-existing claims.