SYSTEM FOR DATA FLOW PROTECTION AND USE CONTROL OF APPLICATIONS AND PORTABLE DEVICES CONFIGURED BY LOCATION

• US 20130174210A1
• Filed: 12/28/2011
• Published: 07/04/2013
• Est. Priority Date: 12/28/2011
• Status: Active Grant

• Current Assignee: Samsung Eletrônica da Amazônia Ltda (Samsung Electronics Co. Ltd.)
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Park, Juha, Marcus, Vinicius Stradiotto Farbiarz, Rachid, Euler Mendes, Figueiredo, Felipe Augusto Pereira de Figueiredo, Ywata, Luis Gustavo de Silva, Junquera, Glauco Barroso, Chiossi, Rodrigo Rafael Santos Costa, Schnick, Guilherme Augusto Kusano
• Granted Patent: US 8,850,513 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

The present invention relates to a system for implementing a firewall service on portable devices such as mobile phones, tablets or notebooks, which has changed their security settings depending on the location where they are. More specifically, the invention relates to a method of protecting data flow and control of use of devices and functional applications present in a portable device and configured from their location.

Claims

1. ) System for the protection of data flow and control of applications and use of portable devices configured by location characterized by the fact that it includes a firewall 11 inserted into the basic architecture of such portable device 10, positioning itself between the Data Network interfaces 12 and the CPU 13, and able to:

Identify whether a data packet being sent by the portable device (10) should be forwarded or discarded;

Determine whether a packet that arrives to the portable device (10) should be received or dropped from the location in which it is in accordance with a set of rules and policies defined in their configuration blocks, restrict or permit the use of functional devices (15) embedded in or connected to said portable device (10) and to determine filtering rules of data packets which passes through this portable device (10) so as to apply different settings for different locations.

2. ) System according to claim 1, characterized in that those data packets may be received by all types of interfaces Data Networks (12), such as Wi-Fi, Bluetooth, Zigbee, or by a cellular network using 2G, 3G or 4G technologies.

3. ) System according to claim 1, characterized by the fact that the location of the portable device (10) is made through the tracking device (14) being those defined by devices geo-location, detection of Wi-Fi connections and detection of connections to Virtual Private Networks, or VPNs, that define the geographic coordinates of the device surface.

4. ) System according to claim 1, characterized by the fact that the said geographic coordinates of the device surface may be defined by GPS or by triangulation of signals from cellular base stations.

5. ) System according to claim 1, characterized in that the identification of locations for Wi-Fi networks is by detecting the proximity of Wi-Fi Access Points previously defined in the Firewall configuration.

6. ) System according to claim 1, characterized by the fact that by making a comparison of parameters of WiFi networks, the system is able to determine the location of the portable device.

7. ) A system according to claim 1, characterized by the fact that an active VPN connection can be also used to determine the location of the portable device (10).

8. ) System according to claim 1, characterized by the fact that it also controls the use of functional devices (15) which are connected to the CPU (13) of the device (10), said control done by the CPU (13) of the portable device (10) that communicates with the Firewall (11) to determine whether, at any given time, a given functional device may or may not be activated or used, and the permissions for the activation of functional devices (15) configured in accordance with the location of the portable device (10) and its configuration.

9. ) System according to claim 1, characterized by the fact that constantly monitor the data that indicate its location:

geographical location, parameters of Wi-Fi connections and Virtual Private Networks (VPN), and whenever a change is identified in these parameters, an event (32) is generated within the Firewall 11, making their configuration blocks to be checked, searching for a block that describes the same location of the active portable device (10), and if it is found, the Filtering Rules and Policies of the devices of that block 33 will be applied on the portable device (10).

10. ) System according to claim 1, characterized in that the flow of decisions is started whenever an event of change of position is posted on the firewall (11), the first check is done if your portable device 10 is connected a Virtual Private Network (VPN), then connected to a Wi-Fi network and finally by its geographical position.

11. ) System according to claim 1, characterized by the fact that, once configured, one of the functions of a firewall (11) is to filter the data packets passing through the network interfaces of the portable device.

12. ) System according to claim 1, characterized by the fact that, when entering the said network interfaces (12) of the portable device (10), the data packet is then checked by a firewall (11), compares the contents of said data packet to its filtering settings active and depending on this comparison, the packet is dropped or the package is allowed to be sent to application layers.

13. ) System according to claim 1, characterized by the fact that, when sending data packets, before letting the portable device 10 to be sent to its destination, the data packet has its content verified by Firewall (11) and compared to its active settings, the package may be dropped or sent to the recipient, depending on the active filtering settings.

14. ) System according to claim 1, characterized by the fact that it controls the use of functional devices (15) that are attached to or embedded to portable device (10), avoiding leakage or capture of sensitive information from the portable device (10), at specific locations.

15. ) System according to claim 1, characterized in that the settings of firewall policies, which can be used to enable or disable features of the devices are remotely configured.