METHOD AND APPARATUS FOR CONTEXT AWARE MOBILE SECURITY

• US 20130254831A1
• Filed: 03/23/2012
• Published: 09/26/2013
• Est. Priority Date: 03/23/2012
• Status: Active Grant

• Current Assignee: Leidos Innovations Technology, Inc.
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Jones, Eric B., Roach, Kyle J., Hrybyk, Alex, Morrison, John S., Kauffman, Kathleen M., Lohrum, Mark, Good, Kenneth R.
• Granted Patent: US 9,027,076 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

An approach is provided for causing a change in a security policy of a device based on contextual information. The approach involves determining context information associated with a device. The approach also involves determining a security policy of the device. The approach further involves determining a change of the context information. The approach additionally involves processing the determined change of the context information to cause, at least in part, a revision of the security policy of the device.

Claims

1. A method comprising:

determining context information associated with a device;

determining a security policy of the device;

determining a change of the context information; and

processing the determined change of the context information to cause, at least in part, a revision of the security policy of the device.

2. A method of claim 1, wherein the security policy of the device enables connectivity to a network accessible by the device, and the revision of the security policy of the device comprises at least a revocation of the connectivity to the network.

3. A method of claim 1, wherein a network is accessible by the device and the revision of the security policy of the device enables the device to have connectivity to the network based, at least in part, on a security policy of the network.

4. A method of claim 3, further comprising:

causing, at least in part, the device and one or more application services accessible by way of the device to adapt to the security policy of the network by implementing the security policy of the network on the device.

5. A method of claim 4, wherein the adaptation of the one or more application services comprises one or more of a limitation of access rights to the one or more application services, a limitation of access rights of the one or more application services to access the network, a limitation of functionality of the one or more application services, and a clearance of a memory that is accessible by the one or more application services.

6. A method of claim 4, further comprising:

determining one or more of another change of the context information and a change of the security policy of the network; and

processing the one or more of the another change of the context information and the change of the security policy of the network to cause, at least in part, a revocation of the connectivity to the network.

7. A method of claim 1, wherein the revision of the security policy of the device further comprises causing, at least in part, a limitation of access rights to one or more application services accessible by way of the device, a limitation of access rights of the one or more application services to data processed by the device, a limitation of functionality of the one or more application services, a clearance of a memory that is accessible by the one or more application services, and an access to one or more secure applications.

8. A method of claim 1, further comprising:

determining a cause of the revision of the security policy of the device; and

processing the cause of the revision of the security policy of the device to cause, at least in part, the revision of the security policy of the device to be one of temporary or permanent.

9. A method of claim 1, wherein the context information comprises one or more of a location, a date, a time, a temperature, a mission, a suspicious activity, a command, a configuration of the device, and user credentials associated with the device.

10. A method of claim 1, wherein the security policy comprises one or more of operational limits, security limits, threat limits, one or more network connectivity allowances, sensor availability allowances, cryptographic protection protocols, memory accessibility allowances, application service accessibility allowances, and user accessibility allowances.

11. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

determine context information associated with a device;

determine a security policy of the device;

determine a change of the context information; and

process the determined change of the context information to cause, at least in part, a revision of the security policy of the device.

12. An apparatus of claim 11, wherein the security policy of the device enables connectivity to a network accessible by the device, and the revision of the security policy of the device comprises at least a revocation of the connectivity to the network.

13. An apparatus of claim 11, wherein a network is accessible by the device and the revision of the security policy of the device enables the device to have connectivity to the network based, at least in part, on a security policy of the network.

14. An apparatus of claim 13, wherein the apparatus is further caused to:

cause, at least in part, the device and one or more application services accessible by way of the device to adapt to the security policy of the network by implementing the security policy of the network on the device.

15. An apparatus of claim 14, wherein the adaptation of the one or more application services comprises one or more of a limitation of access rights to the one or more application services, a limitation of access rights of the one or more application services to access the network, a limitation of functionality of the one or more application services, and a clearance of a memory that is accessible by the one or more application services.

17. An apparatus of claim 11, wherein the revision of the security policy of the device further comprises causing, at least in part, a limitation of access rights to one or more application services accessible by way of the device, a limitation of access rights of the one or more application services to data processed by the device, a limitation of functionality of the one or more application services, a clearance of a memory that is accessible by the one or more application services, and an access to one or more secure applications.

18. An apparatus of claim 11, wherein the apparatus is further caused to:

determine a cause of the revision of the security policy of the device; and

process the cause of the revision of the security policy of the device to cause, at least in part, the revision of the security policy of the device to be one of temporary or permanent.

19. An apparatus of claim 11, wherein the context information comprises one or more of a location, a date, a time, a temperature, a mission, a suspicious activity, a command, a configuration of the device, and user credentials associated with the device.

20. An apparatus of claim 11, wherein the security policy comprises one or more of operational limits, security limits, threat limits, one or more network connectivity allowances, sensor availability allowances, cryptographic protection protocols, memory accessibility allowances, application service accessibility allowances, and user accessibility allowances.

16. An apparatus of 14, wherein the apparatus is further caused to:

determine one or more of another change of the context information and a change of the security policy of the network; and

process the one or more of the another change of the context information and the change of the security policy of the network to cause, at least in part, a revocation of the connectivity to the network.

21. A computer-readable storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to perform at least the following,

determine context information associated with a device;

determine a security policy of the device;

determine a change of the context information; and

process the determined change of the context information to cause, at least in part, a revision of the security policy of the device.

22. A computer-readable storage medium of claim 21, wherein the security policy of the device enables connectivity to a network accessible by the device, and the revision of the security policy of the device comprises at least a revocation of the connectivity to the network.

23. A computer-readable storage medium of claim 21, wherein a network is accessible by the device and the revision of the security policy of the device enables the device to have connectivity to the network based, at least in part, on a security policy of the network.

24. A computer-readable storage medium of claim 23, wherein the apparatus is further caused to:

cause, at least in part, the device and one or more application services accessible by way of the device to adapt to the security policy of the network by implementing the security policy of the network on the device.

25. A computer-readable storage medium of claim 24, wherein the adaptation of the one or more application services comprises one or more of a limitation of access rights to the one or more application services, a limitation of access rights of the one or more application services to access the network, a limitation of functionality of the one or more application services, and a clearance of a memory that is accessible by the one or more application services.

27. A computer-readable storage medium of claim 21, wherein the revision of the security policy of the device further comprises causing, at least in part, a limitation of access rights to one or more application services accessible by way of the device, a limitation of access rights of the one or more application services to data processed by the device, a limitation of functionality of the one or more application services, a clearance of a memory that is accessible by the one or more application services, and an access to one or more secure applications.

28. A computer-readable storage medium of claim 21, wherein the apparatus is further caused to:

determine a cause of the revision of the security policy of the device; and

process the cause of the revision of the security policy of the device to cause, at least in part, the revision of the security policy of the device to be one of temporary or permanent.

29. A computer-readable storage medium of claim 21, wherein the context information comprises one or more of a location, a date, a time, a temperature, a mission, a suspicious activity, a command, a configuration of the device, and user credentials associated with the device.

30. A computer-readable storage medium of claim 21, wherein the security policy comprises one or more of operational limits, security limits, threat limits, one or more network connectivity allowances, sensor availability allowances, cryptographic protection protocols, memory accessibility allowances, application service accessibility allowances, and user accessibility allowances.

26. A computer-readable storage medium of 24, wherein the apparatus is further caused to:

determine one or more of another change of the context information and a change of the security policy of the network; and

process the one or more of the another change of the context information and the change of the security policy of the network to cause, at least in part, a revocation of the connectivity to the network.