METHODS AND SYSTEMS FOR SHARING RISK RESPONSES BETWEEN COLLECTIONS OF MOBILE COMMUNICATIONS DEVICES

• US 20160099963A1
• Filed: 12/17/2015
• Published: 04/07/2016
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin Patrick, Buck, Brian James, Robinson, William, Hering, John G., Burgess, James David, Golombek, David, Richardson, David Luke, Lineberry, Anthony McKay, Evans, Daniel Lee, Salomon, Ariel, Grubb, Jonathan Pantera, Wootton, Bruce, Strazzere, Timothy, Wyatt, Timothy Micheal, Barton, Kyle, Swami, Yogesh
• Granted Patent: US 9,781,148 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

Methods are provided for determining an enterprise risk level, for sharing security risk information between enterprises by identifying a security response by a first enterprise and then sharing the security response to a second enterprise when a relationship database profile for the first collection indicates the security response may be shared. Methods are also provided for determining whether to allow a request from an originating device where the request may have been initiated by a remote device.

Claims

1. A method for sharing security risk responses between a plurality of collections to improve the functioning of mobile communications devices associated with at least one collection based on the shared security risk responses, the method comprising:

accessing, by a server security component, a security database including a plurality of security risk responses, each security risk response associated with at least one of the plurality of collections;

identifying, by the server security component, a first security risk response in the security database, wherein the first security risk response was implemented by at least one of the plurality of collections;

determining, by the server security component from the security database, a first collection associated with the first security risk response;

accessing, by the server security component, a relationship database including collection profiles related to the sharing of information between the plurality of collections; and

,

providing, by the server security component, the first security risk response to a second collection when a first collection profile indicates that the first collection permits information related to the first security risk response to be provided to the second collection.

2. The method of claim 1, wherein the first security response was initiated from a first administrator device associated with a first administrator of the first collection and wherein the providing the first security risk response to the second collection includes providing the first security risk response to a second administrator device associated with a second administrator of the second collection.

3. The method of claim 1, wherein the indication that the first collection permits information related to the first security risk response to be provided to a second collection was based on information supplied by a first administrator of the first collection.

4. The method of claim 1, wherein the first security risk response was implemented in response to a first security risk type and wherein information related to the first security risk response includes information related to the first security risk type, the method further including:

determining, by the server security component from the security database information, a third collection, the third collection having implemented a second security risk response in response to the first security risk type;

accessing, by the server security component, the relationship database; and

,

providing, by the server security component, the second security risk response to the second collection when a third collection profile indicates that the third collection permits information related to the second security risk response to be provided to the second collection.

5. The method of claim 4, further including providing, by the server security component, information related to the first security risk type to the second collection, the information related to the first security risk type including statistical information relating to the prevalence or propagation of the risk type, the statistical information derived from the security database.

6. The method of claim 1, wherein the security database includes risk information acquired in part from device security components on mobile communications devices, wherein the mobile communications devices are associated with at least one collection of the plurality of collections, wherein the device security components send risk information related to security risk responses to the server security component, and wherein the server security component is associated with a platform, the platform associated with an entity separate from any of the plurality of collections.

7. The method of claim 1, wherein the accessing a relationship database includes accessing, by the server security component, a relationship database including collection profiles related to the sharing of information between the plurality of collections, wherein the collection profiles include collection attributes, the method further comprising:

identifying, by the server security component from information related to the first security risk response in the security database, a set of response attributes of the first security risk response; and

identifying, for the second collection, a set of second collection attributes that are similar to response attributes in the first response attribute set,

wherein the providing, by the server security component, the first security risk response to the second collection includes providing, by the server security component, the first security risk response to the second collection when the number of identified attributes in the second response attribute set equals or exceeds a threshold number and when the first collection profile indicates that the first collection permits information related to the first security risk response to be provided to the second collection.

8. The method of claim 1, wherein the accessing a relationship database includes accessing, by the server security component, a relationship database including collection profiles related to the sharing of information between the plurality of collections, wherein the collection profiles include collection attributes, the method further comprising:

identifying, by the server security component from information related to the first security risk response in the security database, a set of response attributes of the first security risk response;

identifying, for the second collection, a set of second collection attributes that are similar to response attributes in the first response attribute set;

receiving, by the server security component, a response attribute value for each response attribute in the first response attribute set;

assigning, by the server security component, a collection attribute value to each of the attributes in the second response attribute set, wherein the collection attribute values are assigned to a second collection attribute based on the response attribute value of the similar corresponding response attribute in the first attribute response set;

summing, by the server security component, the assigned second collection attribute values; and

wherein the providing, by the server security component, the first security risk response to the second collection includes providing, by the server security component, the first security risk response to the second collection;

when the sum of the assigned second collection attribute values equals or exceeds the threshold number, and

when the first collection profile indicates that the first collection permits information related to the first security risk response to be provided to the second collection.

9. The method of claim 8, wherein the response attributes include attributes related to at least one of a risk, a mobile communications device, a collection, or a software, and wherein the collection attributes include attributes related to at least one of a collection of the plurality, the mobile communications devices of a collection, or a software of the collection.

10. The method of claim 1,

wherein the relationship database further includes relationship information related to the sharing of levels of information between the plurality of collections,

wherein the first security risk response includes information of a first level and information of a second level, and

wherein providing, by the server security component, the first security risk response to a second collection includes providing, by the server security component, the first level information to the second collection and not providing the second level information when the first collection profile indicates that the first collection permits the first level information to be provided to the second collection and does not permit the second level information to be provide to the second collection.

11. The method of claim 1, wherein the identified first security risk response includes a response to a detected security risk event, and wherein the detected security risk event was detected by a device security component on a mobile communications device associated with the first collection.

12. The method of claim 1, wherein the identified first security risk response includes a response to a detected security risk event, and wherein the detected security risk event was detected by the server security component based on an analysis of the security database information.

13. The method of claim 1, wherein the second collection automatically implements the first security risk response.

14. A method for sharing security risk responses between a plurality of collections to improve the functioning of computing devices associated with at least one collection based on the shared security risk responses, the method comprising:

accessing, by a server security component, a security database including information useful for detecting security risk events associated with mobile communications devices;

detecting, by the server security component based on the security database information, a security risk event associated with at least one mobile communications device, wherein the at least one mobile communications device is associated with a first collection;

notifying, by the server security component, the first collection of the detected security risk event;

determining, by the server security component, a first security risk response of the first collection to the detected security risk event;

accessing, by the server security component, a relationship database including collection profiles related to the sharing of information between the plurality of collections; and

,

providing, by the server security component, the first security risk response to a second collection when a first collection profile indicates that the first collection permits information related to the first security risk response to be provided to the second collection.

15. The method of claim 14, wherein the notifying step includes the server security component providing a notification to a first administrator device associated with a first administrator of the first collection, and wherein the first security risk response was initiated by the first administrator, and wherein the providing step includes the server security component providing the first security risk response to a second administrator device associated with a second administrator of the second collection.

16. The method of claim 14, wherein the step of determining a first security risk response includes determining, by the server security component, the first security risk response of the first collection to the detected security risk event based on the server security component receiving a notice of the first security risk response.

17. The method of claim 14, wherein the step of determining a first security risk response includes determining, by the server security component, the first security risk response of the first collection to the detected security risk event based on an analysis of information in the security database.

18. A method for sharing security risk responses between a plurality of collections to improve the functioning of mobile communications devices associated with at least one collection based on the shared security risk responses, the method comprising:

accessing, by a server security component, a security database including information useful for detecting security risk events associated with mobile communications devices;

determining, by the server security component from the security database information, a security risk event detected by a device security component on a first mobile communications device;

determining, by the server security component from the security database information, a first collection associated with the first mobile communications device;

accessing, by the server security component, a relationship database including collection profiles related to the sharing of information between the plurality of collections;

determining, by the server security component from a first collection profile, that the first collection permits information related to the detected security risk event to be provided to a first set of at least one collection of the plurality;

providing, by the server security component, information related to the detected security risk event to the first set;

determining, by the server security component, a first security risk response to the detected security risk event from a second collection of the first set;

accessing, by the server security component, the relationship database; and

providing, by the server security component, information related to the first security risk response to a second set of at least one collection when the server security component determines from the second collection profile that the second collection permits information related to the first security risk response to be provided to the second set.

19. The method of claim 18, wherein providing information related to the detected security risk event to the first set includes providing, for each collection of the first set, information related to the detected security risk event to a computing device associated with an administrator of the collection, and wherein providing information related to the first security risk response to a second set includes providing, for each collection of the second set, information related to the first security risk response to an administrator of the collection.

20. The method of claim 18, wherein the step of determining a first security risk response to the detected security risk event includes determining, by the server security component, the first security risk response of the second collection to the detected security risk event based on the server security component receiving a notice of the first security risk response.

21. The method of claim 18, wherein the step of determining a first security risk response to the detected security risk event includes determining, by the server security component, the first security risk response of the second collection to the detected security risk event based on an analysis of information in the security database.

22. The method of claim 18, wherein the determined first security risk response was provided from the second collection to a set of available risk responses, the set of available risk responses being stored in the security database, and wherein the step of determining a first security risk response includes accessing the set of available risk responses.

23. A method for determining an acceptable risk level for a collection to improve the functioning of mobile communications devices associated with the collection, the method comprising:

accessing, by a server security component, a security database including risk information received from a plurality of collections, wherein the risk information includes source information that associates the risk information with one or more collections from the plurality;

determining, by the server security component, a risk level for each collection based on the accessed risk information associated with each collection, the determined risk levels including a first risk level associated with a first collection;

determining, by the server security component, an acceptable risk level based on the determined risk levels; and

providing, by the server security component to the first collection, the acceptable risk level and the first risk level.

24. The method of claim 23, wherein providing, by the server security component to the first collection, the acceptable risk level and the first risk level includes providing the acceptable risk level and the first risk level to a first administrator device associated with a first administrator of the first collection.

25. The method of claim 23, further comprising:

comparing, by the server security component, the first risk level to the acceptable risk level; and

alerting, by the server security component, the first collection when the comparison indicates that the first risk level is more than a threshold more than the acceptable risk level.

26. The method of claim 23, further comprising:

determining, by the server security component, a new first risk level for the first collection based in part on new risk information associated with the first collection;

determining, by the server security component, a new acceptable risk level based on a plurality of determined risk levels; and

providing, by the server security component to the first collection, the new acceptable risk level and the new first risk level.

27. The method of claim 26, further comprising:

comparing, by the server security component, the new first risk level to the new acceptable risk level;

alerting, by the server security component, the first collection when the comparison indicates that the new first risk level is more than a threshold more than the new acceptable risk level.

28. The method of claim 26, wherein the determining, by the server security component, a new first risk level for the first collection was performed in response to the server security component receiving a request for the new first risk level from the first collection.

29. The method of claim 28, wherein the request for the new first risk level was initiated from a device associated with an administrator of the first collection after a change was made that potentially affected the first risk level.

30. The method of claim 23, wherein the security database further includes a plurality of security risk responses, each security risk response associated with at least one of the plurality of collections, the method further comprising:

identifying, by the server security component, a first security risk response in the security database, wherein the first security risk response is associated with the first collection;

accessing, by the server security component, a relationship database including collection profiles related to the sharing of information between the plurality of collections, wherein the relationship database includes a first collection profile indicating that the first collection permits information related to the first security risk response to be shared with a second collection of the plurality when a determined second risk level associated with the second collection is equal to or less than a second threshold more than the acceptable risk level;

comparing, by the server security component, the second risk level to the acceptable risk level; and

,

providing, by the server security component, the first security risk response to the second collection when the second risk level is equal to or less than the second threshold more than the acceptable level.

31. A method for determining whether to allow a network access request, comprising:

receiving, by a destination computing device running a destination computing device security component, an access request by a terminal computing device in a series of at least one computing devices, wherein the series begins with an initial computing device, wherein the initial computing device initiates the access request, and wherein the series includes all computing devices used to transmit the access request to the destination computing device;

requesting, by the destination computing device security component, source information relating to the access request from a terminal device security component running on the terminal computing device; and

allowing, by the destination computing device security component, the access request;

when the destination computing device security component receives source information from the terminal device security component, and

when the source information;

indicates that every computing device in the series is trusted, and

indicates that the initial computing device was not being controlled by a remote device.

32. The method of claim 31, wherein the allowing step allows the access request:

when the destination computing device security component receives source information from the terminal device security component, and

when the source information;

indicates that every computing device in the series is trusted, and

indicates that the initial computing device was not being controlled by a remote device, and

indicates that every user of any computing device in the series is authenticated.

33. The method of claim 31, wherein each computing device in the series is running an instance of the device security component running on the terminal device.

34. The method of claim 31, wherein at least one computing device in the series is a mobile communications device.

35. A method for determining whether to allow a network access request, comprising:

receiving, by a destination computing device running a destination computing device security component, an access request by a terminal computing device in a series of at least one computing devices, wherein the series begins with an initial computing device, wherein the initial computing device initiates the access request, and wherein the series includes all computing devices used to transmit the access request to the destination computing device;

requesting, by the destination computing device security component, source information relating to the access request from a terminal device security component running on the terminal computing device; and

denying, by the destination computing device security component, the access request;

when the destination computing device security component does not receive source information, or

when the destination computing device security component receives source information from the device security component and the source information;

indicates that at least one computing device in the series is not trusted, or

indicates that the initial device was being controlled by a remote device.

36. The method of claim 35, wherein the denying step denies the access request:

when the destination computing device security component does not receive source information, or

when the destination computing device security component receives source information from the device security component and the source information;

indicates that at least one computing device in the series is not trusted, or

indicates that the initial device was being controlled by a remote device, or

indicates that a user of any computing device in the series is not authenticated.

37. A method for determining whether to allow a network access request, comprising:

receiving, by a destination computing device running a destination computing device security component, an access request by a terminal computing device in a series of at least one computing devices, wherein the series begins with an initial computing device, wherein the initial computing device initiates the access request, and wherein the series includes all computing devices used to transmit the access request to the destination computing device;

requesting, by the destination computing device security component, terminal source information relating to the access request from a terminal device security component running on the terminal computing device;

requesting, by the destination computing device security component, next source information relating to the access request from a next device security component running on a next computing device of the series when the destination computing device security component receives terminal source information from the terminal device security component and the terminal source information indicates that the terminal computing device is trusted, and is not the initiator of the access request, and identifies the next computing device in the series; and

allowing, by the destination computing device security component, the access request;

when the destination computing device security component receives next source information from the next device security component, and

when the next source information;

indicates that the next computing device is trusted, and

indicates that the next computing device is the initial computing device and is not being controlled by a remote device.

38. The method of claim 37, further comprising:

repeating, for additional next computing devices, requesting, by the destination computing device security component, additional next source information relating to the initiator of the access request from additional next device security components running on additional next computing devices when the destination computing device security component receives source information from a previous device security component and the previous source information indicates that the previous computing device is trusted, and is not the initiator of the access request, and identifies the additional next computing device in the series,

until the destination computing device security component receives additional next source information from an additional next device security component and the additional next source information indicates that the additional next computing device is trusted, and is the initiator of the access request.

39. A method for determining whether to allow a network access request, comprising:

receiving, by a destination computing device running a destination computing device security component, an access request by a terminal computing device in a series of at least one computing devices, wherein the series begins with an initial computing device, wherein the initial computing device is the initiator of the access request, and wherein the access request is transmitted to the destination computing device using the series;

requesting, by the destination computing device security component, terminal source information relating to the initiator of the access request from a terminal device security component running on the terminal computing device;

requesting, by the destination computing device security component, next source information relating to the initiator of the access request from a next device security component running on a next computing device when the destination computing device security component receives terminal source information from the terminal device security component and the terminal source information indicates that the terminal computing device is trusted, and is not the initiator of the access request, and identifies the next computing device in the series; and

denying, by the destination computing device security component, the access request;

when the destination computing device security component does not receive next source information, or

when the destination computing device security component receives next source information from the next device security component and the next source information indicates that the next computing device is the initiator of the access request and indicates that the next computing device in the series is not trusted.

40. The method of claim 39, further comprising:

repeating, for additional next computing devices, requesting, by the destination computing device security component, additional next source information relating to the initiator of the access request from additional next device security components running on additional next computing devices when the destination computing device security component receives source information from a previous device security component and the previous source information indicates that the previous computing device is trusted, and is not the initiator of the access request, and identifies the additional next computing device in the series;

until the destination computing device security component does not receive additional next source information from an additional next device security component, or

until the additional next source information indicates;

that the additional next computing device is not trusted, or

that the additional next computing device is the initiator of the access request

41. A method for determining whether to allow a network access request, comprising:

receiving, by a destination computing device running a destination computing device security component, an access request from a terminal computing device in a series of at least one computing devices, wherein the series includes an originating computing device, wherein the originating computing device is the origin of the access request, and wherein the access request is transmitted to the destination computing device using the series;

including at least one remote device in the series when the originating computing device is controlled by the at least one remote device, and

receiving, by the destination computing device security component, source information from the terminal computing device, the source information relating to the initiation and transmission of the access request; and

allowing, by the destination computing device security component, the access request when the source information indicates that each device in the series of computing devices is trusted.

42. The method of claim 41, wherein, in the allowing step, each computing device in the series has a corresponding security component, wherein the source information includes information from each of the security components, and wherein the source information from each of the security components indicates that the corresponding computing device is trusted.

43. The method of claim 41, wherein the allowing step includes allowing, by the destination computing device security component, the access request when:

a) the source information indicates that each device in the series of computing devices is trusted; and

b) the source information indicates that every user of any of the series of computing devices is authenticated.

44. A method for determining whether to apply a policy to a communication, the method comprising:

detecting, by a security component on a first computing device having a local device proxy (LDP), an attempt to create a multi-path connection between the first computing device and a second computing device, wherein the attempted multi-path connection includes at least a first path and a second path;

determining, by the security component using the LDP, an identity of a first application related to the attempted multi-path connection;

accessing, by the security component, a security database to determine whether the identified first application relates to at least one of;

a collection use of the first computing device, and a personal use of the first computing device; and

applying, by the security component, a security policy to the requested multi-path connection when the first application relates to a collection use of the first computing device.

45. The method of claim 44, wherein the security policy is applied to the attempted multipath connection when the first application relates to a collection use of the first computing device, or when the first application relates to a personal use of the first computing device and the security component further determines that collection data is involved or collection credentials are involved.

46. The method of claim 44, wherein as a result of applying the security policy the LDP changes the attempted multi-path connection to a single path connection.

47. The method of claim 44, wherein as a result of applying the security policy the LDP denies the attempted multi-path connection.

48. The method of claim 44, wherein as a result of applying the security policy the LDP allows the attempted multi-path connection.

49. The method of claim 48, the method further comprising allowing, by the LDP, a communication received using the allowed connection to flow through the LDP.

50. The method of claim 48, wherein the applied security policy further causes the LDP to send a communication received over at least one of the first path and the second path to a security program for an analysis, the method further comprising allowing, by the LDP, the received communication to flow through the LDP when the security program analysis determines that the received communication is allowed.

51. The method of claim 50, wherein the first path included non-collection infrastructure, and wherein the received communications sent for security program analysis includes communications received via the first path.