MOBILE DEVICE POLICY ENFORCEMENT

• US 20180004937A1
• Filed: 06/29/2017
• Published: 01/04/2018
• Est. Priority Date: 06/30/2016
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Shannon, Michael
• Granted Patent: US 11,086,984 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

In general, in one aspect, a method includes receiving software code with an invalid characteristic, repeatedly attempting to execute the software code with the invalid characteristic on a device, and in response to successful execution of the software code with the invalid characteristic, taking an action. The action may include an action to remediate the device.

Claims

1. A non-transitory computer-readable medium comprising instructions, the instructions when executed causing one or more processors to:

attempt to load on a device software code with an invalid signature, the invalid signature sufficient to prevent loading of the software code if the device meets a specified security policy;

upon unsuccessful loading of the software code with the invalid signature, wait a predetermined time interval or for a designated event and then repeat the attempt; and

in response to successful loading of the software code with the invalid signature on the device, take an action to remediate the device.

2. The computer-readable medium of claim 1, wherein the instructions further cause the one or more processors to receive the software code with the invalid signature.

3. The computer-readable medium of claim 1, wherein the action to remediate the device includes one or more of:

reinstall software on the device, apply changes to software on the device, run remediating software on the device, isolate the device from a network, report a health status of the device that is an unhealthy status, report a health status of the device that indicates that the device is in violation of policy, notify a user, or notify an administrator.

4. A method, comprising:

repeatedly attempting to perform a first action with software code with an invalid characteristic on a device until the attempt is successful, the invalid characteristic sufficient to prevent the first action if the device meets a specified security policy; and

in response to successfully performing the first action with the software code with the invalid characteristic, taking a consequential action by the device.

5. The method of claim 4, wherein the first action comprises one or more of:

loading the software code, executing the software code, accessing a function in the software code.

6. The method of claim 4, further comprising waiting for a predetermined time before repeating the attempt.

7. The method of claim 4, further comprising waiting for an event before repeating the attempt.

8. The method of claim 4, wherein the invalid characteristic comprises one or more of:

an invalid signature, invalid permissions, and an invalid data access request.

9. The method of claim 4, further comprising, receiving the software code with the invalid characteristic.

10. The method of claim 4, wherein the method further comprises installing the software code with invalid signature on the device.

11. The method of claim 4, wherein the consequential action comprises an action to remediate the device, the action comprising one or more of:

reinstalling software on the device, applying changes to software on the device, isolating the device from a network, reporting a health status of the device that is in violation of policy.

12. The method of claim 4, wherein the consequential action comprises one or more of:

notifying a user, and notifying an administrator.

13. A system, comprising:

one or more processors;

a non-transitory computer-readable medium comprising instructions, the instructions when executed causing one or more processors to perform operations, comprising;

receive software code with an invalid characteristic;

repeatedly attempt a first action with the software code with the invalid characteristic on a device until the attempt is successful wherein the invalid characteristic should cause the device to prevent the first action if the device meets a specified security policy; and

in response to successful completion of the first action with the software code with the invalid characteristic, transmit an alert or remediate the device.

14. The system of claim 13, wherein the operations further comprise, store the software code with invalid characteristic on the device.

15. The system of claim 13, wherein the invalid characteristic comprises one or more of an invalid signature, invalid permissions. or an invalid data access request.

16. The system of claim 13, wherein the first action comprises loading the software code, and wherein the invalid characteristic is sufficient to prevent loading of the software code if the device meets specified policy requirements.

17. The system of claim 13, wherein the first action comprises executing the software code, and wherein the invalid characteristic is sufficient to prevent executing the software code if the device meets specified policy requirements.

18. The system of claim 13, wherein remediating the device includes applying changes to an operating system, software, or configuration of the device.

19. The system of claim 13, wherein the action comprises reporting a health status of the device.

20. The system of claim 19, wherein the reported health status of the device is that the device is in violation of policy.