Adaptive security for portable information devices

• US 7,607,174 B1
• Filed: 01/21/2009
• Issued: 10/20/2009
• Est. Priority Date: 12/31/2008
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Kashchenko, Nadezhda V., Polyakov, Dmitry A., Tikhomirov, Anton V.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US12/357,266
• Time in Patent Office: 272 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A portable information device includes a dynamically configurable security arrangement in which operational settings are automatically and dynamically configured for either thick client or thin client protection schemes based at least in part on the current location of the device.

Claims

1. A portable information device having a dynamically configurable security arrangement, the device comprising:

computer circuitry, including a processor operatively coupled to a data store;

a user interface, including display and user input devices;

wireless communications circuitry; and

a power supply that provides power to the computer circuitry, user interface, and wireless communications circuitry, the power supply including an on-board energy source;

wherein the computer circuitry includes a security arrangement comprising;

a configurable security module that facilitates security services in the portable information device;

a location determining module configured to determine and provide an indication of a current location of the portable information device;

a location profile database containing security risk profile information for a plurality of local networks at a plurality of geographic locations; and

a security configuration module that is configured to use the indication of the present location to assess a current security risk to which the portable information device is exposed based on risk profile information contained in the location profile database corresponding to the present location, and to dynamically configure the security module to operate in either;

a thin client configuration in which a majority of security services are provided by a security server that is located remotely from the portable information device;

or

a thick client configuration in which a majority of security services are provided by the configurable security module.

2. The portable information device of claim 1, wherein the security configuration module is adapted to configure the security module to operate in the thin client configuration in response to an assessment, by the security configuration module, of the current risk associated with the current location being a relatively high security risk;

and

wherein the security configuration module is adapted to configure the security module to operate in the thick client configuration in response to an assessment, by the security configuration module, of the current risk associated with the present location being a relatively low security risk.

3. The portable information device of claim 1, wherein the security configuration module is adapted to dynamically configure the security module to operate in a hybrid configuration in which certain security services are selectively provided by the security server located remotely from the portable information device, and other security services are provided by the security module of the portable information device.

4. The portable information device of claim 1, wherein the location determining module includes at least one of:

a global positioning system (GPS) receiver; and

a network topology analyzer.

5. The portable information device of claim 1, further comprising:

a computing capacity determining module that re-assesses a current state of computing capacity availability of the portable information device; and

wherein the security configuration module dynamically configures the security module in response to the current state of computing capacity availability from the computing capacity determining module.

6. The portable information device of claim 1, wherein the configurable security module stores a plurality of threat definitions and scans at least one of the data store and network traffic for any presence of security threats based on the plurality of threat definitions.

7. The portable information device of claim 1, wherein the configurable security module provides a secure communications channel between the portable information device and the security server.

8. The portable information device of claim 1, wherein the security configuration module dynamically configures the security module based on available network communications bandwidth of the portable information device.

9. The portable information device of claim 1, wherein the security configuration module dynamically configures the security module based on available computing capacity in the portable information device.

10. The portable information device of claim 1, further comprising:

a user preferences module that obtains at least one parameter from the user selected from the group consisting of;

security risk tolerance information, user experience requirements, or any combination thereof;

wherein the security configuration module dynamically configures the security module based on the at least one parameter.

11. A method for automatically configuring a security module on a portable information device, the method comprising:

automatically determining, by the portable information device, a current location of the portable information device;

automatically maintaining, by the portable information device, a location profile database containing security risk profile information for a plurality of local networks at a plurality of geographic locations;

automatically re-assessing, by the portable information device, a current security risk to which the portable information device is exposed based on risk profile information contained in the location profile database corresponding to the present location; and

automatically re-configuring the security module based on the current security risk such that the security module operates in either;

a thin client configuration in which a majority of security services are provided by the security server that is located remotely from the portable information device;

or

a thick client configuration in which a majority of security services are provided by the configurable security module.

12. The method of claim 11, wherein the security module is configured to operate in the thin client configuration in response to an assessment of the current risk associated with the current location being a relatively high security risk;

and

wherein the security module is configured to operate in the thick client configuration in response to an assessment of the current risk associated with the current location being a relatively low security risk.

13. The method of claim 11, wherein automatically re-configuring the security module includes configuring the security module to operate in a hybrid configuration in which certain security services are selectively provided by the security server located remotely from the portable information device, and other security services are provided by the security module of the portable information device.

14. The method of claim 11, further comprising:

re-assessing a current state of computing capacity availability of the portable information device; and

re-configuring the security module in response to the current state of computing capacity availability.

15. The method of claim 11, further comprising:

storing a plurality of threat definitions, and scanning data stored in, or communicated with, the portable information device for any presence of security threats based on the plurality of threat definitions.

16. The method of claim 11, wherein the automatically reconfiguring of the security module includes configuring the security module based on available network communications bandwidth of the portable information device.

17. The method of claim 11, wherein the automatically reconfiguring of the security module includes configuring the security module based on available computing capacity of the portable information device.

18. The method of claim 11, further comprising:

obtaining at least one parameter from the user selected from the group consisting of;

security risk tolerance information, user experience requirements, or any combination thereof; and

configuring the security module based on the at least one parameter.