System and method for automatically configuring a mobile device

• US 7,787,863 B2
• Filed: 05/24/2005
• Issued: 08/31/2010
• Est. Priority Date: 05/24/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: van de Groenendaal, Joannes G.
• Primary Examiner(s): Afshar; Kamran
• Assistant Examiner(s): Sarwar; Babar
• Application Number:
  US11/136,028
• Publication Number:
  US 20050260996A1
• Time in Patent Office: 1,925 Days
• Field of Search: 455/419, 4554321-453, 455/455, 455/516, 455/67.11, 455/410, 455/509, 455/411, 455/78, 455/230, 455/457, 455/456.3, 455/268, 370/329, 370/331, 370/341, 370/338, 713151-153, 713/166, 713168-171, 709/229, 709/225, 709/219
• US Class Current: 455/411
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04M 1/67 by electronic means
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading
• CPC Class Codes: H04M 1/72451 according to schedules, e.g. using calendar applications
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04M 1/72463 to restrict the functionality of the device
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The disclosure provides a wireless agent for a mobile device. In one embodiment, the example wireless agent is operable to dynamically determine an access point for wireless communications from a mobile device through a network. The wireless agent is further operable to automatically select one of a plurality of security profiles associated with a mobile device based, at least in part, on the determined access point, with each security profile including a plurality of security parameters for accessing at least one wireless network. The wireless agent then modifies at least one of plurality of network configuration options of the mobile device based on the selected security profile and automatically attempts to communicably connect the mobile device to the access point using the network configuration options.

Claims

1. A wireless agent for configuring and securing wireless access to a network, wherein the wireless agent comprises at least one processing device configured to:

provide a request from a mobile device to wirelessly communicate with a network, wherein the request includes one or more characteristics dynamically describing the mobile device, and wherein the characteristics describing the mobile device include at least one physical characteristic and at least one logical characteristic describing a location of the mobile device;

implement a security profile on the mobile device based on the characteristics describing the mobile device, wherein the security profile includes one or more security parameters defining an access zone for the network;

implement at least one connection profile on the mobile device based on the characteristics describing the mobile device, wherein the connection profile configures one or more of the characteristics describing the mobile device to enforce the security parameters defining the access zone;

authorize the mobile device to wirelessly communicate with the network from within the access zone, wherein the security parameters include one or more in-house security parameters in effect in response to the location of the mobile device being within the network and one or more on-the-road security parameters in effect in response to the location of the mobile device being remote from the network, wherein the connection profile enforces the security parameters defining the access zone by instructing the mobile device to;

automatically collect security information on the mobile device; and

encrypt the collected security information for storage on the mobile device.

2. The wireless agent of claim 1, wherein the at least one logical characteristic includes a network protocol associated with a wireless access point to which the mobile device is connected.

3. The wireless agent of claim 2, wherein the at least one processing device is further configured to authorize the mobile device to wirelessly communicate with the network in response to the security parameters defining the access zone permitting wireless communication using the network protocol associated with the wireless access point.

4. The wireless agent of claim 1, wherein the at least one processing device is further configured to disable a network adapter installed on the mobile device to implement the at least one connection profile.

5. The wireless agent of claim 1, wherein the at least one processing device is further configured to disable Internet sharing or network file sharing on the mobile device to implement the at least one connection profile.

6. The wireless agent of claim 1, wherein the at least one processing device is further configured to invoke one or more actions to implement the at least one connection profile, wherein the one or more actions include at least one of:

disabling wireless access to the network on the mobile device;

disabling wireless access to the network from at least one of a specified port, Internet Protocol address, or access point;

disabling at least one of Internet sharing or network file sharing on the mobile device;

or

updating at least one of the security profile or the connection profile implemented on the mobile device.

7. The wireless agent of claim 1, wherein the collected security information includes at least one of:

networks that the mobile device has previously visited;

access points that the mobile device has previously used;

performance metrics of the mobile device;

intrusion attempts against the mobile device;

or indications that a user of the mobile device has attempted to bypass one or more of the security profile or the connection profile.

8. The wireless agent of claim 1 wherein the connection profile further enforces the security parameters defining the access zone by further instructing the mobile device to provide the encrypted security information to a wireless gateway coupled to the network in response to the location of the mobile device being within the network, and wherein the wireless gateway is configured to decrypt the encrypted security information and store the decrypted security information for subsequent processing.

9. The wireless agent of claim 8, wherein the wireless gateway is further configured to:

update the security profile on a server coupled to the network based on the subsequent processing for the decrypted security information; and

communicate the updated security profile to the mobile device, wherein the at least one processing device is further configured to implement the updated security profile on the mobile device.

10. The wireless agent of claim 9, wherein the wireless gateway is further configured to communicate the updated security profile to a plurality of mobile devices that wirelessly communicate with the network from within the access zone.

11. The wireless agent of claim 1, wherein the at least one logical characteristic includes a first wireless access point to which the mobile device is connected, and wherein the at least one processing device is further configured to:

determine that the mobile device has connected to a second wireless access point; and

update at least one of the security profile or the connection profile implemented on the mobile device based on one or more characteristics of the second wireless access point.

12. The wireless agent of claim 1, wherein the at least one processing device is further configured to:

receive an updated security profile from a wireless gateway coupled to the network in response to the location of the mobile device changing from remote from the network to within the network; and

implement the updated security profile on the mobile device.

13. A method for configuring and securing wireless access to a network, comprising:

providing a request from a mobile device to wirelessly communicate with a network, wherein the request includes one or more characteristics dynamically describing the mobile device, and wherein the characteristics describing the mobile device include at least one physical characteristic and at least one logical characteristic describing a location of the mobile device;

implementing a security profile on the mobile device based on the characteristics describing the mobile device, wherein the security profile includes one or more security parameters defining an access zone for the network;

implementing at least one connection profile on the mobile device based on the characteristics describing the mobile device, wherein the connection profile configures one or more of the characteristics describing the mobile device to enforce the security parameters defining the access zone;

authorizing the mobile device to wirelessly communicate with the network from within the access zone, wherein the security parameters include one or more in-house security parameters in effect in response to the location of the mobile device being within the network and one or more on-the-road security parameters in effect in response to the location of the mobile device being remote from the network, wherein the connection profile enforces the security parameters defining the access zone by instructing the mobile device to;

automatically collect security information on the mobile device; and

encrypt the collected security information for storage on the mobile device.

14. The method of claim 13, wherein the at least one logical characteristic includes a network protocol associated with a wireless access point to which the mobile device is connected.

15. The method of claim 14, further comprising authorizing the mobile device to wirelessly communicate with the network in response to the security parameters defining the access zone permitting wireless communication using the network protocol associated with the wireless access point.

16. The method of claim 13, further comprising disabling a network adapter installed on the mobile device to implement the at least one connection profile.

17. The method of claim 13, further comprising disabling Internet sharing or network file sharing on the mobile device to implement the at least one connection profile.

18. The method of claim 13, further comprising invoking one or more actions to implement the at least one connection profile, wherein the one or more actions include at least one of:

disabling wireless access to the network on the mobile device;

disabling wireless access to the network from at least one of a specified port, Internet Protocol address, or access point;

disabling at least one of Internet sharing or network file sharing on the mobile device;

or

updating at least one of the security profile or the connection profile implemented on the mobile device.

19. The method agent of claim 13, wherein the collected security information includes at least one of:

networks that the mobile device has previously visited;

access points that the mobile device has previously used;

performance metrics of the mobile device;

intrusion attempts against the mobile device;

or

indications that a user of the mobile device has attempted to bypass one or more of the security profile or the connection profile.

20. The method of claim 13, wherein the connection profile further enforces the security parameters defining the access zone by further instructing the mobile device to provide the encrypted security information to a wireless gateway coupled to the network in response to the location of the mobile device being within the network, and wherein the wireless gateway is configured to decrypt the encrypted security information and store the decrypted security information for subsequent processing.

21. The method of claim 20, wherein the wireless gateway is further configured to:

update the security profile on a server coupled to the network based on the subsequent processing for the decrypted security information; and

communicate the updated security profile to the mobile device, wherein the at least one processing device is further configured to implement the updated security profile on the mobile device.

22. The method of claim 21, wherein the wireless gateway is further configured to communicate the updated security profile to a plurality of mobile devices that wirelessly communicate with the network from within the access zone.

23. The method of claim 13, wherein the at least one logical characteristic includes a first wireless access point to which the mobile device is connected, and wherein the method further comprises:

determining that the mobile device has connected to a second wireless access point; and

updating at least one of the security profile or the connection profile implemented on the mobile device based on one or more characteristics of the second wireless access point.

24. The method of claim 13, further comprising:

receiving an updated security profile from a wireless gateway coupled to the network in response to the location of the mobile device changing from remote from the network to within the network; and

implementing the updated security profile on the mobile device.

25. A system for configuring and securing wireless access to a network, comprising:

a memory configured to store a security profile, wherein the security profile includes one or more security parameters defining an access zone for a network; and

at least one processing device configured to;

provide a request from a mobile device to wirelessly communicate with the network, wherein the request includes one or more characteristics dynamically describing the mobile device, and wherein the characteristics describing the mobile device include at least one physical characteristic and at least one logical characteristic describing a location of the mobile device;

implement the security profile on the mobile device based on the characteristics describing the mobile device;

implement at least one connection profile on the mobile device based on the characteristics describing the mobile device, wherein the connection profile configures one or more of the characteristics describing the mobile device to enforce the security parameters defining the access zone; and

authorize the mobile device to wirelessly communicate with the network from within the access zone, wherein the security parameters include one or more in-house security parameters in effect in response to the location of the mobile device being within the network and one or more on-the-road security parameters in effect in response to the location of the mobile device being remote from the network, wherein the connection profile enforces the security parameters defining the access zone by instructing the mobile device to;

automatically collect security information on the mobile device; and

encrypt the collected security information for storage on the mobile device.

26. The mobile device of claim 25, wherein the at least one logical characteristic includes a network protocol associated with a wireless access point to which the mobile device is connected.

27. The mobile device of claim 26, wherein the at least one processing device is further configured to authorize the mobile device to wirelessly communicate with the network in response to the security parameters defining the access zone permitting wireless communication using the network protocol associated with the wireless access point.

28. The mobile device of claim 25, wherein the at least one processing device is further configured to disable a network adapter installed on the mobile device to implement the at least one connection profile.

29. The mobile device of claim 25, wherein the at least one processing device is further configured to disable Internet sharing or network file sharing on the mobile device to implement the at least one connection profile.

30. The mobile device of claim 25, wherein the at least one processing device is further configured to invoke one or more actions to ,implement the at least one connection profile, wherein the one or more actions include at least one of:

disabling wireless access to the network on the mobile device;

disabling wireless access to the network from at least one of a specified port, Internet Protocol address, or access point;

disabling at least one of Internet sharing or network file sharing on the mobile device;

or

updating at least one of the security profile or the connection profile implemented on the mobile device.

31. The mobile device of claim 25, wherein the collected security information includes at least one of:

networks that the mobile device has previously visited;

access points that the mobile device has previously used;

performance metrics of the mobile device;

intrusion attempts against the mobile device;

or

indications that a user of the mobile device has attempted to bypass one or more of the security profile or the connection profile.

32. The mobile device of claim 25, wherein the connection profile further enforces the security parameters defining the access zone by further instructing the mobile device to provide the encrypted security information to a wireless gateway coupled to the network in response to the location of the mobile device being within the network, and wherein the wireless gateway is configured to decrypt the encrypted security information and store the decrypted security information for subsequent processing.

33. The mobile device of claim 32, wherein the wireless gateway is further configured to:

update the security profile on a server coupled to the network based on the subsequent processing for the decrypted security information; and

communicate the updated security profile to the mobile device, wherein the at least one processing device is further configured to implement the updated security profile on the mobile device.

34. The mobile device of claim 33, wherein the wireless gateway is further configured to communicate the updated security profile to a plurality of mobile devices that wirelessly communicate with the network from within the access zone.

35. The mobile device of claim 25, wherein the at least one logical characteristic includes a first wireless access point to which the mobile device is connected, and wherein the at least one processing device is further configured to:

determine that the mobile device has connected to a second wireless access point; and

update at least one of the security profile or the connection profile implemented on the mobile device based on one or more characteristics of the second wireless access point.

36. The mobile device of claim 25, wherein the at least one processing device is further configured to:

receive an updated security profile from a wireless gateway coupled to the network in response to the location of the mobile device changing from remote from the network to within the network; and

implement the updated security profile on the mobile device.