Secure mobile platform system

• US 8,087,067 B2
• Filed: 10/21/2008
• Issued: 12/27/2011
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin, Hering, John G., Burgess, James
• Primary Examiner(s): Chen, Shin-Hon
• Application Number:
  US12/255,632
• Publication Number:
  US 20100100939A1
• Time in Patent Office: 1,162 Days
• Field of Search: None
• US Class Current: 726/3
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/08 Access security

Abstract

The present invention is directed toward a secure platform which enables mobile devices, such as a cell phones, smartphones, or PDAs, to have relationships with services or service providers that are controlled by the state of security on each device. In an embodiment, the platform is comprised of a server that receives data from security software on a mobile device regarding the device'"'"'s security state. The platform enables access to a service to be granted, denied, or limited based on the security state of the mobile device. The platform may provide two-way communications between a mobile device and a service so that the platform can enforce access security both from the client to the service and from the service to the client. Furthermore, the platform allows services or service providers to evaluate the security state of a device independently of using the platform to communicate with the device.

Claims

1. A system comprising:

a server having a security component for communicating with a mobile communications device and with a service provider, the server security component further accessing a database available to store security data generated by the mobile communications device;

the server security component receiving from the mobile communications device security data generated by the mobile communications device and causing the received mobile communications device security data to be stored in the database accessible to the server security component;

the server security component processing the received mobile communications device security data to assess a current security state of the mobile communications device; and

in response to a request from the mobile communications device for access to the service provider or to a request from a service provider to access to the mobile communications device, the server security component granting access to the requested service provider or to the requested mobile communications device at an access level depending on the current security state assessment of the mobile communications device.

2. The system of claim 1, wherein the server security component, during the processing to assess a current security state of the mobile communication device accesses the database containing mobile communications device security data and compares the received mobile communication device security data to the other data stored in database to assess the security state of the mobile communications device.

3. The system of claim 1, wherein if the server security component determines that the mobile communication device security data is not current during the assessment of the current security state, the server security component assesses security events data generated by the mobile communications device to determine severity levels for the security events, and uses this data as part of the current security state assessment for the mobile communications device.

4. A method comprising:

at a server in communication with a mobile communications device and with a service provider, receiving a request from the service provider for access to the mobile communications device or from the mobile communications device for access to the service provider;

receiving by the server security component from the mobile communications device security data generated by the mobile communication device;

in response to the request for access to the mobile communications device or for access to the service provider, determining by the server security component the current security state assessment of the requesting or requested mobile communications device by processing the received mobile communication device security data; and

at the server security component, granting access to the mobile communications device or access to the requested service provider at an access level depending upon the current security state assessment of the mobile communications device.

5. The method of claim 4, wherein the processing step further includes, at the server security component, processing the data received by the server security component to assess a severity of any security events data generated by the mobile communications device to determine severity levels for the security events and uses this data as part of the current security state assessment for the mobile communication device.

6. A non-transitory computer readable storage medium containing computer readable instructions comprising:

computer program code for, at a server in communication with a mobile communications device and with a service provider, receiving a request from the service provider for access to a the mobile communications device;

computer program code for receiving by the server security component from the mobile communication device security data generated by the mobile communication device;

computer program code for, in response to the request for access to the mobile communications device, on the server, assessing the current security state of the mobile communications device by processing the received mobile communications device security data; and

computer program code for granting by the server to the service provider access to the requested mobile communications device at an access level depending upon the current security state assessment of the mobile communications device.

7. The non-transitory computer readable storage medium containing computer readable instructions of claim 6, wherein computer code for assessing the security state of the mobile communications device further comprises:

computer program code for providing a local security component on the mobile communications device;

computer program code for receiving at the local security component security data generated by at least one application running the mobile communications device; and

computer program code for processing the received data by the local security component to assess a current security state of the mobile communications device.

8. A system comprising:

a server having a security component for communicating with a mobile communications device and with a service provider, the server security component further accessing a database available to store security data generated by the mobile communications device;

the server security component receiving from the mobile communications device security data generated by the mobile communications device and causing the received mobile communications device security data to be stored in the database accessible to the server security component;

the server security component processing the received mobile communications device security data to assess a current security state of the mobile communications device; and

in response to a request from the mobile communications device for access to the service provider or to a request from a service provider to access to the mobile communications device, the server security component providing current security state assessment data to the requested service provider or to the requested mobile communications device for enforcement of an application-level security policy that determines whether access is to be granted and at what level.

9. A system comprising:

a server having a security component for communicating with a mobile communications device and with a service provider, the server security component further accessing a database available to store security data generated by the mobile communications device;

the server security component receiving from the mobile communications device security data generated by the mobile communications device and causing the received mobile communications device security data to be stored in the database accessible to the server security component;

the server security component processing the received mobile communications device security data to assess a current security state of the mobile communications device; and

in response to a request from the mobile communications device for access to the service provider, the server security component providing current security state assessment data to the requested service provider for enforcement of an application-level security policy that determines whether mobile communications device access is to be granted to the mobile communications device and at what level.

10. A system comprising:

a server having a security component for communicating with a mobile communications device and with a service provider, the server security component further accessing a database available to store security data generated by the mobile communications device;

the server security component receiving from the mobile communications device security data generated by the mobile communications device and causing the received mobile communications device security data to be stored in the database accessible to the server security component;

the server security component processing the received mobile communications device security data to assess a current security state of the mobile communications device; and

in response to a request from a service provider for access to the mobile communications device, the server security component providing current security state assessment data to the requested service provider for enforcement of an application-level security policy that determines whether access is to be granted and at what level.