System, method, and computer program product for disabling a communication channel during authentication

• US 8,261,093 B1
• Filed: 06/09/2011
• Issued: 09/04/2012
• Est. Priority Date: 03/27/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dhesi, Rajkaran Singh, Hunt, Simon, Parke, Paul Martin
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/156,548
• Time in Patent Office: 453 Days
• Field of Search: 713/189, 726/4
• US Class Current: 713/189
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 72/00 Local resource management

Abstract

A system, method, and computer program product are provided for disabling a communication channel during authentication. In operation, an authentication request for an authentication event is detected. Furthermore, a communication channel is disabled, in response to the authentication event.

Claims

1. A mobile device comprising:

a memory configured to store security computer code; and

a microprocessor coupled to the memory and configured to execute the security computer code;

wherein execution of the security computer code causes the mobile device to;

encrypt data stored in a memory of the device in response to a power down of the device, a logout, or a time out, such that the data is inaccessibble unless a user of the device successfully authenticates;

disable a communication channel during and in response to an authentication event to protect the data being encrypted or decrypted as part of the authentication event; and

re-enable the communication channel upon conclusion of the authentication event.

2. The mobile device of claim 1 wherein the disabled communication channel comprises a Bluetooth connection.

3. The mobile device of claim 1 wherein the computer security code is further configured to allow an administrator to remotely configure the disablement of the communication channel during the authentication event.

4. The mobile device of claim 1 wherein the security computer code is further configured to place the communication channel in a conditionally operable state after the authentication event based on the results of the communication event.

5. The mobile device of claim 4, wherein the security computer code is further configured to leave the communication channel disabled if the authentication fails.

6. The mobile device of claim 1 wherein the mobile device is configured to display a pre-authentication interface such that the mobile device permits data entry prior to a user being authenticated on the mobile device.

7. The mobile device of claim 6 wherein the mobile device is configured to communicate with a server or use functionality associated with the server through the pre-authentication interface.

8. The mobile device of claim 7 wherein the security computer code is further configured to restrict user access to data stored on the server or on the mobile device before the user is authenticated on the mobile device.

9. The mobile device of claim 6 wherein the mobile device is further configured to display a post-authentication interface providing access to various files, folders, and applications on the mobile device including data encrypted and inaccessible prior to the authentication event.

10. An administration system comprising:

a computer hardware configured to communicate with one or more mobile devices and one or more servers over a network, wherein the administration system comprises an interface permitting an administrator to configure the one or more mobile devices to;

disable a communication channel of one or more of the mobile devices during and in response to an authentication event to protect data being encrypted or decrypted as part of the authentication event; and

re-enable the communication channel upon conclusion of the authentication event.

11. The administration system of claim 10 wherein disablement of the communication channel is configured to occur upon an initial authentication event.

12. The administration system of claim 11 wherein the disablement of the communication channel is further configured to occur upon a re-authentication event.

13. A method of securing a mobile device, the method comprising:

executing code on the mobile device to encrypt data stored in the device'"'"'s memory in response to a power down of the device, a logout, or a time out, such that the data is inaccessible unless a user of the device successfully authenticates;

executing code on the mobile device to disable a communication channel during and in response to an authentication event to protect the data being encrypted or decrypted as part of the authentication event; and

executing code on the mobile device to re-enable the communication channel upon conclusion of the authentication event.

14. The method of claim 13 wherein the mobile device is instructed to perform the encryption, disablement of the communication channel, and re-enablement of the communication channel by an administration system.

15. The method of claim 13 wherein the code further causes the mobile device to display a pre-authentication interface such that the mobile device permits data entry prior to a user being authenticated on the mobile device.

16. The method of claim 15 wherein the code further causes the mobile device to communicate with a server or use functionality associated with the server through the pre-authentication interface.

17. The method of claim 16 wherein the code further causes the mobile device to restrict user access to data stored on the server or on the mobile device before the user is authenticated on the mobile device.

18. The method of claim 15 wherein the code further causes the mobile device to display a post-authentication interface providing access to various files, folders, and applications on the mobile device including data encrypted and inaccessible prior to the authentication event.