System and method for identifying and assessing vulnerabilities on a mobile communication device

• US 8,397,301 B2
• Filed: 11/18/2009
• Issued: 03/12/2013
• Est. Priority Date: 11/18/2009
• Status: Expired

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Hering, John G., Mahaffey, Kevin, Burgess, James
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): TRAN, PHUOC D
• Application Number:
  US12/621,431
• Publication Number:
  US 20110119765A1
• Time in Patent Office: 1,210 Days
• Field of Search: 726/24, 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 84/045 using private Base Stations, e.g. femto Base Stations, home Node B

Abstract

The invention is a system and method for identifying, assessing, and responding to vulnerabilities on a mobile communication device. Information about the mobile communication device, such as its operating system, firmware version, or software configuration, is transmitted to a server for assessment. The server accesses a data storage storing information about vulnerabilities. Based on the received information, the server may identify those vulnerabilities affecting the mobile communication device, and may transmit a notification to remediate those vulnerabilities. The server may also transmit result information about the vulnerabilities affecting the mobile communication device. The server may also store the received information about the device, so that in the event the server learns of new vulnerabilities, it may continue to assess whether the device is affected, and may accordingly notify or remediate the device. The server may provide an interface for an administrator to manage the system and respond to security issues.

Claims

1. A method comprising:

a) providing at least one server that accesses a data storage storing a plurality of sets of vulnerability information;

b) receiving, at the at least one server, a set of vulnerability identification information about a mobile communication device;

c) correlating, by the at least one server, the received set of vulnerability identification information to at least one of the plurality of sets of vulnerability information to generate a first set of result information; and

,

d) transmitting, by the at least one server, the first set of result information.

2. The method of claim 1, wherein the vulnerability identification information is information selected from the group consisting of an operating system type, an operating system version, a firmware version, a device model, carrier information, authentication information, user information, configuration information for the mobile communication device, hardware information, a list of files, a list of software components, a list of libraries, and a list of software applications on the mobile communication device.

3. The method of claim 1, wherein vulnerability information is information selected from the group consisting of a name, a description, a remediation instruction, a severity rating, a security impact summary, and a criterion for being vulnerable.

4. The method of claim 1, further comprising the step of:

e) transmitting, by the at least one server to the mobile communication device, a notification about the first set of result information.

5. The method of claim 4, wherein the notification includes an instruction related to the first set of result information.

6. The method of claim 1, further comprising the steps of:

e) updating at least one of the plurality of sets of vulnerability information on the data storage to form a plurality of updated sets of vulnerability information;

f) after the step of transmitting, by the at least one server, the first set of result information, correlating, by the at least one server, the received set of vulnerability identification information to the plurality of updated sets of vulnerability information to generate a second set of result information; and

,

g) transmitting, by the at least one server, the second set of result information.

7. The method of claim 1, further comprising the steps of:

e) updating at least one of the plurality of sets of vulnerability information on the data storage to form a plurality of updated sets of vulnerability information;

f) after the step of transmitting, by the at least one server, the first set of result information, correlating, by the at least one server, the received set of vulnerability identification information to the plurality of updated sets of vulnerability information to generate a second set of result information; and

,

g) transmitting, by the at least one server to the mobile communication device, a notification about the second set of result information.

8. The method of claim 1, further comprising the steps of:

e) receiving, at the data storage, a new set of vulnerability information to form an updated plurality of sets of vulnerability information;

f) after the step of transmitting, by the at least one server, the first set of result information, correlating, by the at least one server, the received set of vulnerability identification information to the updated plurality of sets of vulnerability information to generate a second set of result information; and

,

g) transmitting, by the at least one server, the second set of result information.

9. The method of claim 1, further comprising the steps of:

e) receiving, at the data storage, a new set of vulnerability information to form an updated plurality of sets of vulnerability information;

f) after the step of transmitting, by the at least one server, the first set of result information, correlating, by the at least one server, the received set of vulnerability identification information to the updated plurality of sets of vulnerability information to generate a second set of result information; and

,

g) transmitting, by the at least one server to the mobile communication device, a notification about the second set of result information.

10. A method comprising:

a) transmitting, from a mobile communication device, a set of vulnerability identification information to at least one server that accesses a data storage storing a plurality of sets of vulnerability information; and

,

b) receiving, at the mobile communication device from the at least one server, a first set of result information that correlates to the transmitted set of vulnerability identification information.

11. The method of claim 10, wherein the vulnerability identification information is information selected from the group consisting of an operating system type, an operating system version, a firmware version, a device model, carrier information, authentication information, user information, configuration information for the mobile communication device, hardware information, a list of files, a list of software components, a list of libraries, and a list of software applications on the mobile communication device.

12. The method of claim 10, wherein vulnerability information is information selected from the group consisting of a name, a description, a remediation instruction, a severity rating, a security impact summary, and a criterion for being vulnerable.

13. The method of claim 10, further comprising the step of:

c) receiving, at the mobile communication device from the at least one server, a notification about the first set of result information.

14. The method of claim 13, wherein the notification includes an instruction related to the first set of result information.

15. The method of claim 13, further comprising the step of:

d) displaying, on the mobile communication device, at least a portion of the received notification.

16. The method of claim 10, further comprising the step of:

c) receiving, at the mobile communication device from the at least one server, a notification about a second set of result information.

17. A method comprising:

a) providing at least one server that accesses a data storage storing a plurality of sets of vulnerability information;

b) receiving, at the at least one server, a first set of vulnerability identification information about a first mobile communication device;

c) correlating, by the at least one server, the first set of vulnerability identification information to at least one of the plurality of sets of vulnerability information to generate a first set of result information; and

,

d) transmitting, by the at least one server, the first set of result information;

e) receiving, at the at least one server, a second set of vulnerability identification information about a second mobile communication device, wherein the second set of vulnerability identification information differs from the first set of vulnerability identification information;

f) correlating, by the at least one server, the second set of vulnerability identification information to at least one of the plurality of sets of vulnerability information to generate a second set of result information; and

,

g) transmitting, by the at least one server, the second set of result information.

18. The method of claim 17, wherein the vulnerability identification information is information selected from the group consisting of an operating system type, an operating system version, a firmware version, a device model, carrier information, authentication information, user information, configuration information for the mobile communication device, hardware information, a list of files, a list of software components, a list of libraries, and a list of software applications on the mobile communication device.

19. The method of claim 17, wherein vulnerability information is information selected from the group consisting of a name, a description, a remediation instruction, a severity rating, a security impact summary, and a criterion for being vulnerable.

20. A system comprising:

a data storage storing a plurality of sets of vulnerability information;

a server for accessing the data storage, for receiving one or more sets of vulnerability identification information about one or more mobile communication devices, for correlating the one or more sets of received vulnerability identification information to at least one of the plurality of sets of vulnerability information to generate one or more sets of result information, for transmitting the one or more sets of result information, and for transmitting one or more notifications about the one or more sets of result information; and

,

a network connecting the at least one server, data storage, and the plurality of mobile communication devices.

21. The system of claim 20, further comprising a user interface for monitoring the plurality of mobile communication devices to identify which of the plurality of mobile communication devices is vulnerable.

22. The system of claim 20, wherein vulnerability information is information selected from the group consisting of a name, a description, one or more remediation instructions, a severity rating, a security impact summary, and one or more criteria for being vulnerable.

23. A method comprising:

a) providing at least one server that accesses a data storage storing a plurality of sets of vulnerability information;

b) receiving, at the at least one server, a set of vulnerability identification information about a mobile communication device;

c) correlating, by the at least one server, the received set of vulnerability identification information to at least one of the plurality of sets of vulnerability information to generate a first set of result information; and

,

d) transmitting, by the at least one server to the mobile communication device, a notification about the first set of result information.

24. The method of claim 23, wherein the vulnerability identification information is information selected from the group consisting of an operating system type, an operating system version, a firmware version, a device model, carrier information, authentication information, user information, configuration information for the mobile communication device, hardware information, a list of files, a list of software components, a list of libraries, and a list of software applications on the mobile communication device.

25. The method of claim 23, wherein vulnerability information is information selected from the group consisting of a name, a description, a remediation instruction, a severity rating, a security impact summary, and a criterion for being vulnerable.

26. The method of claim 23, further comprising the steps of:

e) receiving, at the data storage, a new set of vulnerability information to form an updated plurality of sets of vulnerability information;

f) correlating, by the at least one server, the received set of vulnerability identification information to the updated plurality of sets of vulnerability information to generate a second set of result information; and

,

g) transmitting, by the at least one server, the second set of result information.

27. The method of claim 23, further comprising the steps of:

e) receiving, at the data storage, a new set of vulnerability information to form an updated plurality of sets of vulnerability information;

f) correlating, by the at least one server, the received set of vulnerability identification information to the updated plurality of sets of vulnerability information to generate a second set of result information; and

,

g) transmitting, by the at least one server to the mobile communication device, a notification about the second set of result information.