System and method for controlling mobile device access to a network

• US 8,750,108 B2
• Filed: 04/29/2012
• Issued: 06/10/2014
• Est. Priority Date: 10/23/2006
• Status: Active Grant

• Current Assignee: Skyhigh Security LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Laudermilch, Norm, Supernor, William, Boroday, Roman, Goldschlag, David
• Primary Examiner(s): Yao, Kwang B
• Assistant Examiner(s): DUDA, ADAM K
• Application Number:
  US13/459,213
• Publication Number:
  US 20120270522A1
• Time in Patent Office: 772 Days
• Field of Search: 709/203, 709/217, 709/220, 709/223, 709/224, 709/226, 709/229, 455/3.01, 455/411, 455/412.1, 455/414.1, 455/418, 455/419, 455/422.1, 455/423, 455/424, 455/425, 455/426.2, 455/432, 455/435, 455/456, 455/456.3, 455/502, 455/507, 455/556.1, 370/230, 370/328, 370/329, 370/338, 370/395.21, 370/401, 370/423
• US Class Current: 370/230
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

The method may include intercepting a data stream from the mobile device attempting to access the network resource, extracting information from the intercepted data stream relating to at least one of the mobile device or a user of the mobile device, accessing at least one of enterprise service based information and third party information regarding at least one of the mobile device or the user of the mobile device, determining whether the mobile device is authorized to access the network resource, preparing an access decision that specifies whether the mobile device is authorized to access the network resource, and storing the access decision in a database on the network.

Claims

1. A server, comprising:

a processor, wherein the server is configured for;

selecting a command of one or more commands for a mobile device;

constructing a wireless message for the mobile device, the wireless message including a command code associated with the command;

assigning a first type of priority to the wireless message, wherein the first type of priority is higher than a second type of priority assigned to other messages that do not include the one or more commands; and

initiating a communication link to the mobile device, wherein the initiating includes sending the wireless message to the mobile device via a wireless network, wherein the command code is recognizable to a listener component on the mobile device to perform an action on the mobile device.

2. The server of claim 1, wherein the server is further configured for:

provisioning client software for the mobile device in order to interact with the server.

3. The server of claim 1, wherein the one or more commands comprise:

a) a command that the mobile device should execute a wipe of certain data, which is resident on the mobile device;

b) a command to download a current security policy for the mobile device;

c) a command to provide device details associated with the mobile device for performing a device audit of the mobile device;

d) a command to provide information associated with vulnerability reporting associated with the mobile device;

e) a command to lock the mobile device;

f) a command to send a specified file back to the server;

g) a command to execute a soft reset of the mobile device;

h) a command to unlock the mobile device;

i) a command to reset a policy-based flag that forced the mobile device into a locked state; and

j) a command for the mobile device to run a manager program to register the mobile device with the server.

4. The server of claim 1, wherein the server is further configured for:

communicating a particular policy to the mobile device using a push protocol.

5. The server of claim 4, wherein the particular policy applies to a plurality of mobile devices.

15. The server of claim 1, wherein the server is further configured for:

setting information in a database, the information including an item that indicates the command is to be performed on the mobile device, wherein the command is selected based on the information in the database.

6. A method to be performed in conjunction with a processor operating in a computing device, comprising:

selecting, by the processor of the computing device, a command of one or more commands for a mobile device;

constructing a wireless message for the mobile device, the wireless message including a command code associated with the command;

assigning a first type of priority to the wireless message, wherein the first type of priority is higher than a second type of priority assigned to other messages that do not include the one or more commands; and

initiating a communication link to the mobile device, wherein the initiating includes sending the wireless message to the mobile device via a wireless network, wherein the command code is recognizable to a listener component on the mobile device to perform an action on the mobile device.

7. The method of claim 6, further comprising:

provisioning client software for the mobile device in order to interact with the server.

8. The method of claim 6, further comprising:

communicating a particular policy to the mobile device using a push protocol.

9. The method of claim 8, wherein the particular policy applies to a group of mobile devices.

10. A non-transitory media encoded with logic which, when executed by a processor, performs operations comprising:

selecting a command of one or more commands for a mobile device;

constructing a wireless message for the mobile device, the wireless message including a command code associated with the command;

assigning a first type of priority to the wireless message, wherein the first type of priority is higher than a second type of priority assigned to other messages that do not include the one or more commands; and

initiating a communication link to the mobile device, wherein the initiating includes sending the wireless message to the mobile device via a wireless network, wherein the command code is recognizable to a listener component on the mobile device to perform an action on the mobile device.

11. The media of claim 10, the operations further comprising:

provisioning client software for the mobile device in order to systematically interact with the server.

12. The media of claim 10, the operations further comprising:

communicating a particular policy to the mobile device using a push protocol.

13. The media of claim 12, wherein the particular policy applies to a group of mobile devices.

14. The media of claim 12, the operations further comprising:

providing an access decision based, at least in part, on third-party information.

16. A system, comprising:

a short message service (SMS) command service running on a processor of a server, wherein the SMS command service is configured to;

select a command of one or more commands for a mobile device;

construct an SMS message for the mobile device, the SMS message including a command code associated with the command; and

assign a first type of priority to the SMS message, wherein the first type of priority is higher than a second type of priority assigned to other messages that do not include the one or more commands; and

a device communication service configured to send the SMS message to the mobile device via a wireless network, wherein the command code is recognizable to a listener component on the mobile device to perform an action on the mobile device.

17. The system of claim 16, further comprising:

a user interface backend coupled to the server, wherein the user interface backend is configured to send a message to the SMS service when a policy is designated to be pushed to mobile devices immediately.

18. The system of claim 16, wherein the SMS message includes a plain-text prefix that is human-readable for display on the mobile device.

19. The system of claim 16, wherein the server is further configured for:

setting information in a database, the information including an item that indicates the command is to be performed on the mobile device, wherein the command is selected based on the information in the database.