System for data flow protection and use control of applications and portable devices configured by location

• US 8,850,513 B2
• Filed: 12/28/2011
• Issued: 09/30/2014
• Est. Priority Date: 12/28/2011
• Status: Active Grant

• Current Assignee: Samsung Eletrônica da Amazônia Ltda (Samsung Electronics Co. Ltd.)
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Park, Juha, Marcus, Vinicius Stradiotto Farbiarz, Rachid, Euler Mendes, Figueiredo, Felipe Augusto Pereira de Figueiredo, Junquera, Glauco Barroso, Chiossi, Rodrigo Rafael Santos Costa, Schnick, Guilherme Augusto Kusano, Ywata, Luiz Gustavo De Silva
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US13/339,048
• Publication Number:
  US 20130174210A1
• Time in Patent Office: 1,007 Days
• Field of Search: 726/1, 726/2, 726/3, 726/4
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

The present invention relates to a system for implementing a firewall service on portable devices such as mobile phones, tablets or notebooks, which has changed their security settings depending on the location where they are. More specifically, the invention relates to a method of protecting data flow and control of use of devices and functional applications present in a portable device and configured from their location.

Claims

1. A system for the protection of data flow and control of applications and use of a portable device configured by a location, the system comprising:

the portable device; and

a firewall inserted into a basic architecture of the portable device between a Data Network interface and a CPU, the system configured to;

identify whether a data packet being sent by the portable device should be forwarded or discarded;

determine whether a data packet arriving at the portable device should be received or dropped in accordance with a set of rules and policies defined in configuration blocks;

restrict or permit use of functional devices embedded in or connected to the portable device; and

determine filtering rules of the data packets to apply different settings for different locations of the portable device.

2. The system of claim 1, wherein the data packet may be received by interfaces comprising Wi-Fi, Bluetooth, or Zigbee, or by a cellular network using 2G, 3G, or 4G technologies.

3. The system of claim 1, wherein the location of the portable device is determined through a geo-location, detection of a Wi-Fi network, or detection of a connection to a Virtual Private Network (VPN) that define geographic coordinates of the device.

4. The system of claim 3, wherein the geographic coordinates of the device may be defined by GPS or by triangulation of signals from cellular base stations.

5. The system of claim 3, wherein the identification of locations for Wi-Fi networks is performed by detecting the proximity of Wi-Fi Access Points previously defined in the firewall configuration.

6. The system of claim 3, wherein by making a comparison of parameters of Wi-Fi networks, the system is able to determine the location of the portable device.

7. The system of claim 3, wherein an active VPN connection can be also used to determine the location of the portable device.

8. The system of claim 1, further comprising controlling the use of functional devices which are connected to the CPU of the device, by the CPU of the portable device that communicates with the Firewall to determine whether, at any given time, a given functional device may or may not be activated or used, and the permissions for the activation of functional devices configured in accordance with the location of the portable device and its configuration.

9. The system of claim 1, wherein the system constantly monitors the data that indicates the location, and whenever a change is identified in the data, an event is generated within the Firewall, making their configuration blocks to be checked, searching for a block that describes the same location of the active portable device, and if the block is found, the Filtering Rules and Policies of the devices of the block will be applied on the portable device.

10. The system of claim 1, wherein flow of decisions is started whenever an event of change of position is posted on the firewall, a first check is done if the portable device is connected to a Virtual Private Network (VPN), a Wi-Fi network, or geographical position.

11. The system of claim 1, wherein, once configured, one function of the firewall is to filter the data packets passing through the network interface of the portable device.

12. The system of claim 1, wherein, when entering the network interface of the portable device, the data packet is then checked by the firewall, which compares the contents of the data packet to the active firewall filtering settings and, depending on this comparison, the packet is dropped or the package is allowed to be sent to application layers.

13. The system of claim 1, wherein, when sending data packets, before the data packet is sent to a destination, content of the data packet is verified by the firewall and compared to active filtering settings of the firewall, and the data packet may be dropped or sent to the recipient, depending on the active filtering settings.

14. The system of claim 1, wherein the use of functional devices that are attached to or embedded to the portable device are controlled, avoiding leakage or capture of sensitive information from the portable device, at specific locations.

15. The system of claim 1, wherein the settings of firewall policies, which can be used to enable or disable features of the devices, are remotely configured.