Systems and methods for providing mobile security based on dynamic attestation

• US 8,850,588 B2
• Filed: 07/27/2012
• Issued: 09/30/2014
• Est. Priority Date: 05/01/2012
• Status: Active Grant

• Current Assignee: Taasera Licensing LLC (Quest Patent Research Corporation)
• Original Assignee: Taasera, Inc. (Full Circle Investments, Inc.)
• Inventors: Kumar, Srinivas, Pollutro, Dennis
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US13/559,665
• Publication Number:
  US 20130298242A1
• Time in Patent Office: 795 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Instrumented networks, machines and platforms having target subjects (devices, transactions, services, users, organizations) are disclosed. A security orchestration service generates runtime operational integrity profiles representing and identifying a level of threat or contextual trustworthiness, at near real time, of subjects (including mobile devices) and applications on the instrumented target platform. Methods and systems are disclosed for dynamic attestation of mobile device integrity based upon subject reputation scores. In an embodiment, a method scores trustworthiness of a mobile device based on reputation scores for users associated with the device and/or a device reputation score. The method generates runtime integrity alerts regarding execution anomalies for applications executing on the device, calculates risks based on a ruleset, and determines a calculus of risk for the device. The method sends endpoint events comprising data and content of the integrity warnings to a trust orchestrator, which generates an integrity profile based on the endpoint events.

Claims

1. A method for providing runtime operational integrity of a mobile device to a mobile service provider using an endpoint trust agent, and a trust orchestrator, the method comprising:

generating, by the endpoint trust agent, one or more runtime integrity alerts regarding behavioral risks posed by actions of applications not operating with integrity currently executing on the mobile device;

identifying, by the endpoint trust agent, risks based on a predetermined ruleset;

determining a threat as an infected state on the mobile device by a calculus of risk based at least upon the integrity alerts and identified risks;

sending, by the endpoint trust agent, a plurality of endpoint events comprising data and content of runtime integrity warnings to the trust orchestrator to apply flow controls based on the infected state on the mobile device; and

generating, by the trust orchestrator, an integrity profile for applications not operating with integrity based on the received endpoint events, wherein the endpoint events are temporal events generated based on a normalization and collation of elements in endpoint assessment reports from a plurality of collaboration services.

2. The method of claim 1, further comprising sending, by the trust orchestrator, system warnings based on endpoint execution state assessments to:

a network trust agent;

a mobile policy manager; and

a mobile device manager,

wherein the execution state assessments include risky behaviors and threats posed by the one or more applications not operating with integrity currently executing on the mobile device.

3. The method of claim 1, further comprising processing and correlating for the mobile device, by the trust orchestrator:

a system integrity profile generated based on the calculus of risk; and

a system infection profile received from a network analyzer.

4. The method of claim 3, wherein the network analyzer monitors network traffic associated with a mobile device.

5. The method of claim 1, further comprising a network trust agent configured to:

subscribe for reputation services from the trust orchestrator, the reputation services associated with the mobile device, and

receive threat intelligence to remediate network flows associated with the mobile device.

6. The method of claim 1, further comprising sending, by the network trust agent, messages or directives to network security frameworks and/or wireless access points to apply the flow controls based on the infected state of the mobile device.

7. The method of claim 2, further comprising sending, by the mobile policy manager, messages or directives to the mobile device manager to apply controls based on a received infected state of a mobile endpoint.

8. The method of claim 2, further comprising sending, by the mobile device manager, messages or directives to an endpoint agent to activate or deactivate specific feature controls on the mobile device when it is determined to be infected by the calculus of risk.

9. The method of claim 1, further comprising sending, by the trust orchestrator, messages or directives to the endpoint trust agent to apply specific controls on the mobile device when it is determined to be infected by the calculus of risk.

10. The method of claim 1, further comprising notifying a user of a state of an infected or compromised mobile device as at least one of:

an asynchronous push notification to the mobile device;

a text alert message sent to the mobile device;

email alert message;

a warning message during initiation of a transaction with a service from the mobile device.

11. The method of claim 1, wherein the calculus of risk is based on:

a runtime assessment of correlated mobile network activity, system configuration, resource utilization and mobile application integrity for the mobile device using a plurality of sensory inputs from network and endpoint sensors, wherein the runtime assessment is based on one or more of;

a network security scan report for the mobile device;

parsing a plurality of received reports for categorization by a network address or a geo-location of the mobile device;

evaluating the runtime execution context of applications currently executing on the mobile device;

evaluating an identity and a role based context of a user currently logged into or users associated with the mobile device; and

classifying threats identified for the mobile device, the applications, and/or the users,

wherein the ruleset is stored in a rules repository of object attributes and wherein the attributes include constraints, a sample rate, a recurrence, a score, and a weight for integrity assessments of the mobile device, the applications, and/or the users.

12. The method of claim 11, further comprising generating subject reputation scores for the mobile device, the applications, and/or the users based on the calculus of risk;

and

generating trustworthiness scores for the mobile device, the applications, and/or the users based on the subject reputation scores, applications installed on the mobile device, and a patch level of an operating system (OS) running on the mobile device.

13. The method of claim 12, wherein the trustworthiness scores are further based upon execution behaviors and threats posed by the applications.

14. The method of claim 12, wherein one or more features or capabilities of the mobile device are altered, when the mobile device is determined to be infected by the calculus of risk, as a remediation action in response to determining that a trustworthiness score of the mobile device, the applications, or the users is below a predetermined threshold.

15. The method of claim 14, wherein the remediation actions comprise de-activating or activating one or more features or capabilities of the infected mobile device.

16. The method of claim 14, wherein the one or more features or capabilities of the infected mobile device include networking capabilities, service access privileges, resource access privileges, application execution privileges, and communications capabilities.

17. The method of claim 14, wherein the remediation action is based on a geo-location of the infected mobile device.

18. The method of claim 1, wherein the network trust agent, the endpoint trust agent and the trust orchestrator are configured to execute on a computing platform accessible by the mobile service provider.

19. The method of claim 1, wherein the mobile device is one of a personal digital assistant (PDA), a device running a mobile operating system, a smart phone, a mobile phone, a hand held computer, a tablet computer, an electronic reading device, a netbook computer, a palmtop computer, a laptop computer, or an ultra-mobile PC.

20. A system for providing runtime operational integrity to a mobile service provider including execution behaviors and threats posed by an infected mobile computing device or an application not operating with integrity currently executing on the mobile computing device, the system comprising:

a memory;

a computing platform including a computer processor, a network trust agent, an endpoint trust agent, and a trust orchestrator, wherein the computing platform is configured to;

generate, by the endpoint trust agent, runtime integrity alerts regarding execution behaviors of the application and risks based on rulesets and a calculus of risk;

send, by the endpoint trust agent, runtime integrity warnings pertaining to data and content as endpoint events to the trust orchestrator;

generate, by the trust orchestrator, an integrity profile for the endpoint based on the received endpoint events pertaining to data and content;

process and correlate, by the trust orchestrator one or more of;

a system integrity profile generated based on a calculus of risk;

a plurality of temporal events generated based on a normalization and collation of elements in endpoint assessment reports from a plurality of collaboration services; and

a system infection profile received from a network analyzer;

send, by the trust orchestrator, system warnings based on an endpoint execution state of the mobile application or mobile computing device as a threat posture assessment to one or more of;

a network trust agent,

a mobile policy manager, and

a mobile device manager;

send, by the network trust agent, messages or directives to network security frameworks and/or wireless access points to apply flow controls based on the received execution state of the infected mobile device;

send, by the mobile policy manager, messages or directives to the mobile device manager to apply controls based on the received execution state of the infected mobile device;

send, by the mobile device manager, messages or directives to an endpoint agent to activate or deactivate specific feature controls on the infected mobile device; and

send, by the trust orchestrator, messages or directives to the endpoint trust agent to apply specific controls on the infected mobile device.

21. An architecture instrumented to provide runtime operational integrity by identifying execution behaviors and threats posed by a mobile device and applications executing on the mobile device to a mobile service provider, the architecture comprising:

an endpoint trust agent including;

a process monitor configured to observe local execution context of the applications,

a socket monitor configured to observe network activities of the applications,

a resource utilization module monitor configured to observe system and platform resources consumed by the applications, and

an application integrity module configured to assess operational integrity of the mobile device based on a ruleset;

wherein native machine instrumentation for the mobile device is configured to;

represent event subscriptions, callbacks, notification mechanisms provided by an operating system (OS) on the mobile device, and

generate raw events;

extended trust instrumentation;

a runtime monitor configured to;

subscribe to and receive near real time asynchronous notifications of application events for the applications from the extended trust instrumentation, and

generate and send dynamic expressions or rules as application filters linked to running instances of the applications;

a system event correlator configured to correlate system events of the mobile device to determine a calculus of risk;

a trust orchestrator configured to orchestrate actionable intelligence based on the calculus of risk by integrating security intelligence about the mobile device and the applications; and

an endpoint trust sensor configured to measure runtime operational integrity of the mobile device by evaluating risk based on actions of an application executing on, or a user of, the mobile device and receiving the raw events from the native machine instrumentation, wherein the endpoint trust sensor is further configured to perform signature-less behavior based risk correlation using a threat life cycle model to cluster and classify malware for the identification of an infected mobile device.

22. The architecture of claim 21, wherein the trust orchestrator is configured to use an application programming interface (API) collaboration bus to integrate the security intelligence.

23. The architecture of claim 21, wherein the application events include one or more of registry, file system, network, storage, input, output, memory, process operation events, and resource events stemming from usage of a system resource by the applications.

24. The architecture of claim 21, wherein the extended trust instrumentation is comprised of layered extensions to the native machine instrumentation.

25. The architecture of claim 21, wherein the application filters are expressed using standards based schema definitions.

26. The architecture of claim 22, wherein the runtime monitor is configured to use application programming interfaces (APIs) to subscribe to the asynchronous application events.