Security management system and method for location-based mobile device

• US 9,071,621 B2
• Filed: 05/24/2012
• Issued: 06/30/2015
• Est. Priority Date: 07/06/2011
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: You, Yong Ho, Kong, Hyoung Suk
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US13/479,763
• Publication Number:
  US 20130013932A1
• Time in Patent Office: 1,132 Days
• Field of Search: 713/189, 713/201, 726/4, 455/456.3
• US Class Current: 1/1
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A method and a system of managing information security for a mobile device in a restricted area based on location information regarding the mobile device are provided. The method includes receiving, by the mobile device, a request for the execution of an application program in a restricted area from a server managing the restricted area, executing, by the mobile device, the application program requested for execution when the program was set to be executable according to a security policy set to the restricted area, encrypting, by the mobile device, a file, created according to the execution of the application program, based on location information regarding the mobile device, and storing the encrypted file.

Claims

1. A method for managing information security for a mobile device in a restricted area, based on location information regarding the mobile device, the method comprising:

receiving, by the mobile device, a request for the execution of an application program in a restricted area from a server managing the restricted area;

executing, by the mobile device, the application program requested for execution when the program is set to be executable according to a security policy set to the restricted area;

encrypting, by the mobile device, a file, created according to the execution of the application program, based on location information regarding the mobile device, the encrypted file including a flag indicating whether the encrypted file is created while the mobile device is in the restricted area;

storing the encrypted file;

receiving, by the mobile device, when the mobile device is located in the restricted area, a request for the execution of the encrypted file;

requesting, by the mobile device, when the encrypted file requested for execution is created while the mobile device is in the restricted area, a decryption key for executing the encrypted file from the server; and

receiving, by the mobile device, the decryption key from the server, decrypting the encrypted file via the received decryption key, and executing the decrypted file,

wherein the encrypted file comprises;

a header; and

encrypted data following the header,

wherein the header comprises;

the flag; and

the location information for identifying at least one of an encryption key and the decryption key, and

wherein the flag indicates whether the location information includes information regarding a location where the encrypted file is created.

2. The method of claim 1, further comprising:

receiving, by the mobile device, the security policy when the mobile device enters the restricted area.

3. The method of claim 1, wherein the storage of the encrypted file comprises:

transmitting, by the mobile device, a message for reporting the file creation to a server managing the restricted area;

receiving, by the mobile device, an encryption key corresponding to the location information regarding the mobile device from the server;

encrypting, by the mobile device, the created file via the received encryption key; and

storing the encrypted file.

4. The method of claim 1, wherein the execution of the application program comprises:

refusing the execution of the application program when the application program requested for execution is set not to be executable in the restricted area according to the security policy.

5. The method of claim 1, further comprising:

determining, when a request is made to display files stored in the mobile device, whether the mobile device is located in the restricted area;

displaying, when the mobile device is located in the restricted area, all the files stored in the mobile device; and

displaying, when the mobile device is located outside the restricted area, files that were created while the mobile device was located outside the restricted area.

6. The method of claim 1, wherein the decryption key comprises the location information regarding the mobile device.

7. A location information-based security management system, the system comprising:

a Radio Frequency (RF) communication unit for performing RF communication with a server managing a restricted area;

a storage unit for storing a security policy set for the restricted area transmitted from the server and a file created according to the execution of an application program; and

a controller,

wherein the controller;

receives a request for the execution of the application program in a restricted area from the server, and determines whether the application program is set to be executable in the restricted area according to the security policy;

executes the application program when the application program is set to be executable according to the security policy;

encrypts the file, created according to the execution of the application program, based on location information regarding a mobile device, the encrypted file including a flag indicating whether the encrypted file is created while the mobile device is in the restricted area;

stores the encrypted file;

receives, when the mobile device is located in the restricted area, a request for the execution of the encrypted file;

requests, when the encrypted file requested for execution is created while the mobile device is in the restricted area, a decryption key for executing the encrypted file from the server; and

receives the decryption key from the server, decrypts the encrypted file via the received decryption key, and executes the decrypted file,

wherein the encrypted file comprises;

a header; and

encrypted data following the header,

wherein the header comprises;

the flag; and

the location information for identifying at least one of an encryption key and the decryption key, and

wherein the flag indicates whether the location information includes information regarding a location where the encrypted file is created.

8. The system of claim 7, wherein the controller receives the security policy when the mobile device enters the restricted area.

9. The system of claim 7, wherein the controller:

transmits a message for reporting the file creation to a server managing the restricted area;

receives an encryption key corresponding to the location information regarding the mobile device from the server;

encrypts the created file via the received encryption key; and

stores the encrypted file.

10. The system of claim 7, wherein the controller refuses the execution of the application program when the application program requested for execution is set not to be executable in the restricted area according to the security policy.

11. The system of claim 7, wherein the controller:

determines, when a request is made to display files stored in the mobile device, whether the mobile device is located in the restricted area;

displays, when the mobile device is located in the restricted area, all the files stored in the mobile device;

displays, when the mobile device is located outside the restricted area, files that were created while the mobile device was located outside the restricted area.

12. The system of claim 7, wherein the decryption key comprises the location information regarding the mobile device.