Systems and methods for applying a security policy to a device based on location

• US 9,167,550 B2
• Filed: 10/10/2013
• Issued: 10/20/2015
• Est. Priority Date: 02/17/2009
• Status: Active Grant

• Current Assignee: F-Secure Corporation (F-Secure Oyj)
• Original Assignee: Lookout Incorporated
• Inventors: Hering, John Gunther, Burgess, James, Mahaffey, Kevin Patrick
• Primary Examiner(s): MIZRAHI, DIANE D
• Application Number:
  US14/050,804
• Publication Number:
  US 20140040981A1
• Time in Patent Office: 740 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/026 using e-messaging for transporting management information, e.g. email, instant messaging or chat
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/00 Network arrangements or protocols for supporting network services or applications user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/025 using location based information parameters
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A security policy may be applied to a mobile communications device based on a location of the mobile communications device. For example, a first location of the mobile communications device may be obtained and a first security policy may be applied to the mobile communications device based on the first location. Furthermore, a change in the location of the mobile communications device may be detected. For example, the location of the mobile communications device may change from the first location to a second location. In response to the mobile communications device now being located at the second location, a second security policy may be applied to the mobile communications device. Thus, different security policies may be applied to a mobile communications device as the current location of the mobile communications device changes.

Claims

1. A method comprising:

obtaining, by a mobile communications device, a first location associated with a current location of the mobile communications device;

applying a first security policy to the mobile communications device based on the first location;

determining, by the mobile communications device, a change in the current location of the mobile communications device from the first location to a second location associated with the current location of the mobile communications device;

at the mobile communication device, applying a second security policy to replace the first security policy to the mobile communications device based on the change from the first location to the second location;

generating, by the mobile communications device, a notification when the detected change in the current location corresponds to one of the mobile communications device entering a location known to the mobile communications device or leaving a location known to the mobile communications device; and

transmitting, from the mobile communications device, the generated notification to a server.

2. The method of claim 1, wherein an application of the second security policy replaces an application of the first security policy for the mobile communications device.

3. The method of claim 1, wherein the current location is transmitted to the server.

4. The method of claim 3, further comprising receiving at the mobile communications device an email notification from the server in response to a change in the determined current location and transmitted current location.

5. The method of claim 4, wherein the email notification comprises information to indicate that the mobile communications device has left the first location.

6. The method of claim 1, wherein the mobile communications device determines the first security policy to apply and the second security policy to apply based upon the current location.

7. The method of claim 1, wherein the first security policy and the second security policy are different, the second security policy providing access to fewer features of the mobile communications device than the first security policy.

8. The method of claim 1, further comprising receiving, from the server, a command to apply the second security policy, the command being based on the generated notification,

wherein the applying the second security policy to replace the first security policy to the mobile communications device is further based on the received command.

9. A non-transitory computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising:

obtaining, by a mobile communications device, a first location associated with a current location of the mobile communications device;

applying a first security policy to the mobile communications device based on the first location;

determining, by the mobile communications device, a change in the current location of the mobile communications device from the first location to a second location associated with the current location of the mobile communications device;

at the mobile communication device, applying a second security policy to replace the first security policy to the mobile communications device based on the change from the first location to the second location;

generating, by the mobile communications device, a notification when the detected change in the current location corresponds to one of the mobile communications device entering a location known to the mobile communications device or leaving a location known to the mobile communications device; and

transmitting, from the mobile communications device, the generated notification to a server.

10. The non-transitory computer-readable medium of claim 9, wherein an application of the second security policy replaces an application of the first security policy for the mobile communications device.

11. The non-transitory computer-readable medium of claim 9, wherein the current location is transmitted to the server.

12. The non-transitory computer-readable medium of claim 11, wherein the operations further comprise receiving at the mobile communications device an email notification from the server in response to a change in the determined current location and transmitted current location.

13. The non-transitory computer-readable medium of claim 12, wherein the email notification comprises information to indicate that the mobile communications device has left the first location.

14. The non-transitory computer-readable medium of claim 9, wherein the mobile communications device determines the first security policy to apply and the second security policy to apply based upon the current location.

15. The non-transitory computer-readable medium of claim 9, wherein the first security policy and the second security policy are different, the second security policy providing access to fewer features of the mobile communications device than the first security policy.

16. The non-transitory computer-readable medium of claim 9, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising receiving, from the server, a command to apply the second security policy, the command being based on the generated notification,

wherein the applying the second security policy to replace the first security policy to the mobile communications device is further based on the received command.

17. A system, comprising at least one processor and memory, comprising:

a module to obtain, by a mobile communications device, a first location associated with a current location of the mobile communications device;

a module to apply a first security policy to the mobile communications device based on the first location;

a module to determine, by the mobile communications device, a change in the current location of the mobile communications device from the first location to a second location;

a module to apply, at the mobile communication device, a second security policy to replace the first security policy to the mobile communications device based on the change from the first location to the second location;

a module to generate, by the mobile communications device, a notification when the detected change in the current location corresponds to one of the mobile communications device entering a location known to the mobile communications device or leaving a location known to the mobile communications device; and

a module to transmit, from the mobile communications device, the generated notification to a server.

18. The system of claim 17, wherein the application of the second security policy replaces the application of the first security policy for the mobile communications device.

19. The system of claim 17, wherein the current location is transmitted to a server.

20. The system of claim 17, wherein the mobile communications device determines the first security policy to apply and the second security policy to apply based upon the current location.

21. The system of claim 20, further comprising a module to receive at the mobile communications device an email notification from the server in response to the determined and transmitted change in the current location.

22. The system of claim 21, wherein the email notification comprises information to indicate that the mobile communications device has left the first location.

23. The system of claim 17, further comprising a module to receive, from the server, a command to apply the second security policy, the command being based on the generated notification,

wherein the module to apply the second security policy to replace the first security policy to the mobile communications device further applies the second security policy based on the received command.