Team security for portable information devices

• US 9,552,478 B2
• Filed: 07/09/2010
• Issued: 01/24/2017
• Est. Priority Date: 05/18/2010
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Polyakov, Dmitry A., Kalkuhl, Magnus, Sobko, Andrey V., Tikhomirov, Anton V., Kashchenko, Nadezhda V.
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US12/833,325
• Publication Number:
  US 20110289308A1
• Time in Patent Office: 2,391 Days
• Field of Search: 726/16
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A portable information device (PID) having a security module that conducts security-related functionality. At least some of the security-related functionality for the benefit of the PID is provided by a security team of at least one other PID. In one type of arrangement, when configured in a team processing mode, certain ones of the security functions or components operating for the benefit of the PID can be processed on one or more of the security team member devices. In another type of arrangement, the team of devices exchanges security-related information determined as a result of a single team member device'"'"'s processing of one or more security-related tasks.

Claims

1. A portable information device including a user interface device adapted to originate and consume information on behalf of a user, the device having a security arrangement adapted for team-assisted security functionality, the device comprising:

computer circuitry, including a processor operatively coupled to a data store;

a user interface, including display and user input devices;

wireless communications circuitry; and

a power supply that provides power to the computer circuitry, user interface, and wireless communications circuitry, the power supply including an on-board energy source;

wherein the computer circuitry includes a security module adapted to provide team-assisted security services in the portable information device, the security module including;

a thick client security portion adapted to locally process security-related tasks on the computer circuitry;

a security team connection module adapted to facilitate local wireless connectivity via the wireless communication circuitry between the portable information device and a security module of at least one other portable information device; and

a security task coordinator module adapted to locally decide, exclusive of the security team connection module, which of the security-related tasks is to be processed remotely by the security team in lieu of being processed locally on the portable information device using the computer circuitry, by at least determining, by a local analysis executed by the security task coordinator module, an indication of security priority for the portable information device;

wherein the security module is adapted to conduct an exchange of security-related information between the thick client security portion and the at least one other portable information device via the security team connection module; and

wherein the security module is configured to process, via the thick client security portion, a first security task of the security-related tasks on the computer circuitry to produce a first security task output, and to transmit, via the security team connection module, the first security task output to at least one portable information device of the security team.

2. The portable information device of claim 1, wherein the first security task is processed in response to a remotely-generated request by at least one portable information device of the security team.

3. The portable information device of claim 1, wherein the first security task is processed in response to a locally-decided need by the security module.

4. The portable information device of claim 1, wherein the first security task includes at least one security function selected from the group consisting of:

a scan of a data object for a presence of malware, a security update, an identification of a security risk, and an intrusion detection function.

5. The portable information device of claim 1, wherein the security team connection module is adapted to participate in an ad hoc wireless network with the a plurality of other portable information devices of the security team.

6. The portable information device of claim 1, wherein the security module further includes a computing capacity determining module adapted to dynamically re-assess current computing capacity availability relating to usage and performance expectations for operation of the portable information device;

and

wherein the security module is adapted to transmit the first security task output based on the current computing capacity availability re-assessed by the computing capacity determining module.

7. The portable information device of claim 1, wherein the thick client security portion is adapted to respond to a receipt of security-related information from the security team via the security team connection module by increasing a level of security protection being provided for the benefit of the portable information device.

8. In a portable information device (PID) including a user interface device adapted to originate and consume information on behalf of a user, and having a dynamically self-configuring security module, a method for distributing security-related processing to a team of at least one other portable information device communicatively coupled to the PID, the method comprising:

maintaining, by the PID, a list of the at least one other portable information device that is authorized to process security-related tasks for the benefit of the PID, the at least one other portable information device also including a user interface device adapted to originate and consume information on behalf of a user;

locally deciding, by the PID, and exclusive of the team, whether to distribute a security-related task to be processed by a device of the team that is different than the PID in lieu of being processed locally by the PID, wherein the deciding is based on a characteristic of the task and on current available computing capacity of the PID, wherein the characteristic of the task is at least an indication of security priority for the portable information device;

in response to a decision to distribute the security-related task, posting, by the PID, the task to a task list that is accessible to devices of the team; and

receiving, by the PID, an output generated by at least one device of the team in response to a completion of processing of the task.

9. The method of claim 8, wherein maintaining the list of the at least one other portable information device that is authorized to process security-related tasks for the benefit of the PID includes maintaining dynamic information relating to each device, the dynamic information including at least one parameter selected from the group consisting of:

risk profile information, current computing capacity information, trust level information, location information, or any combination thereof.

10. The method of claim 8, wherein maintaining the list of the at least one other portable information device that is authorized to process security-related tasks for the benefit of the PID further includes identifying devices in the list that are portable infrastructure devices.

11. The method of claim 8, wherein posting the task to the task list includes associating the task with a priority level.

12. The method of claim 8, wherein posting the task to the task list includes associating the task with a computational load.

13. The method of claim 8, wherein locally deciding whether to distribute a security-related task includes determining whether a device of the team satisfies trust requirements corresponding to a sensitivity of the task.

14. The method of claim 8, further comprising:

in response to a task having been posted to the task list for a predetermined time limit, adjusting a priority level associated with the task.

15. The method of claim 8, further comprising:

analyzing, by the PID, whether to process a task posted to the task list by another device of the team for the benefit of that other device, wherein the analyzing includes checking a current computing capacity availability of the PID and a load level associated with the task posted by the other device of the team.

16. The method of claim 8, further comprising:

analyzing, by the PID, whether to process a task posted to the task list by another device of the team for the benefit of that other device, wherein the analyzing includes checking whether security resources available on the PID are suitable for processing the task posted by the other device of the team.

17. The method of claim 8, further comprising:

in response to receiving a security update by the PID, sharing, by the PID, the security update with at least one other device of the team.