Method and system for policy based authentication

• US 9,609,024 B2
• Filed: 04/08/2015
• Issued: 03/28/2017
• Est. Priority Date: 10/28/2004
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: NXP B.V. (NXP Semiconductors NV)
• Inventors: Frank, Edward H.
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US14/681,856
• Publication Number:
  US 20150358354A1
• Time in Patent Office: 720 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A mobile device capable of performing a plurality of functions. The mobile device includes a memory for storing a plurality of different security policies; an input device for invoking a function from the plurality of functions by a user; a processor for assigning a first security policy from the stored plurality of security policies to the invoked function; and a security module for requiring the user to satisfy the assigned first security policy, before the invoked function is performed by the mobile device.

Claims

1. A method for securing a mobile device, comprising:

receiving, by the mobile device, a plurality of different security policies, wherein each of the plurality of different security policies has a corresponding security requirement, wherein each of a plurality of functions has an associated security policy, wherein each security requirement either requires authentication or requires encryption of data;

invoking, by a user, a function from the plurality of functions;

selecting, by the mobile device and based on the invoked function, a security policy from the plurality of different security policies;

selecting, by the mobile device, a security requirement corresponding to the security policy; and

before the mobile device performs the invoked function, requiring, by the mobile device, that the user satisfy the selected security requirement.

2. The method of claim 1, further comprising:

determining a location of the mobile device;

selecting, by the mobile device and based on the invoked function and on the determined location, another security policy from the plurality of different security policies;

selecting, by the mobile device, another security requirement corresponding to the other security policy; and

before the mobile device performs the invoked function, requiring the other security requirement be satisfied.

3. The method of claim 1, further comprising:

determining a location of the mobile device; and

receiving, by the mobile device and based on the determined location, a plurality of security policies applicable at the determined location.

4. The method of claim 1, wherein the invoked function is accessing data.

5. The method of claim 1, wherein the invoked function is making a phone call.

6. The method of claim 1, wherein the requiring comprises requiring the user to enter a user name and password to satisfy the selected security requirement corresponding to the selected security policy.

7. The method of claim 1, wherein the requiring comprises requiring the user to enter a biometric credential to satisfy the selected security requirement corresponding to the selected security policy.

8. A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform a method for securing a mobile device, the method comprising

receiving, by a mobile device, a plurality of different security policies, wherein each of the plurality of different security policies has a corresponding security requirement, wherein each of a plurality of mobile device functions has an associated security policy, wherein each security requirement requires either authentication or encryption of data associated with a mobile device function of the corresponding security policy;

selecting a mobile device function to be performed from the plurality of mobile device function;

selecting, by the mobile device, based on the selected mobile device function, a security policy from the plurality of different security policies;

selecting, by the mobile device, a security requirement corresponding to the security policy; and

before the mobile device performs the selected mobile device function, requiring, by the mobile device, the selected security requirement be satisfied through an interaction with a claimed party, the claimed party not being the mobile device.

9. The computer-readable medium of claim 8, the method further comprising:

determining a location of the mobile device;

selecting, by the mobile device and based on the selected mobile device function and on the determined location, another security policy from the plurality of different security policies;

selecting, by the mobile device, another security requirement corresponding to the other security policy; and

before the mobile device performs the selected mobile device function, requiring the other security requirement be satisfied.

10. The computer-readable medium of claim 8, the method further comprising:

determining a location of the mobile device; and

wherein selecting the security policy includes selecting the security policy from a subset of the plurality of different security policies applicable at the determined location.

11. The computer-readable medium of claim 8, wherein the selected mobile device function is accessing data.

12. The computer-readable medium of claim 8, wherein the selected mobile device function is making a phone call.

13. The computer-readable medium of claim 8, wherein the requiring comprises requiring a user to enter a user name and password to satisfy the security requirement corresponding to the security policy.

14. The computer-readable medium of claim 8, wherein the requiring comprises requiring a user to enter a biometric credential to satisfy the security requirement corresponding to the security policy.

15. A mobile device, comprising:

a non-transitory memory configured to store a plurality of different security policies, wherein each of the plurality of different security policies has a corresponding security requirement, wherein each of a plurality of mobile device functions has an associated security policy, wherein each security requirement requires either authentication or encryption of data associated with a mobile device function of the corresponding security policy;

a processor configured to select a mobile device function to be performed from the plurality of mobile device functions, to select, based on the selected mobile device function, a security policy from the stored plurality of different security policies, and select a security requirement corresponding to the selected security policy; and

a security module configured to, before the mobile device performs the selected mobile device function, require the selected security requirement be satisfied through an interaction with a claimed party, the claimed party not being the mobile device.

16. The mobile device of claim 15, the processor further configured to:

determine a location of the mobile device;

select, based on the selected mobile device function and on the determined location, another security policy from the stored plurality of different security policies;

select another security requirement corresponding to the other security policy; and

before the mobile device performs the selected mobile device function, require the other security requirement be satisfied.

17. The mobile device of claim 15, the processor further configured to:

determine a location of the mobile device;

wherein selecting a security policy if further based on the determined location.

18. The mobile device of claim 15, wherein the selected mobile device function is accessing data.

19. The mobile device of claim 15, wherein the security module further requires the security requirement be satisfied by requiring a user to enter a user name and password.

20. The mobile device of claim 15, wherein the security module further requires the security requirement be satisfied by requiring a user to enter a biometric credential.