Security safeguard modification

• US 9,848,011 B2
• Filed: 03/10/2017
• Issued: 12/19/2017
• Est. Priority Date: 07/17/2009
• Status: Active Grant

• Current Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Bailey, Jr., Samuel A.
• Primary Examiner(s): ABYANEH, ALI S
• Application Number:
  US15/456,252
• Publication Number:
  US 20170187744A1
• Time in Patent Office: 284 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06Q 20/206 comprising security or operator identification provisions, e.g. password entry
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

An adaptable network security system includes trust mediator agents that are coupled to each network component. Trust mediator agents continuously detect changes in the security characteristics of the network and communicate the detected security characteristics to a trust mediator. Based on the security characteristics received from the trust mediator agents, the trust mediator adjusts security safeguards to maintain an acceptable level of security. Trust mediator also uses predetermined rules in determining whether to adjust security safeguards. Despite inevitable changes in security characteristics, an acceptable level of security and efficient network operation are achieved without subjecting users of the network to over burdensome security safeguards.

Claims

1. A method comprising:

generating, by a communication device, a risk variable based on location data associated with the communication device;

transmitting, by the communication device, the location data associated with the communication device to a trust mediator;

receiving, by the communication device from the trust mediator, a determined time interval at which to collect security-related data for the risk variable;

collecting, by the communication device, the security-related data for the risk variable at the determined time interval to create collected security-related data;

transmitting, by the communication device to the trust mediator, the collected security-related data;

receiving, by the communication device from the trust mediator, instructions corresponding to a security safeguard modification; and

modifying, by the communication device, a security safeguard in accordance with the security safeguard modification by executing the instructions.

2. The method of claim 1, wherein the generating is by a sensor associated with the communication device.

3. The method of claim 1, wherein the collecting is by a trust mediator agent associated with the communication device.

4. The method of claim 1, wherein the modifying is by a trust mediator agent associated with the communication device.

5. The method of claim 1, wherein the security safeguard modification is based on at least one of the collected security-related data or a predetermined rule.

6. The method of claim 1, wherein the trust mediator is communicatively coupled to the communication device by way of a communication network.

7. The method of claim 1, further comprising receiving, by the communication device, a request from the trust mediator for the location data associated with the communication device, and the location data being transmitted in response to the request.

8. The method of claim 1, further comprising:

updating, by the communication device, location data associated with the communication device;

generating, by the communication device, a second risk variable based on the updated location data;

collecting, by the communication device, second security-related data for the second risk variable; and

transmitting, by the communication device, the collected second security-related data for the second risk variable to the trust mediator.

9. The method of claim 1, further comprising:

generating, by the communication device, a second risk variable based on the collected security-related data;

collecting, by the communication device, second security-related data for the second risk variable; and

transmitting, by the communication device, the collected second security-related data for the second risk variable to the trust mediator.

10. The method of claim 1, further comprising:

generating, by the communication device, a second risk variable based on a security goal;

collecting, by the communication device, second security-related data for the second risk variable; and

transmitting, by the communication device, the collected second security-related data for the second risk variable to the trust mediator.

11. The method of claim 1, wherein the security-related data includes at least one of:

threat data corresponding to at least one of a plurality of communication network modules, user expectation data, a list of currently running security safeguards, or a protection time provided by the currently running security safeguards.

12. The method of claim 1, wherein the instructions corresponding to the security safeguard modification include at least one of increasing a key length, changing an encryption algorithm, or changing an authentication method.

13. The method of claim 1, wherein the communication device is a mobile communication device.

15. The device of claim 1, wherein the generating is by a sensor associated with the communication device.

16. The device of claim 1, wherein the collecting is by a trust mediator agent associated with the communication device.

17. The device of claim 1, further comprising:

updating, by the communication device, location data associated with the communication device;

generating, by the communication device, a second risk variable based on the updated location data;

collecting, by the communication device, second security-related data for the second risk variable; and

transmitting, by the communication device, the collected second security-related data for the second risk variable to the trust mediator.

18. The device of claim 1, further comprising:

generating, by the communication device, a second risk variable based on the collected security-related data;

collecting, by the communication device, second security-related data for the second risk variable; and

transmitting, by the communication device, the collected second security-related data for the second risk variable to the trust mediator.

19. The device of claim 1, further comprising:

generating, by the communication device, a second risk variable based on a security goal;

collecting, by the communication device, second security-related data for the second risk variable; and

transmitting, by the communication device, the collected second security-related data for the second risk variable to the trust mediator.

14. A communication device comprising:

a processor,

a tangible, non-transitory memory configured to communicate with the processor,

the tangible, non-transitory memory having instructions stored thereon that, in response to execution by the processor, cause the processor to perform operations comprising;

generating, by the communication device, a risk variable based on location data associated with the communication device;

transmitting, by the communication device, the location data associated with the communication device to a trust mediator;

receiving, by the communication device from the trust mediator, a determined time interval at which to collect security-related data for the risk variable;

collecting, by the communication device, the security-related data for the risk variable at the determined time interval to create collected security-related data;

transmitting, by the communication device to the trust mediator, the collected security-related data;

receiving, by the communication device from the trust mediator, instructions corresponding to a security safeguard modification; and

modifying, by the communication device, a security safeguard in accordance with the security safeguard modification by executing the instructions.

20. An article of manufacture including a non-transitory, tangible computer readable storage medium having instructions stored thereon that, in response to execution by a communication device, cause the communication device to perform operations comprising:

generating, by the communication device, a risk variable based on location data associated with the communication device;

transmitting, by the communication device, the location data associated with the communication device to a trust mediator;

receiving, by the communication device from the trust mediator, a determined time interval at which to collect security-related data for the risk variable;

collecting, by the communication device, the security-related data for the risk variable at the determined time interval to create collected security-related data;

transmitting, by the communication device to the trust mediator, the collected security-related data;

receiving, by the communication device from the trust mediator, instructions corresponding to a security safeguard modification; and

modifying, by the communication device, a security safeguard in accordance with the security safeguard modification by executing the instructions.