Enterprise-wide security for computer devices

• US 9,998,478 B2
• Filed: 09/29/2014
• Issued: 06/12/2018
• Est. Priority Date: 08/27/2002
• Status: Expired due to Term

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, LLC
• Inventors: Shahbazi, Majid
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US14/499,754
• Publication Number:
  US 20150106924A1
• Time in Patent Office: 1,352 Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A system and method for securing data in mobile devices (104) includes a computing mode (102) and a plurality of mobile devices (104). A node security program (202) executed in the computing node (102) interfaces with a device security program (204) executed at a mobile device (104). The computing node (102) is responsible for managing the security based on a node security profile (208) interpreted by a node security program (202) executed in the computing node (102). A device discovery method and arrangement (106) also detects and locates various information (120) about the mobile devices (104) based on a scan profile (206).

Claims

1. At least one non-transitory computer readable medium that includes code for execution and when executed by a processor:

scans a network based on a scan profile defining one or more parameters associated with at least one of domains and computing nodes in the network;

detects at least one domain on the network in accordance with at least one parameter defined in the scan profile;

detects at least one computing node within the detected domain;

connects to the detected computing node;

detects, using a discovery program, one or more mobile devices connected to the detected computing node; and

determines information associated with at least one mobile device of the detected mobile devices, wherein the information is to include a type of computing platform of the at least one mobile device, and wherein the type of computing platform of the at least one mobile device is determined by querying one or more application registries on the computing node.

2. The at least one non-transitory computer readable medium of claim 1, wherein the discovery program is to run in at least one of a remote central station or a local computing node.

3. The at least one non-transitory computer readable medium of claim 1, which includes further code for execution and when executed by a processor:

groups the detected mobile devices by type.

4. The at least one non-transitory computer readable medium of claim 1, wherein the scan profile contains information associated with at least one of the network, the domains, an IP address, a netmask, and a computer identity to be scanned.

5. The at least one non-transitory computer readable medium of claim 1, which includes further code for execution and when executed by a processor:

analyzes results of the scanning to produce an analysis result; and

displays the analysis result to at least one user.

6. The at least one non-transitory computer readable medium of claim 1, which includes further code for execution and when executed by a processor:

detects one or more resource devices connected to the detected computing node; and

determines information associated with at least one of the detected resource devices.

7. The at least one non-transitory computer readable medium of claim 1, which includes further code for execution and when executed by a processor:

determines at least one of a connection profile and a location of the at least one mobile device.

8. The at least one non-transitory computer readable medium of claim 1, wherein the determining the information of the mobile device is based on at least one of a registry resource, a file resource, a process resource, a network management parameter, a communication protocol parameter, a data format, a packet format, a synchronization log entry, a directory structure and a database entry.

9. The at least one non-transitory computer readable medium of claim 1, which includes further code for execution and when executed by a processor:

detects one or more mobile devices previously connected to the detected computing node; and

determines information associated with at least one of the one or more mobile devices previously connected to the detected computing node.

10. The at least one non-transitory computer readable medium of claim 9, wherein the detecting is based, at least in part, on an imprint in a registry structure of the detected computing node, the imprint associated with the at least one mobile device previously connected to the detected computing node.

11. An apparatus, comprising:

a processor; and

a discovery program configured to run on the processor to;

scan a network based on a scan profile defining one or more parameters associated with at least one of domains and computing nodes in the network;

detect at least one domain on the network in accordance with at least one parameter defined in the scan profile;

detect at least one computing node within the detected domain;

connect to the detected computing node;

detect, using a discovery program, one or more mobile devices connected to the detected computing node; and

determine information associated with at least one mobile device of the detected mobile devices, wherein the information is to include a type of computing platform of the at least one mobile device, and wherein the type of computing platform of the at least one mobile device is determined by querying one or more application registries on the computing node.

12. The apparatus of claim 11, wherein the apparatus is one of a remote central station or a local computing node.

13. The apparatus of claim 11, wherein the discovery program is configured to run on the processor to:

determine at least one of a device type, a connection profile, and a location of the at least one mobile device.

14. The apparatus of claim 11, wherein the discovery program is configured to run on the processor to:

detect one or more mobile devices previously connected to the detected computing node; and

determine information associated with at least one of the one or more mobile devices previously connected to the detected computing node.

15. The apparatus of claim 14, wherein the detecting is based, at least in part, on an imprint in a registry structure of the detected computing node, the imprint associated with the at least one mobile device previously connected to the detected computing node.

16. A method for managing a computer system on a network, the method comprising:

scanning a network based on a scan profile defining one or more parameters associated with at least one of domains and computing nodes in the network;

detecting at least one domain on the network in accordance with at least one parameter defined in the scan profile;

detecting at least one computing node within the detected domain;

connecting to the detected computing node;

detecting, using a discovery program, one or more mobile devices connected to the detected computing node; and

determining information regarding at least one mobile device of the detected mobile devices, wherein the information includes a type of computing platform of the at least one mobile device, and wherein the type of computing platform of the at least one mobile device is determined by querying one or more application registries on the computing node.

17. The method of claim 16, further comprising:

determining at least one of a device type, a connection profile, and a location of the at least one mobile device.

18. The method of claim 16, further comprising:

detecting one or more mobile devices previously connected to the detected computing node; and

determining information associated with at least one of the one or more mobile devices previously connected to the detected computing node.

19. At least one non-transitory computer readable medium that includes code for execution and when executed by a processor:

scans a network based on a scan profile defining one or more parameters associated with at least one of domains and computing nodes in the network;

detects at least one domain on the network in accordance with at least one parameter defined in the scan profile;

detects at least one computing node within the detected domain;

connects to the detected computing node;

detects, using a discovery program, one or more mobile devices previously connected to the detected computing node, wherein the detection of the one or more mobile devices previously connected to the detected computing node is based, at least in part, on an imprint in a registry structure of the detected computing node, the imprint associated with at least one mobile device of the one or more mobile devices previously connected to the detected computing node; and

determines information associated with at least one of the one or more mobile devices previously connected to the detected computing node.

22. The at least one non-transitory computer readable medium of claim 19, which includes further code for execution and when executed by a processor:

analyzes at least one result of the scanning to produce an analysis result; and

displays the analysis result to at least one user.

20. At least one non-transitory computer readable medium that includes code for execution and when executed by a processor:

scans a network based on a scan profile defining one or more parameters associated with at least one of domains and computing nodes in the network;

detects at least one domain on the network in accordance with at least one parameter defined in the scan profile;

detects at least one computing node within the detected domain;

connects to the detected computing node;

detects, using a discovery program, one or more mobile devices connected to the detected computing node;

determines information associated with at least one mobile device of the detected mobile devices, wherein the information is to include a type of computing platform of the at least one mobile device;

detects one or more other mobile devices previously connected to the detected computing node; and

determines information associated with at least one of the one or more other mobile devices previously connected to the detected computing node based on information obtained from the detected computing node.

21. The at least one non-transitory computer readable medium of claim 20, wherein the detecting is based, at least in part, on an imprint in a registry structure of the detected computing node, the imprint associated with a mobile device of the one or more other mobile devices previously connected to the detected computing node.