Administration of protection of data accessible by a mobile device

• US 20040123153A1
• Filed: 04/11/2003
• Published: 06/24/2004
• Est. Priority Date: 12/18/2002
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Wright, Michael, Mims, Robert, Jacobson, Sterling K., Nault, Gabe, Smith, Merrill, Boucher, Peter, Wood, Jonathan
• Granted Patent: US 7,353,533 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

The administration of protection of data on a client mobile computing device by a server computer system such as within an enterprise network or on a separate mobile computing device is described. Security tools are described that provide different security policies to be enforced based on a location associated with a network environment in which a mobile device is operating. Methods for detecting the location of the mobile device are described. Additionally, the security tools may also provide for enforcing different policies based on security features. Examples of security features include the type of connection, wired or wireless, over which data is being transferred, the operation of anti-virus software, or the type of network adapter card.

The different security policies provide enforcement mechanisms that may be tailored based upon the detected location and/or active security features associated with the mobile device. Examples of enforcement mechanisms are adaptive port blocking, file hiding and file encryption.

Claims

1. A computer-implemented method for administering protection of data accessible by a mobile computing device comprising:

defining one or more security policies by a server computer system for the mobile computing device based upon criteria, the criteria including a location associated with a network environment in which the mobile device is operating; and

sending over a network the one or more security policies to the mobile device.

2. The method of claim 1 further comprising:

determining a current security policy by the mobile device from the one or more security policies received over the network from the server computer system based upon criteria, the criteria including a detected location associated with a network environment in which the mobile device is operating; and

enforcing the current security policy.

3. The method of claim 1 further comprising encrypting the one or more security policies.

4. The method of claim 2 further comprising decrypting the one or more received security policies and authenticating that each received security policy is from an authorized server computer system.

5. The method of claim 1 further comprising:

monitoring diagnostic data received over the network from one or more mobile client devices;

analyzing the diagnostic data; and

transmitting support information to the one or more mobile devices.

6. A computer-implemented method for providing protection of data accessible by a mobile computing device comprising:

defining one or more security policies by a server computer system for the mobile computing device based upon criteria, the criteria including a security feature associated with a network environment in which the mobile device is operating; and

sending over a network the one or more security policies to the mobile device.

7. The method of claim 6 further comprising:

determining a current security policy by the mobile device from the one or more security policies received over the network from the server computer system based upon criteria, the criteria including a detected activity status of the security feature; and

enforcing the current security policy.

8. The method of claim 6 further comprising:

determining a current security policy for the client mobile device from the one or more security policies received from the server system based upon criteria including the detected location.

9. The method of claim 6 further comprising:

enforcing the current security policy on the client mobile device by sending commands over the network to the client device

10. A computer-implemented system for providing protection of data accessible by a client mobile computing device comprising:

a policy management module for managing one or more security policies for execution on the client mobile device, the security policies being defined based upon criteria, the criteria including a location associated with a network environment in which the mobile device is operating; and

a policy distribution module for sending over the network the one or more security policies to the mobile device, the policy distribution module having a communication interface with the policy management module for receiving information regarding policies.

11. The system of claim 10 further comprising:

an authorization module for authorizing a communication exchange with the client mobile device based upon information received from the mobile device over the network in accordance with a cryptographic authentication protocol.

12. The system of claim 10 wherein the one or more security policies are defined as XML documents.

13. The system of claim 10 wherein the one or more security policies are encrypted.

14. The system of claim 10 wherein, responsive to an update request from a client, the distribution module transmits over a network to the mobile client device, security information.

15. The system of claim 10 further comprising a remote diagnostics module comprising:

a monitoring module for monitoring diagnostic data received over a network from one or more remotely located mobile client devices;

a diagnosis module for analyzing the diagnostic data; and

a distribution module for transmitting support information to the one or more mobile devices.

16. The system of claim 10 further comprising:

a policy setting module for determining a current security policy for the client mobile device from the one or more security policies received from the policy management module based upon criteria including the detected location.

17. The system of claim 10 wherein the criteria further comprises an activity status of a security feature.

18. The system of claim 16 further comprising a policy enforcement control module being communicatively coupled with the policy setting module for communication of the current security policy to be enforced, the enforcement control module comprising one or more enforcement mechanism modules for enforcing the current security policy on the client mobile device by sending commands over the network to the client device.

19. In a mobile computing device, a computer-implemented system for providing protection of data accessible by a mobile computing device comprising:

a location detection module for detecting the location associated with the network environment in which the mobile device is operating;

a policy setting module being communicatively coupled with the location detection module for communication of the detected location and being communicatively coupled over a network to a policy management module, the policy setting module determining a current security policy from the one or more security policies received from the policy management module based upon criteria including the detected location; and

a policy enforcement control module being communicatively coupled with the policy setting module for communication of the current security policy to be enforced, the enforcement control module comprising one or more enforcement mechanism modules for enforcing the current security policy.

20. The system of claim 19 wherein the policy setting module sends an update request to the policy management module, the update request requesting any new versions of the one or more policies used by the mobile device.

21. The system of claim 19 further comprising

a security features module for determining whether one or more security features have an activity status of inactive or active in a communication session between the mobile device and another computer;

and

the policy setting module having a communication interface with the security features module for communication of the activity status of the one or more security features, the policy setting module determining the current security policy from the one or more security policies received from the policy management module based upon criteria further including the activity status of the one or more security features.

22. The system of claim 19 wherein the mobile device is operating in an unmanaged mode, the policy setting module having a communication interface with the user interface module wherein the policy setting module defines an aspect of a security policy based on input received from the user interface module.

23. The system of claim 19 wherein the location detection module continuously detects the location in which the mobile device is operating;

responsive to a new location being detected, notifying the policy setting module via the communication interface of the new detected location;

responsive to the notification of the new detected location, the policy setting module determining whether the current security policy is to be changed to another policy; and

responsive to the change in policy being indicated, automatically making the other policy the current security policy; and

responsive to the other policy being made the current security policy, the policy enforcement module automatically enforcing the other policy as the current policy.

24. In a mobile computing device, a computer-implemented system for providing protection of data accessible by a mobile computing device comprising:

a security features module for determining whether one or more security features have an activity status of inactive or active in a communication session between the mobile device and another computer;

a policy setting module having a communication interface with the security features module for communication of the activity status of the one or more security features and being communicatively coupled over a network to a policy management module, the policy setting module determining a current security policy from the one or more security policies received from the policy management module based upon criteria including the activity status of the one or more security features; and

a policy enforcement control module being communicatively coupled with the policy setting module for communication of the current security policy to be enforced, the enforcement control module comprising one or more enforcement mechanism modules for enforcing the current security policy.

25. The system of claim 24 wherein at least one of the security features is a connection type of wired or wireless.

26. The system of claim 24 wherein at least one of the security features is a security software program.

27. The system of claim 24 wherein at least one of the security features is a network class.

28. The system of claim 27 wherein the network class is a type of mobile communications system.

29. The system of claim 28 wherein the type of mobile communications system is a type of wireless communications system.

30. The system of claim 29 wherein the network class is a Global System for Mobile Communications system.

31. The system of claim 28 wherein the network class is 802.3.

32. The system of claim 28 wherein the network class is 802.15.

33. The system of claim 28 wherein the network class is 802.16.

34. The system of claim 27 wherein the network class is a variation of 802.11.

35. The system of claim 27 wherein the network class is 3G.

36. The system of claim 27 wherein the network class is General Packet Radio Service.

37. A system for remotely diagnosing one or more mobile devices comprising:

a monitoring module for monitoring diagnostic data received over a network from one or more remotely located mobile client devices;

a diagnosis module for analyzing the diagnostic data; and

a distribution module for transmitting support information to the one or more mobile devices.

38. A method for remotely diagnosing one or more mobile devices comprising:

monitoring diagnostic data received over a network from one or more mobile client devices;

analyzing the diagnostic data; and

transmitting support information to the one or more mobile devices.

39. A method for remotely diagnosing one or more mobile computing devices comprising:

one or more mobile computing devices transmitting diagnostic data over a network to the server computer system;

the mobile device receiving support information including instructions from the server computer system; and

the mobile device executing the instructions.