Mobile data security system and methods

• US 20060224742A1
• Filed: 02/28/2006
• Published: 10/05/2006
• Est. Priority Date: 02/28/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Trust Digital
• Inventors: Shahbazi, Majid
• Granted Patent: US 8,495,700 B2
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

The present invention is directed to security systems and methods for mobile network-based data environments. The present invention provides an integration of security, mobile computing, wireless and IT infrastructure management technology, to create a new level of automation and enforcement to enable the transparent application of mobile security across an enterprise, while embracing end user “transparency” and “ease of use” and empowering IT administration.

Claims

1. A system for providing network security for mobile devices coupled to at least one server through a communication channel, said system comprising:

at least one mobile device having electronic data storage and application software;

at least one server having security software and a mobile device security policy stored thereon, said mobile device security policy including dynamic parameters;

means for permitting the mobile device to access the network only if it operates in compliance with the mobile device security policy.

2. The system of claim 1, wherein compliance with the security system requires the at least one mobile device to have an authorized use status.

3. The system of claim 2, wherein authorized use status requires each of the at least one devices to have an unique identifier and a corresponding authorized user.

5. The system of claim 2, wherein the authorized use status is transmitted to the server and further comprising means for transmitting a security profile to the mobile device based on the authorized use status.

6. The system of claim 1, wherein the dynamic parameters comprise a compliant context required for compliance with the security system.

7. The system of claim 6, wherein the compliant context is based on initial and ongoing compliance with security policies and/or rules.

8. The system of claim 6, wherein the compliant context comprises successful authentication of the at least one mobile device and corresponding authorized user.

9. The system of claim 6, wherein the compliant context comprises an approved device structure, configuration, and/or software.

10. The system of claim 6, wherein the compliant context comprises approved device functions and activities.

11. The system of claim 1, wherein the dynamic parameters are expressed as instantaneous state structure (ISS) that includes said dynamic parameters and static parameters

12. The system of claim 1, wherein the dynamic parameters are based upon interaction of mobile device(s) with server(s) via wireless network.

13. The system of claim 1, wherein the dynamic parameters comprise a set of dynamic information selected from the group consisting of an operating system, software application(s), device location, network information, personality information, current use/activity compared with usage patterns for device and corresponding authorized user, and combinations thereof.

14. The system of claim 10, further comprising a historical state structure (HSS) that includes a plurality of instantaneous state structures for a device stored as an archive and wherein said means for permitting further permits means for prohibiting access to the network if a current instantaneous state structure indicates a usage anaomoly as compared to the historical state structure.

15. A method for synchronizing security policies between a mobile computing device and a computer to determine if the mobile device can access a network, said method comprising the steps of:

providing an initial security policy to the mobile device;

providing initial authorization for the mobile device based on a unique identifier of the device and corresponding authorized user;

determining the status of the device based on dynamic information;

transferring a dynamic security policy to the mobile device based on the determined status; and

if compliance with the dynamic security policy is found, then providing access to the network by the mobile device.

16. A computer readable medium having instructions recoded thereon for providing network security for mobile devices coupled to at least one server through a communication channel, said instructions comprising:

instructions for determining dynamic parameters of a mobile device;

instructions for comparing the determined dynamic parameters with a mobile device security policy;

instructions for permitting the mobile device to access the network only if it operates in compliance with the mobile device security policy.