System and method for enforcing a security policy on mobile devices using dynamically generated security profiles

• US 20070143824A1
• Filed: 12/22/2004
• Published: 06/21/2007
• Est. Priority Date: 12/23/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Shahbazi, Majid
• Granted Patent: US 8,635,661 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security

Abstract

A system and method for enforcing security parameters that collects information from a source relating to a mobile device (104). Based on the collected information, an identity status for the mobile device (104) is determined that uniquely identifies the mobile device (104) and distinguishes it from other mobile devices. The identity status of the mobile device (104) can be determined when the mobile device (104) connects to a computing node source (102) or when the mobile device (104) accesses a resource (124) within the network. A security profile based on the identity status of the mobile device (104) is generated and the security profile is applied to the mobile device (104).

Claims

1. A method for enforcing security parameters in a system that includes one or more mobile devices and one or more computing nodes, comprising:

collecting information from a source relating to a mobile device;

based on the collected information, determining an identity status for the mobile device that is unique to the mobile device and distinguishes it from other mobile devices;

generating a security profile based on the identity status of the mobile device; and

applying the security profile to the mobile device.

2. The method of claim 1, wherein the source is at least one of an internal source to the mobile device or external source to the mobile device.

3. The method of claim 2, wherein the source is a back-up source.

4. The method of claim 1, wherein the identity status of the mobile device is determined internal to the mobile device or external to the mobile device.

5. The method of claim 1, wherein the collected information relates to at least one of a static attribute of the device and a dynamic attribute of the device.

6. The method of claim 5, wherein the static attribute of the mobile device comprises an attribute relating to at least one of physical device identification, device manufacturer, device model number, device serial number, input-output port, and a device capability.

7. The method of claim 5, wherein the dynamic attribute of the mobile device comprises an attribute that relates to at least one of installed operating system, application, attached peripheral, usage pattern, historical activity, synchronization, location, network, communication link, domain, security policy, and a connection attribute between the mobile device and computing node.

8. The method of claim 1, wherein the device security profile includes a parameter relating to at least one of protection of the mobile device, restriction on use of a resource, and configuration of a resource.

9. The method of claim 1, wherein the identity status of the mobile device is determined when the mobile device connects to a computing node source or when the mobile device accesses a resource.

10. The method of claim 1, further including controlling the mobile device according to a parameter in the device security profile that relates to an unauthorized resource in the mobile device.

11. The method of claim 10, wherein controlling the mobile device comprises at least one of deleting the unauthorized resource, hard or soft resetting the mobile device, locking the mobile device, preventing the unauthorized resource from running on the mobile device, deleting one or more files that are associated with the unauthorized resource, and hiding the unauthorized resource.

12. The method of claim 1, further including controlling the mobile device according to a parameter that relates to an unauthorized external resource.

13. The method of claim 12, wherein the unauthorized external resource comprises at least one of a computing node resource, an external application program, and an external database.

14. The method of claim 1, wherein corresponding device security profiles for different identity statuses of the mobile device are administered by a security policy engine.

15. The method of claim 1, wherein the device security profile is transferred to the mobile device after access to the computing node is granted.

16. The method of claim 15, wherein the device security profile is transferred wirelessly.

17. A method for unlocking a password protected mobile device associated with a security station, comprising:

authenticating a user of the mobile device;

authenticating the mobile device according to a device authentication code that is generated based on an identity status of the mobile device that uniquely characterizes the mobile device; and

generating an unlock code for unlocking the password protected mobile device.

18. The method of claim 17, wherein the user is authenticated by at least one of a user authentication response, a biometric parameter, or a security identification parameter.

19. The method of claim 17, further including communicating at least one of the user authentication response and the device authentication code by at least one of the user or the mobile device.

20. The method of claim 17, further including communicating the unlock

code by at least one of the security station and an administrator.

30. The method of claim 17, wherein the new network login information is transmitted to the mobile device from a security station to set the new login information of the mobile device.

21. A method for protecting a mobile device, comprising:

transmitting a request from the mobile device in response to a security threat;

creating a device security profile in response to the request based on the security threat; and

transmitting the device security profile to the mobile device.

22. The method of claim 21, wherein the request comprises information related to one or more attributes of the mobile device.

23. The method of claim 22, wherein one of the one or more attributes of the mobile device relates to at least one of a communication link used by the mobile device, a serial number of the mobile device, software and hardware on the mobile device.

24. The method of claim 22, wherein one of the one or more attributes of the mobile device relates to active directory information of the mobile device.

25. The method of claim 24, wherein the active directory information of the mobile device comprises firewall settings of the mobile device, current security settings of the mobile device, and a security parameter of the mobile device.

26. The method of claim 21, wherein the device security profile protects the mobile device from a virus threat.

27. A method for protecting a mobile device that connects to a computing node, comprising:

transmitting a new computing node login information to the mobile device in a device security profile;

retrieving the new computing node login information from the device security profile at the mobile device; and

setting the new computing node login information as the new login information for the mobile device.

28. The method of claim 27, wherein the new computing node login information comprises a new password.

29. The method of claim 27, wherein the new computing node login information comprises a new network login information.

31. A method for protecting a network comprising, comprising:

detecting access by a mobile device to one or more resources within the network;

authenticating the mobile device for access to the one or more resources; and

transmitting a device security profile to the mobile device upon authentication, said security profile comprising rules for accessing the one or more resources.

32. The method of claim 31, wherein the one or more resources comprise at least one of a communication resource, a data storage resource, and a peripheral resource.

33. The method of claim 31, wherein the communication resource comprises a wireless link resource.

34. A method for securing a computing node that connects to different mobile devices, comprises:

applying security rules to the different mobile devices in accordance with corresponding device parameters contained in a security signature file;

detecting a change in at least one of the device parameters of a mobile device; and

modifying the security rules applied to the mobile device at the computing node in accordance with one or more device parameters of an updated security signature file.

35. The method of claim 34, wherein the one or more device parameters comprise at least one of a serial number, security settings, manufacturer, and a model number.