DYNAMIC CATEGORIZATION OF APPLICATIONS FOR NETWORK ACCESS IN A MOBILE NETWORK

• US 20130205366A1
• Filed: 02/04/2013
• Published: 08/08/2013
• Est. Priority Date: 02/02/2012
• Status: Active Grant

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks Inc
• Inventors: Luna, Michael, Bott, Ross
• Granted Patent: US 9,203,864 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

Systems and methods of dynamic categorization of applications for network use and access in a mobile network are disclosed. Using application profile information, applications can be categorized into one of multiple categories that define restrictions on the application'"'"'s access to the wireless network or cellular network. One example of such categories is the concept of black, white and grey listings. The “white” listed applications may be always allowed access, “black” listed application may never or almost never be granted network access (e.g., application may be malware like or otherwise consumes large amounts of network/device resources), and grey listed applications may be granted access based on one or more criteria.

Claims

1. A method of determining network access permissions for a mobile device application, the method comprising:

receiving a request from the mobile device application to access a network;

determining one category of a plurality of categories to which the mobile device application is assigned, wherein each of the plurality of categories is associated with a different network access policy;

providing to the mobile device application access to the network according to the network access policy associated with the one category.

2. The method of claim 1, further comprising assigning the one category to the mobile device application based upon the mobile device application'"'"'s frequency of access of the network.

3. The method of claim 1, further comprising assigning the one category to the mobile device application based upon the mobile device application'"'"'s polling patterns.

4. The method of claim 1, further comprising assigning the one category to the mobile device application based upon an intensity with which the mobile device application accesses network resources.

5. The method of claim 1, further comprising assigning the one category to the mobile device application based upon an intensity with which the mobile device application uses resources of the mobile device.

6. The method of claim 1, wherein the plurality of categories includes a first category, a second category, and a third category, and further wherein the network access policy associated with the first category is permission to access the network at all times;

the network access policy associated with the second category is permission to access the network if one or more criteria are met; and

the network access policy associated with the third category is denial of permission to access the network unless otherwise specified by a user of the mobile device.

7. The method of claim 6, wherein the one or more criteria includes providing network access only on one or more specified networks, providing access only during off-peak hours, or providing access only when WiFi is available.

8. The method of claim 6, further comprising upon determining that the one category assigned to the mobile device application is the second category, determining whether the one or more criteria is met before providing access to the network to the mobile device application.

9. The method of claim 1, wherein at least a portion of the network access policy is determined by a network operator of the network.

10. The method of claim 1, wherein at least a portion of the network access policy is determined by the user of the mobile device.

11. The method of claim 1, wherein at least a portion of the network access policy is determined by whether a user of the mobile device has a network subscription with a premium account.

12. A method of categorizing mobile device applications installed on a mobile device, the method comprising:

receiving at a client-side proxy on the mobile device network access policy definitions that specify restrictions on accessing the network;

aggregating at the client-side proxy profile information for the mobile device applications;

assigning by the client-side proxy each mobile device application to one of a plurality of categories based on the received network access policy definitions and the aggregated profile information for the respective mobile device application,

wherein each category is associated with different specified restrictions or rights on accessing the network for mobile device applications assigned to the category.

13. The method of claim 12, wherein the plurality of categories includes a first category, a second category, and a third category, and further wherein a specified restriction associated with the first category is permission to access the network at all times;

the specified restriction associated with the second category is permission to access the network if one or more criteria are met; and

the specified restriction or right associated with the third category is denial of permission to access the network unless otherwise specified by a user of the mobile device.

14. The method of claim 13, wherein the one or more criteria includes providing network access only on one or more specified networks, providing access only during off-peak hours, or providing access only when WiFi is available.

15. The method of claim 13, further comprising upon determining that the one category assigned to a given mobile device application is the second category, determining whether the one or more criteria is met before providing access to the network to the given mobile device application.

16. The method of claim 12, further comprising upon receiving a request to access the network from a first mobile device application, identifying the first mobile device application'"'"'s assigned category and granting network access to the first mobile device application based on the specified restrictions associated with the assigned category.

17. The method of claim 12, wherein the profile information includes one or more of access frequency, bandwidth need, polling patterns, network resource intensiveness, and device resource intensiveness.

18. The method of claim 12, wherein network access policy definitions include device specific information.

19. The method of claim 12, wherein network access policy definitions include information provided by network operators.

20. A method of determining access restrictions of a mobile device application running on a mobile device that requests network access, the method comprising:

detecting and identifying a network operator by a server-side proxy that provides wireless services to the mobile device;

determining the network operator'"'"'s categorization of the mobile device application, wherein multiple categories are available for the categorization, and further wherein each of the multiple categories is associated with different specified restrictions on accessing the network;

granting the mobile device application access to the network based on the specified restrictions associated with the application'"'"'s categorization.

21. The method of claim 20, wherein the multiple categories includes a first category, a second category, and a third category, and further wherein a specified restriction associated with the first category is permission to access the network at all or most times;

the specified restriction associated with the second category is permission to access the network if one or more criteria are met; and

the specified restriction associated with the third category is denial of permission to access the network unless otherwise specified by a user of the mobile device.

22. The method of claim 21, further comprising upon determining that the one category assigned to the mobile device application is the second category, determining whether the one or more criteria is met before providing access to the network to the mobile device application.

23. A mobile device having mobile device applications that request access to a network, the mobile device comprising:

a radio;

a processor;

a memory unit having instructions stored thereon which when executed by the processor, causes the processor to;

receive a request from a given mobile device application to access the network;

determine one category of a plurality of categories to which the given mobile device application is assigned, wherein each of the plurality of categories is associated with a different network access policy;

provide to the given mobile device application access to the network according to the network access policy associated with the one category.

24. The mobile device of claim 23, wherein the plurality of categories includes a first category, a second category, and a third category.

25. The mobile device of claim 24, wherein the network access policy associated with the first category is permission to access the network at all or most times.

26. The mobile device of claim 24, wherein, the network access policy associated with the second category is permission to access the network if one or more criteria are met.

27. The mobile device of claim 24, wherein, and the network access policy associated with the third category is denial of permission to access the network unless otherwise specified by a user of the mobile device.

28. The mobile device of claim 24, wherein the processor further upon determining that the one category assigned to the mobile device application is the second category, determines whether the one or more criteria is met before providing access to the network to the mobile device application.