Enterprise-wide security system for computer devices

• US 8,341,693 B2
• Filed: 12/17/2010
• Issued: 12/25/2012
• Est. Priority Date: 08/27/2002
• Status: Expired due to Term

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Shahbazi, Majid
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Nobahar, Abdulhakim
• Application Number:
  US12/972,410
• Publication Number:
  US 20110162049A1
• Time in Patent Office: 739 Days
• Field of Search: 726 1- 4, 726 11- 14, 726/17, 726/22, 726/25, 726/26, 713/151, 713/152, 713/165, 713/167, 713/182, 709223-225, 709/229
• US Class Current: 726/1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A system and method for securing data in mobile devices (104) includes a computing mode (102) and a plurality of mobile devices (104). A node security program (202) executed in the computing node (102) interfaces with a device security program (204) executed at a mobile device (104). The computing node (102) is responsible for managing the security based on a node security profile (208) interpreted by a node security program (202) executed in the computing node (102). A device discovery method and arrangement (106) also detects and locates various information (120) about the mobile devices (104) based on a scan profile (206).

Claims

1. A method, comprising:

communicating with a mobile device from a computing node, wherein the computing node includes a node security program configured to interpret a node security profile of the computing node, wherein the node security profile sets security parameters for managing security between the computing node, the mobile device, and a network resource, and wherein the computing node is separate from the mobile device and communicates with the mobile device via a communication link;

evaluating the node security profile to determine whether the computing node is authorized to transfer a device security profile to the mobile device, wherein the device security profile sets security parameters for the mobile device;

transferring the device security profile to the mobile device if the computing node is authorized to transfer the device security profile;

evaluating at least one security parameter of the node security profile in order to manage a process involving data being communicated between the computing node and the mobile device and the network resource;

determining that the process is not authorized based on the at least one security parameter, wherein the at least one security parameter includes information, based on a mobile device parameter, identifying the computing node as not being authorized; and

preventing the process from executing when it is determined that the process is not authorized based on the at least one security parameter.

2. The method of claim 1, further comprising:

transmitting a device security application to the mobile device based on determining that the process is not authorized, wherein the device security application, when executed, locks the mobile device for usage purposes.

3. The method of claim 1, wherein the process is associated with an unauthorized incoming process to the computing node.

4. The method of claim 1, wherein the process is associated with an unauthorized outgoing process to the mobile device.

5. The method of claim 1, wherein the process is associated with a data transfer associated with the mobile device.

6. The method of claim 1, wherein the process is associated with a data synchronization involving the mobile device.

7. The method of claim 1, wherein the process is associated with password protection in the context of a data transfer.

8. The method of claim 1, wherein the process is associated with a file and a program access associated with the mobile device.

9. The method of claim 1, wherein the process is associated with accessing files from a network.

10. The method of claim 1, wherein the security profile comprises at least one of a text, .ini and binary, XML format.

11. Logic encoded in non-transitory tangible computer readable media that includes code for execution and when executed by a processor is operable to perform operations comprising:

communicating with a mobile device from a computing node, wherein the computing node includes a node security program configured to interpret a node security profile of the computing node, wherein the node security profile sets security parameters for managing security between the computing node, the mobile device, and a network resource, and wherein the computing node is separate from the mobile device and communicates with the mobile device via a communication link;

evaluating the node security profile to determine whether the computing node is authorized to transfer a device security profile to the mobile device, wherein the device security profile sets security parameters for the mobile device based on at least one of time and a location of the mobile device;

transferring the device security profile to the mobile device if the computing node is authorized to transfer the device security profile;

evaluating at least one security parameter of the node security profile in order to manage a process involving data being communicated between the computing node and the mobile device and the network resource;

determining that the process is not authorized based on the at least one security parameter, wherein the at least one security parameter includes information, based on a mobile device parameter, identifying the computing node as not being authorized; and

preventing the process from executing when it is determined that the process is not authorized based on the at least one security parameter.

12. The logic of claim 11, wherein the processor is operable to perform further operations comprising:

transmitting a device security application to the mobile device based on determining that the process is not authorized, wherein the device security application, when executed, locks the mobile device for usage purposes.

13. The logic of claim 11, wherein the process is associated with a data transfer associated with the mobile device.

14. The logic of claim 11, wherein the process is associated with a data synchronization involving the mobile device.

15. The logic of claim 11, wherein the process is associated with a file and a program access associated with the mobile device.

16. The logic of claim 11, wherein the process is associated with accessing files from a network.

17. An apparatus, comprising:

a computing node that includes a node security program configured to interpret a node security profile, the apparatus being configured for;

communicating with a mobile device via a communication link, wherein the computing node is separate from the mobile device, and wherein the node security profile sets security parameters for managing security between the computing node, the mobile device, and a network resource;

evaluating the node security profile to determine whether the computing node is authorized to transfer a device security profile to the mobile device, wherein the device security profile sets security parameters for the mobile device based on at least one of time and a location of the mobile device;

transferring the device security profile to the mobile device if the computing node is authorized to transfer the device security profile;

evaluating at least one security parameter of the node security profile in order to manage a process involving data being communicated between the computing node and the mobile device and the network resource;

determining that the process is not authorized based on the at least one security parameter, wherein the at least one security parameter includes information, based on a mobile device parameter, identifying the computing node as not being authorized; and

preventing the process from executing when it is determined that the process is not authorized based on the at least one security parameter.

18. The apparatus of claim 17, wherein the process is associated with a data synchronization involving the mobile device.

19. The apparatus of claim 17, wherein the process is associated with a file and a program access associated with the mobile device.

20. The apparatus of claim 17, wherein the process is associated with accessing files from a network.