Non-obtrusive security system for devices

• US 8,539,563 B2
• Filed: 05/24/2011
• Issued: 09/17/2013
• Est. Priority Date: 06/29/2007
• Status: Active Grant

• Current Assignee: Mcafee (Singapore) Pte. Ltd. (McAfee, LLC)
• Original Assignee: Mcafee (Singapore) Pte. Ltd. (McAfee, LLC)
• Inventors: Kumar, Rishi, Chatterji, Varun, Jayaraghavendran, Vedvyas, Biswas, Indradeep, Mahajan, Kapil
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US13/114,425
• Publication Number:
  US 20110225635A1
• Time in Patent Office: 847 Days
• Field of Search: None
• US Class Current: 726/6
• CPC Class Codes: G06F 21/33 using certificates

Abstract

A security system is provided including providing a device including: storing a security rule for operation of the device when an event occurs; and implementing the security rule upon the occurrence of the event to allow non-obtrusive user access to the device.

Claims

1. A computer-implemented method comprising:

initiating a computing device including an installed security agent;

using, in a first instance, the security agent to retrieve stored first authentication data;

pre-authenticating the computing device using the retrieved first authentication data;

using the security agent to replace the first authentication data with second authentication data without knowledge of users of the computing device; and

communicating the replacement of the first authentication data with second authentication data to a remote server.

2. The method of claim 1, further comprising providing a user access to the computing device based on the pre-authentication using the retrieved first authentication data.

3. The method of claim 1, wherein the first authentication data includes a first SIM PIN and the second authentication data includes a second SIM PIN.

4. The method of claim 1, wherein the first authentication data includes a first device PIN and the second authentication data includes a second device PIN.

5. The method of claim 1, wherein the computing device is a mobile communication device.

6. The method of claim 1, wherein security of the computing device is managed, at least by the remote server.

7. The method of claim 6, wherein the remote server maintains security by verifying identification information persistently stored on the computing device.

8. The method of claim 7, wherein the identification information includes a subscriber identity module (SIM).

9. The method of claim 1, wherein the authentication data is persistently stored on the computing device.

10. The method of claim 1, further comprising uninstalling the security agent from the computing device, wherein uninstalling the security agent removes the ability to pre-authenticate the computing device.

11. The method of claim 10, further comprising prompting a user of the computing device for user-entered authentication data when the computing device is not able to be pre-authenticated.

12. The method of claim 11, wherein users are prompted for user-entered authentication data when the security agent is uninstalled.

13. The method of claim 11, authenticating the computing device based on user-entered authentication data.

14. The method of claim 13, wherein authenticating the computing device based on user-entered authentication data includes determining that the user-entered authentication data corresponds to the second authentication data.

15. The method of claim 11, further comprising:

receiving the user-entered authentication data in response to the prompt; and

determining that the computing device should not be authenticated based on the received user-entered authentication data, wherein failure to authenticate the computing device at least temporarily disables the computing device.

16. The method of claim 15, wherein determining that the computing device should not be authenticated includes determining that the received the user-entered authentication data does not correspond to the second authentication data.

17. The method of claim 10, wherein the security agent is removed in response to a hard reset of the computing device.

18. The method of claim 10, wherein the security agent is removed in response to a reformatting of the computing device.

19. The method of claim 1, further comprising:

using, in a second, subsequent instance, the security agent to retrieve the stored second authentication data;

pre-authenticating the computing device using the retrieved second authentication data; and

providing at least one user access to the computing device based on the pre-authentication of the computing device using the retrieved second authentication data.

20. The method of claim 1, wherein initiation of the computing device is detected by the security agent, the initiation of the computing device being one of a plurality of events, within the computing device, capable of being detected by the installed security agent.

21. The method of claim 20, wherein the plurality of events further include connection of the computing device to a network and disconnection of the computing device from a network.

22. The method of claim 20, wherein detection of one of the plurality of event prompts performance of at least one operation corresponding to the event.

23. The method of claim 22, wherein performance of the at least one operation includes:

identifying the at least one operation corresponding to the event, based on a type of the event and according to at least one policy.

24. The method of claim 1, wherein the replacement of the first authentication data with second authentication data is communicated to the remote server over a mobile communications network.

25. A computer-implemented method comprising:

authenticating a computing device, in a first instance, using first authentication data managed by security agent, the security agent enabled to change at least a portion of the first authentication data without the knowledge of users of the computing device;

authenticating the computing device, in a second, other instance, using second authentication data received from a user of the computing device in response to an authentication prompt;

wherein authenticating the computing device grants users access to the computing device and changes to the authentication data by the security agent are communicated to a remote server.

26. The method of claim 25, wherein the first authentication data includes a first SIM PIN and the second authentication data includes a second SIM PIN.

27. The method of claim 25, wherein security is maintained for the computing device during reformatting of the computing device.

28. The method of claim 25, wherein security is maintained for the computing device during a loss of connectivity between the computing device and remote server.

29. An apparatus comprising:

at least one processor;

at least one computer-readable medium; and

a security agent operating on the apparatus to;

retrieve stored first authentication data;

pre-authenticate the computing device using the retrieved first authentication data;

replace the first authentication data with second authentication data without knowledge of users of the computing device; and

communicate the replacement of the first authentication data with second authentication data to a remote server associated with a trusted authority;

wherein at least one user is granted access to the computing device based on pre-authentication of the computing device.

30. The apparatus of claim 29, further comprising a subscriber identity module (SIM) having a SIM pin.

31. The apparatus of claim 30, wherein the first authentication data includes a first SIM PIN and the second authentication data includes a second SIM PIN.

32. The apparatus of claim 29, security authentication mechanism operating on the apparatus to:

prompt a user of the apparatus for user-entered authentication data;

receive the user-entered authentication data in response to the prompt; and

determine whether the apparatus should be authenticated based on the received user-entered authentication data, wherein failure to authenticate the apparatus at least temporarily disables the apparatus.

33. The apparatus of claim 29, wherein the apparatus is a mobile communications device.

34. An apparatus comprising:

at least one processor;

at least one computer-readable medium; and

at least one security management module operating on the apparatus to;

pre-authenticate the apparatus, in a first instance, using first authentication data;

change at least a portion of the first authentication data without the knowledge of users of the apparatus; and

authenticate the apparatus, in a second, other instance, using second authentication data received from a user of the apparatus in response to an authentication prompt;

wherein authenticating the apparatus grants users access to the apparatus and changes to the authentication data are communicated to a remote server associated with a trusted authority.

35. The apparatus of claim 34, further comprising a subscriber identity module (SIM) having a SIM pin.

36. The apparatus of claim 35, wherein the first authentication data includes a first SIM PIN and the second authentication data includes a second SIM PIN.

37. The apparatus of claim 34, wherein the security management module includes a security agent configured to:

retrieve the stored first authentication data;

pre-authenticate the apparatus using the retrieved first authentication data;

replace the first authentication data with third authentication data without knowledge of users of the apparatus; and

communicate the replacement of the first authentication data with third authentication data to the remote server associated with the trusted authority.

38. The apparatus of claim 34, wherein the security management module includes an authentication module configured to:

prompt a user of the apparatus for user-entered authentication data, wherein the user-entered authentication data includes the second authentication data;

receive the second authentication data in response to the prompt; and

determine whether the apparatus should be authenticated based on the received user-entered authentication data.

39. An article comprising a non-transitory, machine-readable storage device storing instructions operable to cause at least one processor to perform operations comprising:

initiating a computing device including an installed security agent;

using, in a first instance, a security agent installed on a computing device to retrieve stored first authentication data;

pre-authenticating the computing device using the retrieved first authentication data;

using the security agent to replace the first authentication data with second authentication data without knowledge of users of the computing device; and

communicating the replacement of the first authentication data with second authentication data to a remote server.