System, method and device for cloud-based content inspection for mobile devices

• US 8,621,630 B2
• Filed: 06/17/2011
• Issued: 12/31/2013
• Est. Priority Date: 06/17/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Economos, George Jr., Ismailov, Vadim
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US13/163,514
• Publication Number:
  US 20120324581A1
• Time in Patent Office: 928 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/08 Access security

Abstract

A content inspection system provides cloud-based content inspection for mobile devices. The content inspection system includes a content inspection server for receiving a request providing a digital fingerprint of content for evaluation for threats and a data reputation services server for maintaining a threat database. The content inspection system communicates with the mobile device using a service oriented architecture web services based on exchanges of messages between agents of the content inspection system and the mobile device. The content inspection server authenticates the received request belongs to a subscriber, and once the request is authenticated, the data reputation services server operates on the request to determine whether content identified by the digital fingerprint matches pre-existing claims in the threat database. The content inspection system generates a threat evaluation response for the mobile device based on reviewing the threat database for pre-existing claims.

Claims

1. A cloud-based content inspection system for mobile devices, comprising:

a content inspection system, accessible by a remotely located mobile device, for providing cloud-based content inspection for the remotely located mobile device, the content inspection system including;

a content inspection server for receiving from the mobile device a HTTP request including HTTP headers providing threat types, a timestamp for ensuring the HTTP request is not received by the content inspection server after a predetermined limit, a subscription key providing a unique identifier of the mobile device, and a digital fingerprint of content comprising a hash value of the content for evaluation for threats; and

a data reputation services server for maintaining a threat database;

wherein the content inspection system communicates with the remotely located mobile device using a service oriented architecture web services based on exchange of messages between agents of the content inspection system and the remotely located mobile device, the content inspection server authenticating that the HTTP request to was received from a subscriber, once the HTTP request is authenticated the data reputation services server determines whether the content identified by the digital fingerprint matches pre-existing claims in the threat database, wherein the content inspection system provides a threat evaluation response to the mobile device based on reviewing the threat database for pre-existing claims.

2. The cloud-based content inspection system of claim 1, wherein the content inspection server registers a mobile device for a subscription service and provides a unique subscription key for the mobile device based on the registering of the mobile device.

3. The cloud-based content inspection system of claim 2, wherein a secret key is associated with the unique subscription key, the content inspection server using the secret key to authenticate a subscribed mobile device when the HTTP request is received by the content inspection server.

4. The cloud-based content inspection system of claim 2, wherein the subscription service comprises a flat fee model.

5. The cloud-based content inspection system of claim 2, wherein the subscription service comprises a pay per scan model.

6. The cloud-based content inspection system of claim 2, wherein the content inspection server retrieves an associated secret key based on inspection of the HTTP request to identify the subscription key of the mobile device, performs a hash using the retrieved associated secret key and verifies that a resulting digital fingerprint matches the digital fingerprint associated with the HTTP request.

7. The cloud-based content inspection system of claim 1, wherein the service oriented architecture web services comprises a representational state transfer (REST) architecture for providing web services.

8. The cloud-based content inspection system of claim 1, wherein the threat evaluation response provided to the mobile device indicates the digital fingerprint of the content matched an entry in the threat database and includes threat information obtained from the threat database.

9. The cloud-based content inspection system of claim 1, wherein the threat evaluation response provided to the mobile device indicates the digital fingerprint of the content did not matched a entry in the threat database and requests actual content to be provided for evaluation for threats.

10. The cloud-based content inspection system of claim 1, wherein the content inspection server scans content received in response to the threat evaluation response provided to the mobile device for threats, transmits results of the scan for threats to the mobile device and provides the data reputation services server an update for the threat database based on the scan for threats.

11. A method for providing cloud-based content inspection for mobile devices, comprising:

providing a content inspection system, accessible by a remotely located mobile device, for performing cloud-based content inspection for the remotely located mobile device, wherein the providing the content inspection system further comprises providing a content inspection server for receiving a HTTP request from the mobile device, the HTTP request including HTTP headers providing threat types, a timestamp for ensuring the HTTP request is not received by the content inspection server after a predetermined limit, a subscription key providing a unique identifier of the mobile device, and a digital fingerprint of content comprising a hash value of the content for evaluation for threats and providing a data reputation services server for maintaining a threat database;

authenticating, at the content inspection server, that the HTTP request was received from a subscriber;

operating on the HTTP request, by the data reputation services server once the HTTP request is authenticated, to determine whether the content identified by the digital fingerprint matches pre-existing claims in the threat database; and

generating a threat evaluation response to be provided to the mobile device based on reviewing the threat database for pre-existing claims.

12. The method of claim 11 further comprising registering the mobile device for a subscription service and providing a unique subscription key for the mobile device based on the registering of the mobile device and associating a secret key with the unique subscription key, using the secret key to authenticate a subscribed mobile device when the HTTP request is received by the content inspection server.

13. The method of claim 11 further comprising retrieving, by the content inspection server, an associated secret key based on inspection of the HTTP request to identify the subscription key of the mobile device, performing a hash using the retrieved associated secret key and verifying that a resulting digital fingerprint matches the digital fingerprint associated with the HTTP request.

14. The method of claim 11 further comprising indicating in the threat evaluation response provided to the mobile device that the digital fingerprint of the content matched an entry in the threat database and includes threat information obtained from the threat database.

15. The method of claim 11 further comprising indicating in the threat evaluation response provided to the mobile device that the digital fingerprint of the content did not matched a entry in the threat database, requesting actual content to be provided for evaluation for threats, scanning the content received in response to the threat evaluation response provided to the mobile device, transmitting results of the scan for threats to the mobile device and providing the data reputation services server an update for the threat database based on the scan for threats.

16. The method of claim 11 further comprising sending and receiving messages between agents of the content inspection system and the remotely located mobile device using a service oriented architecture web services.

17. A computer readable storage device having stored therein data representing instructions executable by a computer to implement cloud-based content inspection for mobile devices, comprising:

providing a content inspection system, accessible by a remotely located mobile device, for performing cloud-based content inspection for the remotely located mobile device, wherein the providing the content inspection system further comprises providing a content inspection server for receiving a HTTP request from the mobile device, the HTTP request including HTTP headers providing threat types, a timestamp for ensuring the HTTP request is not received by the content inspection server after a predetermined limit, a subscription key providing a unique identifier of the mobile device, and a digital fingerprint of content comprising a hash value of the content for evaluation for threats and providing a data reputation services server for maintaining a threat database;

authenticating, at the content inspection server, that the HTTP request was received from a subscriber;

operating on the HTTP request, by the data reputation services server once the HTTP request is authenticated, to determine whether the content identified by the digital fingerprint matches pre-existing claims in the threat database; and

generating a threat evaluation response to be provided to the mobile device based on reviewing the threat database for pre-existing claims.

18. The computer readable storage device of claim 17 further comprising registering the mobile device for a subscription service and providing a unique subscription key for the mobile device based on the registering of the mobile device and associating a secret key with the unique subscription key, using the secret key to authenticate a subscribed mobile device when the HTTP request is received by the content inspection server.

19. The computer readable storage device of claim 17 further comprising retrieving, by the content inspection server, an associated secret key based on inspection of the HTTP request to identify the subscription key of the mobile device, performing a hash using the retrieved associated secret key and verifying that a resulting digital fingerprint matches the digital fingerprint associated with the HTTP request.

20. The computer readable storage device of claim 17 further comprising indicating in the threat evaluation response provided to the mobile device that the digital fingerprint of the content matched an entry in the threat database and includes threat information obtained from the threat database.