Enterprise-wide security system for computer devices

• US 8,850,530 B2
• Filed: 09/28/2012
• Issued: 09/30/2014
• Est. Priority Date: 08/27/2002
• Status: Expired due to Term

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Shahbazi, Majid
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Nobahar, Abdulhakim
• Application Number:
  US13/630,830
• Publication Number:
  US 20130047219A1
• Time in Patent Office: 732 Days
• Field of Search: None
• US Class Current: 726/4
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains

Abstract

A system and method for securing data in mobile devices (104) includes a computing mode (102) and a plurality of mobile devices (104). A node security program (202) executed in the computing node (102) interfaces with a device security program (204) executed at a mobile device (104). The computing node (102) is responsible for managing the security based on a node security profile (208) interpreted by a node security program (202) executed in the computing node (102). A device discovery method and arrangement (106) also detects and locates various information (120) about the mobile devices (104) based on a scan profile (206).

Claims

1. A method, comprising:

establishing a connection to a mobile device from a computing node;

determining whether the computing node is authorized to transfer a device security profile to the mobile device;

sending a device security application to the mobile device when the computing node is determined to be not authorized to transfer the device security profile to the mobile device, wherein the device security application is configured to execute at the mobile device to disable the mobile device from usage; and

sending the device security profile to the mobile device if the computing node is determined to be authorized to transfer the device security profile to the mobile device,

wherein a device security program on the mobile device is configured to interpret the device security profile to set one or more security parameters for the mobile device, wherein a node security profile of the computing node is used to determine whether the computing node is authorized to transfer the device security profile to the mobile device.

2. The method of claim 1, wherein the device security application to be executed by the mobile device is further configured to perform at least one of erasing data on the mobile device and sending an alert to an administrator.

3. The method of claim 1, wherein the computing node is a mobile device.

4. The method of claim 1, further comprising:

sending one or more other device security profiles to the mobile device if the computing node is determined to be authorized to transfer the device security profile to the mobile device,

wherein a single one of the device security profiles is activated on the mobile device.

5. The method of claim 4, wherein the single one of the device security profiles is activated based on at least one of time, day, date, location, and mobile device sensing equipment.

6. The method of claim 4, further comprising:

sending signals to the mobile device to activate a different one of the device security profiles when the mobile device is moved to a secure location.

7. The method of claim 1, further comprising:

creating the device security profile dynamically for the mobile device based on a time or a location of the mobile device.

8. The method of claim 7, wherein the device security profile includes a validation life span indicating a time frame that the device security profile can be used.

9. At least one non-transitory computer readable medium that includes code for execution and when executed by a processor:

establishes a connection to a mobile device from a computing node;

determines whether the computing node is authorized to transfer a device security profile to the mobile device;

sends a device security application to the mobile device when the computing node is determined to be not authorized to transfer the device security profile to the mobile device, wherein the device security application is configured to execute at the mobile device to disable the mobile device from usage; and

sends the device security profile to the mobile device if the computing node is determined to be authorized to transfer the device security profile to the mobile device,

wherein a device security program on the mobile device is configured to interpret the device security profile to set one or more security parameters for the mobile device, wherein a node security profile of the computing node is used to determine whether the computing node is authorized to transfer the device security profile to the mobile device.

10. The at least one non-transitory computer readable medium of claim 9, wherein the device security application to be executed by the mobile device is further configured to perform at least one of erasing data on the mobile device and sending an alert to an administrator.

11. The at least one non-transitory computer readable medium of claim 9 that includes further code for execution and when executed by a processor:

sends one or more other device security profiles to the mobile device if the computing node is determined to be authorized to transfer the device security profile to the mobile device,

wherein a single one of the device security profiles is activated on the mobile device.

12. The at least one non-transitory computer readable medium of claim 11, wherein the single one of the device security profiles is activated based on at least one of time, day, date, location, and mobile device sensing equipment.

13. The at least one non-transitory computer readable medium of claim 11, that includes further code for execution and when executed by a processor:

sends signals to the mobile device to activate a different one of the device security profiles when the mobile device is moved to a secure location.

14. The at least one non-transitory computer readable medium of claim 9 that includes further code for execution and when executed by a processor:

creates the device security profile dynamically for the mobile device based on a time or a location of the mobile device.

15. An apparatus, comprising:

a computing node that includes a node security program configured to interpret a node security profile, the computing node being configured to;

establish a connection to a mobile device;

determine whether the computing node is authorized to transfer a device security profile to the mobile device;

send a device security application to the mobile device when the computing node is determined to be not authorized to transfer the device security profile to the mobile device, wherein the device security application is configured to execute at the mobile device to disable the mobile device from usage; and

send the device security profile to the mobile device if the computing node is determined to be authorized to transfer the device security profile to the mobile device,

wherein a device security program on the mobile device is configured to interpret the device security profile to set one or more security parameters for the mobile device, wherein a node security profile of the computing node is used to determine whether the computing node is authorized to transfer the device security profile to the mobile device.

16. The apparatus of claim 15, wherein the device security application to be executed by the mobile device is further configured to perform at least one of erasing data on the mobile device and sending an alert to an administrator.

17. The apparatus of claim 15, wherein the computing node is further configured to:

send one or more other device security profiles to the mobile device if the computing node is determined to be authorized to transfer the device security profile to the mobile device,

wherein a single one of the device security profiles is activated on the mobile device.

18. The apparatus of claim 17, wherein the single one of the device security profiles is activated based on at least one of time, day, date, location, and mobile device sensing equipment.

19. The apparatus of claim 17, wherein the computing node is further configured to:

send signals to the mobile device to activate a different one of the device security profiles when the mobile device is moved to a secure location.