Distributed data revocation using data commands

• US 8,935,384 B2
• Filed: 05/06/2011
• Issued: 01/13/2015
• Est. Priority Date: 05/06/2010
• Status: Active Grant

• Current Assignee: Skyhigh Security LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Goldschlag, David, Sapp, Kevin, Walker, David
• Primary Examiner(s): GREENE, JOSEPH L
• Application Number:
  US13/102,627
• Publication Number:
  US 20110276683A1
• Time in Patent Office: 1,348 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

A policy proxy intercepts a data stream between a data server and a user or other device, identifies the user device, and identifies a policy in an integrated policy server applicable to the user device based on the identity of the user device. The policy proxy may identify one or more of the policy elements based on the user device, and translate the policy elements into actions involving the data stream between the data server and the user device so as to implement at least one aspect of the identified policy. The actions can comprise permitting normal exchange of data between the data server and the user device, preventing communication between the data server and the user device, or modifying the data stream between the data server and the user device.

Claims

1. A method for operating a network comprising:

intercepting, at a policy proxy implemented on non-transitory computer-readable media, a data stream being exchanged between a data server and the mobile device, wherein the policy proxy is remotely and communicably connected to the mobile device over a communication network, and the data stream comprises a synchronization request and email synchronization results,

comparing, at the policy proxy, actual policy elements of the mobile device with expected policy elements of the mobile device, wherein the mobile device is not configured to support the expected policy elements; and

,

modifying, at the policy proxy, the data stream in accordance with difference between the actual policy elements and the expected policy elements to bring the mobile device into compliance with the expected policy elements;

wherein modifying the data stream comprises, when the mobile device requests from the data server to synchronize with a non-empty mailbox or a non-empty folder and the policy proxy determines the mobile device does not have access to the non-empty mailbox or the non-empty folder, modifying the e-mail synchronization results from the data server to cause the mobile device to synchronize with an empty mailbox or an empty folder, respectively, and to cause the deletion of the non-empty mailbox or the non-empty folder of the mobile device respectively.

2. The method of claim 1 wherein the step of modifying the data stream results in altering data stored on the mobile device.

6. The method of claim 1, further comprising:

identifying the mobile device at the policy proxy;

identifying, at the policy proxy, the expected policy in a policy server applicable to the mobile device.

7. The method of claim 1, further comprising:

translating, at the policy server, the difference between the actual policy elements and the expected policy elements into actions involving the data stream to implement the expected policy elements.

8. The method of claim 1, wherein modifying the data stream comprises inserting, removing, or substituting data or commands in the data stream.

9. The method of claim 1, wherein modifying the data stream comprises translating the expected policy elements into a form transmittable by the data stream and acceptable to the mobile device.

10. The method of claim 1, wherein modifying the data stream causes the expected policy elements to be enforced upon the mobile device without requiring or using additional software on the mobile device for supporting said expected policy elements.

11. The method of claim 1, wherein the modified data stream results in deletion of at least some of the data previously stored on the mobile device.

3. A system for operating a network comprising:

one or more memory elements;

a processor;

wherein the one or more memory elements has program instructions stored thereon for providing a policy proxy, when the program instructions are executed by the processor, the policy proxy is configured to;

intercept a data stream being exchanged between a data server and the mobile device, wherein the policy proxy is remotely and communicably connected to the mobile device over a communication network, and the policy proxy is structured to compare actual policy elements of the mobile device with expected policy elements of the mobile device, wherein the mobile device is not configured to support the expected policy elements, and the data stream comprises a synchronization request and email synchronization results;

modify the data stream in accordance with difference between the actual policy elements and the expected policy elements to bring the mobile device into compliance with the expected policy elements;

wherein modifying the data stream comprises, when the mobile device requests from the data server to synchronize with a non-empty mailbox or a non-empty folder and the policy proxy determines the mobile device does not have access to the non-empty mailbox or the non-empty folder, modifying the e-mail synchronization results from the data server to cause the mobile device to synchronize with an empty mailbox or an empty folder, respectively, and to cause the deletion of the non-empty mailbox or the non-empty folder of the mobile device respectively.

4. The system of claim 3 wherein the modified data stream results in altering data previously stored on the mobile device.

12. The system of claim 3, wherein the policy proxy is further configured to:

translate the difference between the actual policy elements and the expected policy elements into actions involving the data stream to implement the expected policy elements.

13. The system of claim 3, wherein modifying the data stream comprises translating the expected policy elements into a form transmittable by the data stream.

14. The system of claim 3, wherein modifying the data stream causes the expected policy elements to be enforced upon the mobile device without requiring or using additional software on the mobile device for supporting said expected policy elements.

15. The system of claim 3, wherein the modified data stream results in deletion of at least some of the data stored on the mobile device.

5. A computer storage device coupled to a processor, said computer storage device storing computer program instructions that when executed control the processor to perform the following functions:

intercepting, using a policy proxy, a data stream being exchanged between a data server and the mobile device, wherein the policy proxy is remotely and communicably connected to the mobile device over a communication network, and the data stream comprises a synchronization request and email synchronization results,

comparing, using the policy proxy, actual policy elements of the mobile device with expected policy elements of the mobile device, wherein the mobile device is not configured to support the expected policy elements;

modifying, using the policy proxy, the data stream in accordance with difference between the actual policy elements and the expected policy elements to bring the mobile device into compliance with the expected policy elements;

wherein the function of modifying the data stream comprises, when the mobile device requests from the data server to synchronize with a non-empty mailbox or a non-empty folder and the policy proxy determines the mobile device does not have access to the non-empty mailbox or the non-empty folder, modifying the e-mail synchronization results from the data server to cause the mobile device to synchronize with an empty mailbox or an empty folder, respectively, and to cause the deletion of the non-empty mailbox or the non-empty folder of the mobile device respectively.

16. The computer storage device of claim 5, wherein the functions further comprises:

translating the difference between the actual policy elements and the expected policy elements into actions involving the data stream to implement the expected policy elements.

17. The computer storage device of claim 5, wherein modifying the data stream causes the expected policy elements to be enforced upon the mobile device without requiring or using additional software on the mobile device for supporting said expected policy elements.