Method and system for evaluating security for an interactive service operation by a mobile device

• US 9,307,412 B2
• Filed: 11/05/2013
• Issued: 04/05/2016
• Est. Priority Date: 04/24/2013
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Halliday, Derek, Bergher, Bruno, Mahaffey, Kevin, Buck, Brian, Gupta, Abheek
• Primary Examiner(s): Rahim, Monjour
• Application Number:
  US14/072,718
• Publication Number:
  US 20140325586A1
• Time in Patent Office: 882 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

A method for evaluating security during an interactive service operation by a mobile communications device includes launching, by a mobile communications device, an interactive service configured to access a server over a network during an interactive service operation, and generating a security evaluation based on a plurality of trust factors related to a current state of the mobile communications device, to a security feature of the application, and/or to a security feature of the network. When the security evaluation is generated, an action is performed based on the security evaluation.

Claims

1. A method for evaluating security during an interactive service operation by a mobile communications device, the method comprising:

identifying, by a security component on a mobile communications device, a launch of an interactive service configured to communicate with a server over a network during an interactive service operation, wherein the interactive service is associated with an entity and is configured to transmit data to and receive data from a target website purportedly associated with the entity;

verifying that the target website is an authentic website associated with the entity, wherein the verifying includes identifying a domain of the target website based on a uniform resource locator (URL) of the target website and includes determining that the domain of the target website is registered by the entity;

in response to the launch of the interactive service, generating, by the security component, a security evaluation of the interactive service based on a plurality of trust factors including;

a trust factor related to a current state of the mobile communications device, a trust factor related to a security feature of the interactive service, and a trust factor related to a security feature of the network; and

allowing, by the security component, the performance, by the mobile communications device, of the interactive service operation when a security measure from the security evaluation does not go beyond a threshold security measure.

2. The method of claim 1 further including displaying, by the mobile communications device, the security evaluation to a user of the mobile communications device while the user is using the interactive service.

3. The method of claim 1 wherein the security evaluation indicates that it is safe to perform the interactive service operation when the security measure does not go beyond the threshold security measure.

4. The method of claim 1 wherein the interactive service includes one or both of an application hosted by the mobile communications device and a web application operating in a web browser on the mobile communications device.

5. The method of claim 1 wherein when the target website is not an authentic website associated with the entity, the method further comprises generating, by the mobile communications device, a security warning indicating that the interactive service is suspicious, and displaying the security warning to the user.

6. The method of claim 1 wherein the entity is a financial institution, a payment service, or an e-commerce service.

7. The method of claim 1 wherein the plurality of trust factors are associated with a plurality of security subscores and the method further includes determining the security measure by accumulating the plurality of security subscores.

8. The method of claim 7 wherein the threshold security measure is a first threshold security score, and when the security measure is greater than the first threshold security score and less than a second threshold security score, the security evaluation indicates that it is not safe to perform the interactive service operation and to proceed with caution, and when the security measure is at least equal to the second threshold security score, the security evaluation indicates that it is not recommended to perform the interactive service operation.

9. The method of claim 7 wherein when a first trust factor is directed to whether malware exists on the mobile communications device, the method further includes setting a security subscore associated with the first trust factor to a value greater than zero when malware is detected, and setting the security subscore to zero when malware is not detected.

10. The method of claim 7 wherein when a first trust factor is related to a current state of the mobile communications device is directed to whether the mobile communications device is lost or stolen, the method includes setting the security subscore associated with the first trust factor to a value greater than zero when the device is reported lost or stolen.

11. The method of claim 10 wherein when the security subscore is greater than zero, the method further includes locking the mobile communications device and wherein when the interactive service is configured to access a target website, the method includes transmitting a notification message to the target website that the mobile communications device is lost or stolen.

12. The method of claim 7 wherein when a first trust factor related to a security feature of the interactive service is directed to whether the interactive service is downloaded from a trusted source, the method includes setting the security subscore associated with the first trust factor to a value greater than zero when the source is not a trusted source, and setting the security subscore to zero when the source is a trusted source.

13. The method of claim 7 wherein when a first trust factor related to a security feature of the interactive service is directed to whether the interactive service encrypts data transmitted to the website, the method includes setting the security subscore associated with the first trust factor to a value greater than zero when the data is not encrypted, and setting the security subscore to zero when the data is encrypted.

14. The method of claim 7 wherein when a first trust factor related to a security feature of the network is directed to whether the network over which data is transmitted and received is a secure network, the method includes setting the security subscore to a value greater than zero when the network is an insecure network, and setting the security subscore to zero when the network is secure.

15. The method of claim 14 wherein when the security subscore is greater than zero, the method further includes detecting a second network that is a secure network, disconnecting from the insecure network, connecting to the second network, and setting the security subscore to zero.

16. The method of claim 1 further comprising displaying, by the mobile communications device, a contextual information overlay associated with the security evaluation, wherein the contextual information overlay provides contextual information relating to the security evaluation.

17. The method of claim 16 wherein the contextual information overlay comprises a checklist that includes information regarding a current security status of the mobile communications device, a security status of the interactive service, and/or to a security status of the network.

18. The method of claim 1 further comprising authenticating, by the mobile communications device, the user of the mobile communications device based on information known to the device'"'"'s user, a geo-location of the mobile communications device, and/or sensor data collected by the mobile communications device, wherein the interactive service operation is performed when the user is authenticated and when the security measure does not go beyond the threshold security measure.

19. The method of claim 18 wherein authenticating the user includes determining, by the mobile communications device, that the mobile communications device is near another mobile communications device known to be associated with the user.

20. The method of claim 1, wherein the interactive service operation is a first interactive service operation, the method further comprising:

in response to an identified second interactive service operation using the interactive service, generating, by the mobile communications device, a second security evaluation of the interactive service based on the plurality of trust factors; and

performing, by the mobile communications device, the second interactive service operation when a security measure based on the second security evaluation does not go beyond the threshold security measure.

21. A method for evaluating security during an interactive service operation by a mobile communications device, the method comprising:

identifying, by a mobile communications device, a launch of an interactive service configured to communicate with a server over a network during an interactive service operation, wherein the interactive service is associated with an entity and is configured to transmit data to and receive data from a target website purportedly associated with the entity;

verifying that the target website is an authentic website associated with the entity, wherein the verifying includes identifying a domain of the target website based on a uniform resource locator (URL) of the target website and includes determining that the domain of the target website is registered by the entity;

in response to the launch of the interactive service, determining, by the mobile communications device, a security score for the interactive service based on a plurality of trust factors including;

a trust factor related to a current state of the mobile communications device, a trust factor related to a security feature of the interactive service, and a trust factor related to a security feature of the network;

generating a security evaluation for the interactive service based on the security score; and

displaying, by the mobile communications device, the security evaluation for the interactive service and/or a contextual information overlay associated with the interactive service comprising a checklist that includes information regarding a current security status of the mobile communications device, a security status of the interactive service, and a security status of the network, wherein the security evaluation and/or the contextual information overlay is displayed while the user is using the interactive service.

22. A method for evaluating security during an interactive service operation by a mobile communications device, the method comprising:

receiving, by a server having a hardware processor and non-transient computer readable media, an indication from a mobile communications device that an interactive service on the mobile communications device is launched, wherein the interactive service is configured to communicate with another server over a network during an interactive service operation, and wherein the interactive service is associated with an entity and is configured to transmit data to and receive data from a target website purportedly associated with the entity;

verifying that the target website is an authentic website associated with the entity, wherein the verifying includes identifying a domain of the target website based on a uniform resource locator (URL) of the target website and includes determining that the domain of the target website is registered by the entity; and

in response to the indication of the launch of the interactive service, generating, by the server, a security evaluation of the interactive service based on a plurality of trust factors including;

a trust factor related to a current state of the mobile communications device, a trust factor related to a security feature of the interactive service, and a trust factor related to a security feature of the network.

23. The method of claim 22 further comprising determining, by the server, an action based on the security evaluation, wherein the action is performed by the server and/or the mobile communications device.

24. The method of claim 22 further comprising transmitting the security evaluation to the mobile communications device, wherein the mobile communications device is configured to perform an action based on the security evaluation.

25. The method of claim 22 wherein the plurality of trust factors includes a trust factor related to a reputation of the launched interactive service and the method further includes determining, by the server, the interactive service'"'"'s reputation from at least one of a social media and social networking web site.

26. The method of claim 22 wherein the server is one of a VPN server that is configured to tunnel data traffic between the mobile communications device and the other server and a proxy web server.