System and method for creating and assigning a policy for a mobile communications device based on personal data

• US 9,642,008 B2
• Filed: 10/25/2013
• Issued: 05/02/2017
• Est. Priority Date: 10/25/2013
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Wyatt, Timothy Micheal, Mahaffey, Kevin Patrick, Richardson, David Luke, Buck, Brian James, Rogers, Marc William
• Primary Examiner(s): Afshar, Kamran
• Assistant Examiner(s): Madani, Farideh
• Application Number:
  US14/063,342
• Publication Number:
  US 20150118992A1
• Time in Patent Office: 1,285 Days
• Field of Search: 726 4, 726 5, 726 6, 455410, 455411
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A system and method to create and assign a policy for a mobile communications device are disclosed. The policy may be created based on personal data associated with the mobile communications device. For example, known sources of personal data on the mobile communications device may be identified and a policy may be created based on the known personal data. The policy may then be used to identify additional personal data associated with the mobile communications device. Thus, the personal data associated with the mobile communications device may be monitored. If an application attempts to access the monitored personal data, the access will be detected.

Claims

1. A method comprising:

identifying, by a policy management module on a mobile communications device, one or more locations for storing personal data on the mobile communications device;

identifying, by the policy management module, a first set of personal data stored at the one or more locations on the mobile communications device;

generating, by the policy management module, a policy for the mobile communications device based on an analysis by the policy management module of the first set of personal data, the generated policy for identifying a second set of personal data stored on the mobile communications device and for controlling access to the second set of personal data;

identifying, by the policy management module, the second set of personal data stored on the mobile communications device based on the generated policy, the second set of personal data being different from the first set of personal data;

monitoring, by the policy management module, the second set of personal data stored on the mobile communications device based on the generated policy; and

detecting, by the policy management module, a request for access to the monitored second set of personal data by an application executed on the mobile communications device.

2. The method of claim 1, wherein the step of identifying the second set of personal data stored on the mobile communications device is achieved by using the generated policy to identify additional personal data stored on the mobile communications device.

3. The method of claim 2, further comprising monitoring, by the policy management module, the first set of personal data stored on the mobile communications device based on the generated policy.

4. The method of claim 1, wherein the first set of personal data comprises data from at least one of a contacts database, email database, a database containing communications received or transmitted by the mobile communications device, location information of the mobile communications device, or recently used network names.

5. The method of claim 1, wherein the step of detecting the request for access to the monitored second set of personal data includes determining if the requested access would result in a transmission of at least part of the second set of personal data from the mobile communications device.

6. The method of claim 1, wherein, when the executed application is associated with a container wrapper, the step of detecting the request for access to the monitored second set of personal data is based on the executed application interacting with an interface of the container wrapper.

7. The method of claim 1, wherein, when the monitored second set of personal data is associated with a container wrapper, the step of detecting the request for access to the monitored second set of personal data is based on the executed application interacting with an interface of the container wrapper.

8. A method comprising:

identifying, by a policy management module on a mobile communications device, a first set of personal data associated with the mobile communications device;

receiving, by the policy management module, from a server, an analysis associated with the mobile communications device;

generating, by the policy management module, a policy for the mobile communications device based on the first set of personal data associated with the mobile communications device and based on the analysis received from the server, the generated policy for identifying a second set of personal data stored on the mobile communications device and for controlling access to the second set of personal data;

assigning, by the policy management module, the policy to the mobile communications device;

identifying, by the policy management module, the second set of personal data stored on the mobile communications device based on the generated policy, the second set of personal data being different from the first set of personal data;

monitoring, by the policy management module, the second set of personal data stored on the mobile communications device based on the generated policy; and

detecting, by the policy management module, a request for access to the monitored data by an application that is executed on the mobile communications device.

9. The method of claim 8, wherein the analysis received from the server is at least partly based on a presence of at least one application installed on the mobile communications device.

10. The method of claim 9, wherein the analysis received from the server is further at least partly based on known access to the monitored data performed by the at least one application installed on the mobile communications device.

11. The method of claim 8, wherein the identified first set of personal data includes at least one of a contacts database, email database, a database containing communications received or transmitted by the mobile communications device, location information of the mobile communications device, or recently used network names.

12. The method of claim 8, wherein the step of detecting the request for access to the monitored data includes determining if the requested access would result in a transmission of at least part of the monitored data from the mobile communications device.

13. The method of claim 8,

further comprising monitoring, by the policy management module, the first set of personal data associated with the mobile communications device based on the policy.

14. The method of claim 8, wherein, when the application is associated with a container wrapper, the step of detecting the request for access to the monitored data is based on the application interacting with an interface of the container wrapper.

15. A method comprising:

identifying, by a policy management module on a mobile communications device, a first set of personal data stored on the mobile communications device;

generating, by the policy management module, a policy based on the identified first set of personal data stored on the mobile communications device, the generated policy for identifying a second set of personal data stored on the mobile communications device and for controlling access to the second set of personal data;

identifying, by the policy management module, the second set of personal data stored on the mobile communications device based on the generated policy, wherein the second set of personal data includes the identified first set of personal data and additional personal data;

monitoring the second set of personal data stored on the mobile communications device based on the generated policy; and

detecting a request for access to the monitored second set of personal data by at least one application executed on the mobile communications device.

16. The method of claim 15, wherein the identified first set of personal data is associated with at least one of a contacts database, email database, a database containing communications received or transmitted by the mobile communications device, location information of the mobile communications device, or recently used network names.

17. The method of claim 15, wherein the step of detecting the request for access to the monitored second set of personal data includes determining if the access resulted in a transmission of at least a part of the second set of personal data from the mobile communications device.

18. The method of claim 15, wherein, when the at least one application is associated with a container wrapper, the step of detecting the request for access to the monitored second set of personal data is based on the at least one application interacting with an interface of the container wrapper.

19. The method of claim 18, wherein, when the monitored second set of personal data is associated with a container wrapper, the step of detecting the request for access to the monitored second set of personal data is based on the at least one application interacting with an interface of the container wrapper.

20. The method of claim 15, further comprising:

displaying a notification of the detecting of the request for access to the second set of personal data, the notification identifying the application requesting access to the second set of personal data and presenting an option to allow the access or not allow the access.