System and method for providing network security to mobile devices

• US 9,747,444 B1
• Filed: 05/03/2017
• Issued: 08/29/2017
• Est. Priority Date: 12/13/2005
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: CUPP Computing AS
• Inventors: Touboul, Shlomo
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US15/586,176
• Publication Number:
  US 20170235952A1
• Time in Patent Office: 118 Days
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A small piece of hardware connects to a mobile device and filters out attacks and malicious code. Using the piece of hardware, a mobile device can be protected by greater security and possibly by the same level of security offered by its associated corporation/enterprise. In one embodiment, a mobile security system includes a connection mechanism for connecting to a data port of a mobile device and for communicating with the mobile device; a network connection module for acting as a gateway to a network; a security policy for determining whether to forward content intended for the mobile device to the mobile device; and a security engine for executing the security policy.

Claims

1. A security system, comprising:

security system memory;

a security system processor configured to;

store in the security system memory a security policy identifying one or more trusted networks and defining when to forward network data intended for a mobile device to the mobile device for processing by at least one mobile device processor of the mobile device, the at least one mobile device processor of the mobile device being different than the security system processor of the security system,

the security policy defining that when the mobile device does not reside on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will scan the network data for malicious content to decide whether the network data should be forwarded to the mobile device,

the security policy defining that when the mobile device resides on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will allow the network data to be forwarded to the mobile device without the security system processor of the security system scanning for the malicious content;

receive from the mobile device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device; and

execute security code to implement the security policy as it relates to the particular network data received from the mobile device, the security code configured to modify at least a portion of the particular network data before delivering the particular network data as modified to the mobile device.

2. The security system of claim 1, wherein the security code is configured to perform gateway level security services including firewall services.

3. The security system of claim 1, wherein the security system uses at least one of a USB connector, a PCMCIA connector, an Ethernet connector, or a wireless communication module to communicate with the mobile device.

4. The security system of claim 1, wherein the security code includes at least one of antivirus software, antispyware software, a firewall, IPS/IDS software, content filtering software, a bytecode monitor, and a URL monitor.

5. The security system of claim 1, further comprising remote management code capable of receiving and installing security policy updates.

6. The security system of claim 1, further comprising remote management code capable of receiving and installing security code updates.

7. The security system of claim 1, further comprising remote configuration code capable of communicating with a wizard, the wizard being in communication with an enterprise network security system, the wizard capable of substantially automatic generation of the security policy based on one or more policies on the enterprise network security system.

8. The security system of claim 1, wherein the security code is configured to prevent at least a portion of the particular network data from being processed by the mobile device.

9. The security system of claim 1, wherein the mobile device includes a kernel-level redirector configured to redirect the particular network data received from a network by the mobile device to the security system.

10. The security system of claim 1, wherein at least a portion of the security system is a part of the mobile device.

11. A method comprising:

storing in security system memory a security policy identifying one or more trusted networks and defining when to forward network data intended for a mobile device to the mobile device for processing by at least one mobile device processor of the mobile device, the at least one mobile device processor of the mobile device being different than a security system processor of the security system,

the security policy defining that when the mobile device does not reside on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will scan the network data for malicious content to decide whether the network data should be forwarded to the mobile device,

the security policy defining that when the mobile device resides on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will allow the network data to be forwarded to the mobile device without the security system processor of the security system scanning for the malicious content;

receiving from the mobile device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device; and

executing security code to implement the security policy as it relates to the particular network data received from the mobile device, the executing the security code including modifying at least a portion of the particular network data before delivering the particular network data as modified to the mobile device.

12. The method of claim 11, wherein the executing the security code includes performing gateway level security services including firewall services.

13. The method of claim 11, further comprising using at least one of a USB connector, a PCMCIA connector, an Ethernet connector, or a wireless communication module to communicate with the mobile device.

14. The method of claim 11, wherein the executing the security code includes executing at least one of antivirus software, antispyware software, a firewall, IPS/IDS software, content filtering software, a bytecode monitor, and a URL monitor.

15. The method of claim 11, further comprising receiving and installing security policy updates.

16. The method of claim 11, further comprising receiving and installing security code updates.

17. The method of claim 11, further comprising communicating with a wizard, the wizard being in communication with an enterprise network security system, the wizard capable of substantially automatic generation of the security policy based on one or more policies on the enterprise network security system.

18. The method of claim 11, wherein the executing the security code includes preventing at least a portion of the particular network data from being processed by the mobile device.

19. The method of claim 11, wherein the receiving the particular network data from the mobile device includes receiving the particular network data from a kernel-level redirector configured to redirect the particular network data received from a network by the mobile device to the security system.

20. The method of claim 11, wherein at least a portion of the security system is a part of the mobile device.

21. A security system comprising:

security system memory storing a security policy identifying one or more trusted networks and defining when to forward network data intended for a mobile device to the mobile device for processing by at least one mobile device processor of the mobile device, the at least one mobile device processor of the mobile device being different than a security system processor of the security system,

the security policy defining that when the mobile device does not reside on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will scan the network data for malicious content to decide whether the network data should be forwarded to the mobile device,

the security policy defining that when the mobile device resides on any of the one or more trusted networks identified by the security policy, the security system processor of the security system will allow the network data to be forwarded to the mobile device without the security system processor of the security system scanning for the malicious content;

means for receiving from the mobile device particular network data before the at least one mobile device processor of the mobile device processes the particular network data, the particular network data having been forwarded to the security system by the at least one mobile device processor of the mobile device; and

security code configured to implement the security policy as it relates to the particular network data received from the mobile device, the security code configured to modify at least a portion of the particular network data before delivering the particular network data as modified to the mobile device.