Methods and systems for sharing risk responses between collections of mobile communications devices

• US 9,781,148 B2
• Filed: 12/17/2015
• Issued: 10/03/2017
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin Patrick, Buck, Brian James, Robinson, William, Hering, John G., Burgess, James David, Wyatt, Timothy Micheal, Golombek, David, Richardson, David Luke, Lineberry, Anthony McKay, Barton, Kyle, Evans, Daniel Lee, Salomon, Ariel, Grubb, Jonathan Pantera, Wootton, Bruce, Strazzere, Timothy, Swami, Yogesh
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US14/973,636
• Publication Number:
  US 20160099963A1
• Time in Patent Office: 656 Days
• Field of Search: None
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

Methods are provided for determining an enterprise risk level, for sharing security risk information between enterprises by identifying a security response by a first enterprise and then sharing the security response to a second enterprise when a relationship database profile for the first collection indicates the security response may be shared. Methods are also provided for determining whether to allow a request from an originating device where the request may have been initiated by a remote device.

Claims

1. A method for determining an acceptable risk level for a collection to improve the functioning of mobile communications devices associated with the collection, the method comprising:

accessing, by a server security component, a security database including risk information received from a plurality of collections, wherein the risk information includes source information that associates the risk information with one or more collections from the plurality;

determining, by the server security component, a risk level for each collection based on the accessed risk information associated with each collection, the determined risk levels including a first risk level associated with a first collection;

determining, by the server security component, an acceptable risk level based on the determined risk levels;

providing, by the server security component to the first collection, the acceptable risk level and the first risk level;

determining, by the server security component, a new first risk level for the first collection based in part on new risk information associated with the first collection;

determining, by the server security component, a new acceptable risk level based on a plurality of determined risk levels;

providing, by the server security component to the first collection, the new acceptable risk level and the new first risk level;

comparing, by the server security component, the new first risk level to the new acceptable risk level; and

,

notifying, by the server security component, the first collection when the comparison indicates that the new first risk level is more than a threshold amount greater than the new acceptable risk level.

2. The method of claim 1, wherein providing, by the server security component to the first collection, the acceptable risk level and the first risk level includes providing the acceptable risk level and the first risk level to a first administrator device associated with a first administrator of the first collection.

3. The method of claim 1, further comprising:

comparing, by the server security component, the first risk level to the acceptable risk level; and

alerting, by the server security component, the first collection when the comparison indicates that the first risk level is more than a threshold more than the acceptable risk level.

4. The method of claim 1, wherein the determining, by the server security component, a new first risk level for the first collection was performed in response to the server security component receiving a request for the new first risk level from the first collection.

5. The method of claim 4, wherein the request for the new first risk level was initiated from a device associated with an administrator of the first collection after a change was made that potentially affected the first risk level.

6. The method of claim 1, wherein the security database further includes a plurality of security risk responses, each security risk response associated with at least one of the plurality of collections, the method further comprising:

identifying, by the server security component, a first security risk response in the security database, wherein the first security risk response is associated with the first collection;

accessing, by the server security component, a relationship database including collection profiles related to the sharing of information between the plurality of collections, wherein the relationship database includes a first collection profile indicating that the first collection permits information related to the first security risk response to be shared with a second collection of the plurality when a determined second risk level associated with the second collection is equal to or less than a second threshold more than the acceptable risk level;

comparing, by the server security component, the second risk level to the acceptable risk level; and

,

providing, by the server security component, the first security risk response to the second collection when the second risk level is equal to or less than the second threshold more than the acceptable level.

7. A method for determining whether to allow a network access request, comprising:

receiving, by a destination computing device running a destination computing device security component, an access request by a terminal computing device in a series of at least one computing devices, wherein the series begins with an initial computing device, wherein the initial computing device initiates the access request, and wherein the series includes all computing devices used to transmit the access request to the destination computing device;

requesting, by the destination computing device security component, terminal source information relating to the access request from a terminal device security component running on the terminal computing device;

requesting, by the destination computing device security component, next source information relating to the access request from a next device security component running on a next computing device of the series when the destination computing device security component receives terminal source information from the terminal device security component and the terminal source information indicates that the terminal computing device is trusted, and is not the initiator of the access request, and identifies the next computing device in the series;

allowing, by the destination computing device security component, the access request;

when the destination computing device security component receives next source information from the next device security component, and

when the next source information;

indicates that the next computing device is trusted, and

indicates that the next computing device is the initial computing device and is not being controlled by a remote device; and

repeating, for additional next computing devices, requesting, by the destination computing device security component, additional next source information relating to the initiator of the access request from additional next device security components running on additional next computing devices when the destination computing device security component receives source information from a previous device security component and the previous source information indicates that the previous computing device is trusted, and is not the initiator of the access request, and identifies the additional next computing device in the series,

until the destination computing device security component receives additional next source information from an additional next device security component and the additional next source information indicates that the additional next computing device is trusted, and is the initiator of the access request.

8. A method for determining whether to allow a network access request, comprising:

receiving, by a destination computing device running a destination computing device security component, an access request by a terminal computing device in a series of at least one computing devices, wherein the series begins with an initial computing device, wherein the initial computing device is the initiator of the access request, and wherein the access request is transmitted to the destination computing device using the series;

requesting, by the destination computing device security component, terminal source information relating to the initiator of the access request from a terminal device security component running on the terminal computing device;

requesting, by the destination computing device security component, next source information relating to the initiator of the access request from a next device security component running on a next computing device when the destination computing device security component receives terminal source information from the terminal device security component and the terminal source information indicates that the terminal computing device is trusted, and is not the initiator of the access request, and identifies the next computing device in the series;

denying, by the destination computing device security component, the access request;

when the destination computing device security component does not receive next source information, or

when the destination computing device security component receives next source information from the next device security component and the next source information indicates that the next computing device is the initiator of the access request and indicates that the next computing device in the series is not trusted; and

repeating, for additional next computing devices, requesting, by the destination computing device security component, additional next source information relating to the initiator of the access request from additional next device security components running on additional next computing devices when the destination computing device security component receives source information from a previous device security component and the previous source information indicates that the previous computing device is trusted, and is not the initiator of the access request, and identifies the additional next computing device in the series;

until the destination computing device security component does not receive additional next source information from an additional next device security component, or

until the additional next source information indicates;

that the additional next computing device is not trusted, or

that the additional next computing device is the initiator of the access request.