# US 10,375,572 B2 · User interface for security protection and remote management of network endpoints > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,572 B2 - Document ID: US10375572B2 - Status: Granted - Kind: B2 - Application number: 14/966,315 - Filed: 2015-12-11 - Published: 2016-06-16 - Granted: 2019-08-06 - Earliest claimed: 2014-12-11 - Assignees: Bitdefender IPR Management Ltd. - Applicants: Bitdefender IPR Management Ltd. - Inventors: Alexandru I. Achim; Mirela L. Padina; Monica M. Miron; Bogdan C. Cebere; Cosmin C. Stan; Catalina Albisteanu; Dan Berte; Bogdan Dumitrache; Daniel A. Mircescu; Alex Novac - Web page: https://patentgrep.com/patent/US10375572B2 ## CPC - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - H04L 41/0803: Configuration setting - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/101: {Access control lists [ACL]} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04W 12/088: using filters or firewalls - H04W 76/12: Setup of transport tunnels - H04W 76/32: Release of transport tunnels - H04L 12/2834: {Switching of information between an external network and a home network (access arrangements H04L12/2856)} - H04L 41/0809: {Plug-and-play configuration} - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 61/5061: Pools of addresses - H04L 63/105: {Multiple levels of security} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 88/12: Access point controller devices - H04W 88/16: Gateway arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In some embodiments, a network regulator device protects a local network of client systems (e.g. Internet-of-things devices such as smartphones, home appliances, wearables, etc.) against computer security threats. Various aspects of the operation of the network regulator may be managed remotely via a graphical user interface (GUI) executing on an administration device, such as a mobile phone. The GUI is further configured to display a security notification to a user of the administration device, the security notification indicating the occurrence of a security event caused by an action of a protected client system. ## Claims ### Claim 1 A computing system comprising a hardware processor and a memory, the memory storing instructions which, when executed by the hardware processor, cause the computing system to: receive data from a remote server, the data selected by the server for transmission to the computing system according to a subscription associated with a network regulator protecting a plurality of client systems against computer security threats, wherein the plurality of client systems are connected to the network regulator over a local network; and perform a display of a graphical user interface (GUI) of a device administration application according to the data, the GUI configured to: generate at least one device management view enabling a user of the computing system to remotely configure a client system of the plurality of client systems by selecting a device group from a predetermined plurality of device groups to indicate a membership of the client system in the selected device group, wherein members of each device group have group-specific values of configuration parameters; and generate at least one security notification view displaying an indicator of a computer security event caused by an action of the client system, wherein the network regulator is configured, in response to connecting to a router providing a service of supplying local network addresses to the plurality of client systems, to automatically take over the service of supplying local network addresses from the router. ### Claim 2 (depends on 1) The computing system of claim 1, wherein the at least one device management view displays an interactive element enabling a user to select an entry from an address book of the computing system to designate an owner of the client system. ### Claim 3 (depends on 1) The computing system of claim 1, wherein the computer security event comprises detecting malicious software executing on the client system. ### Claim 4 (depends on 1) The computing system of claim 1, wherein the computer security event comprises detecting an attempt by the client system to access a resource located outside the local network, wherein accessing the resource constitutes a computer security threat to the client system. ### Claim 5 (depends on 1) The computing system of claim 1, wherein the indicator of the computer security event comprises an indicator of a category of computer security threats indicated by the computer security event, and further comprises a text definition of the category. ### Claim 6 (depends on 1) The computing system of claim 1, wherein the computing system comprises a mobile telephone. ### Claim 7 A method comprising: employing a network regulator to protect a plurality of client systems against computer security threats, wherein the plurality of client systems are connected to the network regulator over a local network; employing the network regulator, in response to connecting to a router providing a service of supplying local network addresses to the plurality of client systems, to automatically take over the service of supplying local network addresses from the router; in response to the network regulator taking over the network service, employing a hardware processor of a computing system to receive data from a remote server, the data selected by the server for transmission to the computing system according to a subscription associated with the network regulator; and in response to the network regulator taking over the network service, employing the hardware processor to perform a display of a graphical user interface (GUI) of a device administration application according to the data, the GUI configured to: generate at least one device management view enabling a user of the computing system to remotely configure a client system of the plurality of client systems by selecting a device group from a predetermined plurality of device groups to indicate a membership of the client system in the selected device group, wherein members of each device group have group-specific values of configuration parameters; and generate at least one security notification view displaying an indicator of a computer security event caused by an action of the client system. ### Claim 8 (depends on 7) The method of claim 7, wherein the at least one device management view displays an interactive element enabling a user to select an entry from an address book of the computing system to designate an owner of the client system. ### Claim 9 (depends on 7) The method of claim 7, wherein the computer security event comprises detecting malicious software executing on the client system. ### Claim 10 (depends on 7) The method of claim 7, wherein the computer security event comprises detecting an attempt by the client system to access a resource located outside the local network, wherein accessing the resource constitutes a computer security threat to the client system. ### Claim 11 (depends on 7) The method of claim 7, wherein the indicator of the computer security event comprises an indicator of a category of computer security threats indicated by the computer security event, and further comprises a text definition of the category. ### Claim 12 (depends on 7) The method of claim 7, wherein the computing system comprises a mobile telephone. ### Claim 13 A non-transitory computer-readable medium storing instructions which, when executed by a hardware processor of a computing system, cause the computing system to: receive data from a remote server, the data selected by the server for transmission to the computing system according to a subscription associated with a network regulator protecting a plurality of client systems against computer security threats, wherein the plurality of client systems are connected to the network regulator over a local network; and perform a display of a graphical user interface (GUI) of a device administration application according to the data, the GUI configured to: generate at least one device management view enabling a user of the computing system to remotely configure a client system of the plurality of client systems by selecting a device group from a predetermined plurality of device groups to indicate a membership of the client system in the selected device group, wherein members of each device group have group-specific values of configuration parameters; and generate at least one security notification view displaying an indicator of a computer security event caused by an action of the client system, wherein the network regulator is configured, in response to connecting to a router providing a service of supplying local network addresses to the plurality of client systems, to automatically take over the service of supplying local network addresses from the router. ### Claim 14 (depends on 1) The computing system of claim 1, wherein the predetermined plurality of device groups comprises a family group and a guest group. ### Claim 15 (depends on 14) The computing system of claim 14, wherein the device administration application is further configured to: in response to the user selecting the family group, allow the user to configure a set of device management parameters for the client system; and in response to the user selecting the guest group, not allow the user to configure the set of device management parameters. ### Claim 16 (depends on 15) The computing system of claim 15, wherein the set of device management parameters includes an owner name and an owner icon indicative of an owner of the client system. ### Claim 17 (depends on 1) The computing system of claim 1, wherein the at least one device management view is further configured to display a device icon representing the client system, an owner icon representing an owner of the client system, an indicator of the selected device group of the client system, and an indicator of a current security status of the client system. ### Claim 18 (depends on 17) The computing system of claim 17, wherein the at least one device management view is further configured to display an item selected from a group of items consisting of an indicator of a network connection speed of the client system, an indicator of an amount of storage space currently available on a storage device of the client system, and an indicator of a quality of a password set for the client system. ### Claim 19 (depends on 17) The computing system of claim 17, wherein the at least one security notification view is configured to display the device icon and the owner icon, and wherein: the at least one device management view is configured to visually emphasize the device icon with respect to the owner icon; and the at least one security notification view is configured to visually emphasize the owner icon with respect to the device icon. ### Claim 20 (depends on 1) The computing system of claim 1, wherein the at least one device management view displays an interactive element enabling a user to select an image from a plurality of images stored on a storage device of the computing system, and wherein the GUI is further configured to display a rendition of the selected image to represent an owner of the client system. ### Claim 21 (depends on 1) The computing system of claim 1, wherein the at least one security notification view is configured to display an owner icon indicative of an owner of the client system, and wherein the device administration application is configured, in response to receiving an input indicating a user interaction with the owner icon, to invoke a telephone interface of the computing system. ### Claim 22 (depends on 1) The computing system of claim 1, wherein automatically taking over the service of supplying local network addresses to the plurality of client systems comprises the network regulator performing the steps of: detecting an address availability probe transmitted by the client system over the local network, the address availability probe configured to enable the client system to determine whether a first network address is available, wherein the first network address is distinct from a current network address of the network regulator; in response to detecting the address availability probe, transmitting a reply over the local network, the reply indicating that the first network address is currently in use; and transmitting a local network address offer to the client system.