# US 8,474,004 B2 · System for implementing security on telecommunications terminals > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,004 B2 - Document ID: US8474004B2 - Status: Granted - Kind: B2 - Application number: 12/309,810 - Filed: 2006-07-31 - Published: 2009-10-08 - Granted: 2013-06-25 - Earliest claimed: 2006-07-31 - Assignees: Telecom Italia S.p.A. - Applicants: Manuel Leone - Inventors: Manuel Leone - Web page: https://patentgrep.com/patent/US8474004B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04W 4/60: Subscription-based services using application servers or record carriers, e.g. SIM application toolkits - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 2221/2113: Multi-level security, e.g. mandatory access control - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A system includes at least one telecommunications terminal having data processing capabilities, the telecommunications terminal being susceptible of having installed thereon software applications, wherein each software application has associated therewith a respective indicator adapted to indicate a level of security of the software application, the level of security being susceptible of varying in time; a software agent executed by the at least one telecommunications terminal, the software agent being adapted to conditionally allow the installation of software applications on the telecommunications terminal based on the respective level of security; a server in communications relationship with the software agent, the server being adapted to dynamically calculate the level of security of the software applications, and to communicate to the software agent the calculated level of security of the software applications to be installed on the telecommunications terminal. ## Claims ### Claim 1 A system comprising: at least one telecommunications terminal comprising data processing capabilities, the telecommunications terminal being susceptible of having installed thereon software applications, wherein a plurality of software applications are monitored, and wherein each of the plurality of monitored software applications has associated therewith a respective numerical value indicating a level of security of the corresponding software application, said numerical value indicating the level of security being susceptible of varying in time; a software agent executed by the at least one telecommunications terminal, said software agent capable of being adapted to conditionally allow the installation of software applications on the telecommunications terminal based on the respective level of security; and a server in communications relationship with the software agent, said server being adapted to dynamically calculate the numerical value indicating the level of security of each of the monitored software applications, and to communicate to the software agent, the calculated numerical value indicating the level of security of the monitored software applications to be installed on said telecommunications terminal, wherein said server comprises: a binary analyzer adapted to perform a static analysis of codes of the software applications; and a vulnerability analyzer adapted to perform an analysis of vulnerabilities exhibited by the software applications, wherein said vulnerability analyzer comprises an adaptation to perform said analysis of vulnerabilities based on information obtained from one or more among a computer emergency response team, an open vulnerability and assessment language, common vulnerabilities and exposures bulletins of the software applications producers/vendors, and software certification authorities. ### Claim 2 (depends on 1) The system of claim 1, wherein said software agent further comprises an adaptation to: detect an incipient activity of installation of a software application on the telecommunications terminal; and request to the server an updated security level with respect to the software application to be installed. ### Claim 3 (depends on 1) The system of claim 1, wherein the telecommunications terminal is further susceptible of executing software applications installed thereon, said software agent further comprising an adaptation to conditionally allow the software applications, when executed on the telecommunications terminal, to access telecommunications terminal resources based on the level of security of the software application being executed. ### Claim 4 (depends on 3) The system of claim 3, wherein said telecommunications terminal resources comprise application program interfaces exposed by an operating system governing the operation of the telecommunications terminal. ### Claim 5 (depends on 3) The system of claim 3, wherein the software agent further comprises an adaptation to: detect the launching of a software application installed on the telecommunications terminal; and request from the server an updated security level with respect to the software application being launched. ### Claim 6 (depends on 5) The system claim 5, wherein said software agent further comprises a local database adapted to store the security levels of the software applications installed on the telecommunications terminal. ### Claim 7 (depends on 6) The system of claim 6, wherein said software agent further comprises an adaptation to request from the server the updated security level with respect to the software application being launched on condition that a security level stored in the local database for the software application is not up to date. ### Claim 8 (depends on 1) The system of claim 1, wherein said binary analyzer comprises an adaptation to perform said static analysis by assessing a type of telecommunications terminal resources invoked by the software applications. ### Claim 9 (depends on 1) The system of claim 1, wherein said binary analyzer comprises an adaptation to perform said static analysis by assessing a modality of installation of the software applications on the telecommunications terminal. ### Claim 10 (depends on 1) The system of claim 1, wherein said binary analyzer comprises an adaptation to perform said static analysis by assessing a type of data accessed by the software applications. ### Claim 11 (depends on 1) The system of claim 1, wherein said vulnerability analyzer comprises an adaptation to perform said analysis of vulnerabilities based on an indication of an overall number of known vulnerabilities detected for the software applications. ### Claim 12 (depends on 1) The system of claim 1, wherein said vulnerability analyzer comprises an adaptation to perform said analysis of vulnerabilities based on a degree of criticality of the detected vulnerabilities. ### Claim 13 (depends on 1) The system of claim 1, wherein the server comprises: a first database adapted to store a list of software applications monitored by the server, and a respective level of security. ### Claim 14 (depends on 13) The system of claim 13, wherein the server comprises: a second database adapted to store a list of software applications installed on the at least one telecommunications terminal. ### Claim 15 (depends on 1) The system of claim 1, further comprising at least a second telecommunications terminal, the software agent being adapted to receive from said second telecommunications terminal information related to the level of security of said software applications. ### Claim 16 (depends on 1) The system of claim 1, wherein said software agent further comprises an adaptation to: gather information from one or more anti-malware software applications or an intrusion detection system running on the telecommunications terminal; and communicate the gathered information to said server, said server further comprising an adaptation to: receive from the telecommunications terminal the gathered information; and use the received information for dynamically calculating the security levels of software applications. ### Claim 17 A telecommunications terminal having data processing capabilities, the telecommunications terminal being susceptible of having installed thereon software applications or executing software applications installed thereon, wherein a plurality of software applications are monitored, and wherein each of the plurality of software applications has associated therewith a respective numerical value indicating a level of security of the corresponding software application, comprising: a software agent, adapted to be executed by the telecommunications terminal, said software agent comprising an adaptation to at least one among: conditionally allow the installation of software applications on the telecommunications terminal; and conditionally allow the software applications, when executed on the telecommunications terminal, to access telecommunications terminal resources based on the respective level of security, and to receive from a server updated numerical values indicating levels of security calculated by the server, wherein said server comprises: a binary analyzer adapted to perform a static analysis of codes of the software applications; and a vulnerability analyzer adapted to perform an analysis of vulnerabilities exhibited by the software applications, wherein said vulnerability analyzer comprises an adaptation to perform said analysis of vulnerabilities based on information obtained from one or more among a computer emergency response team, an open vulnerability and assessment language, common vulnerabilities and exposures bulletins of the software applications producers/vendors, and software certification authorities. ### Claim 18 (depends on 17) The telecommunications terminal of claim 17, wherein said software agent further comprises an adaptation to: detect an incipient activity of installation of a software application on the telecommunications terminal or detect the launching of a software application installed on the telecommunications terminal; and request to the server an updated security level with respect to the software application to be installed or of the software application being launched. ### Claim 19 (depends on 18) The telecommunications terminal according to claim 18, wherein said software agent further comprises a local database adapted to store the security levels of the software applications installed on the telecommunications terminal. ### Claim 20 (depends on 19) The telecommunications terminal of claim 19, wherein said software agent, further comprises an adaptation to request from the server the updated security level with respect to the software application being launched on condition that a security level stored in the local database for the software application is not up to date. ### Claim 21 A server including at least one hardware component, comprising: a communication interface to communicate with at least one telecommunications terminal having data processing capabilities, wherein the telecommunications terminal is capable of having installed or run thereon software applications, wherein a plurality of software applications are monitored, and wherein each of the plurality of monitored software applications has associated therewith a respective numerical value indicating a level of security of the corresponding software application, said numerical value indicating the level of security being capable of varying in time, said server comprising: a security level evaluator to dynamically calculate the numerical value indicating the level of security of each of the plurality of monitored software applications, and to communicate to a software agent the calculated numerical value indicating the level of security of each of the plurality of monitored software applications to be installed or run on said telecommunications terminal, a binary analyzer adapted to perform a static analysis of codes of the software applications; and a vulnerability analyzer adapted to perform an analysis of vulnerabilities exhibited by the software applications, wherein said vulnerability analyzer comprises an adaptation to perform said analysis of vulnerabilities based on information obtained from one or more among a computer emergency response team, an open vulnerability and assessment language, and common vulnerabilities and exposures bulletins of the software applications producers/vendors, and software certification authorities.