# US 8,495,700 B2 · Mobile data security system and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,495,700 B2 - Document ID: US8495700B2 - Status: Granted - Kind: B2 - Application number: 11/363,283 - Filed: 2006-02-28 - Published: 2006-10-05 - Granted: 2013-07-23 - Earliest claimed: 2005-02-28 - Assignees: McAfee, Inc. - Applicants: Majid Shahbazi - Inventors: Majid Shahbazi - Web page: https://patentgrep.com/patent/US8495700B2 ## CPC - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The present invention is directed to security systems and methods for mobile network-based data environments. The present invention provides an integration of security, mobile computing, wireless and IT infrastructure management technology, to create a new level of automation and enforcement to enable the transparent application of mobile security across an enterprise, while embracing end user “transparency” and “ease of use” and empowering IT administration. ## Claims ### Claim 1 A method comprising: transferring a user specific policy to a mobile device based on authentication of a corresponding authorized user, wherein the user specific policy is synchronized with mobile device policies of a security system in a network; detecting an attempt by the mobile device to access the network; obtaining a state structure of the mobile device, wherein the state structure provides a set of information including static and dynamic mobile device information based on parameters, the parameters including one or more of an operating system, a software application, a device location, network information, personality information, and a current usage state, wherein the state structure is populated by the mobile device as a state of the mobile device changes over time; determining whether the mobile device complies with a static security policy based on the static mobile device information of the state structure; determining whether the mobile device complies with a dynamic security policy based on the dynamic mobile device information of the state structure; and comparing a historical usage state of the mobile device to the current usage state of the mobile device to determine a usage anomaly, which reflects a level of current e-mail messages being higher than historical levels of e-mail messages being sent by the mobile device, wherein if the mobile device fails to comply with at least one of the static security policy and the dynamic security policy, then access to the network is denied until the mobile device undergoes a virus scan, wherein compliance with the dynamic security policy is verified continuously while the mobile device is connected to the network. ### Claim 2 (depends on 1) The method of claim 1, wherein the static mobile device information includes at least one of a phone number or a device ESN. ### Claim 3 (depends on 1) The method of claim 1, wherein the dynamic mobile device information includes at least one of user ID, user domain/group, device operating system name, device operating system version, device ROM version, device peripherals list, device total memory, device free memory, application list and versions, applications currently running on the mobile device, registry setting snapshot, date/time of last hard reset, date/time of last soft reset, date/time of last policy receipt, date/time of last OTA sync, date/time of last USB sync, date/time of last IR sync, date/time of last Bluetooth sync, policy number, network interface list and configuration, network names that interfaces are connected to, GPS location information, and combinations thereof. ### Claim 4 (depends on 1) The method of claim 1, wherein a server computer maintains a historical state structure based on prior instances of the state structures of the mobile device. ### Claim 5 (depends on 4) The method of claim 4, further comprising comparing the state structure of the mobile device to the historical state structure of the mobile device to identify changes in the state structure of the mobile device relative to the historical state structure of the mobile device. ### Claim 6 (depends on 1) The method of claim 1, further comprising monitoring the mobile device to identify variations in at least one of the static device information of the mobile device and the dynamic device information of the mobile device. ### Claim 7 (depends on 6) The method of claim 6, further comprising determining whether any of the identified variations in the static device information of the mobile device or the dynamic device information of the mobile device cause the mobile device to be non-compliant with either of the static security policy or the dynamic security policy. ### Claim 8 (depends on 7) The method of claim 7, further comprising restricting access of the mobile device to the network if the identified variations in the static device information of the mobile device or the dynamic device information of the mobile device cause the mobile device to be non-compliant with either of the static security policy or the dynamic security policy. ### Claim 9 (depends on 1) The method of claim 1, further comprising creating a visualization of one or more security risks associated with the mobile device, wherein the security risks are determined from at least one of the static device information and the dynamic device information. ### Claim 10 (depends on 9) The method of claim 9, wherein the visualization comprises a graphical representation of the security risks associated with the mobile device. ### Claim 11 (depends on 1) The method of claim 1, further comprising running a discovery program to identify the mobile device, wherein the discovery program identifies mobile devices that are connected to, or are attempting to connect to, the network. ### Claim 12 (depends on 1) The method of claim 1, wherein compliance with the dynamic security policy requires that the mobile device have an authorized use status. ### Claim 13 (depends on 12) The method of claim 12, wherein the authorized use status requires that the mobile device has a unique identifier and an authorized user. ### Claim 14 A system comprising: a device management module for identifying a mobile device in communication with a network, the system being configured for: transferring a user specific policy to a mobile device based on authentication of a corresponding authorized user, wherein the user specific policy is synchronized with mobile device policies of a security system in a network, obtaining a state structure of the mobile device including static mobile device information and dynamic mobile device information based on parameters, the parameters including one or more of an operating system, a software application, a device location, network information, personality information, and a current usage state, wherein the state structure is populated by the mobile device as a state of the mobile device changes over time; and a compliance management module for: determining whether the mobile device complies with a static security policy based on the static mobile device information, determining whether the mobile device complies with a dynamic security policy based on the dynamic mobile device information, comparing a historical usage state of the mobile device to the current usage state of the mobile device to determine a usage anomaly, which reflects a level of e-mail messages being higher than historical levels of e-mail messages being sent by the mobile device, wherein if the mobile device fails to comply with at least one of the static security policy and the dynamic security policy, then access to the network is denied until the mobile device undergoes a virus scan, wherein compliance with the dynamic security policy is verified continuously while the mobile device is connected to the network. ### Claim 15 (depends on 14) The system of claim 14, wherein the static mobile device information includes at least one of a phone number or a device ESN. ### Claim 16 (depends on 14) The system of claim 14, wherein the dynamic mobile device information includes at least one of user ID, user domain/group, device operating system name, device operating system version, device ROM version, device peripherals list, device total memory, device free memory, application list and versions, applications currently running on the mobile device, registry setting snapshot, date/time of last hard reset, date/time of last soft reset, date/time of last policy receipt, date/time of last OTA sync, date/time of last USB sync, date/time of last IR sync, date/time of last Bluetooth sync, policy number, network interface list and configuration, network names that interfaces are connected to, GPS location information, and combinations thereof. ### Claim 17 (depends on 14) The system of claim 14, wherein at least one of the static mobile device information and the dynamic mobile device information includes information about a user of the mobile device. ### Claim 18 (depends on 14) The system of claim 14, wherein a database maintains a historical state structure based on prior instances of the state structures of the mobile device. ### Claim 19 (depends on 18) The system of claim 18, wherein the compliance management module compares the state structure of the mobile device to the historical state structure of the mobile device to identify changes in the state structure of the mobile device relative to the historical state structure of the mobile device. ### Claim 20 (depends on 14) The system of claim 14, wherein the device management module monitors the mobile device to identify variations in at least one of the static device information of the mobile device and the dynamic device information of the mobile device. ### Claim 21 (depends on 20) The system of claim 20, wherein the compliance management module determines whether any of the identified variations in the static device information of the mobile device or the dynamic device information of the mobile device cause the mobile device to be non-compliant with either of the static security policy or the dynamic security policy. ### Claim 22 (depends on 21) The system of claim 21, wherein the compliance management module restricts access of the mobile device to the network if the identified variations in the static device information of the mobile device or the dynamic device information of the mobile device cause the mobile device to be non-compliant with either of the static security policy or the dynamic security policy. ### Claim 23 (depends on 14) The system of claim 14, further comprising a visualization means for creating a visualization of one or more security risks associated with the mobile device, wherein the security risks are determined from at least one of the static device information and the dynamic device information. ### Claim 24 (depends on 23) The system of claim 23, wherein the visualization comprises a graphical representation of the security risks associated with the mobile device. ### Claim 25 (depends on 14) The system of claim 14, wherein the device management module executes a discovery program to identify the mobile device, wherein the discovery program identifies mobile devices that are connected to, or are attempting to connect to, the network. ### Claim 26 A method comprising: transferring a user specific policy to a mobile device based on authentication of a corresponding authorized user, wherein the user specific policy is synchronized with mobile device policies of a security system in a network, wherein the user specific policy includes an application security policy, the application security policy including an identification of trusted applications; detecting an attempt by the mobile device to access the network; obtaining a state structure of the mobile device, wherein the state structure includes static and dynamic mobile device information based on parameters, the parameters including one or more of an operating system, an identified software application, a device location, network information, personality information, and a current usage state, wherein the state structure is populated by the mobile device as a state of the mobile device changes over time; comparing a historical usage state of the mobile device to the current usage state of the mobile device to determine a usage anomaly, which reflects a level of e-mail messages being higher than historical levels of e-mail messages being sent by the mobile device; determining whether the application is compliant with an application security policy; if the identified application is determined to be compliant with the application security policy, allowing the mobile device to run the identified application, wherein if the identified application fails to comply with the application security policy, then the identified application is prohibited from running on the mobile device until the mobile device undergoes a virus scan, wherein compliance with the application security policy is verified continuously while the mobile device is connected to the network. ### Claim 27 (depends on 26) The method of claim 26, wherein the step of determining includes: performing a SHA-1 hash of the identified application to obtain a hash associated with the identified application; comparing the hash of the identified application with a corresponding hash included with the identification of the trusted applications; and if the hash of the identified application matches the corresponding hash included with the identification of the trusted applications, determining the identified application to be compliant. ### Claim 28 (depends on 26) The method of claim 26, further comprising dynamically verifying the compliance of the identified application each time the mobile device attempts to run the identified application. ### Claim 29 (depends on 26) The method of claim 26, wherein, if the identified application is determined to be in compliance with the application security policy, the identified application is identified as a trusted application. ### Claim 30 (depends on 29) The method of claim 29, further comprising granting the trusted application access rights. ### Claim 31 (depends on 30) The method of claim 30, wherein the access rights include at least one of read only or read and write access rights. ### Claim 32 (depends on 29) The method of claim 29, further comprising providing a secure signature to the trusted application. ### Claim 33 At least one non-transitory computer readable medium having instructions stored thereon, the instructions when executed by a processor cause the processor to: transfer a user specific policy to a mobile device based on authentication of a corresponding authorized user, wherein the user specific policy is synchronized with mobile device policies of a security system in a network; detect an attempt by the mobile device to access the network; obtain a state structure of the mobile device, wherein the state structure provides a set of information including static and dynamic mobile device information based on parameters, the parameters including one or more of an operating system, a software application, a device location, network information, personality information, and a current usage state, wherein the state structure is populated by the mobile device as a state of the mobile device changes over time; determine whether the mobile device complies with a static security policy based on the static mobile device information of the state structure; determine whether the mobile device complies with a dynamic security policy based on the dynamic mobile device information of the state structure; and compare a historical usage state of the mobile device to the current usage state of the mobile device to determine a usage anomaly, which reflects a level of current e-mail messages being higher than historical levels of e-mail messages being sent by the mobile device, wherein if the mobile device fails to comply with at least one of the static security policy and the dynamic security policy, then access to the network is denied until the mobile device undergoes a virus scan, wherein compliance with the dynamic security policy is verified continuously while the mobile device is connected to the network. ### Claim 34 (depends on 33) The medium of claim 33, wherein the instructions when executed by the processor further cause the processor to monitor the mobile device to identify variations in at least one of the static device information of the mobile device and the dynamic device information of the mobile device. ### Claim 35 (depends on 34) The medium of claim 34, wherein the instructions when executed by the processor further cause the processor to determine whether any of the identified variations in the static device information of the mobile device or the dynamic device information of the mobile device cause the mobile device to be non-compliant with either of the static security policy or the dynamic security policy. ### Claim 36 (depends on 34) The medium of claim 34, wherein the instructions when executed by the processor further cause the processor to restrict access of the mobile device to the network if the identified variations in the static device information of the mobile device or the dynamic device information of the mobile device cause the mobile device to be non-compliant with either of the static security policy or the dynamic security policy. ### Claim 37 (depends on 33) The medium of claim 33, wherein the instructions when executed by the processor further cause the processor to run a discovery program to identify the mobile device, wherein the discovery program is configured to identify mobile devices that are connected to, or are attempting to connect to, the network.