Methods and systems for blocking potentially harmful communications to improve the functioning of an electronic device

Patent metadata

Field	Value
Publication number	US-10417432-B2
Application number	US-201816000712-A
Country	US
Kind code	B2
Filing date	Jun 5, 2018
Priority date	Oct 21, 2008
Publication date	Sep 17, 2019
Grant date	Sep 17, 2019

Abstract

Methods and systems are provided for sharing information and improving the functioning of devices by blocking potentially harmful communications. In the methods and systems disclosed, a security component on an electronic device may receive a policy. The security component may also receive, from a local device proxy on the electronic device, information pertaining to a communication. The security component may compare the information pertaining to the communication to the policy. The comparison may result in a determination that the communication is potentially harmful. The security component may then instruct the local device proxy to block the communication from proceeding past the local device proxy.

First claim

What is claimed is:

1. A method for blocking, by an electronic device, a communication from an application, the communication transmitted to the electronic device using a first network connection, the method comprising:
receiving, by a security component, a policy configured by an administrator, the policy pertaining to the processing of communications by the security component and based on answers of the administrator to a set of questions;
receiving over the first network connection or a second network connection, by the security component according to the policy and from a local device proxy on the electronic device after the communication is received by the local device proxy, information pertaining to the communication from the application;
comparing, by the security component according to the policy, the obtained information to information associated with potentially harmful applications;
determining, by the security component from the comparison according to the policy, that the communication is from a potentially harmful application; and
instructing, by the security component as a result of the determination that the communication is from a potentially harmful application according to the policy, the local device proxy on the electronic device to block the communication from proceeding past the local device proxy to the remainder of the electronic device.

2. The method of claim 1 , wherein the electronic device includes a mobile communications device or an internet-of-things device.

3. The method of claim 1 , wherein the security component is a component of the local device proxy.

4. The method of claim 1 , wherein the security component uses an inter-process communication in instructing the local device proxy to block the communication from the first application.

5. The method of claim 1 , wherein:
the security component is executing on a server.

6. The method of claim 1 , wherein the policy configured by the administrator was created by:
the administrator receiving, from a software component executing on a server, the set of questions;
the administrator providing, to the software component, the answers to the set of questions; and
based on the answers received from the administrator, the software component configuring the policy.

7. The method of claim 1 ,
wherein the comparing the obtained information to information associated with potentially harmful applications comprises:
comparing the obtained information to information associated with a first potentially harmful application from a plurality of potentially harmful applications, the comparison producing a value corresponding to a degree the obtained information matches the information associated with the first potentially harmful application; and
wherein the determining that the communication is from a potentially harmful application comprises:
determining that the communication is from the first potentially harmful application when the comparison value exceeds a threshold value.

8. The method of claim 1 ,
wherein the comparing the obtained information to information associated with potentially harmful applications comprises:
comparing the obtained information to behavioral characteristics of potentially harmful applications, the behavioral characteristics specified by the policy, the comparison producing a value corresponding to a degree the obtained information matches the behavioral characteristics of potentially harmful applications; and
wherein the determining that the communication is from a potentially harmful application comprises:
determining that the communication is from a potentially harmful application when the comparison value exceeds a threshold value.

9. A method for blocking, by an electronic device, a communication from an application installed on the electronic device, the application attempting to transmit the communication using a first network connection, the method comprising:
receiving, by a security component, a policy configured by an administrator, the policy pertaining to the processing of communications by the security component and based on answers of the administrator to a set of questions;
receiving over the first network connection or a second network connection, by the security component according to the policy and from a local device proxy on the electronic device after the communication is received by the local device proxy, information pertaining to the communication from the application;
comparing, by the security component according to the policy, the obtained information to information associated with potentially harmful applications;
determining, by the security component from the comparison according to the policy, that the communication is from a potentially harmful application; and
instructing, by the security component as a result of the determination that the communication is from a potentially harmful application according to the policy, the local device proxy on the electronic device to block the communication from proceeding past the local device proxy to the remainder of the electronic device.

10. The method of claim 9 , wherein the electronic device includes a mobile communications device or an internet-of-things device.

11. The method of claim 9 , wherein:
the security component is executing on a server.

12. The method of claim 9 , wherein the policy configured by the administrator was created by:
the administrator receiving, from a software component executing on a server, the set of questions;
the administrator providing, to the software component, the answers to the set of questions; and
based the answers received from the administrator, the software component configuring the policy.

13. The method of claim 9 ,
wherein the comparing the obtained information to information associated with potentially harmful applications comprises:
comparing the obtained information to information associated with a first potentially harmful application from a plurality of potentially harmful applications, the comparison producing a value corresponding to a degree the obtained information matches the information associated with the first potentially harmful application; and
wherein the determining that the communication is from a potentially harmful application comprises:
determining that the communication is from the first potentially harmful application when the comparison value exceeds a threshold value.

14. The method of claim 9 ,
wherein the comparing the obtained information to information associated with potentially harmful applications comprises:
comparing the obtained information to behavioral characteristics of potentially harmful applications, the behavioral characteristics specified by the policy, the comparison producing a value corresponding to a degree the obtained information matches the behavioral characteristics of potentially harmful applications; and
wherein the determining that the communication is from a potentially harmful application comprises:
determining that the communication is from a potentially harmful application when the comparison value exceeds a threshold value.

15. A method for blocking, by an electronic device, a communication from a first application installed on the electronic device to a second application installed on the electronic device, the method comprising:
receiving, by a security component, a policy configured by an administrator, the policy pertaining to the processing of communications by the security component and based on answers of the administrator to a set of questions;
receiving over the first network connection or

Assignees

• Lookout Inc

Inventors

• Mahaffey Kevin Patrick
• Buck Brian James
• Robinson William
• Hering John G
• Burgess James David
• Wyatt Timothy Micheal
• Golombek David
• Richardson David Luke
• Lineberry Anthony Mckay
• Barton Kyle
• Evans Daniel Lee
• Salomon Ariel
• Grubb Jonathan Pantera
• Wootton Bruce
• Strazzere Timothy
• Swami Yogesh

Classifications

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title