Mobile device security, device management, and policy enforcement in a cloud based system

Patent metadata

Field	Value
Publication number	US-10749907-B2
Application number	US-201916680766-A
Country	US
Kind code	B2
Filing date	Nov 12, 2019
Priority date	Mar 18, 2011
Publication date	Aug 18, 2020
Grant date	Aug 18, 2020

Abstract

Mobile device security, device management, and policy enforcement are described in a cloud based system where the “cloud” is used to pervasively enforce security and policy and perform device management regardless of device type, platform, location, etc. A cloud based method includes monitoring traffic between a mobile device and an external network in a cloud based system separate from the mobile device and the external network; enforcing policy with respect to the traffic from the mobile device to the external network to determine whether to block or allow the traffic from the mobile device to the external network; and inspecting content associated with the traffic from the external network to the mobile device to determine whether to block or allow the traffic from the external network to the mobile device.

First claim

What is claimed is:

1. A non-transitory computer-readable medium having computer readable code stored thereon for programming a processor to perform steps of:
monitoring traffic between a mobile device and an external network in a cloud based system separate from the mobile device and the external network;
enforcing policy with respect to the traffic from the mobile device to the external network to determine whether to block or allow the traffic from the mobile device to the external network; and
inspecting content associated with the traffic from the external network to the mobile device to determine whether to block or allow the traffic from the external network to the mobile device.

2. The non-transitory computer-readable medium of claim 1 , wherein the computer readable code is further configured to program the processor to perform steps of:
blocking or allowing the traffic from the mobile device to the external network based on the policy.

3. The non-transitory computer-readable medium of claim 1 , wherein the computer readable code is further configured to program the processor to perform steps of:
blocking or allowing the traffic from the external network to the mobile device based on the inspecting.

4. The non-transitory computer-readable medium of claim 1 , wherein the policy includes any of data usage, time-of-day, location, type of website, use of a particular application on the mobile device, data leakage protection, and a black list of websites.

5. The non-transitory computer-readable medium of claim 1 , wherein the inspecting content includes detecting a security risk including any of malware, spyware, viruses, email spam, data leakage, phishing content, Trojans, and botnets.

6. The non-transitory computer-readable medium of claim 1 , wherein the computer readable code is further configured to program the processor to perform steps of:
causing a notification on the mobile device responsive to the policy or the inspecting.

7. The non-transitory computer-readable medium of claim 1 , wherein the computer readable code is further configured to program the processor to perform steps of:
allowing or disallowing various functions implemented locally on the mobile device.

8. The non-transitory computer-readable medium of claim 7 , wherein the various functions include any of
installation of specified applications, use of specified applications, use of screen capture, use of voice dialing, use of games, use of social media, use of streaming media, web browser usage, and use of Wi-Fi and/or Bluetooth.

9. A server comprising:
a network interface communicatively coupled to a mobile device and to an external network;
a processor communicatively coupled to the network interface; and
memory storing instructions that, when executed, cause the processor to
monitor traffic between a mobile device and an external network in a cloud based system separate from the mobile device and the external network;
enforce policy with respect to the traffic from the mobile device to the external network to determine whether to block or allow the traffic from the mobile device to the external network; and
inspect content associated with the traffic from the external network to the mobile device to determine whether to block or allow the traffic from the external network to the mobile device.

10. The server of claim 9 , wherein the instructions that, when executed, cause the processor to
block or allow the traffic from the mobile device to the external network based on the policy.

11. The server of claim 9 , wherein the instructions that, when executed, cause the processor to
block or allow the traffic from the external network to the mobile device based on the inspecting.

12. The server of claim 9 , wherein the policy includes any of data usage, time-of-day, location, type of website, use of a particular application on the mobile device, data leakage protection, and a black list of websites.

13. The server of claim 9 , wherein the content is inspected by any of detecting a security risk including any of malware, spyware, viruses, email spam, data leakage, phishing content, Trojans, and botnets.

14. The server of claim 9 , wherein the instructions that, when executed, cause the processor to
cause a notification on the mobile device responsive to the policy or the inspecting.

15. The server of claim 9 , wherein the instructions that, when executed, cause the processor to
allow or disallow various functions implemented locally on the mobile device.

16. A method comprising:
monitoring traffic between a mobile device and an external network in a cloud based system separate from the mobile device and the external network;
enforcing policy with respect to the traffic from the mobile device to the external network to determine whether to block or allow the traffic from the mobile device to the external network; and
inspecting content associated with the traffic from the external network to the mobile device to determine whether to block or allow the traffic from the external network to the mobile device.

17. The method of claim 16 , further comprising:
blocking or allowing the traffic from the mobile device to the external network based on the policy.

18. The method of claim 16 , further comprising:
blocking or allowing the traffic from the external network to the mobile device based on the inspecting.

19. The method of claim 16 , wherein the policy includes any of data usage, time-of-day, location, type of website, use of a particular application on the mobile device, data leakage protection, and a black list of websites.

20. The method of claim 16 , wherein the inspecting content include detecting a security risk including any of malware, spyware, viruses, email spam, data leakage, phishing content, Trojans, and botnets.

Assignees

• Zscaler Inc

Inventors

• Sinha Amit
• Paul Narinder
• Devarajan Srikanth

Classifications

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L67/55

  Push-based network services · CPC title

• H04L67/1001

  for accessing one among a plurality of replicated servers · CPC title

• H04L63/0281

  Proxies · CPC title