Configuring access to a network service based on a security state of a mobile device

Patent metadata

Field	Value
Publication number	US-12081540-B2
Application number	US-202117307332-A
Country	US
Kind code	B2
Filing date	May 4, 2021
Priority date	Jun 9, 2017
Publication date	Sep 3, 2024
Grant date	Sep 3, 2024

Abstract

In one approach, a first computing device receives a request from a second computing device. The request is for access by the second computing device to a service provided by a third computing device over a network. In response to receiving the request, the first computing device performs a security evaluation of the second computing device. The evaluation determines a risk level. The first computing device generates, based on the evaluation, a token for the second computing device. The token includes data encoding the risk level. The token is sent to the second computing device and/or third computing device. The sent data is used to configure the service provided to the second computing device.

First claim

What is claimed is:

1. A method, comprising:
receiving, from prior computing devices, data regarding prior software associated with the prior computing devices;
storing, in a database, the data regarding the prior software;
receiving, by a first computing device, a request from a second computing device other than the prior computing devices, wherein the request is for access by the second computing device to a service provided by a third computing device, wherein the third computing device is separate from the first computing device;
in response to receiving the request, performing, by the first computing device, an evaluation of the second computing device, wherein the evaluation comprises determining a source of first software on the second computing device by comparing the first software to the prior software using the stored data in the database, and further comprises determining a security state of the second computing device, the security state including a risk level, and the security state based on the source of the first software;
generating, by the first computing device based on the evaluation, a token for the second computing device, the token comprising first data encoding the risk level; and
sending the token to at least one of the second computing device or the third computing device, wherein the first data is used to configure the service provided to the second computing device.

2. The method of claim 1 , wherein the service provided to the second computing device is configured by the third computing device according to the security state of the second computing device.

3. The method of claim 2 , wherein the security state is determined by the third computing device based at least on the risk level determined from the evaluation by the first computing device.

4. The method of claim 2 , further comprising receiving data from security software on the second computing device, wherein the security state of the second computing device is determined at least using the data received from the security software.

5. The method of claim 2 , wherein the third computing device is configured to grant, deny, or limit the access to the service based on the security state of the second computing device.

6. The method of claim 1 , wherein the access requires authorization by a fourth computing device of an identity provider, and wherein the evaluation is based at least in part on data received from the fourth computing device.

7. The method of claim 1 , further comprising sending a communication to a fourth computing device of an identity provider, wherein the communication indicates the risk level, and wherein access to the service requires authorization by the fourth computing device.

8. The method of claim 1 , wherein an extent of access to the service provided to the second computing device is based on the risk level.

9. A system comprising:
at least one processor of a first computing device; and
memory storing instructions configured to instruct the at least one processor to:
receive a request from a second computing device, wherein the request is for access by the second computing device to a service provided by a third computing device, wherein the third computing device is separate from the first computing device;
in response to receiving the request, perform an evaluation of the second computing device, wherein the evaluation comprises:
determining a source of software on the second computing device by identifying first components of the software, and comparing the first components to second components of software associated with prior installations made on computing devices other than the second computing device, and
generating data regarding a security state of the second computing device, the security state based at least in part on the source of the software;

send at least a first portion of the data regarding the security state to a fourth computing device of an identity provider, wherein the fourth computing device is configured to authenticate the second computing device using the first portion of the data;
receive, from the fourth computing device, an authentication of the second computing device; and
in response to receiving the authentication, send at least a second portion of the data regarding the security state to the third computing device, wherein the second portion of the data is used by the third computing device to configure the service provided to the second computing device.

10. The system of claim 9 , wherein the instructions are further configured to instruct the at least one processor to receive data from the fourth computing device, and wherein the evaluation is based at least in part on the data received from the fourth computing device.

11. The system of claim 9 , wherein the software on the second computing device is used to access the service.

12. The system of claim 9 , wherein the third computing device is configured to set the security state for the second computing device to have access to the third computing device.

13. The system of claim 9 , wherein the instructions are further configured to instruct the at least one processor to:
periodically perform subsequent evaluations of the second computing device to determine updated security states of the second computing device; and
send data regarding the updated security states to the third computing device, wherein the third computing device is configured to change a level of access to the service based on one or more of the updated security states.

14. The system of claim 9 , wherein the instructions are further configured to instruct the at least one processor to:
after the second computing device has started receiving the service, perform a subsequent evaluation of the second computing device to determine an updated security state of the second computing device; and
send a communication regarding the updated security state to the third computing device, wherein the third computing device is configured to, in response to receiving the communication, terminate access to the service or decrease a level of access to the service.

15. The system of claim 9 , wherein data extracted from one or more communications received from the third computing device is used in performing the evaluation.

16. The system of claim 9 , wherein data extracted from one or more communications received from the fourth computing device of the identity provider is used in performing the evaluation.

17. The system of claim 9 , wherein the second components are stored in a database of the identity provider.

18. The system of claim 9 , wherein comparing the first components to the second components is supported by the identity provider.

19. A non-transitory computer-readable storage medium storing instructions, which when executed, cause a first computing device to:
receive a request from a second computing device, the request for access by the second computing device to a service provided by a third computing device, wherein the third computing device is separate from the first computing device;
in response to receiving the request, perform an evaluation of the second computing device, wherein the evaluation comprises determining a source of software on the second computing device by comparing behavior of the software with behavior of similar software previously installed on computing devices other than the second computing device, and determining a risk level based on the source of the software;
generate, based on the evaluation, a token for the second comput

Assignees

• Lookout Inc

Inventors

• Cockerill Aaron
• Richardson David
• Thanos Daniel
• Robinson William Neil
• Buck Brian James
• Mahaffey Kevin Patrick

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/105

  Multiple levels of security · CPC title