Cloud based mobile device security and policy enforcement

Patent metadata

Field	Value
Publication number	US-9609460-B2
Application number	US-201514797227-A
Country	US
Kind code	B2
Filing date	Jul 13, 2015
Priority date	Mar 18, 2011
Publication date	Mar 28, 2017
Grant date	Mar 28, 2017

Abstract

Cloud based mobile device security and policy systems and methods use the “cloud” to pervasively enforce security and policy on mobile devices. The cloud based mobile device security and policy systems and methods provide uniformity in securing mobile devices for small to large organizations. The cloud based mobile device security and policy systems and methods may enforce one or more policies for users wherever and whenever the users are connected across a plurality of different devices including mobile devices. This solution ensures protection across different types, brands, operating systems, etc. for smartphones, tablets, netbooks, mobile computers, and the like.

First claim

What is claimed is:

1. A mobile device security and policy enforcement method implemented by a processing node in a cloud based system, comprising:
subsequent to communicatively coupling a mobile device to the processing node based on configuring the mobile device with a mobile configuration profile which natively supports updating configuration settings in a mobile operating system to cause communication of the mobile device through the cloud based system, monitoring data between the mobile device and an external network;
enforcing policy relative to the data, wherein the policy is associated with a user of the mobile device, and inspecting the data for malicious content therein, wherein an authority node provides threat data for the malicious content and updates to the processing node;
allowing the data responsive to the data complying with the policy and/or containing no malicious content such that the data is provided through the cloud based system to either the mobile device or the external network; and
blocking the data in the processing node responsive to the data not complying with the policy and/or containing malicious content such that the data is not provided to either the mobile device or the external network, wherein the enforcing, the inspecting, the allowing, and the blocking is performed in the processing node independent of the mobile device.

2. The mobile device security and policy enforcement method of claim 1 , wherein the monitoring, the enforcing, the inspecting, the allowing, and the blocking are performed by the node without a platform-specific app on the mobile device.

3. The mobile device security and policy enforcement method of claim 1 , wherein the malicious content comprises one or more of viruses, spyware, malware, Trojans, botnets, spam email, phishing content, and blacklisted content.

4. The mobile device security and policy enforcement method of claim 1 , wherein the policy comprises one or more of inappropriate content, data leakage, data usage limits, time-of-day usage limits, location, operation of a particular application, and black lists of websites.

5. The mobile device security and policy enforcement method of claim 1 , wherein the policy comprises preventing installation of a particular application on the mobile device.

6. The mobile device security and policy enforcement method of claim 5 , wherein the particular application is blocked for one or more of failing to meet a minimum threshold for security and/or privacy and interfering with an enterprise network associated with the user.

7. The mobile device security and policy enforcement method of claim 1 , further comprising:
receiving an update to the policy for the user or for a group of users comprising the users; and
performing the enforcing with the updated policy.

8. The mobile device security and policy enforcement method of claim 1 , further comprising:
receiving an update related to the malicious content from another node in the cloud based system; and
performing the inspecting the data with the update.

9. The mobile device security and policy enforcement method of claim 1 , wherein the node forms an association with the mobile device.

10. A mobile device security and policy enforcement system comprising a processing node in a cloud based system, comprising:
a network interface communicatively coupled to a processor; and
memory storing instructions that, when executed, cause the processor to:
subsequent to communicatively coupling to a mobile device based on configuring the mobile device with a mobile configuration profile which natively supports updating configuration settings in a mobile operating system to cause communication of the mobile device through the cloud based system, monitor data between the mobile device and an external network;
enforce policy relative to the data, wherein the policy is associated with a user of the mobile device, and inspect the data for malicious content therein, wherein an authority node provides threat data for the malicious content and updates to the processing node;
allow the data responsive to the data complying with the policy and/or containing no malicious content such that the data is provided through the system to either the mobile device or the external network; and
block the data in the processing node responsive to the data not complying with the policy and/or containing malicious content such that the data is not provided to either the mobile device or the external network, wherein the policy is enforced, the data is inspected, and the data is allowed or blocked in the system independent of the mobile device.

11. The mobile device security and policy enforcement system of claim 10 , wherein the mobile device does not utilize a platform-specific app for mobile device security and policy enforcement.

12. The mobile device security and policy enforcement system of claim 10 , wherein the malicious content comprises one or more of viruses, spyware, malware, Trojans, botnets, spam email, phishing content, and blacklisted content.

13. The mobile device security and policy enforcement system of claim 10 , wherein the policy comprises one or more of inappropriate content, data leakage, data usage limits, time-of-day usage limits, location, operation of a particular application, and black lists of websites.

14. The mobile device security and policy enforcement system of claim 10 , wherein the policy comprises preventing installation of a particular application on the mobile device.

15. The mobile device security and policy enforcement system of claim 14 , wherein the particular application is blocked for one or more of failing to meet a minimum threshold for security and/or privacy and interfering with an enterprise network associated with the user.

16. The mobile device security and policy enforcement system of claim 10 , wherein the memory storing instructions that, when executed, further cause the processor to:
receive an update to the policy for the user or for a group of users comprising the users; and
enforce the policy with the updated policy.

17. The mobile device security and policy enforcement system of claim 10 , wherein the memory storing instructions that, when executed, further cause the processor to:
receive an update related to the malicious content from another node in the cloud based system; and
inspect the data with the update.

18. The mobile device security and policy enforcement system of claim 10 , wherein the node forms an association with the mobile device.

19. A mobile device, comprising:
a network interface communicatively coupled to a processor; and
memory storing instructions that, when executed, cause the processor to:
subsequent to communicatively coupling to a processing node in a mobile device security and policy enforcement system based on configuring the mobile device with a mobile configuration profile which natively supports updating configuration settings in a mobile operating system to cause communication of the mobile device through the cloud based system, transmit data to an external network through the processing node, wherein responsive to the data (i) complying with policy associated with a user of the mobile device based on enforcement by the processing node and (ii) containing no malicious data therein based on inspection of the data for the policy and for the malicious data by the processing node independent of the mobile device, the processing node is configured to allow the data;
responsive to responsive data from the external networ

Assignees

• Sinha Amit
• Zscaler Inc

Inventors

• Sinha Amit

Classifications

• H04L67/306

  User profiles · CPC title

• H04W4/60

  Subscription-based services using application servers or record carriers, e.g. SIM application toolkits · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title