Lookout, Inc.

David Luke Richardson

Kevin Patrick Mahaffey

Brian James Buck

Timothy Micheal Wyatt

James David Burgess

David Golombek

William Neil Robinson

Anthony McKay Lineberry

John Gunther Hering

Daniel Lee Evans

Jonathan Grubb

Kyle Barton

Ayan Kanti Mandal

Ariel Salomon

Cherry Mangat

Vance Grkov

Ahmed Mohamed Farrakha

Bruce Christopher Wootton

Marc William Rogers

Timothy Strazzere

Yuan Xie

Yogesh Swami

Aaron David Cockerill

Alex Richard Gladd

Samuel Alexander Walker

Christopher Michael Jones

Daniel Thanos

Derek Joseph Halliday

Devesh Senapati

Arunsunai Anbukarasi Anbalagapandian

Nam Huy Bui

Solange Richardson

R Tyler Croy

Sergio Ivan Marcin Gorrino

Timothy Michael Wyatt

Jonathan Pantera Grubb

Kavin Patrick Mahaffey

Systems and methods are described for managing personal data on a client computer, in which personal data associated with the client computer is identified by a policy management module. An analysis may be performed for the client computer by a server using fake personal data. To identify applications which may attempt to access the personal data, the fake personal data is tracked for access on the client computer. A policy is then created that disallows access of the personal data by any applications identified by the analysis of the client computer as accessing the fake personal data. The policy is then assigned to the client computer.

Using fake personal data to create a policy to protect personal information on client computing devices

For increased security, a source is determined for software to be installed on a computing device. In one approach, a side-load server receives, from a mobile device, data regarding an application to be installed on the mobile device. The server determines a source of the application, then sends, to an authenticity server, data regarding the source. The server receives, from the authenticity server, a first state designation for the application. In response to receiving the first state designation, the server sets a second state designation, and sends the second state designation to the mobile device (e.g., to permit or block installation of the application).

Determining a security state based on communication with an authenticity server

In one approach, a first computing device receives a request from a second computing device. The request is for access by the second computing device to a service provided by a third computing device over a network. In response to receiving the request, the first computing device performs a security evaluation of the second computing device. The evaluation determines a risk level. The first computing device generates, based on the evaluation, a token for the second computing device. The token includes data encoding the risk level. The token is sent to the second computing device and/or third computing device. The sent data is used to configure the service provided to the second computing device.

Configuring access to a network service based on a security state of a mobile device

A cloud server collects and stores context data from mobile devices. Data collected for a mobile device is compared to the historical data. A security policy is selected for the mobile device based on the comparison. The selected policy is deployed to the mobile device. A status of the deployment is tracked by the cloud server.

Evaluation server to compare data from mobile devices to historical device data to control deployment of security policies

An operating system monitors a computing device to determine that one or more events, including background activity, have occurred. In response to detecting the background activity, data associated with the background activity is automatically obtained from the computing device. An application is initiated on the operating system of the computing device, and the data is transmitted to the application.

Monitoring a computing device to automatically obtain data in response to detecting background activity

A method is provided for evaluating the usage of a mobile communications device that itself provides access to a resource. In the method, a detected usage of the mobile communications device is compared to a stored usage pattern of an authorized user. When a measure associated with the difference between the detected usage and the stored usage pattern exceeds a threshold, it is concluded that the mobile communications device is being used by an unauthorized user. In response to this conclusion, a restriction is placed on an ability of the mobile communications device to access the resource.

Methods and systems for addressing unreported theft or loss of mobile communications devices

Techniques for deployment of policies to computing devices are described herein. The techniques can include a server deploying a passive policy to the computing devices. After deploying the passive policy, data is collected from each of the computing devices regarding operation of the computing device. The server monitors, based on comparing the passive policy to the collected data, compliance of each computing device with the passive policy. The server determines, based on the monitoring, a set of the computing devices that exhibit a policy violation associated with the passive policy. The server deploys an active policy to the set of computing devices. The active policy corresponds to the passive policy, and deploying the active policy causes one or more actions that correspond to the policy violation to be performed on each of the set of computing devices.

Deployment of passive and active security policies to mobile devices

For increased security, a source is determined for software to be installed on a computing device. In one approach, an application identifier is received from the computing device for an application to be installed. A source identifier of the application is determined. The application identifier and the source identifier are sent over a network to a server. A first state designation for the first application is received from the server. The first state designation represents a trusted state or an untrusted state. In response to receiving the first state designation, a second state designation is set. The second state designation is sent to the computing device.

Determining a security state designation for a computing device based on a source of software

Systems and methods enhance the security of an electronic device by causing an application on the device to intercept and analyze a communication. When the communication meets certain conditions an audio transmission is initiated. In the absence of the conditions the communication is passed to a different application.

Methods and systems for enhancing electronic device security by intercepting and analyzing a communication

A method includes: receiving a request regarding access by a first computing device (e.g., a mobile device of a user) to a service; in response to the request, performing, by a second computing device (e.g., a device risk evaluation server, or a server of an identity provider), an evaluation that includes creating a fingerprint of the first computing device; and determining, by the second computing device, whether the fingerprint matches a fingerprint of one or more other computing devices. The second computing devices determines whether to authorize access to the service based on the evaluation.

Managing access to services based on fingerprint matching

Systems and methods are disclosed for managing personal data on a mobile communications device in which personal data stored at one or more locations on the mobile communications device is identified by a policy management module on the mobile communications device. A policy is then created based on the identified personal data. The policy management module on the mobile communications device monitors at least the personal data stored in the one or more locations on the mobile communications device and detects attempts to access the monitored data.

Methods and systems for detecting attempts to access personal information on mobile communications devices

Techniques for enterprise policy rehearsals, rollouts, and rollbacks are described herein. The techniques can include a server receiving data associated with computing devices. The server compares the received data to data stored in a data repository. The data in the data repository corresponds to risks identified based on information collected from different computing devices prior to receiving the data associated with the computing devices. A risk profile is generated by the server based on comparing the received data to the repository data for each of the computing devices. The server causes, based on the risk profile for each of the computing devices, one or more responsive actions (e.g., using the risk profiles to prioritize deployment of software to the computing devices).

Developing security policies for deployment to mobile devices

An operating system of a computing device is configured to monitor for occurrence of an event. In response to determining that the event has occurred, data associated with the event is obtained from the computing device. An address associated with an account of the computing device is determined, and the data associated with the event is sent to the address.

Configuring a computing device to automatically obtain data in response to a predetermined event

Systems and methods for enhancing the security of an electronic device by causing the electronic device to go into a mode for lost or stolen devices after a security component receives information regarding an event at the electronic device and determines that the event indicates the electronic device is lost or stolen.

Methods and systems for enhancing electronic device security by causing the device to go into a mode for lost or stolen devices

An action may be performed in response to a determination of a source of side-loaded software. In one case, the handling of an application on a mobile device may be based on whether the source of the application is trusted or untrusted. If a software application being newly-installed on a mobile device of a user is determined to be untrusted, installation or execution is blocked. In one approach, the determination of the source includes: receiving, from the mobile device, a first application identifier and a first source identifier, each for a first application; sending the first application identifier and the first source identifier over a network to an administrator server; receiving, from the administrator server, a first state designation for the first application; setting a second state designation based on the first state designation; and sending the second state designation to the mobile device.

Growing community of inventors

San Francisco, CA, United States of America

David Luke Richardson