Lookout, Inc.

John Gunther Hering

Kevin Patrick Mahaffey

James David Burgess

Brian James Buck

David Luke Richardson

Timothy Micheal Wyatt

William Neil Robinson

David Golombek

Anthony McKay Lineberry

Jonathan Grubb

Ayan Kanti Mandal

Amit Gupta

Daniel Lee Evans

Bruce Christopher Wootton

Kyle Barton

Cherry Mangat

Vance Grkov

Alex Cameron Abey

Ariel Salomon

Timothy Strazzere

Yogesh Swami

Christopher Michael Jones

Yuan Xie

James Bergess

Timothy Michael Wyatt

Jonathan Pantera Grubb

Kavin Patrick Mahaffey

Data is collected from a set of devices according to a data collection policy. The data is associated with at least one of: device configuration, device state, or device behavior. A norm is established using the collected data. A different data collection policy is established based on the norm. Data is collected from a particular device according to the different data collection policy. The norm is compared to the data collected from the particular device. If there is a deviation beyond a threshold deviation between the norm and the data collected from the particular device, a responsive action is taken.

Individual device response options from the monitoring of multiple devices

Methods and systems are provided for providing a mobile communications device with access to a provider with a plurality of security levels. The security state of the device varies according to severity levels of device security events. The mobile communications device generates data regarding security events and provides the data to the provider, which compares that security state to a policy associated with the provider. The mobile communications device is allowed to access to a provider service where the device's current security state meets or exceeds the security state required for the provider service.

Providing a mobile communications device with access to a provider service conditioned upon a device security level determination

The invention is a system and method for identifying, assessing, and responding to vulnerabilities on a mobile communication device. Information about the mobile communication device, such as its operating system, firmware version, or software configuration, is transmitted to a server for assessment. The server accesses a data storage storing information about vulnerabilities. Based on the received information, the server may identify those vulnerabilities affecting the mobile communication device, and may transmit a notification to remediate those vulnerabilities. The server may also transmit result information about the vulnerabilities affecting the mobile communication device. The server may also store the received information about the device, so that in the event the server learns of new vulnerabilities, it may continue to assess whether the device is affected, and may accordingly notify or remediate the device. The server may provide an interface for an administrator to manage the system and respond to security issues.

System and method for determining the risk of vulnerabilities on a mobile communications device

A method is provided for evaluating the usage of a mobile communications device that itself provides access to a resource. In the method, a detected usage of the mobile communications device is compared to a stored usage pattern of an authorized user. When a measure associated with the difference between the detected usage and the stored usage pattern exceeds a threshold, it is concluded that the mobile communications device is being used by an unauthorized user. In response to this conclusion, a restriction is placed on an ability of the mobile communications device to access the resource.

Methods and systems for addressing unreported theft or loss of mobile communications devices

System and method for identifying and [assessing] remediating vulnerabilities on a mobile communications device

Data is collected from a set of devices according to a data collection policy. The data is associated with device configuration, device state, or device behavior. A norm is established using the collected data. A different data collection policy is established based on the norm. Data is collected from a particular device according to the different data collection policy. The norm is compared to the data collected from the particular device. If there is a deviation outside of a threshold deviation between the norm and the data collected from the particular device, a message is transmitted to an administrator.

Distributed monitoring and evaluation of multiple devices

Systems and methods for enhancing the security of an electronic device by causing the electronic device to go into a mode for lost or stolen devices after a security component receives information regarding an event at the electronic device and determines that the event indicates the electronic device is lost or stolen.

Methods and systems for enhancing electronic device security by causing the device to go into a mode for lost or stolen devices

Methods and systems are provided for conditionally granting access to service levels based on a determined security state of the device requesting access. A software component, upon receiving a request for access to a provider having a plurality of service levels, determines the current security state of the requesting device. The software component compares that security state to a policy associated with the provider. The software component then allows the requesting device access to the provider services where the device's current security state meets or exceeds the security state required for the service.

Methods and systems for conditionally granting access to services based on the security state of the device requesting access

A software component, upon receiving a request for access to a provider having a plurality of service levels, determines the current security state of the requesting device. The security state of the requesting device varies according to severity levels of device security events. The software component compares that security state to a policy associated with the provider. The software component then allows the requesting device access to the provider services where the device's current security state meets or exceeds the security state required for the service.

Methods and systems for granting access to services based on a security state that varies with the severity of security events

System and method for identifying and assessing vulnerabilities on a mobile communications device

Embodiments of the present disclosure help protect computing devices by, among other things, identifying events that may pose a risk to a computing device based on data from sensors coupled to the computer device.

Systems and methods for computing device protection

Methods and systems are provided for sharing information and improving the functioning of devices by blocking potentially harmful communications. In the methods and systems disclosed, a security component on an electronic device may receive a policy. The security component may also receive, from a local device proxy on the electronic device, information pertaining to a communication. The security component may compare the information pertaining to the communication to the policy. The comparison may result in a determination that the communication is potentially harmful. The security component may then instruct the local device proxy to block the communication from proceeding past the local device proxy.

Methods and systems for blocking potentially harmful communications to improve the functioning of an electronic device

A method is provided for comparing a usage of a mobile communications device to a stored pattern of usage. When a measure associated with a difference between the usage and the stored usage pattern exceeds a threshold, the mobile communications device is caused to emit a sound encoded with information that may be decoded by another electronic device.

Methods and systems for causing mobile communications devices to emit sounds with encoded information

Data is collected from a set of devices according to a data collection policy. The data is associated with device configuration, device state, or device behavior. A norm is established using the collected data. A different data collection policy is established based on the norm. Data is collected from a particular device according to the different data collection policy. The norm is compared to the data collected from the particular device. If there is a deviation outside of a threshold deviation between the norm and the data collected from the particular device, a response is initiated.

Response generation after distributed monitoring and evaluation of multiple devices

Methods and systems are provided for sharing information and improving the functioning of devices by blocking the installation of an application based on an assessment. In the methods and systems disclosed, a server may receive data pertaining to an application from the mobile communications device. The server may process the data from the mobile communications device to determine an assessment of the application, where the assessment is based on an analysis using information shared by sources other than the mobile communications device. The server may then provide the assessment to the mobile communications device.

Growing community of inventors

San Francisco, CA, United States of America

John Gunther Hering