Lookout, Inc.

Kyle Barton

Kevin Patrick Mahaffey

David Luke Richardson

James David Burgess

Daniel Lee Evans

David Golombek

Anthony McKay Lineberry

Timothy Micheal Wyatt

Ariel Salomon

Brian James Buck

John Gunther Hering

William Neil Robinson

Bruce Christopher Wootton

Jonathan Grubb

Timothy Strazzere

Yogesh Swami

Timothy Michael Wyatt

Jonathan Pantera Grubb

Kavin Patrick Mahaffey

Methods and systems are provided for conditionally granting access to service levels based on a determined security state of the device requesting access. A software component, upon receiving a request for access to a provider having a plurality of service levels, determines the current security state of the requesting device. The software component compares that security state to a policy associated with the provider. The software component then allows the requesting device access to the provider services where the device's current security state meets or exceeds the security state required for the service.

Methods and systems for conditionally granting access to services based on the security state of the device requesting access

Methods and systems are provided for sharing information and improving the functioning of devices by blocking potentially harmful communications. In the methods and systems disclosed, a security component on an electronic device may receive a policy. The security component may also receive, from a local device proxy on the electronic device, information pertaining to a communication. The security component may compare the information pertaining to the communication to the policy. The comparison may result in a determination that the communication is potentially harmful. The security component may then instruct the local device proxy to block the communication from proceeding past the local device proxy.

Methods and systems for blocking potentially harmful communications to improve the functioning of an electronic device

A server receives from a mobile communication device information about a data object (e.g., application) on the device when the device cannot assess the data object. The server uses the information along with other information stored at the server to assess the data object. Based on the assessment, the device may be permitted to access the data object or the device may not be permitted to access the data object. The other information stored at the server can include data objects known to be bad, data objects known to be good, or both.

System and method for assessing data objects on mobile communications devices

Methods are provided for determining an enterprise risk level, for sharing security risk information between enterprises by identifying a security response by a first enterprise and then sharing the security response to a second enterprise when a relationship database profile for the first collection indicates the security response may be shared. Methods are also provided for determining whether to allow a request from an originating device where the request may have been initiated by a remote device.

Methods and systems for sharing risk responses between collections of mobile communications devices

Methods and systems are provided for sharing security risk information between collections of computing devices, such as mobile communications devices, to improve the functioning of devices associated with the collections. The methods and systems disclosed may share security risk information by identifying a security risk response by a first collection and then providing the security risk response to a second collection when a relationship database profile for the first collection indicates the security response may be shared with the second collection. Methods and systems are also provided for determining whether to allow a request from an originating device where the request may have been initiated by a remote device.

Methods and systems for sharing risk responses to improve the functioning of mobile communications devices

Disclosed herein is a system and method for efficiently gathering information about applications for mobile communications devices (e.g., smartphones, netbooks, and tablets) and using that information to produce assessments of the applications. To gather information, a server may send a request for application data to a mobile communications device. In response, the server may receive some but not all of the first-requested application data. The server may then a second request for application data to a second mobile communications device that also has access to the application. The server may receive application data from the second mobile communications device, and store the received first- and second-requested application data. The server then uses the stored application data to assess the application.

System and method for assessing an application based on data from multiple devices

A server receives from a mobile communication device application data identifying an application accessible by the mobile communication device. The server uses at least some of the application data to assess the application. The application data can include, for example, behavioral data, metadata, parts of the application, information indicating the application is installed on the mobile communication device, or combinations of these.

Assessing an application based on application data associated with the application

System and method for preventing malware on a mobile communication device

A system and method for preventing malware, spyware and other undesirable applications from affecting mobile communication devices uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a characterization assessment and can also provide a characterization re-assessment for the application, or data object, and transmits the assessment to the device. By performing analysis on a server, the invention allows a device to reduce the battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server can accumulate this data and then perform a characterization re-assessment of a data object it has previously assessed to provide an assessment based upon one of trust, distribution and ratings information.

System and method for server-coupled application re-analysis to obtain trust, distribution and ratings assessment

A system and method prevent malware, spyware and other undesirable applications from affecting mobile communication devices, which use a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a characterization assessment and can also provide a characterization re-assessment for the application, or data object, and transmits the assessment to the device. Performing analysis on a server reduces the battery and performance cost of protection. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats. The server can accumulate this data and then perform a characterization re-assessment of a data object it has previously assessed.

System and method for server-coupled application re-analysis to obtain characterization assessment

To prevent malware, spyware and other undesirable applications from affecting mobile communication devices (e.g., smartphones, netbooks, and tablets), a device uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces a categorization assessment and can provide a categorization re-assessment, and transmits the assessment to the device. By performing analysis on a server, a device can reduce its battery and performance cost of protecting against undesirable applications. The server transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats. The server can accumulate this data and perform a categorization re-assessment of a data object previously assessed.

System and method for server-coupled application re-analysis

Disclosed herein is a system and method for efficiently gathering information about applications for mobile communication devices (e.g., smartphones, netbooks, and tablets). This disclosure is also directed to a server producing assessments for applications by analyzing data from multiple sources. To gather information, a device sends information about an application to a server, which stores some or all of the information and may request additional information, if necessary. The server collects information from many devices, including devices that have varied configurations and different operating systems, by only collecting the appropriate information from each device. The server gathers the appropriate data to perform in-depth, granular mobile application analysis while minimizing overhead on devices, wireless networks, and the server. The server may collect portions of data from multiple devices, combining them on the server to produce an assessment for an application.

System and method for security data collection and analysis

This disclosure is directed to a system and method for preventing malware, spyware and other undesirable applications from affecting mobile communication devices (e.g., smartphones, netbooks, and tablets). A mobile communication device uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces an assessment for the application, and transmits the assessment to the device. By performing analysis on a server, the invention allows a device to reduce the battery and performance cost of protecting against undesirable applications. The servers transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats.

Growing community of inventors

Pacifica, CA, United States of America

Kyle Barton