Lookout, Inc.

Symantec Corporation

Timothy Micheal Wyatt

Kevin Patrick Mahaffey

Brian James Buck

David Luke Richardson

James David Burgess

David Golombek

Daniel Lee Evans

Anthony McKay Lineberry

Kyle Barton

John Gunther Hering

Marc William Rogers

Ariel Salomon

Bruce Christopher Wootton

Timothy Strazzere

Jonathan Grubb

William Neil Robinson

Yogesh Swami

Matthew Robert Baker

Danielle Hewson Kingsley

Elaine P Teoh

Amit Gupta

Matthew John Joseph LaMantia

Alex Cameron Abey

Emil Barker Ong

Nitin Shridhar Desai

Robert Blaine Elwell

Ayan Kanti Mandal

Hai Chen

Alex Richard Gladd

John Gerald Ferguson

Shree Raman

Derek Joseph Halliday

Anbu Anbalagapandian

Eike Christian Falkenberg

Meng Hu

Tim Strazzere

Phillip DiCorpo

Dirk Kessler

Ian Barile

Shun Chen

Richard Bruce Dandliker

Prasad Deshpande

Matthew Quigley

David Kincade

David William Cowden

Systems and methods are described for managing personal data on a client computer, in which personal data associated with the client computer is identified by a policy management module. An analysis may be performed for the client computer by a server using fake personal data. To identify applications which may attempt to access the personal data, the fake personal data is tracked for access on the client computer. A policy is then created that disallows access of the personal data by any applications identified by the analysis of the client computer as accessing the fake personal data. The policy is then assigned to the client computer.

Using fake personal data to create a policy to protect personal information on client computing devices

The security of network connections on a computing device is protected by detecting and preventing compromise of the network connections, including man-in-the-middle (MITM) attacks. Communications are intercepted by a client-side proxy before being sent to a recipient designated by an application. The intercepted communication is inspected, and a first connection is determined to be used to send the communication based on the inspection. Finally, before the communication is sent via the first connection, an action is performed by the client-side proxy resulting in an indication that the first connection is compromised. The action may include comparing data associated with the first connection to data associated with known compromised connections. In various embodiments, additional security responses may subsequently be performed by the client-side proxy based on the indication that the first connection is compromised.

Methods and systems for detecting and preventing compromised network connections

In one approach, a request for software evaluation is received by an evaluation server from a user device. The request relates to software to be installed on the user device. In response to receiving the request, the evaluation server sends data associated with the software to an authenticity server. The evaluation server receives, from the authenticity server, a result from the evaluation of the software. The evaluation server determines based on the result whether a security threat is associated with the software. In response to determining that there is a security threat, the evaluation server sends a communication to the user device that causes the software to be quarantined.

Quarantine of software by an evaluation server based on authenticity analysis of user device data

Data is collected from a set of devices according to a data collection policy. The data is associated with at least one of: device configuration, device state, or device behavior. A norm is established using the collected data. A different data collection policy is established based on the norm. Data is collected from a particular device according to the different data collection policy. The norm is compared to the data collected from the particular device. If there is a deviation beyond a threshold deviation between the norm and the data collected from the particular device, a responsive action is taken.

Individual device response options from the monitoring of multiple devices

Systems and Computer Readable Media for enabling methods for multi-party authorization including a security component determining that a request for the performance of an action on a computing device is from a first party. The security component initiates transmissions to the computing device of first and second information indicating knowledge of first and second secrets provisioned on the computing device. The computing device, upon verifying the knowledge of first and second secrets, then permits the requested action.

System and computer readable media enabling methods for permitting a request after verifying knowledge of first and second secrets

Methods and systems provide for preventing a false report of a compromised connection even though a security component receives an indication a connection is compromised, and the security component, by default, would report a compromised connection. In the method, the security component determines that captive portal authentication is enabled for a computing device. The security component requests a response from a server over a connection, with the response indicating that the connection is compromised. However, because captive portal authentication is enabled, the security component does not report the connection as being compromised.

Methods and systems for preventing a false report of a compromised network connection

A method for multi-party authorization includes a security component determining that a request for the performance of an action on a computing device is from a first party. The security component initiates transmissions to the computing device of first and second information indicating knowledge of first and second secrets provisioned on the computing device. The computing device, upon verifying the knowledge of first and second secrets, then permits the requested action.

System and method for permitting a request after verifying knowledge of first and second secrets

Software applications to be installed on user devices are monitored. Authenticity of the applications is evaluated using trust factors. In some cases, the trust factors relate to security associated with a network being accessed by a user device. In response to the evaluation, an action is performed such as configuring or disabling execution of one or more components of an application.

Evaluating authenticity of applications based on assessing user device context for increased security

A method includes: after installation of software on a first mobile device, receiving new data from a second mobile device; analyzing, using a data repository, the new data to provide a security assessment; determining, based on the security assessment, a new security threat associated with the software; and in response to determining the new security threat, causing the first mobile device to implement a quarantine of the software.

Quarantine of software based on analysis of updated device data

A computing device creates verification information and a challenge token and sends the verification information and token to a server. The computing device receives authentication credentials and a command from the server and a command. The authentication credentials were generated using verified authentication information and the token. The computing device verifies the authentication credentials and processes the command if the credentials are valid.

System and method for processing a command based on verification information and a challenge token

Systems and methods are disclosed for managing personal data on a mobile communications device in which personal data stored at one or more locations on the mobile communications device is identified by a policy management module on the mobile communications device. A policy is then created based on the identified personal data. The policy management module on the mobile communications device monitors at least the personal data stored in the one or more locations on the mobile communications device and detects attempts to access the monitored data.

Methods and systems for detecting attempts to access personal information on mobile communications devices

Data is collected from a set of devices according to a data collection policy. The data is associated with device configuration, device state, or device behavior. A norm is established using the collected data. A different data collection policy is established based on the norm. Data is collected from a particular device according to the different data collection policy. The norm is compared to the data collected from the particular device. If there is a deviation outside of a threshold deviation between the norm and the data collected from the particular device, a message is transmitted to an administrator.

Distributed monitoring and evaluation of multiple devices

A computing device creates verification information and a challenge token and sends the verification information and token to a server. A server receives a command and authentication information and uses the verification information to verify the authentication information. The server creates authentication credentials based on the authentication information and the challenge token. The computing device receives the command and the authentication credentials from the server, determines whether the credentials are valid, and then processes the command if the credentials are valid.

System and method for permitting an action based on verification information and a challenge token

A system and method to create a policy for managing personal data on a mobile communications device are disclosed. Personal data stored at one or more locations on the mobile communications device is identified by a policy management module on the mobile communications device. A policy is then created based on the personal data stored at the one or more locations. The policy management module on the mobile communications device monitors at least the personal data stored in the one or more locations on the mobile communications device.

System and method for creating a policy for managing personal data on a mobile communications device

The security of network connections on a computing device is protected by detecting and preventing compromise of the network connections, including man-in-the-middle (MITM) attacks. Active probing and other methods are used to detect the attacks. Responses to detection include one or more of displaying a warning to a user of the computing device, providing an option to disconnect the network connection, blocking the network connection, switching to a different network connection, applying a policy, and sending anomaly information to a security server.

Methods and systems for detecting and preventing network connection compromise

Growing community of inventors

Toronto, Canada

Timothy Micheal Wyatt