Granted Patent B2

US 12,192,170 · App. 18/242,795 · Granted Jan 7, 2025

Inventor: Shlomo Touboul (Kefar Haim, IL)

Assignee: CUPP Computing AS

H04L63/0209G06F21/57H04W12/12H04W12/128G06F2221/034H04L63/0227H04W12/08

Abstract

Claims (39)

1. A security system configured to protect a mobile device from untrusted network data while the mobile device is roaming outside of a trusted network, the security system comprising:

a security device configured to be installed in a mobile device, the security device comprising:

a routing device configured to receive untrusted network data intercepted from an untrusted network, the untrusted network data being sent to be processed by the mobile device, the intercepting and receiving occurring before a mobile device processor of the mobile device processes the untrusted network data;

a security engine including security instructions operative to implement a security policy, the security instructions configured to provide in accordance with the security policy pre-runtime security protection from malicious or potentially malicious code in the untrusted network data without forcing a connection to a remote gateway;

one or more dedicated security system processors dedicated to security functions and configured to execute the security engine, thereby enabling the security engine to receive the untrusted network data from the routing device, to evaluate the untrusted network data for violations of the security policy to identify the malicious or potentially malicious code in the untrusted network data in accordance with the security policy, and to provide network data deemed safe to the routing device for transmission to the mobile device processor for processing, the network data deemed safe being at least a portion of the untrusted network data that was not identified as containing malicious or potentially malicious code in accordance with the security policy; and

dedicated storage accessible only by the one or more dedicated security system processors.

2. The security system of claim 1 , further comprising a secure operating system on the security device.

3. The security system of claim 1 , wherein the mobile device is a mobile phone.

4. The security system of claim 1 , wherein the mobile device is a laptop computer.

5. The security system of claim 1 , wherein the security engine and the dedicated security system processor are incorporated in at least one chip coupled to an internal bus of the mobile device.

6. The security system of claim 1 , wherein the security engine and the dedicated security system processor are incorporated in a communication chip.

7. The security system of claim 1 , wherein the routing device is configured in the mobile device to redirect the untrusted network data to the one or more dedicated security system processors.

8. The security system of claim 1 , wherein the security policy is configured to be updated by a remote administrator.

9. A method of protecting a mobile device from untrusted network data while the mobile device is roaming outside of a trusted network, the method comprising:

launching a security system, the security system including a security device installed in a mobile device, the security device including one or more dedicated security system processors and dedicated storage accessible only by the one or more dedicated security system processors, the security device further including a security engine including security instructions operative to implement a security policy, the security instructions configured to provide in accordance with the security policy pre-runtime security protection from malicious or potentially malicious code in untrusted network data received from an untrusted source over an untrusted network without forcing a connection to a remote gateway;

the security engine being executed by the one or more dedicated security system processors on the security system, the one or more dedicated security system processors being dedicated to security functions, the executing the security engine assisting in causing the security system to perform the following steps:

receiving, by a routing device, particular untrusted network data intercepted from the untrusted network, the particular untrusted network data being sent to be processed by the mobile device, the intercepting and receiving occurring before a mobile device processor of the mobile device processes the particular untrusted network data;

using the security instructions to evaluate the particular untrusted network data for violations of the security policy to identify the malicious or potentially malicious code in the particular untrusted network data in accordance with the security policy; and

providing network data deemed safe to the routing device for transmission to the mobile device processor for processing, the network data deemed safe being at least a portion of the particular untrusted network data that was not identified as containing malicious or potentially malicious code in accordance with the security policy.

10. The method of claim 9 , wherein the security engine and the dedicated security system processor are incorporated in at least one chip coupled to an internal bus of the mobile device.

11. The method of claim 9 , wherein the security engine and the dedicated security system processor are incorporated into a communication chip.

12. The method of claim 9 , wherein the security device includes a secure operating system thereon.

13. A security system configured to protect a mobile device from untrusted network data while the mobile device is roaming outside of a trusted network, the security system comprising:

a security device configured to be installed in a mobile device, the security device comprising:

means for receiving untrusted network data intercepted from an untrusted network, the untrusted network data being sent to be processed by the mobile device, the intercepting and receiving occurring before a mobile device processor of the mobile device processes the untrusted network data;

a security engine including security instructions operative to implement a security policy, the security instructions configured to provide in accordance with the security policy pre-runtime security protection from malicious or potentially malicious code in the untrusted network data without forcing a connection to a remote gateway;

one or more dedicated security system processors dedicated to security functions and configured to execute the security engine, thereby enabling the security engine to receive the untrusted network data from the means for receiving, to evaluate the untrusted network data for violations of the security policy to identify the malicious or potentially malicious code in the untrusted network data in accordance with the security policy, and to provide network data deemed safe to the means for receiving for transmission to the mobile device processor for processing, the network data deemed safe being at least a portion of the untrusted network data that was not identified as containing malicious or potentially malicious code in accordance with the security policy;

dedicated storage accessible only by the one or more dedicated security system processors.

14. A security system configured to protect a mobile device from untrusted network data while the mobile device is roaming outside of a trusted network, the security system comprising:

a security device configured to be installed in a mobile device, the mobile device including a mobile device processor, the security device comprising:

one or more dedicated security system processors dedicated to security functions;

dedicated storage accessible only by the one or more dedicated security system processors;

a security engine including security instructions operative to implement a security policy when executed by the one or more dedicated security system processors, the security instructions configured to provide in accordance with the security policy pre-runtime security protection from malicious or potentially malicious code in untrusted network data in accordance with the security policy without forcing a connection to a remote gateway; and

a routing device configured to receive particular untrusted network data intercepted from an untrusted network before the mobile device processor of the mobile device processes the particular untrusted network data, the particular untrusted network data being sent to be processed by the mobile device, the intercepting and receiving occurring before the mobile device processor processes the particular untrusted network data, the routing device further configured to forward the particular untrusted network data to the security engine, the routing device further configured to forward particular return network data received from the security engine to the mobile device for processing by the mobile device processor;

the one or more dedicated security system processors configured to execute the security engine, thereby causing the security engine to:

receive the particular untrusted network data from the routing device,

evaluate the particular untrusted network data for violations of the security policy to identify particular malicious or potentially malicious code in the particular untrusted network data in accordance with the security policy,

and

provide the particular return network data to the routing device for transmission to the mobile device for processing by the mobile device processor, the particular return network data being at least a portion of the particular untrusted network data that was not identified as containing malicious or potentially malicious code in accordance with the security policy.

Assignments (2)

Continuity (6)

References Cited (313)