WO2011114308A1

WO2011114308A1 - Method of and system for installing client protection software on a mobile device

Info

Publication number: WO2011114308A1
Application number: PCT/IB2011/051133
Authority: WO
Inventors: Craig Howard Bregman; Willem Liebrecht Fick; Hayden Paul Schwarz
Original assignee: Arbalest (Pty) Limited
Priority date: 2010-03-18
Filing date: 2011-03-18
Publication date: 2011-09-22
Also published as: ZA201208066B

Abstract

According to a first aspect of the present invention there is provided a method of installing client protection software on a mobile device, the method comprising receiving a service request from a client, directing the client to a URL, with the client then executing the URL through the device's default browser, determining the mobile device's details, receiving confirmation from the user that the mobile device's details determined in the previous step are correct, pushing an installation package to the mobile device, the installation package comprising the protection software, a configuration file and an installer application that manages the installation process, requesting client authorisation to install the protection software and prompting the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device, installing the configuration file, which commences the installation of the protection software, and installing the protection software on the device.

Description

METHOD OF AND SYSTEM FOR INSTALLING CLIENT PROTECTION

SOFTWARE ON A MOBILE DEVICE

FIELD OF THE INVENTION

This invention relates to a method of and system for installing client software, and in particular, protection software, on a client's mobile device. The protection software may comprise antivirus, antispam, firewall and risk management components in a single client application. In particular, this invention relates to the packaging, delivering, monitoring and subscription auditing of protection software solutions, and related data storage, data loss protection, and recovery services.

BACKGROUND OF THE INVENTION

Mobile devices have become the new computing platform for both business and leisure, often containing sensitive and confidential information typically found on traditional computer devices. Consequently, these devices are vulnerable to attack, and, accordingly, the protection of these devices has become paramount.

However, the very nature of mobile devices means that the manner in which protection software is packaged and delivered to these devices has to adapt accordingly. For example, the ease with which mobile devices can be lost or stolen poses a real threat to companies and consumers alike, exposing both to data disclosure on multiple levels.

Security software solutions for mobile devices are not new. For example, Symantec has an Endpoint Protection, Mobile Edition, security solution. For convenience, the present invention will be described with particular reference to this security solution, but it should be clear that the present invention is by no means limited to this particular security solution. Symantec's mobile security solution extends beyond antivirus to address new attack vectors such as "snoopware" (a Symantec term for mobile spyware), which remotely places a phone into diagnostic mode then activates the microphone to monitor conversations, and "pranking4profit", in which an attack results in theft by accessing premium mobile SMS payments. Symantec's Mobile Endpoint Security Suite software leverages Mobile Device Management Systems (MDMs) from vendors to roll out its installation package, send down new configurations, and collect log events if an administrator chooses to do so. This also enables companies to conduct loss mitigation techniques such as 'wipe and kill' to protect any proprietary information on lost or stolen phones.

Symantec's Endpoint Protection, Mobile Edition provides integrated security and management capabilities for today's mobile devices. Today, many mobile devices contain confidential and sensitive data. Thus, the need to manage and secure these devices is critical.

Symantec Endpoint Protection, Mobile Edition includes the following core components:

The Symantec Endpoint Protection, Mobile Edition client software is installed on the mobile devices to be protected. It includes antivirus, antispam, firewall, and risk management in a single client.

Symantec Management Platform (SMP) is installed on an administrator's computer. Mobile security policies are managed in the Symantec Management Console, as well as mobile security reports and notifications.

The Symantec Mobile Security Solution is the mobile security management plug-in to the platform. The solution includes mobile security policies, reports, notifications, and risk management. Symantec Network Access Control, Mobile Edition is available separately, with this product providing Host Integrity checks to make sure that the security software on the mobile devices complies with an organization's security policies. The Symantec Network Access Control, Mobile Edition, also protects an organisation's network against connections by any device that does not comply with defined security policies. Network Access Control uses a series of Host Integrity checks to verify that your devices are compliant. If the checks indicate noncompliance, you can deny access to your network.

Symantec Management Platform includes the following components:

1 . Notification Server, which is the platform service that provides event processing, communication, and coordination with other platform services. 2. Configuration Management Database (CMDB), which is the platform database.

3. Symantec Management Console, which is a web-based user interface that allows management of the mobile security products.

To install Symantec Endpoint Protection, Mobile Edition on the mobile devices, this can be done in any of the following ways:

1 . By creating a download site on the Notification Server computer, with the resulting URL then being sent to the mobile device. In this method, the

Symantec Management Platform and the Symantec Mobile Security Solution is first installed. The download site contains the client installers and an agent installation file. An agent installation file is created by using a Symantec Mobile Security Agent policy page in the Symantec Management Console. This file contains the settings to establish communication between the device and the Notification Server computer.

2. By running a product disc on a client computer and synching the device with the computer. In this method, the product disc is inserted and the instructions on the screen followed. Significantly, this method installs an unmanaged client.

Symantec Endpoint Protection, Mobile Edition protects an organization's network and the devices that connect to it by providing antivirus protection and a firewall. Antivirus protection provides real-time scanning of files as users access them on their devices. It also provides scheduled scans, on-demand scans, and repair options. Symantec's Endpoint Protection, Mobile Edition also helps to mitigate the risks to an organisation's data if a device is lost or stolen. In particular, a list of sensitive files that were accessed on a lost or stolen device may then be retrieved.

The Symantec Endpoint Protection, Mobile Edition client software includes the Symantec Mobile Security Agent. The agent communicates with the server to perform the following actions:

1 . Upload device inventory to the server.

2. Upload logs to the server.

3. Receive and apply new security and management policies.

4. Receive and apply SMS commands for risk mitigation.

Significantly, the installation of the Symantec Endpoint Protection, Mobile Edition on a mobile device, whether by sending a download site or by running a product disc on a client computer, requires significant input from the user, often of a technical nature, and is thus not particularly user friendly for general users.

It is thus an aim of the present invention to provide a method of and system for installing client protection software, in a seemingly seamless and effortless manner with minimal input from the user.

SUMMARY OF THE INVENTION

According to a first aspect of the present invention there is provided a method of installing client protection software on a mobile device, the method comprising: receiving a service request from a client; directing the client to a URL, with the client then executing the URL through the device's default browser; determining the mobile device's details; receiving confirmation from the user that the mobile device's details determined in the previous step are correct; pushing an installation package to the mobile device, the installation package comprising the protection software, a configuration file and an installer application that manages the installation process; requesting client authorisation to install the protection software and prompting the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device; installing the configuration file, which commences the installation of the protection software; and installing the protection software on the device.

In an embodiment, the step of directing a client to a URL comprises the steps of compiling a text message containing a URL and then sending the text message with the URL to the client's mobile device.

In an alternative embodiment, the step of directing a client to a URL comprises the step of directing a client from a web interface to the URL.

In an embodiment, the URL sent to the client's mobile device comprises a code that is unique for the device's MSISDN, so as to define a unique URL, with the method comprising the step of disabling the unique URL.

In an embodiment, during the installation process, and typically in response to the client entering the MSISDN for the device, the method comprises the steps of sending the MSISDN and the device's IMEI (International Mobile Equipment Identity) to a billing server, the billing server confirming the MSISDN and linking the MSISDN and IMEI. In an embodiment, the step of installing the protection software on the device includes the step of connecting to a managing server to assign a license and provide configurations for the device.

In an embodiment, the method includes the step of the billing server reconciling with the managing server to confirm the successful installation of the protection software on the device, and to confirm the validity of the client by matching the IMEI on the billing server with the IMEI on the managing server.

In an embodiment, the method includes the step of maintaining the device on the managing server and the billing server.

In an embodiment, the method includes the step of the billing server initiating a first billing for the client, typically via an external billing entity. According to a second aspect of the present invention there is provided a system of installing client protection software on a mobile device, the system comprising: means to receive a service request from a client; means to direct the client to a URL, with the client then executing the URL through the device's default browser; means to determine the mobile device's details; means to receive confirmation from the user that the mobile device's details are correct; means to push an installation package to the mobile device, the installation package comprising the protection software, a configuration file and an installer application that manages the installation process; means to request client authorisation to install the protection software and to prompt the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device; and installation means to install the configuration file, which commences the installation of the protection software, and the protection software on the device.

According to a third aspect of the present invention there is provided a system for installing client protection software on a mobile device, the system comprising: a communications server arranged to: receive a service request from a client; direct the client to a URL, with the client then executing the URL through the device's default browser; determine the mobile device's details; receive confirmation from the user that the mobile device's details determined in the previous step are correct; push an installation package to the mobile device, the installation package comprising the protection software, a configuration file and an installer application that manages the installation process; request client authorisation to install the protection software and to prompt the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device; install the configuration file, which commences the installation of the protection software; and install the protection software on the device.

In an embodiment, the system comprises a billing server that, during the installation process, and typically in response to the client entering the MSISDN for the device, receives the MSISDN and the device's IMEI (International Mobile Equipment Identity), the billing server confirming the MSISDN and linking the MSISDN and IMEI.

In an embodiment, the system comprises a managing server to assign a license and provide configurations for the device. The managing server is further arranged to reconcile with the billing server to confirm the successful installation of the protection software on the device, and to confirm the validity of the client by matching the IMEI on the billing server with the IMEI on the managing server.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 shows a schematic flow diagram of a method of installing client protection software on a mobile device, according to a first embodiment of the present invention;

Figure 2 shows a schematic block diagram of a system for installing client protection software on a mobile device, according to a second embodiment of the present invention;

Figure 3 shows a matrix that combines the primary method steps of

Figure 1 with the system components of Figure 2; and

Figure 4 shows a sample report of a Device Record for the purposes of real-time reporting. DESCRIPTION OF PREFERRED EMBODIMENTS Referring to the figures, a method 10 of and system 50 for installing protection software on a mobile device 52 of a client 54 is shown. The method 10 comprises receiving a service request from the client, as indicated by block 12 in Figures 1 and 2. The client 54 is represented by layer 14 in Figure 1 , a central communications server 56 in Figures 2 and 3 by layer 16 in Figure 1 , and a mobile service provider by layer 18.

The client 54 thus typically registers a request for the service of the present invention, typically by sending an SMS text message with pre-defined content, such as "AV" as shown in Figure 2, or typically any other alphanumeric sequence, to a unique mobile number. This request for service may also be submitted in any number of other known ways, such as via a website, or as a request from a Service Provider or an Organisation.

A registration API (Application Programming Interface) receives the request for service, as indicated by block 20.

Depending upon the way in which the service request was submitted, in response to receiving an SMS text message, a text message containing a URL may be compiled by the communications server 56, as indicated by block 22 in Figures 1 and 2, with the text message then being sent to the client, as indicated by arrow 23 in Figure 2. In an embodiment, the URL sent to the client's mobile device is unique, with the URL sent to the client's mobile device 52 comprising a code that is unique for the device's MSISDN, so as to define the unique URL. The method 10 further comprises the step of deactivating/disabling the unique URL down the line, as indicated by block 24 in Figure 2, the aim of which is to prevent license sharing. Alternatively, if the service request was made through a web site, then the client may simply be directed from his/her web interface to the URL.

The client then executes the URL through the device's default browser, as indicated by block 26 in Figure 1 .

The method 10 then includes the step of determining the mobile device's details, as indicated by block 28 in Figure 1 . This is typically achieved by the executed URL interrogating the devices' UAProf (User Agent Profile) so as to determine the type and operating system of the mobile device. As is well known, in general terms, the UAProf specification is concerned with capturing capability and preference information for wireless devices. This information can be used by content providers to produce content in an appropriate format for the specific device. In particular, a UAProf file describes the capabilities of a mobile handset, including Vendor, Model, Screensize, Multimedia Capabilities, Character Set support, and more. There are a number of ways of obtaining this information, with the present invention, in one embodiment, using open source software WURFL (wurfl.sourcefourge.net) which is a popular method of accessing the above. In particular, the information obtained includes the device's 52 brand, model, operating system name and version, software platform name and version, screen size, and WAP capabilities.

The method 10 then comprises receiving confirmation from the client 54 that the mobile device's 52 details determined in the previous step are correct. This is indicated by block 30 in Figure 1 .

An installation package 58, as shown in Figure 3, is then pushed to the mobile device 52, as indicated by block 32 in Figures 1 and 2. In an embodiment, the installation package 58 comprises the protection software 60 itself, a configuration file 62 and an installer application 64 that manages the installation process.

In one version, the protection software 60 corresponds to the Symantec product described above (i.e. the Endpoint Protection, Mobile Edition product described above), and the configuration file 62 is an XML configuration file, the format and content of which is defined by Symantec. The purpose of the configuration file 62 is to provide the details and pre-shared security details required by the protection software to connect to a managing server (reference numeral 66 in Figures 2 and 3). The managing server 66 corresponds substantially to the Symantec Management Platform described above. Finally, the installer application 64 is responsible for:

Providing an explanation of the installation process.

Allowing the client 54 to enter the device's 56 mobile number to enable the number to be confirmed and validated by a billing server (reference numeral 68 in Figures 2 and 3).

Installing the protection software 60 on the mobile device 52.

The method 10 then comprises requesting client authorisation to install the protection software 60 and prompting the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device 52, as indicated by block/s 34 in Figures 1 and 2. Thus, the installation procedure is invoked by the client 54 and typically triggers the validation of the installation via an application connecting to the billing server 68. In particular, during the installation process, and typically in response to the client 54 entering the MSISDN for the device 52, the method comprises the steps of sending the MSISDN and the device's IMEI (International Mobile Equipment Identity) to the billing server 68, as indicated by block 36 in Figures 1 and 2. The billing server 68 then confirms the MSISDN and links the MSISDN and IMEI, as indicated by block 38 in Figures 1 and 2.

As is well known in the art, the MSISDN is a number that uniquely identifies a subscription in a GSM or UMTS mobile network. Simply put, it is the telephone number to the SIM card in a mobile/cellular phone. The MSISDN is used to route calls to the subscriber. The IMEI is a number unique to every GSM, WCDMA, and iDEN mobile phone, as well as some satellite phones. It is usually found printed inside the battery compartment of the phone and can be retrieved on any mobile device by dialing ^*#06#. The IMEI number is used by the GSM network to identify valid devices and therefore can be used to stop a stolen phone from accessing the network in that country.

As then indicated by block/s 40 in Figures 1 and 2, the xml configuration file 62 is then loaded, which commences the installation of the protection software 60, with the protection software 60 then being installed on the device 52.

In an embodiment, once the protection software 60 has been installed on the device 52, the device 52 connects to the managing server 66, which then assigns a license and provides configurations for the device 52. This is indicated by blocks 41 in Figure 2. Part of this process includes the linking of the device's MSISDN and IMEI on the managing server 66. As described above, the managing server 66 corresponds with Symantec's SMP server and, amongst other things, provides the management of the protection software 60 (e.g. policy updates, virus definition updates etc,).

In an embodiment, the method 10 includes the step of the billing server 68 reconciling with the managing server 66 to confirm the successful installation of the protection software 60 on the device 52. Part of this process is to confirm the validity of the client 54 by matching the IMEI on the billing server 68 with the IMEI on the managing server 66, as indicated by block 42 in Figure 1 and 2.

In an embodiment, as indicated by block 44 in Figures 1 and 2, the method 10 includes the step of maintaining the device 52 on the managing server 66 and the billing server 68.

In an embodiment, as indicated by block 46 in Figures 1 and 2, the method 10 includes the step of the billing server 68 initiating a first billing for the client 54, typically via an external billing entity 70.

The managing server 66 and billing server 68 are linked, so that information drawn from both servers may be consolidated into what may be termed a Device Record containing all the details necessary for the purposes of real-time reporting. This reporting may be made available to a Service Provider to whom the client 54, and thus by extension his/her device 52, is contracted or subscribed. The reporting provides details related to Device Status, Billing Status and Activity Status, each of which will be briefly described below. Device Status

By combining existing technologies with the client's MSISDN, a detailed device identity may be created, including:

Network operator, via SMS or other similar interaction;

Device brand and model number, as described above with reference to block 28 in Figure 1 ;

- MSISDN, via various user input options;

IMEI, on device activity; and

SMP or similar Managing Server functionality, on device activity. Billing Status

The Billing Server 68 is populated with information fed from the Managing Server 66. In addition, Service Provider billing policies may be defined and activated, with separate Service Provider user bases being defined, analysed and reported on.

Activity Status

This includes individual device 52 logs, updates, virus detections, quarantine records and other related activities tracked via the Managing Server 66. All activities are thus reported.

The sample report shown in Figure 4 shows how the above information may be consolidated and presented. The benefits of this additional service solution complement the first leg of the total solution described above, namely the over the air (OTA) deployment of protection software. The service solution benefits include:

Service Providers can set their own billing policies and maintain ownership of their user base by being directly involved in the distribution of the service; Real-time analysis (in the form of reports) provides invaluable marketing insight with regard to user and related device management / protective activities and

The ability to identify handset models and link these with IMEI's and MSISDN's and report on these statistics gives all stakeholders, namely device manufacturers, network operators and service providers further insight into their base.

Claims

A method of installing client protection software on a mobile device, the method comprising: receiving a service request from a client;

directing the client to a URL, with the client then executing the URL through the device's default browser; determining the mobile device's details; receiving confirmation from the user that the mobile device's details determined in the previous step are correct; pushing an installation package to the mobile device, the installation package comprising the protection software, a configuration file and an installer application that manages the installation process; requesting client authorisation to install the protection software and prompting the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device; installing the configuration file, which commences the installation of the protection software; and installing the protection software on the device.

2. The method of claim 1 , wherein the step of directing a client to a URL comprises the steps of compiling a text message containing a URL and then sending the text message with the URL to the client's mobile device.

3. The method of claim 2, wherein the step of directing a client to a URL comprises the step of directing a client from a web interface to the URL.

4. The method of claim 2, wherein the URL sent to the client's mobile device comprises a code that is unique for the device's MSISDN, so as to define a unique URL, with the method comprising the step of disabling the unique URL.

5. The method of any one of the preceding claims, wherein, during the installation process, and in response to the client entering the MSISDN for the device, the method comprises the steps of sending the MSISDN and the device's IMEI (International Mobile Equipment Identity) to a billing server, the billing server confirming the MSISDN and linking the MSISDN and IMEI.

6. The method of claim 5, wherein the step of installing the protection software on the device includes the step of connecting to a managing server to assign a license and provide configurations for the device.

7. The method of claim 6, which includes the step of the billing server reconciling with the managing server to confirm the successful installation of the protection software on the device, and to confirm the validity of the client by matching the IMEI on the billing server with the IMEI on the managing server.

8. The method of claim 7, which includes the step of maintaining the device on the managing server and the billing server.

9. The method of claim 8, which includes the step of the billing server initiating a first billing for the client, typically via an external billing entity.

10. A system of installing client protection software on a mobile device, the system comprising: means to receive a service request from a client;

means to direct the client to a URL, with the client then executing the URL through the device's default browser; means to determine the mobile device's details; means to receive confirmation from the user that the mobile device's details are correct; means to push an installation package to the mobile device, the installation package comprising the protection software, a configuration file and an installer application that manages the installation process; means to request client authorisation to install the protection software and to prompt the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device; and installation means to install the configuration file, which commences the installation of the protection software, and the protection software on the device.

A system for installing client protection software on a mobile device, the system comprising: a communications server arranged to: receive a service request from a client; direct the client to a URL, with the client then executing the URL through the device's default browser; determine the mobile device's details; receive confirmation from the user that the mobile device's details determined in the previous step are correct; push an installation package to the mobile device, the installation package comprising the protection software, a configuration file and an installer application that manages the installation process; request client authorisation to install the protection software and to prompt the client to enter the MSISDN ("Mobile Subscriber Integrated Services Digital Network Number) for the device; install the configuration file, which commences the installation of the protection software; and install the protection software on the device.

The system of claim 9, which comprises a billing server that, during the installation process, and in response to the client entering the MSISDN for the device, receives the MSISDN and the device's IMEI (International Mobile Equipment Identity), the billing server confirming the MSISDN and linking the MSISDN and IMEI.

The system of claim 12, which comprises a managing server to assign a license and provide configurations for the device.

The system of claim 13, wherein the managing server is arranged to reconcile with the billing server to confirm the successful installation of the protection software on the device, and to confirm the validity of the client by matching the IMEI on the billing server with the IMEI on the managing server.