Patent Description:
The present application generally relates to network security technology and more particularly, to security systems and methods for wireless network security.

When a mobile device such as a smart phone or a tablet or a laptop computer connects to a public Wireless-Fidelity (Wi-Fi) network at a public place (e.g., a mall, restaurant, movie theater, KTV, bar, airport, hotel, subway, etc.), a large number of users unknown to each other transmit data traffic over the shared Wi-Fi network. For example, a legitimate user connects to the public Wi-Fi network via his or her mobile device and decides to perform a security sensitive transaction such as making a payment on the mobile device. Because of the open nature of the public Wi-Fi, the payment transaction is vulnerable for being eavesdropped or snooped by a malicious user who is also connected to the public Wi-Fi, resulting in the sensitive information such as the legitimate user's password, account number, or the like being stolen by the malicious user. Therefore, there exists a need for wireless network security over an insecure wireless network such as a public Wi-Fi network.

<CIT> describes a mobile terminal-based payment method and apparatus, and mobile terminal. The mobile terminal-based payment method comprises: determining a mobile terminal has entered a payment scenario; detecting the network connection type of the mobile terminal; on the basis of the network connection type, establishing a secure network transmission channel from the mobile terminal to a payment server; and using the secure network transmission channel to transmit payment data until the payment is complete. Using a VPN or other tunnelling transmission technology to implement a secure network transmission channel for implementing mobile payment fulfils the secure switching requirements of different network service and secure payment applications, ensuring that during the process of a payment operation, the mobile terminal only connects to a dedicated mobile secure payment data network, eliminating the security risks of mobile payment caused by the transmission channel.

The exemplary embodiments will be explained in detail here. Examples thereof are presented in the drawings. In cases where the following descriptions relate to figures, the same numbers in different figures represent the same or similar elements, unless otherwise indicated. The implementations described in the exemplary embodiments below do not represent all of the implementations consistent with the present application. On the contrary, they are merely examples of means and methods consistent with some aspects of the present application, as described in detail in the claims.

The terms used in the present application merely serve to describe specific embodiments and are not intended to restrict the present application. The singular forms of "a," "said," and "the" used in the present application and the attached claims are also intended to include plural forms, unless otherwise clearly indicated by the context. Also, please understand that the term "and/or" used in this document refers to and contains any or all possible combinations of one or more associated elements.

Please understand that although the present application employs the terms "first," "second," "third," and so on to describe various information, this information shall not be limited by these terms. These terms merely serve to differentiate pieces of information of the same category. For example, so long as they remain within the scope of the present application, a first piece of information could be called a second piece of information. Similarly, a second piece of information could be called a first piece of information. The term "if" that is used herein may be interpreted as "when" or "upon being confirmed," depending on the context.

The term "client" as used herein refers to a program that interacts with its corresponding server in order to provide a service to a user of the client.

The term "app" as used herein refers to an application installed on a mobile device such as a smart phone, a tablet, a wearable device, or the like.

The term "virtual private network" or "VPN" as used herein refers to a private network constructed using public network connections (e.g., wired or wireless connections) to provide encrypted and secure communication between two points on the network.

<FIG> illustrates a block diagram of an example wireless network security system in accordance with an embodiment of the present disclosure. As shown herein, system <NUM> comprises a mobile device <NUM>, a first server <NUM>, and a second server <NUM>. A client <NUM> is installed on mobile device <NUM>, and capable of establishing a secure communication channel with first server <NUM>. Second server <NUM> is configured to service one or more applications (apps) running on mobile device <NUM>. Second server <NUM> is also in communication with first server <NUM>. Such apps include, for example, security sensitive apps that a user of mobile device <NUM> operates. It should be noted that although one mobile device <NUM>, one first server <NUM>, and one second server <NUM> are shown in <FIG> for the purpose of illustration, embodiments of the present disclosure can be applied to a plurality of mobile devices, first servers, and second servers, and the like.

Mobile device <NUM> can be a computing device, such as a smart phone, tablet computer, personal computer, laptop, personal digital assistant (PDA), wearable device, or the like with one or more wired, wireless, or any other suitable communication connections to first server <NUM>.

In this example, mobile device <NUM> is configured to directly access an IP Network through a Wi-Fi (<NUM>) connection. Once connected to the IP Network, mobile device <NUM> connects and communicates with one or more entities, e.g., first server <NUM> and second server <NUM>, which are also in communication with the IP network. For example, the user of mobile device <NUM> can connect with an e-commerce service hosted at second server <NUM> to conduct on-line shopping, or with a video service hosted at second server <NUM> to stream movie-clips.

With network connectivity, mobile device <NUM> is configured to, via a variety of apps, interact with entities for security sensitive operations or transactions such as managing accounts, making payments, or a variety of other tasks that involve accessing, updating, and transmitting user sensitive information. For example, the user may make a payment online with a merchant and share credit card information with the merchant. The user may manage their online credit card accounts with the credit card issuer. The user may also connect to a financial institution through their mobile device <NUM>, for managing bank accounts.

User sensitive information includes, for example, personal information (e.g., birth dates, social security numbers, etc.) and personal account information (e.g., credit card numbers, account numbers, passwords, etc.), for secure transactions such as accessing bank accounts or making payments. Mobile apps making use of such user sensitive information are referred to herein as security sensitive apps. In this example, Alipay™ is the security sensitive app.

After mobile device <NUM> is connected to a wireless network, client <NUM> is configured to determine whether the network type of the existing wireless network is an insecure type or a secure type. When client <NUM> detects the existing wireless network as, for example, a public Wi-Fi, a password free Wi-Fi, a free-of-charge Wi-Fi, a Wi-Fi unknown to mobile device <NUM>, a Wi-Fi not frequently accessed by mobile device <NUM>, or the like, client <NUM> determines that mobile device <NUM> is connected to an insecure type of network. On the other hand, if client <NUM> detects the existing wireless network as a password protected Wi-Fi or a Wi-Fi frequently accessed by mobile device <NUM>, client <NUM> determines that mobile device <NUM> is on a secure type of network. Upon determining that the existing wireless network mobile device <NUM> is connected to an insecure type of network, client <NUM> causes mobile device <NUM> to enter into a secure mode. In this secure mode, client <NUM> monitors to detect whether a security sensitive app, e.g., a financial transaction app, is to be activated or launched on mobile device <NUM> by the user. When client <NUM> detects that a security sensitive app is to be activated, client <NUM> causes mobile device <NUM> to establish a secure communication channel with first server <NUM>. In this example, the secure communication channel is a VPN connection and client <NUM> causes mobile device <NUM> to establish a VPN connection by launching a VPN application.

Once the security sensitive app is activated, client <NUM> is configured to monitor the operations or transactions of the security sensitive app, and to cause messages generated by the security sensitive app to be transmitted to first server <NUM> using the secure communication channel. First server <NUM> is configured to receive via the secure communication channel messages generated by the security sensitive app and to forward the messages to second server <NUM> for processing. In this example, the message generated by the security sensitive app, e.g., Alipay™, can be an account transfer related message, a payment message, an order message, or the like.

In some embodiments, during the secure mode, client <NUM> is further configured to detect whether the current display interface of mobile device <NUM> is displaying the user interface of the security sensitive app. The detection can be performed by invoking an operating system call such as registering a listener to be notified once the system display's visibility changes for one or more particular user interface components. When the current display interface is not displaying the interface of the security sensitive app, client <NUM> causes mobile device <NUM> to disconnect from the secured communication channel but to maintain a connection with first server <NUM> via the existing insecure wireless network.

In this example, when it is determined that the type of the current wireless connection, e.g., a Wi-Fi connection, is insecure, client <NUM> enters into a secure mode. When a security sensitive app, e.g., Alipay™, is activated on mobile device <NUM> with client <NUM> in the secure mode, client <NUM> establishes a secure communication channel, e.g., a VPN connection, with first server <NUM>. In this example, client <NUM> is the Ali Money Shield™ app and client <NUM> can be configured upon installation to allow a user to select mobile apps for Ali Money Shield™ to provide for security. With user configured inter-app communication permissions, client <NUM> can be authorized to access transactions and statuses of the apps selected. In this example, it is ensured that client <NUM> starts monitoring the operations of Alipay™ and forwarding messages generated by the operations of Alipay™ via the secure communication channel to first server <NUM>. This prevents a malicious user from stealing sensitive information such as a legitimate user's password to Alipay™ when the legitimate user operates Alipay™ to transmit sensitive information on a public network. Therefore, secure transactions on mobile device <NUM> are ensured even though the user accesses a risky network, e.g., a public Wi-Fi network, on mobile device <NUM>. The secure communication channel (e.g., VPN) connection is established only when the security sensitive app is activated so that client <NUM> would not generate excessive system loads on first server <NUM> by maintaining a long-term connection. Furthermore, secured communication transmitted to and from first server <NUM> can also be reduced to preserve system resources.

<FIG> is a flowchart of an example process for secure wireless network connections in accordance with an embodiment of the present disclosure. <FIG> is a schematic illustration of a screen shot of an example scenario of process <NUM> of <FIG> in operation in accordance with an embodiment of the present disclosure. Process <NUM> can be implemented by, for example but is not limited to, client <NUM> on mobile device <NUM> of <FIG>.

As shown herein, process <NUM> starts at <NUM>, where the type of wireless network a mobile device is connected to is acquired.

In this example, a mobile device is currently connected to a Wi-Fi network. The types of a Wi-Fi network include, for example, a free-of-charge Wi-Fi network, a password-free Wi-Fi network, a Wi-Fi network not frequently visited by the mobile device, a Wi-Fi network unknown to the mobile device, or the like. The above-described types of Wi-Fi are considered insecure types of Wi-Fi connections. For another example, a password-protected Wi-Fi or a Wi-Fi frequently accessed by the user of the mobile device is considered a secure type of Wi-Fi. Types of the wireless network can be configured according to various usages or demands of networks without limitations.

At <NUM>, if it is determined that the type of the wireless network is an insecure type, process <NUM> starts to monitor an app for secure transactions. In this example, the application is a pre-configured security sensitive app, such as the payment app of Alipay™. It should be noted that any types of apps, not limited to security sensitive ones, can be monitored by process <NUM>, or pre-configured for secure transaction and to be monitored by process <NUM>. In some embodiments, the monitored aspects of an app include, for example, whether the app is to be activated, whether the app has exited from operation, operations or transactions performed by the user using the app, etc..

At <NUM>, it is determined that the app is to be activated on the mobile device. For example, the client can be implemented to query a list of active processes of the mobile device and to determine whether the app is a foreground process. For another example, the client can be implemented to register for a listener on the event of the app being launched. For yet another example, the app can be configured to notify the client upon being launched into activation.

At <NUM>, the mobile device is caused to establish a connection with a first server via a secure communication channel such as a virtual private network (VPN).

In this example, the VPN connection is a network designated for connecting the mobile device and the first server. Messages generated and output by the pre-configured app on the mobile device are transmitted over the VPN connection to the first server, which in turn forwards these messages to a second server for processing.

In this example, the client is Ali Money Shield™, an official software for online shopping security on cellular devices. The first server is configured to service Ali Money Shield™. The mobile device connects to a wireless local area network via a public Wi-Fi provided by a public place, e.g., a mall. When Ali Money Shield™ determines that the type of the current Wi-Fi connection is a free-of-charge Wi-Fi and therefore the mobile device is currently on an insecure network, Ali Money Shield™ enters into the secure mode. While in the secure mode, Ali Money Shield™ monitors one or more apps pre-configured for secure transaction. Here, Ali Money Shield™ monitors to detect whether a financial transaction app, such as Alipay™, is to be activated on the mobile device by the user.

As shown in <FIG>, mobile device <NUM> has Alipay™ activated and is currently displaying the user interface of Alipay™. At this point of time, Ali Money Shield™ has determined that Alipay™ is activated and causes mobile device <NUM> to display an indication that Ali Money Shield™ is in secure mode. The indication can be displayed in any suitable manner at any suitable location on the current display interface of mobile device <NUM>, for example, in status bar <NUM> where other information such as the time, cellular carrier, network status, battery level, etc. are usually displayed. As shown herein, with Ali Money Shield™ in secure mode and Alipay™ active, status bar <NUM> displays that "Ali money shield Wi-Fi Secure mode, one payment transaction secured. " Here, Ali Money Shield™ causes mobile device <NUM> to establish a secure communication channel (e.g., a VPN) with the first server so that messages generated by Alipay™ are encrypted by the secure communication channel and transmitted over the secure communication channel to the first server. Upon receiving the messages from mobile device <NUM>, the first server decrypts the messages and forwards them to the second server to be processed.

The client can be configured to monitor any aspects or operations of an app for secure transaction on the mobile device in order to ensure the security of information transmitted by the app over certain types of wireless networks (e.g., insecure wireless networks). Since the secure communication channel is established only when a app is to be activated, the mobile device does not require long-term connections and incurs less system load on the first server. In this manner, traffic to and from the first server over the secure communication channel is also reduced.

<FIG> is a flowchart of an example process for secure wireless network connections in accordance with an embodiment of the present disclosure. <FIG> illustrates a screen shot of an example scenario of process <NUM> of <FIG> in operation in accordance with an embodiment of the present disclosure. Process <NUM> can be implemented by, for example, client <NUM> on mobile device <NUM> of <FIG>, after process <NUM> of <FIG> causes mobile device <NUM> to establish a connection with first server <NUM> using a secure communication channel.

As shown herein, process <NUM> starts at <NUM>, where, during the above described monitoring of the app, the mobile device displays content at a pre-configured location on the current display interface of the mobile device to indicate that the client is in the secure mode. As shown above in <FIG>, status bar <NUM> of the mobile device is configured to display indications of the mode and statuses of the client. In this example the app is an app pre-configured to be monitored.

Referring back to <FIG>, at <NUM>, it is detected whether the current display interface of the mobile device is showing the user interface of the app under monitoring. When the current display interface does not display the user interface of the app, process proceeds to <NUM>. When the current display interface is displaying the user interface of the app, process <NUM> goes back to <NUM> and continues to monitor the pre-configured app.

In this example, the client determines whether the current display interface of the mobile device is displaying the Alipay™ user interface by querying the operating system of the mobile device using certain pre-defined function calls supported by the operating system (e.g., by invoking a getVisibility function call or the like). In this example, as shown in <FIG>, the current display interface of mobile device <NUM> displays the home screen of the operating system instead of the user interface of Alipay™. Thus, it is determined that Alipay™ is no longer shown on the current display interface.

At <NUM>, when the current display interface does not show the user interface of the app, process <NUM> causes the mobile device to disconnect from the secure communication channel (e.g., the VPN), and to maintain the connection with the first server via the existing wireless connection, e.g., the Wi-Fi connection.

In this example, when Alipay™ is no longer displayed on the current display interface of the mobile device, the absence of the display indicates that the client no longer needs to be in the secure mode. Or, it indicates that the client, if still in the secure mode, no longer needs to monitor the activities or operations of Alipay™. Thus, the client disconnects from the secure communication channel (e.g., by invoking a CloseVPNConnection function call or the like) but continues to maintain the connection with the first server via the existing Wi-Fi connection. In this manner, it is ensured that the user can access other apps of lower security risks, such as video apps or game apps, through the existing (free) Wi-Fi connection to conserve the amount of network bandwidth used.

At <NUM>, when the mobile device disconnects from the secure communication channel, process <NUM> causes the mobile device not to display the indication previously displayed on the display interface of the mobile device. As shown in <FIG>, when client <NUM> (e.g., Ali Money Shield™) causes the mobile device <NUM> to disconnect from the secure communication channel, or after mobile device <NUM> disconnects from the communication channel, status bar <NUM> no longer displays the information previously displayed with regard to the mode and statuses of client <NUM>. As shown herein, status bar <NUM> now displays the usual information of the signal status bar, the time, and the battery level.

In this example, it is determined whether the current display interface shows an interface of the pre-configured app under the monitoring of the client. When the current display interface no longer shows the interface of the pre-configured app, the mobile device is caused to disconnect from the communication channel. In this way, the system load incurred by the client via the communication channel connection on the first server can be reduced. The mobile device no longer displays the client related messages and also helps to promptly inform the user of the current status of the client.

<FIG> is a flowchart of an example process for secure wireless network connections in accordance with an embodiment of the present disclosure. <FIG> illustrates a screen shot of an example scenario of process <NUM> of <FIG> in operation in accordance with an embodiment of the present disclosure. <FIG> illustrates a screen shot of another example scenario of process <NUM> of <FIG> in operation in accordance with an embodiment of the present disclosure. Process <NUM> can be implemented by, for example, client <NUM> on mobile device <NUM> of <FIG>.

As shown in <FIG>, process <NUM> starts at <NUM>, where in the secure mode, it is determined whether the client has exited (closed) from its display interface. When the client has exited from its display interface, process <NUM> proceeds to <NUM>. When the client has not exited from its display interface, process <NUM> goes back to <NUM> to remain in the secure mode and to continue to monitor the apps.

At <NUM>, when the client has exited from its interface, a corresponding icon is displayed in the current display interface of the mobile device to indicate that the app is being monitored.

In this example, as shown in <FIG>, when client <NUM> is not in the secure mode and has exited from its current display interface (e.g., as shown herein, the home screen is displayed instead), indicator <NUM> corresponding to client <NUM> is displayed in the current display interface of mobile device <NUM>. The indicator can be any suitable interface components such as an icon, an animation, a toast, a bubble, a balloon, or the like. In some embodiments, the indicator is an icon having a shape similar or identical to that of the icon of client <NUM> on the user interface. In this example, indicator <NUM> is a smaller version of the same design (tilted shield) of the Ali Money Shield™ icon.

Also in this example, as shown in <FIG>, when client <NUM> is in the secure mode, and client <NUM> has exited from its current interface, a corresponding indicator is displayed to indicate that a pre-configured app is being monitored. Similarly, the indicator can be any suitable user interface component such as an icon, an animation, a toast, a bubble, a balloon, or the like. In this example, indicator <NUM> is an icon, as shown in <FIG>, which indicates the pre-configured app is being monitored. In some embodiments, indicator <NUM> of <FIG> and indicator <NUM> of <FIG> are floating icons. Upon the detection of the user clicking on and moving indicator <NUM> or indicator <NUM>, indicator <NUM> or indicator <NUM> may be moved to any location on the current display interface by the user using finger movements. Further, by interacting with indicators <NUM> or <NUM>, the user can obtain the status information of client <NUM> with respect to its secure mode and statuses. For example, the user can rotate indicator <NUM> or indicator <NUM> to display a textual popup indicating that "Ali Money Shield™ in secure mode" for two seconds to obtain more detailed information about the application being monitored.

<FIG> is a flowchart of an example process for secure wireless network connections in accordance with an embodiment of the present disclosure. <FIG> illustrates a screen shot of an example scenario of process <NUM> of <FIG> in operation in accordance with an embodiment of the present disclosure. <FIG> illustrates a screen shot of another example scenario of process <NUM> of <FIG> in operation in accordance with an embodiment of the present disclosure. Process <NUM> can be implemented by, for example, client <NUM> on mobile device <NUM> of <FIG> and in connection with process <NUM> of <FIG>.

As shown in <FIG>, process <NUM> starts at <NUM> where it is determined whether the mobile device has disconnected from the existing Wi-Fi connection. When the mobile device has disconnected from the existing Wi-Fi connection, process <NUM> proceeds to <NUM>. When the mobile device remains connected over the existing Wi-Fi connection, process <NUM> continues to execute process <NUM> of <FIG>.

In some embodiments, the client determines whether the mobile device connects to a Wi-Fi network by querying the network interface of the electronic device.

At <NUM>, when the mobile device is disconnected from the Wi-Fi connection, it is determined whether the client has entered into the security mode for the first time. When the client has entered the secure mode for the first time, process <NUM> follows the YES path to proceed to <NUM>. When it is not the first time that the client entered the secure mode, process <NUM> follows the NO path to proceed to <NUM>.

At <NUM>, when the client has entered the secure mode for the first time, an interface component is used to indicate that the monitoring process has ended. Process <NUM> concludes at <NUM>. The interface component can be any suitable interface component. For example, it can be a toast, a pop up message window, or the like.

As shown in <FIG>, at <NUM>, when the client has entered the secure mode for the first time, and mobile device <NUM> needs to leave the existing Wi-Fi connection, a toast <NUM> is displayed on the display interface of the mobile device. The toast is a window that appears on the display for a limited amount of time (e.g., a few seconds) then automatically disappears. Here, the toast indicates to the user that the secure mode has ended. In some embodiments, if the operating system of mobile device <NUM> grants the client permission to open a toast, a toast is displayed. In some other embodiments, if the operating system of mobile device <NUM> does not grant the client permission to open a toast, a popup message (e.g., a window that requires the user to manually close) is displayed.

Referring back to <FIG>, at <NUM>, when it is not the first time the client has monitored the app, it is determined whether the client has performed any security measures for the pre-configured operation of the app. If so, process <NUM> proceeds to <NUM>. If no, process <NUM> concludes at <NUM>.

At <NUM>, an interface component is used to indicate that the pre-configured operations of the app have been secured by the client. The interface component can be any suitable interface component. For example, it can be a toast or a popup message window, or the like.

A <NUM>, the operations for which the client has secured during the secure mode until the present point of time are displayed. Process <NUM> concludes at <NUM>. As shown in <FIG>, from <NUM> through <NUM>, when the client has not entered the secure mode for the first time (e.g., the client has entered the security mode for a second time), if mobile device <NUM> needs to leave the existing Wi-Fi connection, it is determined whether any operations such as account transfer on Alipay™ have been secured by the client. For example, since Ali Money Shield™ is authorized to access the transaction log or details of operations of Alipay™ such as bank account transfers, placed orders or the like, Ali Money Shield™ retains the information about transactions secured for Alipay™ in the secure mode. As shown in <FIG>, a toast <NUM> is displayed to indicate that Ali Money Shield™ has protected five account transfers by Alipay™ and blocked three phishing websites. In some embodiments, if the operating system of mobile device <NUM> grants the client permission to open a toast, a toast is displayed. If the operating system of mobile device <NUM> does not grant the client permission to open a toast, a popup message is displayed.

In this example, when the client disconnects from the existing Wi-Fi connection, corresponding notification messages are displayed to the user according to whether the client has entered the secure mode before. Such messages help the user learn about the statuses and results the client has provided for the app.

<FIG> is a flowchart of a process for secure wireless network connections in accordance with an embodiment of the present disclosure. Process <NUM> can be implemented by, for example, client <NUM> on mobile device <NUM> of <FIG>.

As shown in <FIG>, process <NUM> starts at <NUM> where a website URL is obtained during the secure mode.

In this example, the client obtains the website Uniform Resource Locator (URL) from the browser launched by the user on the mobile device.

At <NUM>, the website URL is compared with the URLs specified in a pre-configured list, which records the phishing website URLs.

At <NUM>, when there is a match between the website URL and one of the website URLs included in the pre-configured list, the mobile device is blocked from accessing the website URL.

In some embodiments, the pre-configured list is obtained from the first server, which compiles and maintains a collection of the URLs of the phishing websites. The first server also updates the pre-configured list periodically or in real time. The first server further transmits the pre-configured list to the mobile device so that the client can use the most updated pre-configured list to block phishing websites.

In some other embodiments, the client transmits the website URL obtained at <NUM> to the first server (e.g., first server <NUM> of <FIG>). By checking against the above-described pre-configured list, the first server determines whether the website URL is included in the pre-configured list. If so, the first server generates a comparison result and transmits the comparison result back to the mobile device. When the client determines that the comparison result indicates that the website URL is included in the pre-configured list, the mobile device is blocked from accessing the website URL.

With phishing websites blocked during the secure mode of the client, the Wi-Fi connection is also protected against phishing websites automatically on the mobile device. This prevents the user of the mobile device from falling victim to a phishing website.

<FIG> is a functional diagram illustrating an embodiment of a programmed computer system for secure wireless network connections, in accordance with an embodiment of the present disclosure. Computing system <NUM> can be used to implement the mobile device, the first server, and the second server (shown in <FIG>) as appropriate. As will be apparent, other computer system architectures and configurations can be used to implement the systems and methods for wireless network security. Computing system <NUM> includes a processor <NUM>, a bus <NUM>, a network interface <NUM>, a memory <NUM>, and a non-volatile memory <NUM>. Processor <NUM> reads the corresponding computer program from the non-volatile memory <NUM> to the memory <NUM> for execution. The present disclosure does not exclude other implementations in addition to a software implementation, e.g., a logic device or a combination of software and hardware. In other words, the entity that executes the process is not be limited to the various logical units. It may also be hardware or a logic device.

Processor <NUM> is used for acquiring the type of wireless network accessed by the mobile device. The mobile device is controlled by process <NUM> so that it establishes a connection with a first server via a virtual private network (VPN) using network interface <NUM>.

Upon considering the invention disclosed here in the description and in practice, persons skilled in the art shall easily think of other schemes for implementing the present application. The present application intends to cover any variation, use, or adaptation of the present application where the variation, use, or adaptation complies with the general principles of the present application and includes public knowledge or customary technical means in the art not disclosed by the present application. The description and embodiments are regarded merely as illustrative. The true scope of the present application are indicated by the claims below.

Please also note that the term "comprise" or "contain" or any of their variants are to be taken in their non-exclusive sense. Thus, processes, methods, merchandise, or equipment that comprises a series of elements not only comprises those elements, but also comprises other elements that have not been explicitly listed or elements that are intrinsic to such processes, methods, merchandise, or equipment. In the absence of further limitations, elements that are limited by the phrase "comprises a(n). " do not exclude the existence of additional identical elements in processes, methods, merchandise, or devices that comprise said elements.

The above-described are merely preferred embodiments of the present application and do not serve to limit the present application. Any modifications, equivalent substitutions, or improvements that are performed shall be contained within the protective scope of the present application.

Claim 1:
A method (<NUM>; <NUM>) for secure wireless network connections, the method being performed by a client (<NUM>) installed on a mobile device (<NUM>), and the method comprising:
acquiring (<NUM>) a type of a wireless network to which a mobile device is connected;
determining that the type of the wireless network is insecure based at least in part on how frequently the mobile device has accessed the wireless network; and
in response to a determination that the type of network is insecure, monitoring (<NUM>) to determine whether an application is to be activated, wherein:
the monitoring to determine whether the application is to be activated comprises:
querying an operating system of the mobile device using certain pre-defined function calls supported by the operating system to determine that the application corresponds to a current display interface of the mobile device, and the application is installed on the mobile device;
determining (<NUM>) that the application is to be activated based at least in part on a detection that the current display interface of the mobile device is showing the application; and
in response to the determination that the application is to be activated, establishing (<NUM>) a secure communication channel between the mobile device and a first server (<NUM>);
determining (<NUM>) that a display of the interface for the application is no longer being shown by the mobile device based at least in part on querying the operating system of the mobile device using certain pre-defined function calls supported by the operating system to determine that the application is no longer shown on the current display interface of the mobile device; and
in response to a determination that the application is no longer shown on the current display interface of the mobile device, disconnecting (<NUM>), by the mobile device, the secure communication channel and maintaining a connection with the first sever via the wireless network for one or more other applications to communicate via a non-secure channel