Patent Description:
Embodiments of the present invention generally relate to systems and methods for implementing a data network, and more specifically to a network cyber-security platform providing security protocols to devices associated with the data network.

Data or telecommunication networks may provide Internet access to one or more devices connected to the network through a wired or wireless interface. For example, a modem within a user's home network may connect to the data network and provide access to the Internet for devices communicating with the modem. In some instances, the modem may be located at a customer premises, such as a customer's home or place of business, or may be located away from the customer premises. For example, a computing device, such as a laptop computer or smart phone, may access the Internet via a data network via a private router located at the customer premises. The computing device may later connect to the Internet via a public modem (or other connecting device) outside of the premises, such as at a public library, a coffee shop, a hotel lobby, an airport, etc. Such connections may be with the modem through a WiFi connection. In general, WiFi is a wireless communication standard that allows for the generation of wireless local area network (WLAN) of devices. A typical WLAN set-up includes a modem that broadcasts a wireless signal to multiple wireless devices and acts as a gateway device to a larger network over which connection to the Internet is available.

Accessing the Internet may open computing devices to potential malicious actions intended to obtain sensitive or secret information from the computing devices, harm the devices, or take over control of the device for some malicious purpose. For example, a website may include a link or file that, when accessed by the computing device, downloads a virus or malware to the computing device. The virus or malware may disrupt the operation of the computing device or may obtain information stored on the computing device and transfer that information to a third party. In another example, some websites on the Internet may include explicit material or images that may be unsuitable for children or others. Data networks or computing devices may therefore include features that attempt to prevent devices from downloading or accessing malicious or harmful content on the Internet.

It is with these observations in mind, among other, that aspects of the present disclosure were conceived. The following prior art documents are relevant: <CIT>, <CIT>, <CIT>, and <CIT>.

One aspect of the present disclosure relates to a method for providing security features to a network. The method may include the operations of configuring, based on an input provided to a user interface associated with a security platform of a data network, a security policy for a wireless network, the security policy comprising a plurality of security rules for interacting with a public network and instructing a routing device of the wireless network and a device in communication with the routing device to each install a security application configured to communicate with the security platform. The method may also include the operations of receiving, from the security application of the device or the routing device, a request to access the public network and transmitting, to the security application of the device or the routing device, the security action based on a parameter of the received request and the security policy for the wireless network, the security action comprising an instruction for processing the request to access the public network.

Another aspect of the present disclosure relates to a networking apparatus comprising a processing device and a non-transitory computer-readable medium encoded with instructions. When the instructions are executed by the processing device, the processing device may perform the operations of configuring a security policy for devices communicating with a wireless network, the security policy comprising a plurality of security rules for interacting with a public network, transmitting an instruction to a routing device of the wireless network and a device in communication with the routing device to each activate a security application configured to communicate with a security platform of a data network, receiving, from the security application, a request to access the public network, the request originating from the device, and instructing the security application to execute an action on the request to access the public network, the action based on a security rule identified by a parameter of the received request.

Yet another aspect of the present disclosure relates to a security platform for a network comprising a database storing a plurality of security profiles, each of the plurality of security profiles associated with a corresponding customer network and a security controller. The security controller may receive, via a user interface, one or more user inputs indicating a plurality of security rules for inclusion in one of the security profiles associated with a first customer network, the security policy comprising a plurality of security rules for interacting with a public network, configure, based on the indicated plurality of security rules, a security policy for the first customer network, and instruct a routing device of the first customer network and a device in communication with the routing device to each install a security application configured to communicate with the security controller. The security controller may also receive, from the security application of the device, a request to access the public network and transmit, to the security application of the device and based on a request from the device to access the public network, a security action based on a parameter of the received request and the security policy for the first customer network.

Aspects of the present disclosure involve systems, methods, and the like, for a security platform of a data network providing security services to one or more computing devices in communication with the data network. In one implementation, the security platform may apply a security policy to the computing devices when accessing the Internet via a home network (or other customer network) and to the computing devices when accessing the Internet via a public or third party network. The policy may be generated or configured at a security platform in or associated with the data network. To provide security services to computing devices via the home network, the security platform may communicate with a security agent application executed on the router (or other gateway device) of the home network. The security agent application may be provided to the router and/or activated by the security platform in response to configuration of a security policy associated with the home network. The security agent application activated on the router may monitor access to the Internet and block or otherwise prevent downloading of malicious or harmful files or data from the Internet. In another implementation, the security policy for the home network may include security parental controls that prevent or monitor access to particular websites or particular content of the Internet. The configuration of the parental controls may include identifying devices in communication with the router of the home network, associating those devices with family members, employees, etc., and establishing content-based rules for one or more of the identified devices. The security platform and/or the router of the home network may apply the parental control security rules for each identified device based on the security profile for the network.

In addition, each of the devices identified by the security profile for the home network may be instructed or otherwise be provided a security agent application for execution on the computing devices. The security agent application may communicate with the security platform to monitor and/or control access to the Internet based on the security profile for the home network. Further, the security agent may also communicate with the security platform when the computing device connects to the Internet over a third party or public access point. For example, a mobile computer (such as a laptop) or smart phone may connect to the Internet via a public network or other network access point away from the home network. The security agent application executed on the mobile computer may communicate with the security platform when connecting to the Internet and the security profile for the home network may be applied to the Internet access for the mobile computer. In this manner, the security profile, including parental security controls, configured for the home network may also be applied to the identified computing devices whether connecting to the Internet via the home network or via a third party, out-of-home network.

In some instances, the security agent application downloaded or executed by the router/gateway device and/or the computing devices identified by the home network may be installed as a container-based application on the respective operating systems of the computing devices. In this manner, the security applications may be installed on the computing device and/or router regardless of the manufacturer of the device via an abstraction layer within the operating system. As such, the computing device and/or router may be a third party device separate from a data network administrator to provide the in-home and out-of-home security to the devices associated with the in-home network.

<FIG> is a schematic diagram illustrating an exemplary Internet Protocol (IP) operating environment in accordance with one embodiment. In general, the environment <NUM> provides for establishing communication sessions between network users and the Internet <NUM>. One or more networks (such as customer network <NUM> and wireless network <NUM>) may connect to an IP network <NUM> to provide and receive communications between devices associated with the networks <NUM>-<NUM> and the Internet <NUM>. With specific reference to <FIG>, the environment <NUM> includes an IP data network <NUM>, which may be provided by a wholesale network service provider. The IP network <NUM> includes numerous components such as, but not limited to gateways, routers, route reflectors, and registrars, which enable communication and/or provides services across the IP network <NUM>. Communications between the IP network <NUM> and other entities or networks, such as the one or more customer home or business local area networks (LANs) <NUM>-<NUM>, may also be managed through network environment <NUM>. In some instances, the customer network <NUM>-<NUM> may form a Wireless Local Area Network (WLAN) in which wireless devices may communicate with the network <NUM> via a respective modem <NUM>,<NUM> or similar network communication device.

Customer networks <NUM>-<NUM> can include computing devices such as, but not limited to, a personal computer <NUM>, wireless communication device <NUM>, gaming console <NUM>, Internet of Things (IoT) devices <NUM>, etc., connected to a modem <NUM>. In general, the computing devices may include any type of device that receives a multimedia signal, such as an audio, video or web-based signal, and presents that signal for use by a user of the computing device. In many cases, the computing device <NUM> may be a wireless computing device. The components of the connected network <NUM>-<NUM> enable devices of the network to communicate via the IP network <NUM> to other communication devices or to the Internet <NUM>. For example, a laptop computer <NUM> of home network <NUM> may utilize the modem <NUM> to access the Internet <NUM> to view a webpage, download a document, send or receive an e-mail, and the like. Components of the customer networks <NUM>-<NUM> are typically home- or business-based, but they can be relocated and may be designed for easy portability.

The customer or wireless networks <NUM>-<NUM> typically connect to the IP network <NUM> via respective gateways <NUM>-<NUM> or other network edge devices. The IP network <NUM> may also connect to other networks (collectively known herein as the "Internet" <NUM>) through a gateway <NUM> or other edge device. For example, home network <NUM> may include a modem <NUM> in communication with gateway <NUM>. One or more computing devices <NUM>-<NUM> may communicate with the modem <NUM>, either via a wired or wireless connection, to transmit instructions, packets, signals, or other communications for transmission to one or more servers or other destinations of the Internet <NUM>. The IP network <NUM> may transmit the received communications to gateway <NUM> for connection to the destination device of the Internet <NUM>. The communications may thus include an identifier of the destination device, such as a destination Internet Protocol (IP) address or other address identifier. In some instances, the network <NUM> may host the destination device. Regardless, the network environment <NUM> may provide a connection path between the computing device <NUM>-<NUM> of the home network <NUM> to one or more devices of the Internet <NUM>. A similar Internet connection service may be provided to other networks of the IP network <NUM>, such as wireless network <NUM>, such that mobile computing devices may connect to both the home network <NUM> and the wireless network <NUM>, despite the home network and wireless network having geographically disparate locations, as discussed in more detail below.

In some instances, the network <NUM> may include a security platform <NUM> configured to provide security services to networks <NUM>-<NUM> or devices connected to the network <NUM>. For example, security platform <NUM> may provide security services, such as firewall capabilities, parental control, content-monitoring and blocking, and the like, to devices <NUM>-<NUM> connecting to the Internet <NUM> via modem <NUM>. <FIG> is a schematic diagram illustrating a network environment <NUM> including one such security platform <NUM> for providing security procedures to devices <NUM>-<NUM> within an in-home network <NUM> in accordance with one embodiment. Components of the home network <NUM> are similar to those described above such that the home network <NUM> may include one or more communication devices (computer <NUM>, mobile device <NUM>, gaming system <NUM>, loT device <NUM>, etc.) in communication with modem <NUM>. The modem <NUM> may provide a communication path to the Internet <NUM>, as described above. A security platform <NUM> may also be included in environment <NUM> for providing security services to the devices <NUM>-<NUM> of the home network <NUM>. In particular and as described in more detail below, the security platform <NUM> may communicate with a security agent application <NUM>, installed on the modem <NUM> and executed by operating system <NUM>, to configure and execute security services for accessing the Internet <NUM>. The security platform <NUM> may also communicate with a security application <NUM> installed on one or more of the computing devices <NUM>-<NUM>, such as security application <NUM> executed by operating system <NUM> of mobile device <NUM>, to provide security services to the device upon which the application <NUM> is installed.

In addition to communicating with security applications <NUM>, <NUM>, the security platform may also communicate with a database <NUM> storing various information associated with providing security services, including but not limited to, security profiles, customer identifiers, computing device identifiers, security rules, and the like. The database <NUM> may also store information associated with destinations, devices, files, etc. of the Internet, such as classifications of websites, identified malicious files or links, fingerprints or other identifiers of potential harmful viruses, a reputation score for websites, and the like. The Internet destination information may be provided to the database <NUM> from a third party source or may be generated from an analysis of the Internet content or traffic patterns associated with network <NUM>. For example, a computing device associated with the database <NUM>, such as an application server or other configurable computing device, may access webpages of the Internet <NUM> and analyze the content of the accessed webpages. Analysis of the webpages may include scanning the software code associated with the webpage for particular words, phrases, or images that may provide an indication of the content of the webpage. For example, particular words or phrases obtained from the code of a webpage may indicate the webpage is a gambling site. In another example, particular words or phrases obtained from the code of a webpage may indicate the webpage is a pornographic site. Matching the words of the code of a webpage may allow the application server to categorize the webpage based on the webpage content. In some instances, the category associated with the webpage may be a default categorization if the code does not include the scanned for words or phrases. The categorization of the webpage may then be stored in the database <NUM> for use by the security platform <NUM>, as described below.

In another instance, the application server of the database <NUM> may execute a hash function on files downloaded from destinations within the Internet <NUM> and compare the determined hash value to hash values of known malicious files. In some instances, the hash values of known malicious files of the Internet <NUM>, such as viruses or malware programs, may be received from third party systems configured to detect and provide threats disseminated on the Internet <NUM>. The application server of the database <NUM> may determine hash values for requested files or programs from the devices <NUM>-<NUM> of the home network <NUM> and compare such values to known hash values of harmful files. The hash values for the known harmful files may be similarly be stored in the database <NUM> for use by the security platform <NUM>.

The security platform <NUM> may include one or more programs that are executed by the platform to provide security services to devices of the home network <NUM>. For example, the security platform <NUM> may include a user interface <NUM> through which a user or customer of the network <NUM> may configure aspects of the security services provided to the home network <NUM>. In some instances, the user interface <NUM> may display security feature options, display computing devices <NUM>-<NUM> of the home network <NUM>, may receive one or more inputs to configure or establish a security policy for the home network <NUM>, show results of application of security rules of the policy to the computing device <NUM>-<NUM>, and the like. Additional aspects of the user interface <NUM> are discussed below with reference to the operations of the security platform <NUM>.

As discussed above, the security platform <NUM> may provide security services to the devices <NUM>-<NUM> of the home network <NUM> when such devices are connected to the Internet via a network different than the home network. For example, <FIG> is a schematic diagram illustrating a network environment <NUM> for a security platform <NUM> providing security procedures to a device <NUM> connected to an out-of-home network <NUM> in accordance with one embodiment. Several of the components of the environment <NUM> are similar or the same as that of <FIG>. For example, home network <NUM> may include modem <NUM> executing operating system <NUM> and security agent <NUM>, loT device <NUM>, game system <NUM>, and computer <NUM>, as described above. The modem <NUM> may communicate with a security platform <NUM> to provide security services for the devices accessing the Internet <NUM>.

In some instances, computing device <NUM> may be a mobile device such that the device may be carried to a location other than the home network <NUM>. For example, the mobile device <NUM> may be a smart phone or laptop that is portable. Further, the mobile device <NUM> may connect to other wireless or wired networks for access to the Internet <NUM>, such as wireless network <NUM>. For example, a public library or coffee shop may establish a wireless network <NUM> for computing devices associated with patrons of the establishment to connect, generally over a Wi-Fi connection, to the Internet <NUM>. As shown in <FIG>, public wireless network <NUM> may include modem <NUM> that provides access to the Internet <NUM>. In general, the modem <NUM> may broadcast a wireless signal to which computing devices may discover and connect to exchange communications with the modem <NUM>. In one example, the modem <NUM> may broadcast a Service Set Identifier (SSID) that indicates to the computing device <NUM> a wireless connection is available for connecting to the Internet <NUM>. In some instances, a password or other exchange of credentials between the modem <NUM> and the mobile device <NUM> may occur before connection to the Internet <NUM> is established. Regardless, once connected, the mobile device <NUM> may communicate with devices or destinations of the Internet <NUM> to receive information or data.

As mentioned above, the modem <NUM> of the home network <NUM> may include a security application <NUM> in communication with the security platform. The security application <NUM> may apply one or more aspects of a security policy as configured by the security platform <NUM> for devices connecting to the Internet <NUM> via the modem <NUM>. For example, the security application <NUM> may intercept requests for access to the Internet <NUM> from a computing device, such as loT device <NUM>, and determine, based on rules included in the security policy for the home network <NUM> provided by the security platform <NUM>, whether access to the Internet should be provided to the loT device <NUM> or denied. Other actions may also be taken by the security application <NUM> based on the rule set of the security policy for the home network <NUM>. In another example, the security application <NUM> may provide the requests for access to the Internet <NUM> from the computing devices <NUM>-<NUM> to the security platform <NUM>. The security platform <NUM> may execute the security policy on the access request and provide a response to the modem <NUM> to allow access, deny access, or undertake some other action on the request. Regardless, the modem <NUM> and the security application <NUM> of the home network <NUM> may provide security services to the computing devices <NUM>-<NUM> connected to the modem <NUM> as provided or configured by the security platform <NUM>.

For computing devices of the home network <NUM> that attempt to connect to the Internet <NUM> via an out-of-home wireless network, such as wireless network <NUM>, the security platform <NUM> may be configured to apply the security profile for the home network <NUM> to the mobile device <NUM>. In particular, the security application <NUM> executed on the mobile device <NUM> may direct access requests for the Internet <NUM> to the security platform <NUM>, regardless of which modem or network the mobile device is utilizing to connect to the Internet <NUM>. The security platform <NUM> may communicate with and provide instructions or other data to the security application <NUM> of the mobile device <NUM> to execute the rules of the security policy for the home network <NUM>. Such rules may include parental controls, virus protection, content monitoring, and the like. In this manner, the security platform <NUM> may apply the security profile of the home network <NUM> to mobile computing devices <NUM> registered with or otherwise associated with the home network <NUM>, regardless of which devices or networks the mobile device <NUM> uses to request access to the Internet <NUM>.

To establish a security profile for the home network <NUM>, a user, administrator, or other entity in control of the home network <NUM> may access the security platform <NUM> to configure the security profile. <FIG> is a flowchart illustrating a method <NUM> for configuring a security platform of a data network to provide security services to devices connected to the data network in accordance with one embodiment. In general, the operations of the method <NUM> may be performed by the security platform <NUM>, in some cases in response to one or more inputs received via the user interface <NUM>. Other components of the network environments <NUM>, <NUM> discussed herein, such as security application <NUM>, <NUM> or computing devices <NUM>, <NUM>, may perform other operations of the method <NUM>. The operations may be executed through a combination of hardware components of the computing device and one or more instructions stored on a computer-readable medium of the device.

In operation <NUM>, the security platform <NUM> activates a security profile for a user or home network <NUM> in communication with the security platform. In some instances, the user of the security platform <NUM> may be associated with or administer a wireless or other network connected to the data network <NUM>. For example, an administrator of home network <NUM> (such as a home owner, account owner, or other customer of the data network <NUM> associate with the home network <NUM>) may access the user interface <NUM> of the security platform <NUM> to request a security feature for the home network <NUM>. The user may access the user interface <NUM> via a computing device my logging into the user interface and, in some instances, providing credentials such as a user identifier and/or password. The security platform <NUM> may compare the received user credentials to a database of network users to verify the user's identity. The database (which in some instances may be database <NUM>) may also include network identification information that identifies the home network <NUM> associated with the user. For example, the network identification information may include one or more IP addresses of devices associated with the network <NUM>, a home or physical address location of the network, a service plan associated with the network, technical information (such as a bandwidth of the connection between the home network <NUM> and the data network <NUM>), and the like.

In addition to accessing the user/home network information, the security platform <NUM> may also, via the user interface <NUM>, receive a request to activate one or more security features for the home network <NUM> and define or configure a security policy for the home network <NUM>. The request may be received as an input to the user interface <NUM> through a selection of an option displayed on the user interface <NUM> to security activation. Such a selection may include selection of a package of security features for the network <NUM> or may include selection of individual security features available for the network <NUM>. Upon selection of one or more security features, the security platform <NUM> may create or otherwise activate a security policy for the home network <NUM>. The security policy may also be associated with the user logged into the user interface <NUM>. For example, the security policy may be associated with a customer profile, a home network identifier, a user identifier, or the like. The activation of the security policy for the home network <NUM> may include accessing various databases of the data network <NUM>, including a billing database and/or a customer support database, to indicate the activation of the security policy for the home network <NUM>.

In operation <NUM>, the security platform <NUM> may transmit one or more instructions to the modem/gateway device <NUM> to activate one or more security features for the home network <NUM>. The instructions may be transmitted to the modem <NUM> in response to the activation of the security policy for the home network <NUM>. For example, the security platform <NUM> may transmit an activation signal to the modem <NUM> to cause the modem to launch the security application <NUM> within the operating system <NUM> of the modem <NUM>. The security platform <NUM> may transmit the activation signal to the modem <NUM> based on the information accessed by the security platform <NUM> or included in the security profile for the home network <NUM>. Upon launch, the security application <NUM> may register with the security platform <NUM> to begin receiving additional instructions or commands. Thus, in some instances, the security application <NUM> may be preloaded on the modem <NUM> for activation by the security platform <NUM>. The modem <NUM> may be associated with or provided to the home network <NUM> by the data network <NUM>. In another example, the security platform <NUM> may, based on the modem/network information accessed above, may transmit a request to the modem <NUM> to download the security application <NUM> from the security platform <NUM> or from another source of the data network <NUM>. Upon launch, the security application <NUM> may request additional security information from the security platform <NUM> to apply a security policy for the home network <NUM>.

In operation <NUM>, the security platform <NUM> may load or otherwise provide a security policy configuration to the security application <NUM>. As explained in more detail below, the security policy for a home network <NUM> may be configured via inputs provided to the user interface <NUM> by a network administrator. Such a security policy configuration may include parental controls, virus detection and prevention, malware detection and prevention, and the like. The various countermeasures to potential threats on the Internet <NUM> may define the security policy for the home network <NUM>. For example, the policy may cause the security application <NUM> of the modem <NUM> to intercept connection or other requests intended for the Internet <NUM> and transmit or otherwise provide information of the requests to the security platform <NUM> for analysis. The types of requests intercepted by the security application <NUM> may be based on the security policy for the home network <NUM>. Thus, the security policy may include instructions on which requests are intercepted and which are allowed to be transmitted, by the modem <NUM>, to the Internet <NUM> for connection to an Internet-based device. For example, the security policy for the home network <NUM> may include virus protection such that requests to download a file from the Internet may be intercepted by the security application <NUM> for verification with the security platform <NUM>. In another example, the security policy may include one or more parental controls that verify the content of each requested webpage against a parental rule established for the requesting device. In such instances, the security application <NUM> may intercept each request for a webpage for verification against the parental control. The number and types of Internet requests intercepted by the security application <NUM> of the modem <NUM> may be determined by the security policy supplied by the security platform <NUM>.

In some instances, the security policy may be configured based on inputs provided by the user of the security platform <NUM>. For example, the user, via the user interface <NUM>, may select security features offered via the security platform <NUM>, may provide information or configurations of parental controls, may provide blocked websites via a black list, may provide allowed websites via a white list, and the like. In another example, one or more default security features, such as virus and/or malware protection, may automatically be included in the security policy for the home network <NUM> upon activation of the security profile by the security platform <NUM>. In another example, various security features may be configured, via the user interface <NUM>, for the various components or devices <NUM>-<NUM> of the home network <NUM>. For example, in operation <NUM>, the security platform <NUM> may receive one or more device identifiers of devices connected or in communication with the modem/gateway <NUM> of the home network <NUM>. In particular, the modem/router <NUM> may receive or assign an identification from each device requesting connection to the wireless network emitted by the modem <NUM>. For example, computer <NUM> may request connection to the SSID network transmitted by the modem <NUM> and, within the request, include a Media Access Controller (MAC) identifier or another device identifier unique to the computer <NUM>. The modem <NUM> may store the identifier received from the computer <NUM> for use in transmitting wireless signals to the computer <NUM>. In another example, the computer <NUM> may request connection to the modem <NUM> and, in response, the modem may assign a temporary IP address to the computer <NUM> at which the computer may receive communications. The IP address assigned to the computer <NUM> may also be stored by the modem <NUM>. The other devices within the home network <NUM> may similarly provide or be assigned an identifier when connecting to the modem <NUM>.

In some instances, the modem <NUM> may classify or estimate a type of device associated with the received or assigned identifiers. For example, a device <NUM>-<NUM> of the home network <NUM> may frequently access particular websites or servers within the Internet <NUM>. The ownership or maintenance of the accessed server may provide an indication of an owner or type of device, obtained from a database of IP addresses and companies associated with the IP addresses. For example, a smart phone requesting connection to a server identified as being operated by Company A may be determined to be a device manufactured by Company A. The modem <NUM> may analyze communication packets from that device and extract a destination IP address from the communications and correlate, via a database of IP addresses, an association of the destination address with Company A. In another example, the modem <NUM> may analyze requests from a device of the network <NUM> and determine that a majority of the requests comprise Domain Name Server (DNS) requests. The modem <NUM> may thus determine that the particular device is a smart television. The modem <NUM> may, upon determining a possible type and/or manufacturer of a device, provide the estimated type and/or manufacturer of the device to the security platform <NUM> for use in configuring the security policy for the home network, as explained below.

In operation <NUM>, the security platform <NUM> may determine if one or more parental controls are to be added to the security policy for the home network <NUM>. Determination of the addition of parental controls may be based on one or more inputs received via the user interface <NUM>. For example, a user of the interface <NUM> may provide an input selecting to add one or more parental control security features to the security policy for the home network <NUM>. In one instance, the security platform <NUM> may display a list of detected devices of the home network <NUM> and, in some instances, the estimated device type/manufacturer of the detected devices. Each detected device may have its own security policy or parental controls. For example, the smart phone <NUM> of the network <NUM> may have a first security policy associated with the device and the gaming system <NUM> may have a second security policy associated with the device. Parental controls may therefore added to each device individually or as a group as the security policy for the network <NUM> is configured.

If the security platform <NUM> determines that parental controls for one or more devices of the network <NUM> are to be added, the platform may access the security profile for the home network <NUM> and the corresponding device identifiers received above. As mentioned, each device <NUM>-<NUM> connected to the modem <NUM> of the home network <NUM> may provide or be given a device identifier that is provided to the security platform <NUM>. Each device identifier may be associated with the security profile of the home network <NUM> such that each device identifier of the home network <NUM> may be accessed and displayed via the user interface <NUM>. In operation <NUM>, the security platform <NUM> may receive parental control policies for one or more of the devices <NUM>-<NUM> associated with the home network <NUM>. In one example, a user may utilize the user interface <NUM> to select one of the devices shown and provide one or more of the parental controls discussed above (such as white list, black list, category or content blocks, etc.) to be applied to the selected device. The same or different parental controls may be applied to the devices <NUM>-<NUM> of the network <NUM>. In this manner, the security policies for each detected device of the home network <NUM> may be configured individually by a user of the interface <NUM>.

In operation <NUM>, the security platform <NUM> may instruct one or more of the devices <NUM>-<NUM> of the home network <NUM> to download a security application for execution of the security policies associated with that device. For example, security platform <NUM> may transmit an instruction or message to mobile device <NUM> instructing the operating system <NUM> to download security application <NUM> to continue to access the Internet <NUM> via modem <NUM>. In another example, security platform <NUM> may transmit an instruction to modem <NUM> to instruct mobile device <NUM> to download security application <NUM>. The security application <NUM> of the computing devices <NUM>-<NUM> may, in some instances, provide a status indicator to the modem <NUM> informing the modem <NUM> that the security application was downloaded and is executed by the operating system of the corresponding device. The modem <NUM> may, in determining that the security application <NUM> is not operational on the device <NUM>, may deny Internet access for that device until the security application is activated. A similar application may be downloaded and executed by loT device <NUM>, game system <NUM>, and computer <NUM> of the home network <NUM>. In some instances, only those devices identified for parental controls <NUM> in the above operations may be instructed to download the security application <NUM>. As described in more detail below, the security application <NUM> on the computing devices <NUM>-<NUM> of the home network <NUM> may aid in applying the security policy for that device when connecting through networks other than the home network <NUM>.

In operation <NUM>, the security platform <NUM> may update the security policy for the home network <NUM> with the parental controls of each device associated with the network. Through the update, the security platform <NUM> may maintain a current security policy associated with home network <NUM>. In operation <NUM>, the security platform <NUM> may determine if additional updates to the security policy of the home network <NUM> are received, such as via the user interface <NUM>. For example, additional updates to the security policy may be received via the user interface <NUM>, such as additional parental controls for application to one or more of the devices <NUM>-<NUM> of the home network <NUM>. If no updates to the security policy are received, the security platform <NUM> may wait for network activity in operation <NUM>. Network activity from one or more devices <NUM>-<NUM> of the home network <NUM> may trigger a security feature, as described in more detail below. If updates to the security policy are received, the security platform <NUM> may update the security profile for the home network <NUM> accordingly in operation <NUM>. For example, a parental control may be applied to a device <NUM>-<NUM> of the network <NUM> as describe above. Upon update of the profile, the security platform <NUM> may again determine if additional updates are received and wait for network activity.

With the security policy for the home network <NUM> configured, the security platform <NUM> and/or the modem <NUM> may begin applying the policy to the devices <NUM>-<NUM> of the network <NUM>. <FIG> is a flowchart illustrating a method <NUM> for a security platform of a data network <NUM> to provide security services to devices <NUM>-<NUM> connected to the data network in accordance with one embodiment. In general, the operations of the method <NUM> of <FIG> may be performed by the security platform <NUM>. Other components of the network environments <NUM>, <NUM> discussed herein, such as security application <NUM>,<NUM> or computing devices <NUM>,<NUM>, may also perform one or more of the operations of the method <NUM>. The operations may be executed through a combination of hardware components of the computing device and one or more instructions stored on a computer-readable medium of the device.

In operation <NUM>, the security platform <NUM> may receive network activity parameters from the security application <NUM> executed by the operating system <NUM> of the modem <NUM> of the home network <NUM> or from the security application <NUM> executed by the operating system <NUM> of mobile device <NUM>. For example, IoT device <NUM> may connect to the modem <NUM> of the home network <NUM> as described above and may attempt to connect to a device of the Internet <NUM>, such as an application server, or otherwise communicate with the Internet <NUM>. To communicate with the Internet <NUM>, the loT device <NUM> may transmit a communication or request to a device of the Internet <NUM> via modem <NUM>. Security application <NUM> executed by the modem <NUM> may intercept the Internet request from the loT <NUM> and provide some indication or parameter of the request to the security platform <NUM>. For example, the security application <NUM> may provide a Uniform Resource Locator (URL) of a requested website, a destination IP address included in the request, a file name requested to be downloaded, and the like. In some instances, the security application <NUM> may extract or generate a portion of the request (such as a destination IP address from the header) and transmit the portion to the security platform <NUM> for analysis. In other instances, the security application <NUM> may forward the communication from the loT device <NUM> to the security platform <NUM> without altering or extracting portions of the request. In this manner, the security application <NUM> may be a gateway for requests from each of the devices <NUM>-<NUM> connected to the modem <NUM> in communication with the Internet <NUM> to provide security services for the home network <NUM>.

In another example illustrated in <FIG>, the mobile device <NUM> may be moved from the home network <NUM> and connect to the Internet <NUM> via a wireless network <NUM> away from the home network <NUM>. For example, mobile device <NUM> may be a smart phone that connects to a public network <NUM> at a library or school via modem <NUM>. In this instance, the security application <NUM> executed on the mobile device <NUM> may intercept the requests from the mobile device <NUM> to the Internet <NUM> in a similar manner as above and transmit the requests to the security platform <NUM> via modem <NUM>. In one instance, the security application <NUM> may identify requests to the Internet <NUM> and replace a destination address of the request to an IP address of the security platform <NUM>. In other instances, the security application <NUM>, similar to security application <NUM> of modem <NUM>, may extract or generate a portion of the request and transmit the portion to the security platform for analysis. Through the security application <NUM> executed on the mobile device <NUM>, the security policy for the home network <NUM> may be applied to devices when connecting the Internet via wireless networks <NUM> away from the home network <NUM>. The device requests or portions of requests may therefore be transmitted to the security application <NUM> as network activity parameters via security application <NUM> of modem <NUM> of security application <NUM> executed on the mobile device <NUM>.

In operation <NUM>, the security platform <NUM> may associate a security profile with the device corresponding to the received network activity. As mentioned above, the modem <NUM> may provide device identifiers for each device <NUM>-<NUM> of the home network <NUM>, including IP addresses associated or assigned to each device <NUM>-<NUM>. The requests transmitted by a device, such as mobile device <NUM>, may include a source address identifier corresponding to the assigned IP address for that device. In another example, the security application <NUM> may provide the network activity parameters to the security platform <NUM> with an identifier of the modem <NUM> or the home network <NUM>. A database <NUM> of home network identifiers and/or device identifiers and the associated security profile for the identifiers may be maintained and accessed by the security platform <NUM>. With the device <NUM>-<NUM> identifier, the modem <NUM> identifier, or the home network <NUM> identifier, the security platform <NUM> may determine a security profile associated with the home network <NUM> from a database, such as database <NUM>. In operation <NUM>, the security platform <NUM> may access a security policy for the home network <NUM> and/or one or more devices <NUM>-<NUM> of the home network <NUM> based on the determined security profile for the received communication. The security policy may be configured via security platform <NUM> and may include, as described above, virus and malware protection, parental controls, white lists of websites, black lists of websites, and the like.

In operation <NUM>, the security platform <NUM> may access the database <NUM> based on one or more aspects of the received network parameter from the home network <NUM> or mobile device <NUM>. For example, the security platform <NUM> may obtain a requested webpage or URL from the received request and, based on the obtained URL, access one or more entries in the database <NUM> associated with the URL. Entries in the database <NUM> may include a reputation, a category, a security risk score, and the like associated with the URL. In another example, the security platform <NUM> may obtain, from the request, an identifier of a file or other downloaded content from a device of the Internet <NUM>. The security platform <NUM> may utilize the identifier of the file or other content to access one or more entries in the database <NUM> to obtain information of the requested file, such as a reputation, category, risk of the file containing a virus, etc. In general, any aspect of the received request may be used by the security platform <NUM> to access entries in the database <NUM> for application of one or more security features, such as a destination IP address, a URL, a webpage identifier, a file identifier, an Internet device identifier, and the like.

In operation <NUM>, the security platform <NUM> may receive a reputation, category, risk score, etc. from the database <NUM> based on the network activity parameter utilized to access the database. The reputation of the network activity may include a risk score or other identifier that provides an indication of known risk of the requested network access. For example, an IP address of the Internet <NUM> may be known as risky or to include one or more viruses that may infect a device accessing the IP address. The reputation of the URL or downloadable file may be provided to the database <NUM> via a third party configured to determine potential risks of the Internet <NUM>. In another example, the reputation of the URL or downloadable file may be determined by a computing device (such as an application server) in communication with the database <NUM>. As explained above, the computing device of the database <NUM> may analyze traffic patterns of the data network <NUM> and/or receive reported risks encountered during accessing the Internet <NUM> and store a risk assessment in the database <NUM> with an identifier of the risky URL or file. In one example, the reputation of the network activity may include a "safe" identifier, an "unknown" identifier, a "moderate risk" identifier, a "extreme risk" identifier, and the like. In another example, a score or other value may be associated with a reputation for the network activity, such as a score from <NUM>-<NUM> that ranges from safe to extreme risk. Other metrics, scales, values, or the like for identifying a reputation of a URL, file, device, or the like of the Internet <NUM> may be used and stored in the database <NUM>.

The database <NUM> may also include a category associated with the network activity, such as a category of a URL or file. In general, the category may include an identifier of the type of content included in or associated with the URL or file. For example, a gambling website or URL may be categorized under a "gambling" identifier. Similarly, a website including pornography may be categorized with a "pornography" identifier. Files, such as images, videos, and other multimedia content, known to include explicit images or content may be categorized as "explicit", "adult", "inappropriate for children", and the like. Websites or files known to be safe for children may be categorized as "safe" or "appropriate for all ages". In general, the category associated with a URL or file may indicate the content of any portion of the website or file and may indicate any type of content. Further, the category of a URL or file may be provided by a third party configured to identify the content of websites and files of the Internet <NUM> or may be generated based on analysis of the websites or files conducted by an application server or other computing device. For example, the application server may analyze the Hypertext Markup Language (HTML) of a website to identify particular words of the website and assign a category to the website based on the HTML analysis.

In operation <NUM>, the security platform <NUM> may determine a security rule from the home network <NUM> security policy to be applied to the device from which the request was received based on the obtained reputation and/or category of the network activity included in the request. For example, an Internet request received at modem <NUM> may be provided to security platform <NUM> as discussed above. Security platform <NUM> may access, from the database <NUM>, a reputation and/or category associated with the request received from the modem <NUM>. The security policy associated with the home network <NUM> may include one or more rules based on the reputation and/or category information received from the database <NUM>. For example, the security policy for the home network <NUM> may include a rule set that prohibits access to a URL that has a risk score above <NUM> or a category of "gambling". The security platform <NUM> may compare the received network activity information from the database <NUM> to the rule sets of the security policy for the home network <NUM> to determine if a security action is to be taken on the request. For example, if the reputation of the network activity exceeds the threshold value or the category of the network activity matches a banned category, a security rule of the security policy may define a security action to undertake on the Internet <NUM> request.

Further, the security policy for the home network <NUM> may include different rule sets for the different devices <NUM>-<NUM> of the home network <NUM>. For example, computing device <NUM> may be associated with an adult user of the home network <NUM> and thus may include a first security rule set that allows for accessing adult-oriented websites. Mobile device <NUM> may be associated with a child user of the home network <NUM> and the security policy may include stricter security rules for the device. Thus, the rule set applied by the security platform <NUM> may vary based on the identification of the device associated with the Internet <NUM> request. The security platform <NUM> may therefore determine an identification of the device from which the request was received to determine a rule set from the security policy to apply to the request.

In another example, the request may be received from mobile device <NUM> accessing the Internet <NUM> via wireless network <NUM>. The security application <NUM> transmits the request to security platform <NUM>, including an identification of the mobile device <NUM>. The security platform <NUM> may access the database <NUM> to determine a reputation and/or category of the request. In addition, the security platform <NUM> may access a security policy associated with the mobile device <NUM> (as included in the security policy for the home network <NUM>) and apply the reputation and/or category to the rule sets of the security policy associated with the mobile device <NUM>. In this manner, even when connecting to the Internet <NUM> via a network away from the home network <NUM>, the security policy for the home network <NUM> may be applied to the mobile device <NUM>.

After application of the reputation and/or category of the network activity the security policy for the home network <NUM> and/or device <NUM>-<NUM>, the security platform may determine a security action to execute to the request. The security action may be defined in the rule set or security policy in response to the network activity and information accessed from the database <NUM>. In operation <NUM>, the security platform <NUM> may provide the security action to the device in response to receiving the request from the device. For example, the security platform <NUM> may provide the security action to the modem <NUM>, and more particularly to the security application <NUM> of the modem <NUM>, for application to the network activity. For example, the security action may include blocking access to the requested URL or file. The security application <NUM> may instruct the modem <NUM> to block the request to the Internet <NUM> from the device <NUM> to protect the device from accessing a risky website or file. In some instances, the modem <NUM> may redirect the requesting device <NUM> to a webpage that displays information on the action taken by the modem <NUM>. In another example, the security action may include allowing access, but removing some portion of a displayed website that may exceed a risk score or reputation indication. In some instances, the security action may allow access to the Internet <NUM> based on the request. The modem <NUM> may apply the received security action or otherwise control the access to the Internet <NUM> for the requesting device.

In a similar manner, the security platform <NUM> may provide the security action to the security application <NUM> executed by the mobile device <NUM>. The security application <NUM> may enforce or execute the security action on the requests transmitted by the mobile device <NUM> to block or otherwise monitor the Internet access by the mobile device <NUM>. In some instances, the security action may allow access to the Internet <NUM> based on the request. The security application <NUM> may therefore receive the security action determined by the security platform, through application of the security policy for the home network <NUM> and associated devices <NUM>-<NUM>, and enforce the security policy on the mobile device <NUM>.

In addition to executing the security action, the security application <NUM>, <NUM> may locally store the security action with an indication of the Internet <NUM> access request. For example, the security platform <NUM> may determine a blocking security action for a particular request based on the security policy for the requesting device <NUM> and return the blocking security action to the requesting device. The device <NUM> may store one or more aspects of the request and the returned blocking security action. Additional requests to the same URL or file may then be blocked by the security application <NUM>, <NUM> without transmitting the request to the security platform <NUM> first. In other words, known security actions for particular network activity may be automatically undertaken by the security application <NUM>, <NUM> without further comparison to the security policy for the home network <NUM>. In some instances, the local storage of the security action and request may include a time stamp or other time indicator. Stored security actions that exceed a time threshold may be discarded or removed from local storage such that the particular network activity may again be checked against the security policy by the security platform <NUM>. This may ensure that updates to the security policy are enforced by the security applications <NUM>,<NUM> after expiration of the time limit. The time limit for a security action may be any amount of time, such as a day, a week, <NUM> days, etc..

The security platform <NUM> may therefore provide security features for devices <NUM>-<NUM> of the home network <NUM>, whether those devices connect to the data network <NUM> via the modem <NUM> of the home network <NUM> or via a different network. A security application <NUM>, <NUM> of the modem <NUM> of the home network <NUM> and/or of the devices <NUM>-<NUM> of the network may communicate with the security platform <NUM> to receive security actions for requests to the Internet <NUM> based on a security policy associated with the home network <NUM>. The security policy may be configured via a user interface <NUM> to the security platform <NUM> such that an administrator of the home network <NUM> may monitor and control the security features provided to the network. Further, the security policy may be configured through one interface and apply to each of the devices <NUM>-<NUM> of the home network <NUM>, instead of using multiple, differing security applications, each with their own interface on which policy may be configured. As such, the security platform <NUM> provides a fast and convenient portal through which security policies for multiple devices may be configured and executed.

<FIG> is a block diagram illustrating an example of a computing device or computer system <NUM> which may be used in implementing the embodiments of the components of the network disclosed above. For example, the computing system <NUM> of <FIG> may be the security platform <NUM> discussed above. The computer system (system) includes one or more processors <NUM>-<NUM>. Processors <NUM>-<NUM> may include one or more internal levels of cache (not shown) and a bus controller or bus interface unit to direct interaction with the processor bus <NUM>. Processor bus <NUM>, also known as the host bus or the front side bus, may be used to couple the processors <NUM>-<NUM> with the system interface <NUM>. System interface <NUM> may be connected to the processor bus <NUM> to interface other components of the system <NUM> with the processor bus <NUM>. For example, system interface <NUM> may include a memory controller <NUM> for interfacing a main memory <NUM> with the processor bus <NUM>. The main memory <NUM> typically includes one or more memory cards and a control circuit (not shown). System interface <NUM> may also include an input/output (I/O) interface <NUM> to interface one or more I/O bridges or I/O devices with the processor bus <NUM>. One or more I/O controllers and/or I/O devices may be connected with the I/O bus <NUM>, such as I/O controller <NUM> and I/O device <NUM>, as illustrated.

I/O device <NUM> may also include an input device (not shown), such as an alphanumeric input device, including alphanumeric and other keys for communicating information and/or command selections to the processors <NUM>-<NUM>. Another type of user input device includes cursor control, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to the processors <NUM>-<NUM> and for controlling cursor movement on the display device.

System <NUM> may include a dynamic storage device, referred to as main memory <NUM>, or a random access memory (RAM) or other computer-readable devices coupled to the processor bus <NUM> for storing information and instructions to be executed by the processors <NUM>-<NUM>. Main memory <NUM> also may be used for storing temporary variables or other intermediate information during execution of instructions by the processors <NUM>-<NUM>. System <NUM> may include a read only memory (ROM) and/or other static storage device coupled to the processor bus <NUM> for storing static information and instructions for the processors <NUM>-<NUM>. The system set forth in <FIG> is but one possible example of a computer system that may employ or be configured in accordance with aspects of the present disclosure.

According to one embodiment, the above techniques may be performed by computer system <NUM> in response to processor <NUM> executing one or more sequences of one or more instructions contained in main memory <NUM>. These instructions may be read into main memory <NUM> from another machine-readable medium, such as a storage device. Execution of the sequences of instructions contained in main memory <NUM> may cause processors <NUM>-<NUM> to perform the process steps described herein. In alternative embodiments, circuitry may be used in place of or in combination with the software instructions. Thus, embodiments of the present disclosure may include both hardware and software components.

A machine readable medium includes any mechanism for storing or transmitting information in a form (e.g., software, processing application) readable by a machine (e.g., a computer). Such media may take the form of, but is not limited to, non-volatile media and volatile media and may include removable data storage media, non-removable data storage media, and/or external storage devices made available via a wired or wireless network architecture with such computer program products, including one or more database management products, web server products, application server products, and/or other additional software components. Examples of removable data storage media include Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc Read-Only Memory (DVD-ROM), magneto-optical disks, flash drives, and the like. Examples of non-removable data storage media include internal magnetic hard disks, SSDs, and the like. The one or more memory devices <NUM> may include volatile memory (e.g., dynamic random access memory (DRAM), static random access memory (SRAM), etc.) and/or non-volatile memory (e.g., read-only memory (ROM), flash memory, etc.).

Computer program products containing mechanisms to effectuate the systems and methods in accordance with the presently described technology may reside in main memory <NUM>, which may be referred to as machine-readable media. It will be appreciated that machine-readable media may include any tangible non-transitory medium that is capable of storing or encoding instructions to perform any one or more of the operations of the present disclosure for execution by a machine or that is capable of storing or encoding data structures and/or modules utilized by or associated with such instructions. Machine-readable media may include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more executable instructions or data structures.

Embodiments of the present disclosure include various steps, which are described in this specification. The steps may be performed by hardware components or may be embodied in machine-executable instructions, which may be used to cause a general-purpose or special-purpose processor programmed with the instructions to perform the steps. Alternatively, the steps may be performed by a combination of hardware, software and/or firmware.

Claim 1:
A method for providing security features to a network, the method comprising:
instructing (<NUM>), by a security platform (<NUM>), a routing device (<NUM>) of a wireless network (<NUM>) and a device (<NUM>, <NUM>) in communication with the routing device to each install and activate a security application (<NUM>) configured to communicate with the security platform of a data network (<NUM>);
receiving (<NUM>), by the security platform, from the security application of the device or the routing device, a request to access a public network (<NUM>), different than the wireless network, the request originating from the device;
transmitting (<NUM>), by the security platform, to the security application of the device or the routing device, a security action based on a security rule identified by a parameter of the received request and a security policy for the wireless network, the security action comprising an instruction for processing the request to access the public network;
wherein the security policy includes different rule sets;
wherein the method further comprises before the transmitting (<NUM>):
accessing (<NUM>), by the security platform, based on the parameter of the received request, a database (<NUM>) comprising an entry associating a reputation indicator and a category with the parameter of the received request,
wherein the security rule is identified by comparing (<NUM>), by the security platform, a device identification, the reputation indicator and the category associated with the parameter of the received request to at least one security rule of a plurality of security rules of the security policy, the at least one security rule comprising a device identification, the reputation indicator and the category as an input and the security action as an output.