COLLECTION DEVICE, PROGRAM PRODUCT OF A MOBILE DEVICE, AND METHOD FOR A SECURITY ANALYSIS OF A COMPU

专利摘要:
The present invention relates to a collection device for collecting security analysis data from a computer system. The collecting device comprises a communication means for sending said security analysis data to a mobile device. In further aspects, the present invention relates to a program product of a mobile device for processing the security analysis data and presenting related information on a display of the mobile device, and method for performing a security analysis of the computer system, and a use .
公开号:BE1025948B1
申请号:E2018/5377
申请日:2018-06-06
公开日:2019-08-20
发明作者:Vito Rallo
申请人:Pwc Enterprise Advisory Cvba；
IPC主号:

专利说明:

COLLECTION DEVICE, PROGRAM PRODUCT OF A MOBILE DEVICE, AND METHOD FOR A SECURITY ANALYSIS OF A COMPUTER SYSTEM
Technical area
The present invention relates to a collection device for collecting security analysis data from a computer system. The collecting device comprises a communication means for sending said security analysis data to a mobile device. In further aspects, the present invention relates to a program product of a mobile device for processing the security analysis data and presenting related information on a display of the mobile device, and a method for performing a security analysis of the computer system.
Background
Computer security is the protection of computer systems against theft or damage to the software or information thereon, as well as against disruption or deception of the services they offer. Damage can result from various sources such as, for example, accidental abuse, backdoor methods, viruses, worms, Trojans, keyloggers, and hidden eavesdropping devices.
Computer security analysis can be performed by executing software or by human intervention. This first usually requires the installation of security analysis software on the computer system to be analyzed, and requires connectivity of the computer system with an external device to obtain information regarding newly discovered threats. However, if the computer system itself is not switched on to obtain information about newly discovered threats, or if the installation of security analysis software on the computer system is not possible, the analysis cannot be performed properly. On the other hand, human intervention requires training by specialists and can therefore be very expensive.
US 9,654,496 describes a device that can detect a suspicious activity. The device can automatically obtain a suspicious object from a client device that is associated with the suspicious activity and that is based on detecting the suspicious activity. The suspicious object can be an object that is possibly associated with the suspicious activity. The device can determine that the suspicious object is harmful. The device can perform an action based on the provision that
BE2018 / 5377 the suspicious object is harmful. US 9,654,496, however, is not flexible in its use.
US 8,793,795 describes a forensic acceleration engine of a computer intended to speed up the forensic analysis process. It is a device for use with an analysis device for analyzing data on a suspicious computer device, and comprises a first interface for connection to the suspicious computer device, a second interface for connection to the analysis device, and a processing unit that is programmed for reading data from the suspicious device via the first interface, performing analysis on the data, sending the data to the analysis device via the second interface, and sending results of the analysis to the analysis device via the second interface. With a view to speeding up forensic analysis, the US 8,793,795 lacks many of the features needed for flexible use, and it is also far too complex.
US 2012/0324067 describes a managed Universal Serial Bus (USB) service capacity configured to use a mobile computing device (e.g., a smartphone or other suitable mobile computing device) to support a series of services for a computer (e.g., a desktop, a laptop, and the like) that can connect to the mobile computing device via a USB connection. The managed USB service capacity allows local and / or remote control of the mobile computing device to operate in various USB device classes, so that the mobile computing device can provide various managed USB services for the computer via the peripheral connection. In this way, the mobile computing device can be dynamically configured to act as one or more of a network interface, a virtual private network (VPN) client, a smart card, a serial console, a mass storage device, a booting device, and the like.
US 2012/0324067 does not describe the use of the USB service capacity for security analysis. However, if USB service capacity were used for that, security analysis software would run from the mobile computing device. The latter can therefore not be disconnected or removed during the collection of security analysis data from the user's computer system. Therefore, the mobile computing device cannot be used to its full capacity, since some of its resources are reserved for the security analysis software.
BE2018 / 5377
US 2014/0115487 describes an intermediate interface system for remote service of a computer in a local customer system by a remote representative system even if the local customer system has no network connection with the remote representative system. The intermediate interface system includes a smartphone and a dongle. The dongle connects video output and inputs of the keyboard and mouse of the local customer system with the smartphone. The smartphone wirelessly connects the dongle with the remote representative system. The representative system thus displays the video signal from the local customer system for analysis and transmits signals from the keyboard and mouse to the local customer system in response without requiring a network connection between the local customer system and the remote representative system.
The method described in US 2014/0115487 is based on the intermediate interface system for operating the local customer system via the remote representative system. The transmission of a large amount of data to and / or from the remote representative system can make the analysis or service slow, expensive, or even impossible to perform. Moreover, since the connection is based on the smartphone that wirelessly connects the dongle to the remote representative system, the smartphone cannot be disconnected or removed during the analysis or service. Therefore, the smartphone cannot be used at full capacity, since some of its resources are reserved for the wireless interface between the dongle and the remote representative system.
The present invention has for its object to solve at least some of the above problems.
Summary of the invention
In a first aspect, the present invention provides a collection device for a security analysis of a computer system, as described in claim 1.
In a second aspect, the present invention provides a program product of a mobile device for security analysis of a computer system, as described in claim 17.
In a third aspect, the present invention provides a method for a security analysis of a computer system, as described in claim 21.
In a fourth aspect, the present invention provides a use according to claim 25.
BE2018 / 5377
The advantage of the present invention is the flexible and orthogonal addressing of the collection device or target, which offers flexibility and user-friendliness, combined with general reporting without interference and with a single access point of security analysis data. The flexibility lies in the fact that the security analysis data is sent to a mobile device. The user can therefore get the security analysis data through a mobile device such as a smartphone, laptop or tablet, with which most users are much more familiar than a separate security device, and therefore prefer the user as a means of interaction. The invention therefore describes the provision of a collection device that acts as an intermediary between the computer system and the mobile device, rather than attempting to cause the mobile device to interact directly with the computer system. Such direct interaction is problematic for various reasons. First and foremost, for general reporting of security analysis data, it is important to address a broad population of different computing devices in an essentially identical manner. In particular, the applicant has found that it is impracticable or extremely impractical for the mobile device, preferably provided with a special app for security analysis, to communicate directly with the low-level hardware of the computer system, in particular in the case of mobile devices running closed-source operating systems. Specifically, having a mobile device directly communicate with the computer system requires at least installing system-dependent drivers on the computer system and / or requires the configuration of trust or explicit exchange parameters on the computer system, such as explicit identification of the mobile device on the computer system. This can be partially bypassed using a rooted or jailbroken mobile device, but this is not acceptable to most users. By introducing a collection device between the computer system and the mobile device, the invention provides a general approach that allows bypassing the installation of drivers or configuring parameters on the computer system, while it can also be used with ordinary mobile devices that are not jailbroken or be rooted. By using a collection device according to the present invention, it is relatively easy, according to a preferred embodiment, to provide a security analysis app on the mobile device that meets all security requirements, using a predefined and population protocol stack such as Bluetooth which is supplied with the control system of the mobile device to communicate with the predetermined and therefore predictable second communication means that are present in the collecting device. The collection device uses, on the other hand, a first one
BE2018 / 5377 communication means that is different from the second communication means to interact with the computer system, the first communication means being able to be chosen to improve general addressing of a wide variety of computer systems, e.g., by complying with HID device requirements, where the installing drivers and / or configuring parameters on the computer system is bypassed.
It should further be noted that the use of the mobile device together with the collection device, instead of allowing the mobile device to interact directly with the computer system, may offer further advantages. In particular, it allows for the limited power / battery resources of the mobile device to be taken into account by flexibly downloading the power consuming task of collecting the security analysis to the collecting device, which must not be mobile with respect to the computer system and at is preferably connected to the computer system with a wired connection. This flexible arrangement is also provided so that a single access point to the computer system is provided. It is well known that computer systems can be protected against external access to internal security-related information. A single access point provided by the collection device, which acts as an intermediary in the chain between the computer system and the mobile device, therefore allows maximum robustness for security present in the computer system. Finally, the circuit between the computer system, the collecting device and the mobile device is such that the communication means / technology between the computer system and the collecting device is different from that between the collecting device and the mobile device. Such an orthogonal approach reduces the chance of interference, and moreover allows a double-blind connection approach with regard to security analysis, wherein the mobile device may or may not be computer system diagnostic and vice-versa. This is particularly advantageous when a certain degree of privacy and / or anonymization is desirable (see, e.g., fast scan mode as described in this document), thereby preventing the computer system and the mobile device from identifying each other, e.g., on the same Ethernet - or the same WiFi network, which can lead to an undesirable track for the security analysis mentioned.
The advantageous combination of said collecting device and said mobile device according to the present invention differs significantly from the security device according to US 9,654,496. US 9,654,496 in particular describes a device comprising a communication interface, but does not provide a description
BE2018 / 5377 regarding the use of said communication interface for sending security analysis data to another device. Moreover, US 9,654,496 does not describe said further device which is a mobile device, and therefore does not allow the user-friendliness offered by the present invention. Moreover, US 9,654,496 does not describe said second communication means different from said first communication means, and therefore does not permit said interference-free and / or double-blind and / or orthogonal operation.
Moreover, the invention differs significantly from the forensic computer instrument according to US 8,793,795. Since US 8,793,795 is directed to the different purpose of speeding up the forensic analysis process, all connections are assumed to be wired, and no second communication means other than the first communication means is described. Similarly, no use of a mobile device is described.
The present invention is explained in more detail in the detailed description. In addition, various preferred embodiments and various related advantages are discussed.
Description of the figures
Figure 1 shows a schematic overview of devices and communication channels that can be used in a preferred embodiment of the present invention.
Figure 2 shows a block diagram of a preferred embodiment of the method of the present invention.
Detailed description of the invention
The present invention relates to a collection device, a program product of a mobile device, and a method for security analysis of a computer system. These three aspects are summarized in the respective paragraph above. In this section, the present invention is explained in more detail and preferred embodiments and various related advantages are discussed.
Unless defined otherwise, all terms used in the description of the invention, including technical and scientific terms, have the meaning generally understood by a person skilled in the art in the field to which this invention
BE2018 / 5377. Furthermore, the definitions of the terms are included to better understand the description of the present invention.
In this document, the term first device is an umbrella term that refers to a first class of devices including the collection device. Furthermore, the term second device is an umbrella term that refers to a second class of devices including the mobile device. Mobile device as used herein refers to any portable computer device. Examples of mobile devices include a smartphone, a smartwatch, a laptop computer, a tablet computer, some portable devices, and the like.
The terms computer system and purpose are used interchangeably in this document.
As used herein, the following terms have the following meaning:
One, the and the as used herein refer to both the singular and the plural, unless the context indicates otherwise. A compartment refers, by way of example, to one or more than one compartment.
Include, including and including and consisting of as used herein, are synonymous with containing, containing or containing and are inclusive or open terms specifying the presence of what follows, for example, a component and excluding the presence of additional, non-named components, features , elements, parts, steps, which are well known in the art or described therein, do not matter.
Communication as used herein includes some analog or digital data communication between computer devices. Communication can be wired or wireless. Communication is not limited by the protocol used. A non-limitative list of communication technologies includes 2G, 3G, 3G +, 3GPP, 4G, 4G +, 5G, 6LowPAN, Bluetooth, Bluetooth 4.0, Bluetooth 4.1, Bluetooth 4.2, Bluetooth 5, Bluetooth Low-Energy, CDMA, CDMA2000, Cellular, Dash7, EDGE, EDGE Evolution, Ethernet, EV-DO, Flash-OFDM, GPRS, GSM, HIPERMAN, HSPA, iBurst, IEEE 802.11a, IEEE 802.11ac, IEEE 802.11b, IEEE 802.11g, IEEE 802.11η, IEEE 802.15.4, IEEE 802.15.4-2006, IEEE 802.16, IEEE 802.16-2009, IEEE 802.16m, IEEE 802.20, Internet, IPv4, IPv6, LAN, LoRaWAN, Low Rate WPAN, LTE, NarrowBand-IoT, Near Field Communication, Zero, RFID, RTT, Sigfox, Thread, UMTS, UMTS W-CDMA, UMTS-TDD, USB, UWB, WAN, Weightless, Wi-Fi, WiMAX, Wireless USB, WLAN, WWAN, ZigBee, and Z-Wave.
BE2018 / 5377
The abbreviation USB as used herein refers to Universal Serial Bus, a standard in the industry for connection, communication and power supply between computers and electronic devices. The standard defines interconnected USB ports and USB connectors. A non-exhaustive list of examples of USB standards includes the USB 2.0, USB 3.0, and USB 3.1 standards. A non-exhaustive list of examples of USB formats includes the standard, mini and micro formats.
Bluetooth as used herein refers to a wireless technology standard for exchanging data over short distances. Bluetooth may or may not require the pairing of devices before communication can be established between the devices. To the extent that pairing is required in a particular Bluetooth standard used in a particular embodiment of the present invention, it is implicitly assumed that such pairing is performed between the devices to allow communication.
Wi-Fi as used herein refers to any wireless local area network product based on the Institute of Electrical and Electronics Engineers' 802.11 standards. Wi-Fi can be used to establish a connection from one device to the internet, a local network such as a campus network, or to another device.
Wireless mobile telecommunications technology as used herein refers to any communication standard for establishing mobile internet access. Examples of wireless mobile telecommunications technology include the third generation (3G), the fourth generation (4-G), and the fifth generation (5-G).
User input device as used herein refers to a device for supplying input by a user to a computer device. The input is not limited by modality and may include mechanical movement, sound, images, and the like. The input can be discreet and / or continuous. The input is also not limited to the number of degrees of freedom. The input can be direct or indirect. When input is supplied over a position or a position change, for example, to move an arrow on a screen, the input can be absolute or relative. A non-limiting list of examples of user input devices includes a keyboard, a computer mouse, a touch pad, a touch screen, a camera, a scanner, a joystick, a microphone, a light pen, a trackball, a projected keyboard, a game controller, a card reader, and of such.
In a first aspect, the present invention provides a collection device for a security analysis of a computer system. The collecting device comprises a
BE2018 / 5377 first communication means suitable for communicating with the computer system, a second communication means that may be the same, but preferably different from the first communication means, the second communication means suitable for communicating with a mobile device, and a non-temporary storage medium. The non-temporary storage medium comprises computer-executable instructions intended for generating security analysis data. The collection device is configured, upon establishing communication with the computer system via the first communication means, to load the computer-readable instructions from the non-temporary storage medium to execute the computer-executable instructions to collect security analysis data from the computer system and send the security analysis data to a mobile device via the second communication means.
In a preferred embodiment, any or any combination of the steps performed by the collection device performed is triggered by the mobile device or during reporting to the mobile device by sending data thereto. Such an advantage is not offered by U.S. Pat. No. 9,654,496. It provides a user of said computer system with control over the collection device and the actions performed by said collection device. Such a check is not offered by U.S. Pat. No. 9,654,496, which leads to problematic situations, for example, in cases where the computer system is not cooperative and / or advanced. In such cases, according to U.S. Pat. No. 9,654,496, the user of the computer system must take control of the security device itself to control the actions performed, which may be undesirable and / or unfeasible. And even if the user were allowed to take control of said security device, the security device that is a single entity leads to the practical problem that it must be available and that it must be connected to the computer device through the full operation of generating security analysis data . This is in contrast to the present invention, wherein the security device is advantageously split into a collection device and a mobile device, where control-related functionality is implemented in the mobile device, while the actual functions required for performing the task in question are implemented in the collection device. In other words, the present invention provides the user of the computer device with a remote control over the actions performed by the security device,
BE2018 / 5377 wherein the remote control is preferably implemented as an app that runs on the user's smartphone. The unclear nature of this provision can be understood from the fact that U.S. Pat. No. 9,654,496 neither points to offering the user of the computer device control over the collection of the security analysis data, nor describes any hint with with regard to any form of remote control of said security device.
Another advantageous aspect of the invention is that, in a preferred embodiment, the collection of security data is completely triggered by the user, and is not triggered by external screening, as is the case in an administrative security approach. In particular, the US patent does not describe or give any hint in the direction of performing actions at the request of the user.
Another advantageous aspect of the invention relates to the fact that the security analysis data is not sent to any remote server to which, for example, an administrator has access, but rather is sent to the mobile device. This indicates the user centered nature of the security analysis being performed. Rather than having a security device analyzing security of a computer device, regardless of the needs of the user, and reporting to the security device, the invention provides a solution where the user sits in the driver's seat, deciding whether or not a security analysis is needed, and where he is moreover the person who receives the result of this analysis. In some embodiments, this may relate to privileged access to this information, where only the user may know the result of the security analysis, or, more specifically, only the user may know that the security analysis is being performed. Consequently, the solution offered by the invention lowers the threshold for user to start a security analysis. This offers the user a simple solution whereby a user who is not sure about the integrity of his computer device can assess the integrity independently of a third party, so he / she does not need a motivation as to why such a check would be necessary and / or , more importantly, allowing him / her to decide on further action by him / herself when the security analysis shows that his / her computer device may be damaged.
In a preferred embodiment, said step is to load said computer executable instructions and said execution
BE2018 / 5377 triggered by a user-selected instruction from said mobile device via said second communication means, wherein preferably said user of said mobile device is also a user of said computer system. This offers the advantage of both the start of the security analysis and the eventual reporting of the security analysis being available to the mobile device. This leads to more user-friendliness, with the mobile device as front-end for the user, but also offers greater control for the user over the information flow, because the computer system is not scanned without the user knowing, as, for example, the case in U.S. Patent No. 9,654,496.
In a preferred embodiment, said collecting device is a dongle, wherein preferably a largest dimension of said collecting device is not larger than 150 mm, more preferably wherein an outer surface of said collecting device is fully accommodated in a volume with dimensions 150 mm X 50 mm x 50 mm. Such a dongle is easy, easy to carry along with the mobile device, and easily fits any computer system to be analyzed, even if the computer system is in a narrow space. This leads to a use of the collecting device that is fundamentally different from that of a device according to US Pat. No. 9,654,496, which does not allow the collecting device to be carried by the user.
In a preferred embodiment, said security analysis data is not stored on any of said computer system and said collection device; preferably not stored on any of said computer system, said collection device, and said mobile device. Such an embodiment may or may not relate to fast scan mode. It advantageously provides more control for the user, whereby the user can carry out a diagnosis himself without fear of leaks of security data or other data via any of the computer system and the collection device and / or the mobile device. This lowers the threshold for conducting the security analysis, which leads to an incentive to perform security checks more frequently, which leads to a generally increased security.
In another preferred embodiment, said computer-executable instructions include a plurality of self-analysis instructions, said self-analysis instructions preferably being scripting language instructions for execution
BE2018 / 5377 by said computer system for performing said security analysis as a self-analysis, and said step of collecting security analysis data from the computer system comprises the sub-steps, or preferably consists of:
- transferring, by said collection device, said plurality of self-analysis instructions to said computer system via said first communication means;
- having said computer system execute said plurality of self-analysis instructions for performing said security analysis as said self-analysis, which yields said security analysis data that is a self-analysis result;
- receiving, by said collection device, said self-analysis result.
Thus, in such an embodiment, the computer-executable instructions include both instructions for the collector to execute, on the one hand, and self-analysis instructions to be transmitted to said computer system, on the other. The instructions executable by the computer may relate to establishing communication between the collection device, preferably a dongle, and the computer system. In addition, the computer-executable instructions may involve opening an application that can receive self-analysis instructions, preferably a security-related application and / or diagnostic application and / or task automation framework and / or configuration management framework and / or command line shell application on the computer system, such as PowerShell for Microsoft, Linux or OS X. Such an application that can receive self-analysis instructions can then receive the plurality of self-analysis instructions from the collection device and can perform the security analysis to execute these self-analysis instructions. The major advantage of this is that the tasks performed by the collection device are limited to merely handing instructions, rather than performing these tasks, which can be intrusive and may include security-related information that may include a particular security mechanism and / or threat detection mechanism. triggering in the computer system and may block further activity of the collection device. Accordingly, the embodiment advantageously provides a means for preventing the computer system from being alerted by the activity of the collection device, by delegating the actual security analysis to the computer device in a transparent manner based on self-analysis instructions.
BE2018 / 5377
In a related preferred embodiment, said plurality of self-analysis instructions relates to man-interpretable instructions, preferably script language instructions and / or source code instructions, wherein said computer device comprises a display, and wherein said step of transferring the said plurality of self-analysis instructions by said collection device to said computer system includes transferring a visualization-related instruction intended for said computer system to request said computer system to display at least one of said plurality of self-analysis instructions during and / or after said execution of said plurality of self-analysis instructions, preferably prior to requesting said computer system to display said plurality of self-analysis instructions in real time after they have been executed by said computer system. This is advantageous because it provides visual feedback to the user regarding the activities involved in the security analysis. This can be useful to convince the user to perform a security analysis, to reduce his / her reasonable fear that his / her computer system may be damaged by a certain hidden process.
In a preferred embodiment, said first communication means relates to a HID protocol-based communication in which said computer system acts as a host and in which said collecting device emulates an HID device, said collecting device preferably an HID keyboard or an HID -joystick emulates. Such an embodiment is advantageous because it allows a driverless connection to the computer system, i.e. a connection that does not require installation of device-specific software on the computer system, but rather can immediately cooperate with the collection device. This is because most operating systems such as Windows, OS X and Linux can communicate with HID devices as standard. Moreover, this embodiment is advantageous in that the choice of communication based on HID is particularly suitable for the purpose of the present invention, since HID devices do not usually trigger the many security mechanisms that are present in typical computer systems. By choosing HID, a security mechanism of the computer system is therefore prevented from tagging the collection device as suspicious and / or blocking the security analysis.
In a related preferred embodiment, said first communication means relates to an HID protocol based HID device, said collecting device having an HID keyboard or a HID joystick
BE2018 / 5377; wherein said transfer of said plurality of self-analysis instructions for transferring and sequence of HID instructions representing said plurality of self-analysis instructions from said collection device to said computer system, and wherein said receiving of said self-analysis by said collection device relates to receiving one or more HID instructions representing said self-analysis. In such an embodiment, from the point of view of the computer system, the collection device may be equivalent to a virtual security expert typing the instruction into the computer system. Hereby, feedback from the computer system to the collection device is also supported, even in the case of a HID keyboard, where such feedback may be encoded, for example, by modulating the caps lock on (and / or shift lock on) signal as a variation of zeros and ones over time. Such an embodiment advantageously combines the advantages of emulating a HID device and having the security analysis performed as a process running on the computer system rather than the collection device, thereby both chances of the computer system labeling the collection device as suspicious and / or block the security analysis.
In a related further preferred embodiment, the first communication means satisfies any or any combination of the following: USB HID, Bluetooth HID, Serial HID remote control receiver, ZigBee HID, HID over I ² C, HID over GATT.
In various embodiments, the collection device may comprise a processor, e.g., a cisc processor, a rise processor, microprocessor, or microcontroller.
In a preferred embodiment, the collection device is further configured for:
in particular, in establishing communication with the computer system via the first communication means, determining a hardware and operating system specification of the computer system, and sending the determined hardware and operating system specification to the mobile device via the second communication means ;
- upon establishing communication with the mobile device over the second communication means, loading downloading by the mobile device of updated computer-executable instructions from a remote server, preferably taking into account said particular hardware and operating system specifications, the said download preferably
BE2018 / 5377 takes place via another means of communication that is different from said first and said second means of communication,
- receiving said updated computer-executable instructions from the mobile device via the second communication means, and
- storing said updated computer-executable instructions on the non-temporary storage medium.
This is advantageous because it allows you to perform the security analysis based on up-to-date information. Hereby, the communication means that were to connect to the remote server are not searched in the computer system, which would be inappropriate in particular in cases where the system may be damaged and therefore preferably not connected to any network or any other device. then said collection device. These communication means are rather provided by the mobile device. In an embodiment in which the hardware and operating system specifications are determined in a first step, this furthermore leads to the execution of the security analysis according to computer-executable instructions tailored to the particular computer system, which can contribute to a more reliable security analysis.
In a preferred embodiment, the first communication means is a wired communication means capable of supplying power to the collection device in establishing communication with the computer system. In an even more preferred embodiment, the first communication means is a Universal Serial Bus (USB) connector. This USB connector can be of any USB standard or of any USB format.
In a preferred embodiment, the second communication means is a wireless communication means. This is advantageous when the collecting device is attached to the computer device at a location where it is difficult to reach. In a still more preferred embodiment, the second communication means is a Bluetooth communication module.
In a second aspect, the present invention provides a program product of a mobile device for security analysis of a computer system. The program product of the mobile device comprises a plurality of instructions executable by the mobile device for execution on a mobile device. The mobile device comprises a processor for executing the instructions executable by the mobile device, a display, a user input device for selecting an option presented on the display, and a third communication means suitable for communicating with the second communication means of the
BE2018 / 5377 collecting device according to the first aspect of the present invention. The program product of the mobile device includes instructions for receiving security analysis data from the collection device via the third communication means, processing the received security analysis data that results in a first diagnosis, and presenting information related to the first diagnosis on the display of the mobile device.
In a preferred embodiment, the third communication means of the mobile device is a wireless communication means. In an even more preferred embodiment, the third communication means is a Bluetooth communication module.
In a third aspect, the present invention provides a method for security analysis of a computer system. The method requires a collection device and a mobile device. The method comprises the following steps:
- allowing communication between the collection device and the computer system,
- collecting security analysis data about the computer system on the collection device,
- allowing communication between the collection device and the mobile device,
- sending the security analysis data from the collection device to the mobile device,
- processing the security analysis data on the mobile device resulting in a first diagnosis, and
- presenting information regarding the first diagnosis on the mobile device.
The security analysis data is an intermediate form of data that consists of any information that can be retrieved on the computer system. The security analysis data is then processed until the first diagnosis. A person skilled in the art will know that the security analysis data may be any data in the spectrum between the information that can be retrieved directly on the computer system and the first diagnosis. The security analysis data can therefore include one or more from the following list:
- any raw data that can be retrieved directly on the computer system,
the first diagnosis, and
BE2018 / 5377
- a processed form of intermediate data, derived from information that can be retrieved on the computer system, and which requires further processing to obtain the first diagnosis.
In a preferred embodiment, the collection device comprises a full scan operation mode and a fast scan operation mode. In the full scan operation mode, the security analysis data comprises raw data that can be retrieved on the computer system and / or a processed form of intermediate data. In the fast scan operation mode, the security analysis data includes the first diagnosis.
The present invention is advantageous for various reasons. The collection device includes computer-executable instructions for generating security analysis data about the computer system and also collects this data. During this operation, the mobile device must not be present near the collection device or the computer system. During this operation, the mobile device must not be in communication with the collection device. Sources of the mobile device such as processor time or memory are not used during this operation. The mobile device can be moved to a different location and can be used, without limiting the said sources, for other functionalities such as searching for information on the internet or making a phone call, for example. Only when the collected data is sent from the collection device to the mobile device for processing, may the mobile device be in communication with the collection device to allow the transmission. Then, during processing of the security analysis data that results in the first diagnosis, the mobile device can be remotely remote from the collection device or the computer system.
Collecting devices according to preferred embodiments of the first aspect of the present invention, which include a USB connector and a Bluetooth communication module, are known in the art as dongles. In what follows, we refer to the collection device as a dongle, the first communication means as a USB connector, the second communication means as a Bluetooth communication module, and the third communication means as a Bluetooth communication module. It should be noted, however, that these terms are used only to indicate a preferred embodiment of the present invention, and should not be interpreted as a limitation. In the following, a dongle may refer to any collection device according to the first aspect of the present invention, USB connector and / or USB port may
BE2018 / 5377 refer to any communication means suitable for communication between the computer system and the collection device, and Bluetooth communication module may refer to any communication means suitable for communication between the collection device and the mobile device.
Figure 1 shows a schematic overview of the devices (1, 3, 4, 5) and wireless communication channels (7, 8, 9, 10) that can be used in a preferred embodiment of the present invention. A security analysis of a computer system (1) comprising one or more USB ports (2) is desired. A dongle (3) is provided for this purpose. The dongle (3) comprises a USB connector for connection (6) in a USB port (2) of the computer system (1). When connected, the dongle (3) receives power from the computer system (1). The dongle (3) further comprises a Bluetooth communication module for communicating (7, 8) with a mobile device (4). The dongle (3) also includes a non-temporary storage medium comprising computer-executable instructions for generating security analysis data on the computer system (1). After loading and executing the computer-executable instructions, the security analysis data is collected on the dongle (3) and sent (8) to the mobile device (4) via the Bluetooth communication module of the dongle (3).
The mobile device (4) may comprise a non-temporary storage medium for storing a program product of the mobile device. The program product of the mobile device comprises a plurality of instructions executable by the mobile device. The mobile device (4) further comprises a processor suitable for executing the instructions executable by the mobile device, a display, a user input device for selecting an option presented on the display, and a Bluetooth communication module. The program product of the mobile device includes instructions for receiving (8) the security analysis data from the dongle (3) via the Bluetooth communication module of the mobile device (4), processing the received security analysis data that results in a first diagnosis, and proposing of information related to the first diagnosis on the display of the mobile device.
The dongle (3) includes computer-executable instructions for generating security analysis data on the computer system (1) and also collects this data. During this operation, the mobile device (1) must not be present near the dongle (3) or the computer system (1). During this operation, the mobile device (4) must not be in communication (7, 8) with the dongle. Sources of the
BE2018 / 5377 mobile device (4) such as processor capacity or memory are not used during this operation. The mobile device (4) can be moved to a different location and can be used, without limiting the said sources, for other functionalities such as searching for information on the internet or making a phone call, for example. Only when the collected security analysis data is sent (8) from the dongle (3) to the mobile device (4) for processing, can the mobile device (4) be present near the dongle (3) to allow the transmission. Subsequently, during processing of the security analysis data resulting in the first diagnosis, the mobile device (4) can be remotely spaced from the dongle (3) or the computer system (1).
In one embodiment, the program product of the mobile device further comprises instructions executable by the computer device for giving a start option on the display of the mobile device (4). Upon selection of the start option with the user input device of the mobile device (4), a start signal (7) is sent from the mobile device (4) to the dongle (3). The reception of the start signal with the Bluetooth communication module of the dongle (3) then triggers the loading of computer-executable instructions from the non-temporary storage medium of the dongle (3) and its execution for obtaining the security analysis data.
In a preferred embodiment of the present invention, the dongle (3) further comprises a processor, and the computer-executable instructions are executed on the processor of the dongle (3) for emulating one or more user input devices to obtain the desired security analysis data. In an alternative embodiment of the present invention, the computer system (1) comprises a processor of the computer-executable instructions are loaded from the non-temporary storage medium of the dongle (3) and are executed by the processor of the computer system (1) . In yet another embodiment of the present invention, the dongle (3) comprises a first processor and the computer system (1) comprises a second processor, and part of the computer-executable instructions are executed by the first processor and part of the computer-executable instructions executed by the second processor.
In a preferred embodiment of the present invention, the mobile device (4) further comprises a Wi-Fi module and / or a wireless mobile telecommunications technology module suitable for communicating (9, 10) with
BE2018 / 5377 a remote server (5). Furthermore, the program product of the mobile device in this embodiment comprises instructions for sending (9) the security analysis data from the mobile device (4) to the remote server (5). The security analysis data is then processed on the remote server (5), resulting in a second diagnosis. The second diagnosis is then sent (10) from the remote server (5) to the mobile device (4). The program product of the mobile device includes instructions for receiving the second diagnosis. It also includes instructions for presenting information related to the second diagnosis on the display of the mobile device (4) upon receipt.
If the processing of the security analysis data is previously involved and requires a large amount of processing time, preferably with regard to a full scan mode, it may be advantageous to perform this processing on a more suitable device, such as a remote server (5). This remote server (5) may, for example, also comprise a database comprising a large amount of information for performing a more detailed security analysis, wherein the large amount of information for performing a more detailed security analysis is not suitable for storage on the non-secure temporary storage medium of the mobile device (4).
In a preferred embodiment of the present invention, the program product of the mobile device further comprises instructions for selecting one or more recovery options from a recovery option list based on the first and / or second diagnosis. The restore option list may include an update option for performing a software update on the computer system. The recovery option list can also include a second opinion option only if a first diagnosis has been made. The recovery option list may further include a transmission option for sending recovery information regarding the security analysis data, which may include all or part of the security analysis data, to a third party service. The third-party service can provide a human interpretation of the recovery information. The third-party service can also provide a third diagnosis based on a computer-implemented method for processing the recovery information. The restore option list may further include a contact option for contacting a specialized service. The contact can be established by telephone. The contact can also be established by automatically filling in and sending an online form of the specialized service by the program product of the mobile device. Based on the first and / or second diagnosis, a stop function can also be proposed, for example if no violation of the security of the computer system was detected. It
BE2018 / 5377 program product of the mobile device may also include instructions for presenting the selected restore options on the display of the mobile device (4) as well as instructions for triggering the proposed restore option upon selection of the proposed option with the user input device of the mobile device device (4).
Usually, users who request a security analysis of their computer system are not only aware of potential threats, but also of a recovery tool to resolve these potential threats. It can therefore be advantageous to propose a recovery means to the user when a threat is detected. This can save time and costs for the user to get a suitable repair tool.
In a preferred embodiment, the dongle (3) is configured to store the collected security analysis data on its non-temporary storage medium, to fully or partially load the security analysis data upon receipt of a transmission request from the mobile device (4), and to send the loaded full or partial security analysis data to the mobile device (4).
This is advantageous because it can perform the security analysis during multiple separate executions of the computer-executable instructions. It is furthermore advantageous because the security analysis data will also be available after, for example, an unexpected power failure, or when the mobile device is spaced from the dongle (3) or the computer system (1) for a longer period and the computer system was rebooted. It may also be advantageous to have different pieces of partial security analysis data sent at different times, for example upon request of a specific piece by the program product of the mobile device on the mobile device (4). This request can be triggered by the program product of the mobile device itself, or by the remote server (5), for example when generating the second diagnosis. Sending only the relevant pieces of the security analysis data can result in less sent data in general, which limits the costs and time to obtain the first and / or second diagnosis.
In a preferred embodiment, the dongle (3) can determine a hardware and operating system specification of the computer system (1), and send the determined hardware and operating system specification (8) to the mobile device (4). The determined hardware and operating system specification can be part of the
BE2018 / 5377 security analysis data. This can also be sent separately from the security analysis data.
This is advantageous because a hardware and operating system specification can include important information for performing a security analysis. It may also be important to assess whether the non-temporary storage medium of the dongle (3) includes computer-executable instructions suitable for the computer system (1) under investigation. It may also be important to propose suitable software updates for the computer system and offer them through the recovery options.
In a preferred embodiment of the present invention, the dongle (3) can receive updated computer-executable instructions from the mobile device (4) and store the updated computer-executable instructions on the non-temporary storage medium. The program product of the mobile device then includes instructions for sending (7) the updated computer-executable instructions from the mobile device (4) to the dongle (3) via their respective Bluetooth communication modules. The program product of the mobile device may further include instructions for downloading the updated computer executable instructions from a second remote server. The program product of the mobile device can also obtain (10) updated computer executable instructions from the remote server (5) capable of generating the second diagnosis.
This is advantageous because it allows an update of the computer-executable instructions on the dongle (3). This may be required if the instructions are out of date. This may also be required if the old computer-readable instructions are not suitable for a hardware and / or operating system specification of the computer system (1) under investigation. This may be further required if further analysis is desired during the processing of the security analysis data on the remote server (5) and the old computer-executable instructions do not include the required instructions for further analysis.
In a further aspect, which is not intended to limit the invention in any way, the invention relates to the following points 1-15.
A collection device for security analysis of a computer system, the collection device comprising:
- a first means of communication suitable for communicating with the computer system,
BE2018 / 5377
- a second communication means, which can be the same or different from the first communication means, which is suitable for communicating with a mobile device,
- a non-temporary storage medium comprising computer-executable instructions for generating security analysis data, wherein the collecting device is configured for, when establishing communication with the computer system via the first communication means:
- loading the computer-executable instructions from the non-temporary storage medium for executing the computer-executable instructions,
- collecting security analysis data from the computer system, and
- sending the security analysis data to the mobile device via the second communication means.
2. Collection device according to item 1, wherein the first communication means is a Universal Serial Bus connector and wherein the second communication means is a Bluetooth communication module.
3. Collection device as claimed in any of the items 1 and 2, wherein the collection device comprises a processor and wherein the collection device is configured to emulate one or more user input devices for collecting said security analysis data.
Collecting device for a security analysis of a computer system according to one of points 1 to 3, wherein the collecting device is further configured for, when establishing communication with the computer system via the first communication means:
- storing the collected security analysis data on the non-temporary storage medium,
- receiving a transmission request from the mobile device via the second communication means,
- the full or partial loading of the stored security analysis data from the non-temporary storage medium, and
- sending the loaded full or partial security analysis data to the mobile device via the second communication means.
BE2018 / 5377
Collecting device for a security analysis of a computer system according to any of the points 1 to 4, wherein the collecting device is further configured for, when establishing communication with the computer system via the first communication means:
- determining a hardware and operating system specification of the computer system, and
- sending the determined hardware and operating system specification to the mobile device via the second communication means.
Collecting device for a security analysis of a computer system according to one of points 1 to 5, wherein the collecting device is further configured for, when establishing communication with the computer system via the first communication means:
- receiving updated computer executable instructions from the mobile device via the second communication means, and
- storing said updated computer-executable instructions on the non-temporary storage medium.
Program product of a mobile device for security analysis of a computer system, wherein the program product of the mobile device comprises a plurality of instructions executable by the mobile device for execution on a mobile device, the mobile device comprising a processor for performing the instructions executable by the mobile device, a display, a user input device for selecting an option presented on the display, and a third communication means suitable for communicating with the second communication means of a collecting device according to one of the points 1 to 6, the program product of the mobile device comprising instructions for:
- receiving security analysis data from the collection device via the third communication means,
- processing the received security analysis data that results in a first diagnosis, and
- presenting information regarding the first diagnosis on the mobile device.
Program product of a mobile device for security analysis of a computer system according to item 7, wherein the mobile device further comprises a fourth communication means, preferably a Wi-Fi module and / or
BE2018 / 5377 wireless mobile telecommunications technology module, wherein the fourth communication means is adapted to communicate with a remote server, the program product of the mobile device comprising instructions for:
- sending the security analysis data from the mobile device to the remote server, the remote server processing the security analysis data that results in a second diagnosis,
- receiving the second diagnosis from the remote server, and
- presenting information regarding the second diagnosis on the display of the mobile device.
Program product of a mobile device for security analysis of a computer system according to one of points 7 and 8, wherein the program product of the mobile device comprises instructions for:
- selecting one or more recovery options from a recovery option list based on one or more of the diagnoses,
- presenting the selected recovery options on the display of the mobile device,
- if the recovery option list includes a transmission option for sending recovery information regarding the security analysis data to a third-party service, sending the recovery information to the third-party service, and
- if the recovery option list includes a contact option for contacting a specialized service, contacting the specialized service.
Program product of a mobile device for security analysis of a computer system according to any of points 7 to 9, wherein the program product of the mobile device comprises instructions for sending the updated computer executable instructions intended for the collecting device to the collecting device via the third means of communication.
A method for security analysis of a computer system, the method comprising the following steps:
- allowing communication between a first device and the computer system,
- collecting security analysis data about the computer system on the first device,
BE2018 / 5377
- allowing communication between the first device and a second device,
- sending the security analysis data from the first device to the second device,
- processing the security analysis data on the second device, which results in a first diagnosis, and
- presenting information regarding the first diagnosis on the second device.
12. Method for a security analysis of a computer system according to point 11, the method comprising the following steps:
- allowing communication between the second device and a second system,
- sending the security analysis data from the second device to the second system,
- processing the security analysis data on the second system resulting in a second diagnosis,
- sending the second diagnosis from the second system to the second device, and
- presenting information regarding the second diagnosis at the second device.
Method for security analysis of a computer system according to one of points 11 and 12, the method comprising the following steps:
- proposing one or more selectable recovery options based on one or more of the diagnoses of the second device,
- if the one or more selectable recovery options include a transmission option for sending recovery information regarding the security analysis data to a third party service, sending the recovery information to the third party service upon selection of the sending option, and
- if the one or more selectable recovery options include a contact option for contacting a specialized service, contacting the specialized service when selecting the contact option.
A method for security analysis of a computer system according to any of points 11 to 13, the method comprising the following steps:
BE2018 / 5377
- collecting a hardware and operating system specification from the computer system on the first device, and
- sending the collected hardware and operating system specification from the first device to the second device.
A method for security analysis of a computer system according to any of points 11 to 14, the method comprising the following steps:
- Sending instructions for collecting security analysis data over the computer system from the second device to the first device.
The invention will be further described by the following non-limitative examples which further illustrate the invention, and which are not intended, and should not be construed as a limitation of the scope of the invention.
EXAMPLES
Example 1
A user of a computer suspects a security violation. He requests a dongle according to the present invention from a service company, and downloads the associated application, i.e. the associated program product from the mobile device according to the present invention, onto his smartphone. Figure 2 shows an overview diagram of the steps for performing a security analysis of the computer.
The user plugs the dongle's USB connector into a USB port on his computer, the user's computer system (201). The dongle receives power from the user's computer system and its Bluetooth communication module can be displayed on other devices. The user opens the application and searches for a dongle associated with the application. The dongle is found and the user establishes communication between his smartphone and the dongle (202). The user further selects the start option for a full scan on the touch screen of his smartphone that triggers the sending of a start signal from the mobile device to the dongle (203). The computer-executable instructions are loaded from the non-temporary storage medium of the dongle executed on the processor of the dongle emulating one or more user input devices for retrieving the desired security analysis data, and this security analysis data is stored
BE2018 / 5377 in the non-temporary storage medium of the dongle (204). During step (204), the user goes out of his office to make a phone call with his smartphone. A while later, the user returns to the computer system, detects the dongle, and selects the option to send the security analysis data from the dongle to the mobile device (205). The security analysis data is processed by the application resulting in a first diagnosis of security breach (206). Information regarding the first diagnosis is presented on the touch screen of the smartphone (207). This information indicates that a security violation is likely. A second diagnosis is proposed (208). The user selects the corresponding option on the touch screen of his smartphone, and the mobile device establishes communication with an analysis computer system (209), i.e. the remote server (5), via Wi-Fi. The security analysis data is sent from the smartphone to the analysis computer system (210), where it is processed resulting in a second diagnosis (211). This second diagnosis is sent to the mobile device (212) and presented on the touch screen of the smartphone (207). A security violation is detected. The application proposes an option to call a specialist (208). The user selects this option, a telephone call to the specialist is triggered (213), and the user makes an appointment to have his computer system repaired.
Example 2
A dongle (collecting device), such as, for example, that described in Example 1, may be configured to operate in a full scan operation mode or a fast scan operation mode. The application (application product of the mobile device) may then include instructions for presenting on-screen information of the mobile device of information for selecting one of the two operating modes. The full scan operation mode may require the receipt of a key from the supplier of the dongle and / or the acceptance by the user of an agreement and / or the payment of a fee by the user to the supplier of the dongle.
In the fast scan operation mode, the security analysis data includes the first diagnosis. The first diagnosis preferably comprises an indication of the threat level. This can be a discrete indication of the threat level, such as 'yes', 'maybe', or 'no' or a continuous indication of a threat level, such as a percentage value. Preferably, no security analysis data is stored on the dongle in the fast scan operation mode. This indication of it
BE2018 / 5377 threat level is preferably the security analysis data that is communicated from the dongle to the mobile device.
An example of an embodiment of a full scan operation mode is shown in the flow chart shown in Figure 2 and described in the above first example.
Example 3
A dongle (collecting device), such as, for example, that described in the first and second examples, may be configured to operate in a fast scanning operation mode. The dongle is connected to the computer system through a USB connector. The dongle is powered by the computer system and emulates a HID keyboard. The dongle is recognized by the computer system and works directly, without having to install drivers, since the operating system present on the computer system supports HID keyboards as standard. The user uses a security analysis application on his / her smartphone to connect to the dongle via Bluetooth. The user instructs the security analysis to be started. This leads to a signal that is sent to the dongle, causing the dongle to begin collecting security analysis data. In a first step, the dongle sends an instruction to the computer system to open a PowerShell. This opens a PowerShell window on the computer system, which is visible to the user. In a next step, the dongle sends instructions for self-analysis to the computer system via the HID interface in the form of keystrokes, which are performed one by one by the computer system while being visible to the user in the PowerShell. The execution of all self-analysis instructions results in a security variable on the computer system to be set to 0, indicating that no security issue has been detected. This value is transferred via the HID interface to the dongle as a modulation of the caps lock on field (and / or shift lock on field). Once it is received by the dongle, the dongle sends the value of the security variable to the smartphone via Bluetooth. An indication that no security issue has been detected is shown on the smartphone's screen.

权利要求:
Claims (25)
[1]
Conclusions
A collection device for security analysis of a computer system, the collection device comprising:
- a first means of communication suitable for communicating with the computer system,
- a second means of communication suitable for communicating with another device,
- a non-temporary storage medium comprising computer-executable instructions for generating security analysis data, wherein the collecting device is configured for, when establishing communication with the computer system via the first communication means:
- loading the computer-executable instructions from the non-temporary storage medium for executing the computer-executable instructions,
- collecting security analysis data from the computer system, and
- sending the analysis data to the other device;
characterized in that said other device is a mobile device, and said transmitting of the security analysis data is performed via said second communication means that is different from said first communication means.
[2]
A collecting device according to claim 1, characterized in that said step of loading said computer executable instructions and said execution is triggered by a user-selected instruction of said mobile device via said second communication means, wherein preferably said user of said mobile device is also a user of said computer system.
[3]
3. Collection device as claimed in claims 1-2, characterized in that said collecting device is a dongle, wherein preferably a largest dimension of said collecting device is not larger than 150 mm, more preferably wherein an outer surface of said collecting device is completely in there is a volume with dimensions 150 mm x 50 mm x 50 mm.
BE2018 / 5377
[4]
Collecting device according to claims 1-3, characterized in that said security analysis data is not stored on any of said computer system and said collecting device; preferably not stored on any of said computer system, said collection device, and said mobile device.
[5]
Collecting device according to claims 1-4, characterized in that said computer-executable instructions comprise a plurality of self-analysis instructions, said self-analysis instructions preferably being scripting language instructions, for execution by said computer system for performing said security analysis as a self-analysis, and that said step of collecting security analysis data from the computer system comprises the sub-steps, or preferably consists of:
- transferring, by said collection device, said plurality of self-analysis instructions to said computer system via said first communication means;
- having said computer system execute said plurality of self-analysis instructions for performing said security analysis as said self-analysis, which yields said security analysis data that is a self-analysis result;
- receiving, by said collection device, said self-analysis result.
[6]
A collection device according to claim 5, characterized in that said plurality of self-analysis instructions relates to man-interpretable instructions, preferably script language instructions and / or source code instructions, said computer device comprises a display, and said step of transferring said plurality of self-analysis instructions from said collection device to said computer system comprises transferring a visualization-related instruction intended for said computer system to request said computer system for at least one of said plurality of self-analysis instructions to display during and / or after said execution of said plurality of self-analysis instructions, preferably prior to requesting said computer system to display said plurality of self-analysis instructions in real-time after being executed by said computer system .
BE2018 / 5377
[7]
A collection device according to claims 1-6, characterized in that said first communication means relates to a communication based on HID protocol, wherein said computer system acts as a host and wherein said collecting device emulates a HID device, said collecting device being emulate a HID keyboard or a HIDjoy stick.
[8]
A collecting device according to claims 5-6, characterized in that said first communication means relates to a HID protocol based HID device, wherein said collecting device emulates a HID keyboard or a HID joystick; that said transfer of said plurality of self-analysis instructions for transferring and sequence of HID instructions representing said plurality of self-analysis instructions from said collection device to said computer system, and that said receiving said self-analysis by said collection device relates to receiving one or more HID instructions representing said self-analysis.
[9]
A collection device according to claims 7-8, characterized in that the first communication means complies with any or any combination of the following: USB HID, Bluetooth HID, Serial HID remote control receiver, ZigBee HID, HID over I ² C, HID over GATT.
[10]
Collecting device according to claims 1-9, characterized in that the first communication means is a Universal Serial Bus connector and / or wherein the second communication means is a Bluetooth communication module.
[11]
11. Collection device as claimed in claims 1-10, characterized in that the collection device comprises a processor and wherein the collection device is configured to emulate one or more user input devices for collecting said security analysis data.
[12]
12. A security device collecting system for a computer system as claimed in claims 1-11, characterized in that the collecting device is further configured for, when establishing communication with the computer system via the first communication means:
- determining a hardware and operating system specification of the computer system, and
BE2018 / 5377
- sending the determined hardware and operating system specification to the mobile device via the second communication means.
[13]
A security analysis collection device of a computer system according to claims 1-12, characterized in that the collection device is further configured for, when establishing communication with the computer system via the first communication means:
- storing the collected security analysis data on the non-temporary storage medium,
- receiving a transmission request from the mobile device via the second communication means,
- the full or partial loading of the stored security analysis data from the non-temporary storage medium, and
- sending the loaded full or partial security analysis data to the mobile device via the second communication means.
[14]
14. A collecting device for a security analysis of a computer system as claimed in claims 1-13, characterized in that the collecting device is further configured for, when establishing communication with the computer system via the first communication means:
- receiving updated computer executable instructions from the mobile device via the second communication means, and
- storing said updated computer-executable instructions on the non-temporary storage medium.
[15]
Collection device for security analysis of a computer system according to claims 1-14, characterized in that the collection device is further configured for
in particular, in establishing communication with the computer system via the first communication means, determining a hardware and operating system specification of the computer system, and sending the determined hardware and operating system specification to the mobile device via the second communication means ;
- upon establishing communication with the mobile device over the second communication means, downloading loading by the mobile device of updated computer executable
BE2018 / 5377 instructions from a remote server preferably taking into account the said specific hardware and operating system specifications, wherein said downloading is preferably done via another communication means that is different from said first and said second communication means,
- receiving said updated computer-executable instructions from the mobile device via the second communication means, and
- storing said updated computer-executable instructions on the non-temporary storage medium.
[16]
A collection device according to claims 5-15, characterized in that said collection device is configured by a user of said mobile device and / or is pre-configured to operate in a fast scan mode, said operation in fast scan mode mode results in that the result of said self-analysis is not stored on said collecting device to avoid spreading said result of the self-analysis through said collecting device, preferably wherein a memory status of said non-temporary storage medium remains unchanged during execution of any or a combination of the following steps:
said loading of said computer executable instructions,
said collection of said security analysis data, and
- said sending of said security analysis data.
[17]
A program product of a mobile device for security analysis of a computer system, wherein the program product of the mobile device comprises a plurality of instructions executable by the mobile device for execution on a mobile device, the mobile device comprising a processor for performing the instructions executable by the mobile device, a display, a user input device for selecting an option presented on the display, and a third communication means suitable for communicating with the second communication means of a collecting device according to any one of claims 1-16, the program product of the mobile device comprising instructions for:
BE2018 / 5377
- receiving security analysis data from the collection device via the third communication means,
- processing the received security analysis data that results in a first diagnosis, and
- presenting information regarding the first diagnosis on the mobile device.
[18]
A program product of a mobile security system analysis device according to claim 16, wherein the mobile device further comprises a fourth communication means, preferably a Wi-Fi module and / or wireless mobile telecommunications technology module, the fourth communication means being suitable for communicating with a remote server, the program product of the mobile device comprising instructions for:
- sending the security analysis data from the mobile device to the remote server, the remote server processing the security analysis data that results in a second diagnosis,
- receiving the second diagnosis from the remote server, and
- presenting information regarding the second diagnosis on the display of the mobile device.
[19]
A program product of a mobile device for security analysis of a computer system according to any of claims 17-18, wherein the program product of the mobile device comprises instructions for:
- selecting one or more recovery options from a recovery option list based on one or more of the diagnoses,
- presenting the selected recovery options on the display of the mobile device,
- if the recovery option list includes a transmission option for sending recovery information regarding the security analysis data to a third-party service, sending the recovery information to the third-party service, and
- if the recovery option list includes a contact option for contacting a specialized service, contacting the specialized service.
[20]
A program product of a mobile device for security analysis of a computer system according to any of claims 17-19, wherein the program product of the mobile device comprises instructions for
BE2018 / 5377 sending the updated computer executable instructions intended for the collection device to the collection device via the third communication means.
[21]
A method for security analysis of a computer system, the method comprising the following steps:
- providing a collecting device and another device, wherein said collecting device comprises o a non-temporary storage medium, o a first communication means, and o a second communication means,
- allowing communication between the collecting device and the computer system via said first communication means,
- allowing communication between the collecting device and the other device via said second communication means,
- preferably, having said collection device determine a hardware and operating system specification of the computer system;
preferably, sending said hardware and operating system specification from said collecting device to said other device via said second communication means and receiving, via said second communication means, updated computer-executable instructions by said collecting device from the said other establishment,
- loading the computer-executable instructions, said computer-executable instructions preferably being said updated computer-executable instructions, from said non-temporary storage medium,
- executing computer-executable instructions for collecting security analysis data on the computer system on the collection device,
- sending the security analysis data from the collection device to the other device,
- preferably, having the other analysis process the security analysis data that results in a first diagnosis, and
- preferably, having the further arrangement of information relating to the first diagnosis present it,
BE2018 / 5377, characterized in that said other device is a mobile device, and that said sending of the security analysis data is performed via said second communication means that is different from said first communication means.
[22]
A method according to claim 21, characterized in that the method comprises the following further steps:
- allowing the mobile device to process the security analysis data that results in a first diagnosis, and
- having the mobile device present information regarding the first diagnosis, wherein said information relates to one or more user-selectable actions with regard to a second diagnosis,
- receiving a selection from a user with respect to one or more actions selectable by the user,
- based on said selection, allowing communication between the mobile device and a second system according to said selection,
- sending the security analysis data from the mobile device to the second system,
- processing the security analysis data on the second system resulting in a second diagnosis,
- sending the second diagnosis from the second system to the mobile device, and
- having said mobile device present information regarding the second diagnosis.
[23]
A method according to claims 21-22, characterized in that the method comprises the following further steps:
- proposing one or more selectable recovery options based on one or more of the diagnoses of the mobile device,
- if the one or more selectable recovery options include a transmission option for sending recovery information regarding the security analysis data to a third party service, sending the recovery information to the third party service upon selection of the sending option, and
BE2018 / 5377
- if the one or more selectable recovery options include a contact option for contacting a specialized service, contacting the specialized service when selecting the contact option.
[24]
A method according to claims 21-23, characterized in that said computer-executable instructions comprise a plurality of self-analysis instructions, said self-analysis instructions preferably being scripting language instructions, for execution by said computer system for executing the said security analysis as a self-analysis, and that said step of collecting security analysis data from the computer system comprises the following sub-steps, or preferably consists of:
- transferring, by said collection device, said plurality of self-analysis instructions to said computer system via said first communication means;
- having said computer system execute said plurality of self-analysis instructions for performing said security analysis as said self-analysis, which yields said security analysis data that is a self-analysis result;
- receiving, by said collection device, said self-analysis result.
[25]
Use according to claim 21-24 in the collecting device according to claim 1-
16.

类似技术:

---

公开号 | 公开日 | 专利标题

---

CN106161344B|2018-03-30|The malicious objects that Behavior-based control increment identifier is hidden

---

US10194321B2|2019-01-29|Periodic mobile forensics

---

EP2348440A2|2011-07-27|Collaborative malware detection and prevention on mobile devices

---

EP3113062B1|2017-09-13|System and method of detecting modified or corrupted external devices

---

CN104364767A|2015-02-18|Device and settings management platform

---

CN109923544A|2019-06-21|Method for authenticating and electronic equipment

---

CN108475304B|2021-08-13|Method and device for associating application program and biological characteristics and mobile terminal

---

CN107193666B|2021-07-20|Control method and device for calling between application programs

---

CN106713319B|2020-01-14|Remote control method, device and system between terminals and mobile terminal

---

WO2017088402A1|2017-06-01|System, method and device for information interaction

---

CN102314551A|2012-01-11|Be used to transmit long-range contextual system and method

---

CN108932429A|2018-12-04|Analysis method, terminal and the storage medium of application program

---

US9100059B2|2015-08-04|System and method for mapping multiple applications to a single NFC tag

---

US9131089B2|2015-09-08|Image processing system including image forming apparatus having touch panel

---

CN105706098B|2019-09-10|Data accessibility control

---

CN106709282B|2018-10-02|resource file decryption method and device

---

US10853215B2|2020-12-01|Intelligent configuration management of user devices

---

CN108984265B|2020-12-15|Method and device for detecting virtual machine environment

---

BE1025948B1|2019-08-20|COLLECTION DEVICE, PROGRAM PRODUCT OF A MOBILE DEVICE, AND METHOD FOR A SECURITY ANALYSIS OF A COMPUTER SYSTEM

---

CN109118160B|2021-06-15|Information sharing method, device, terminal equipment and medium

---

CN106534093B|2019-10-25|A kind of processing method of terminal data, apparatus and system

---

CN107295035B|2021-05-14|Method and device for sharing content of mobile terminal

---

JP6397200B2|2018-09-26|Management server, data processing method, and program

---

US10637930B2|2020-04-28|System for integrating a detectable medical module

---

KR20140101726A|2014-08-20|System and method for running applications from computer devices

同族专利:

---

公开号 | 公开日

---

BE1025948A1|2019-08-14|

---

WO2018224571A1|2018-12-13|

---

EP3413228A1|2018-12-12|

引用文献:

---

公开号 | 申请日 | 公开日 | 申请人 | 专利标题

---

US8793795B1|2005-01-28|2014-07-29|Intelligent Computer Solutions, Inc.|Computer forensic tool|

---

US20120324577A1|2011-06-14|2012-12-20|Honeywell International Inc.|Detecting malicious software on a computing device with a mobile device|

---

US9654496B1|2015-03-31|2017-05-16|Juniper Networks, Inc.|Obtaining suspect objects based on detecting suspicious activity|

---

US9619417B2|2011-06-17|2017-04-11|Alcatel Lucent|Method and apparatus for remote delivery of managed USB services via a mobile computing device|

---

US9313602B2|2012-10-24|2016-04-12|Beta Brain, Inc.|Remotely accessing a computer system|

---

法律状态:
2019-10-10| FG| Patent granted|Effective date: 20190820 |

---

2021-04-19| MM| Lapsed because of non-payment of the annual fee|Effective date: 20200630 |

优先权:

---

申请号 | 申请日 | 专利标题

---

EP17174591.2A|EP3413228A1|2017-06-06|2017-06-06|Collecting device, mobile device program product, and method for a security analysis of a computing system|

---

EP17174591.2|2017-06-06|

---