RU101231U1 - MOBILE COMPUTER DEVICE SECURITY MANAGEMENT SYSTEM - Google Patents

Abstract

 1. The security management system of a mobile device containing a battery monitoring device for monitoring the level and consumption of electricity associated with the control device of a custom security module; a custom security module for implementing security services of a mobile device associated with a control device for a custom security module; a localization device for determining a location of a mobile device associated with a database of localization profiles; a database of localization profiles, designed to store information about the risks of danger of many points of entry into the network with various locations associated with the control device of the custom security module; a user classification device designed to classify a user as a user according to actions taken in a mobile computing device by comparing actions with user models stored in a user profile database associated with a security module control device; a user action analysis device for collecting statistics of user actions in a mobile device and transmitting the received data to a user classification device; a user profile database for storing user models containing at least data about user behavior and user activity statistics that is associated with a user type determination device; database of parameters of mobile devices, p

Description

Technical field

The present utility model relates to security systems for computing devices, and more particularly to security management systems for a mobile computing device.

State of the art

In the modern world, the number of mobile computing devices (MVS), such as laptops, netbooks, handheld portable computers (PDAs) and multifunctional communicators (smartphones) under the operating systems Symbian, Windows Mobile, Android, iPhoneOS, BlackBerry OS, etc. is growing rapidly. Users they show an increased interest in broadband Internet access via wireless communication channels: to accelerated Internet access based on digital technology for EDGE mobile communications; 3G (also 3.5G) - high-speed mobile access with Internet services; various Wi-Fi networks (according to IEEE 802.11 a / b / g / n standards), as well as WiMAX (according to IEEE 802.16 standards), etc. With a data transfer rate that approaches tens of megabits per second, the risk that the user may receive malware along with useful data.

Important criteria for the MVP are, for example, small dimensions (compactness), mobility, functionality and battery life. All these factors inhibit the performance growth of such devices and impose restrictions on the execution of applications that use a significant part of the system resources (processor power, RAM, etc.). In particular, such applications include systems for ensuring the safety of the IDP.

The urgent issue is the creation of the security system of the IDP, which helps to rationalize the use of device resources. This application describes a system that allows you to save battery power and change the settings of the security module depending on the location, while maintaining the effectiveness of the protection of the IDP.

Known systems that are designed to protect the IDP. Such systems allow you to create secure communication channels, set the security policy of the IDP, and detect malware and spam.

Applications JP20030288275 and W006 / 076536 describe systems for configuring the security of the IDP depending on its location. It describes the various device security architectures and support for security policies. These systems do not have an integrated approach to managing security, since they do not take into account the battery charge and user behavior.

A system for distributed load balancing applications is disclosed in US20030120502. This system also includes various system architectures, such as thin and thick client. This system solves the problem of economical energy consumption, while the MVU safety management system monitors energy consumption and, with this in mind, sets up the security system modules.

Data filtering to prevent unauthorized access to the IDP is implemented in US7174566 and W006 / 1131124. They reveal the idea of a firewall operating at the level of packages and applications. For applications, there is a security policy that takes into account known threats. The firewall analyzes various ports to identify attacks.

The described utility model allows more efficiently and effectively solving the security management problem at the MVU. The benefits are in configuring the security modules adaptively, depending on location, battery level and type of user.

Utility Model Essence

This utility model is intended to solve the problem of ensuring effective protection of a mobile computing device from cyber threats. The technical result of this utility model is the optimal security management of a mobile computing device. The system described below allows you to save battery power and change the settings of the security module depending on the location, while maintaining effective protection for the mobile device. According to the security management system of a mobile computing device, comprising: (a) a battery monitoring device for monitoring the level and consumption of electricity associated with a control device for a custom security module; (b) a custom security module for implementing mobile device security services associated with a custom security module control device; (c) a localization device for determining the location of a mobile device associated with a database of localization profiles; (d) a database of localization profiles designed to store information about the risks of danger of multiple entry points to the network with different locations associated with the control device of the custom security module; (e) a user classification device intended to classify a user as a user according to actions taken in a mobile computing device by comparing actions with user models stored in a user profile database associated with a security module control device; (f) a user action analysis device for collecting statistics of user actions in a mobile device and transmitting the received data to a user classification device; (g) a user profile database for storing user models containing at least user behavior data and user activity statistics that are associated with a user type determination device; (h) a configurable security module control device for assessing hazard risk using localization profiles that are stored in the profile database for the location of the mobile device, associated with the battery monitoring device and dynamically adjusting the protection services implemented in the security module.

In a particular embodiment, the mobile computing device may be devices such as a laptop, netbook, smartphone, mobile phone, communicator, thin client, and includes at least a processor, memory, battery, and communication device providing a connection for the mobile device.

In another particular embodiment, the communication device uses standard communication protocols for connection.

In another particular embodiment, the battery monitoring device is designed to measure the remaining battery charge, the amount of power consumed, calculate the operating time of the mobile device without recharging, depending on the number of protection services included.

In another particular embodiment, the security module includes the following protection services: antivirus, designed at least for signature and heuristic analysis; anti-spam designed to filter the email messages of a mobile device; application control that tracks application access to critical areas of the operating system and unauthorized actions; a firewall designed to control the connection to a mobile device over the network; backup; (dec-) data encryption.

In another particular embodiment, the protection services have an efficiency setting, depending on which the security level of the mobile device and the battery power consumption are changed, and the power consumption is greater, the higher the level of protection service efficiency.

In another particular embodiment, the localization device is designed to determine a location by GPS and / or by positioning in cellular networks and / or by positioning relative to Wi-Fi stations and / or using network services of the TCP / IP stack.

In another particular embodiment, the localization profile includes at least the name of the local network, its location, the degree of danger of working in the network, and the minimum settings of the security module, and is stored in the database, with several local locations being possible networks.

In another particular embodiment, the database of localization profiles is stored on a remote server connected to the mobile device via the communication device and / or in the memory of the mobile device.

In another particular embodiment, a plurality of network entry points is a set of devices providing for the connection of mobile devices and the connection of a mobile device to Internet resources.

In another particular embodiment, it offers the user and / or automatically connects the mobile computing device to the most secure network if several network entry points are available at once.

In another particular embodiment, the control device for the custom security module for a specific location positioning device is designed to locate the local networks corresponding to this location in the database of localization profiles, and for this network finds danger risks.

In another particular embodiment, the control device for said custom security module is configured to determine the name of the local network from the information about connecting to it and for this local network finds danger risks in the database of localization profiles.

In another particular embodiment, the control device for the custom security module is configured to connect protection services depending on the risk of danger and change their level of effectiveness, and the greater the risk, the greater the number of included services and the higher the level of their effectiveness.

In another particular embodiment, the control device for a custom security module, depending on the data received from the battery monitoring device, connects protection services and changes their efficiency level, and the larger the remaining battery capacity, the more services are included and their efficiency level is higher .

In another particular embodiment, if the number of operating protection services determined by the battery level and / or location and / or type of user and / or efficiency settings determined by the battery level and / or location and / or type of user are different, then the user is prompted to choose between configuration options.

Brief description of the attached drawings

The accompanying drawings, which are included to provide an additional understanding of the utility model and form part of this description, show embodiments of the utility model and, together with the description, serve to explain the principles of the utility model.

The claimed utility model is illustrated by the following drawings, in which:

Figure 1 shows a block diagram of a mobile computing device.

Figure 2a shows a diagram of using a security server to protect a mobile computing device.

Fig.2b shows a diagram of the use of a security system as part of a mobile computing device.

Figure 3 shows the security system with the separation of the server and client parts, as well as their devices.

Figure 4 shows the installation options of the security system on a mobile device.

Figure 5 shows a diagram of the division of information space into areas with different levels of security.

6 shows an example of a database of localization profiles.

7 shows a diagram of the operation of the positioning device, which allows you to determine the location of the mobile computing device in the space of wired and / or wireless networks.

Fig. 8 shows a block diagram of an MVP security management system.

Fig.9 shows the shutdown algorithm and protection services depending on the battery level.

10 shows an example of a more detailed configuration of a security service.

11 shows the possibility of improving data protection during transmission through an encrypted channel.

12 shows the operation of a dual firewall in a more detailed manner.

13 shows a table of user profiles.

Detailed Description of Preferred Embodiments

The objects and features of the present utility model, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present utility model is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the utility model, and the present utility model is determined only in the scope of the attached formula.

A mobile computing device (MVU) in the general case is necessary for exclusively user applications to work, so called because it is convenient to take with you on the road, to work, home, or rest. In this regard, the features of the IDP are light weight and low productivity. Such a device is powered by a battery or battery, the charge of which is enough for less than 30 hours of operation without recharging from the network, and with more intensive work, the battery charge is spent in less than half a day. In this regard, the question arises of the optimal use of these resources to maintain the operation of the device on the Internet and information carriers, including taking into account the issue of security and data safety.

At the moment, the market of compact devices that also have full Internet access is developing very rapidly. This is due to the introduction of new technical processes in the creation of the latest microcircuits, as well as the use of modern communication standards and infrastructure improvements.

One example is Intel Atom - the latest processor for small devices, which will find its application both in netbooks and in new developments called MID devices (for example, Moorestown).

We single out the main mobile devices for which the described system is positioned. Such mobile devices must have a complex architecture in order to be able to put a lot of applications on them. These include: netbooks, tablet PCs (Ultra-Mobile PC, UMPC), handhelds (Handheld PC), some smartphones (Smartphones) and communicators. As already mentioned, in the future they can all go into the category of devices called MID (Mobile Internet Device), which allow you to access the Internet at the level of the most technologically advanced networks, combine (this is an increasing trend) touch screen (touch-screen) , i.e. lack of keyboard, intuitive interface, the ability to use a large number of applications.

It is clear that the disadvantage for small portable devices is the battery capacity. If for smartphones and handhelds with a not very large load capacity lasts literally for a day, then netbooks have enough battery power for several hours with continuous operation.

It should be noted that running applications directly affect the speed of battery consumption - the main consumers in such devices are the screen and communication devices (WiFi, 3G chips, etc.). In addition, the processor frequency, data storage chips (usually a flash), the peripherals used (for example, a speaker) play a large role.

The structural diagram of the IDP is shown in figure 1. User applications are loaded into the memory 120 and executed in the processor 110. The operation of the devices included in the IDP is controlled by the processor 110. The GPS module 130 determines the location of the IDP by its communications with satellites. Communication device 140 communicates between the IDP and other devices using the OSI model protocols, according to such standards as, for example: IRDA, USB, EIA RS-232, EIA-422, EIA-423, RS-449, RS-485, Ethernet, 802.11 Wi-Fi, DSL, ISDN, SONET / SDH, GSM Um radio interface, IEEE 802.15, ITU and ITU-T, Firewire, TransferJet, Etherloop, ARINC 818, G.hn/G.9960. Among them are both wired and wireless communication standards. The processor 110, the GPS module 130, the communication device 140 are powered by a battery 150.

On figa shows a diagram in which protection against various threats for the client device 250 and applications 260 installed on it provides the server 200, which monitors the traffic going to the network 240 from the Internet (external network) 210. To mobile computing devices (MVD) 250 include both ordinary laptops and subnotebooks (netbooks), as well as various communicators. As a network, there can be, for example, a corporate network in which the client works. Various applications 230 are installed on server 200, which work in conjunction with client applications 260 — a web server may be an example of such an application. In addition to such applications, the server should also provide security. To manage them and also to change various settings, an application is provided - the management console 220. This console has its own graphical interface that allows the server administrator to configure applications in real time and change various settings (including security settings). It is important to note that using this console, the administrator can configure both security applications and various other applications running on the server. The main goal of such an architecture is to reduce the load on the computing resources of the MVU, remote configuration, as well as additional communication protection when working on the global Internet.

On figb shows a diagram of the client device that is used by the user in an insecure network. This can happen when a user tries to access the Internet 270 from a cafe or hotel, tries to download an update for a program while at the airport, etc.

Client device 260 must be equipped with its own security system, which is enclosed in Appendix 285. Using its own management console 280, the user can configure the level of protection depending on where he is or at will. Thus, protection can be provided for user applications 290 and user data.

The system has the following modules that can reside on a mobile device (shown in FIG. 3):

An encryption device that only works when connected to a security server. The efficiency and resource consumption of this module is determined by the size of the encryption keys. Thus, you can reduce resource consumption by reducing the size of the encryption key or by choosing a simpler encryption algorithm (for example, use 2DES instead of 3DES).

The local location database contains information about the network, in particular coordinates, access points, danger risks and is stored in the memory of a mobile device or on a remote server. When the user is in the same place for a long time, the database is disabled. Support for this base in terms of resource consumption is minimal. A device for determining the location of a mobile device is known in the art and is often a component of a mobile device (for example, an integrated GPS receiver). The functions of this device can also be performed by a communication device, measuring the metric of transmitted packets.

The management console is required by the user to manage the system. The console is turned on only if manual input is necessary and does not consume a lot of resources.

The firewall controls the communication device, which detects the activity of ports and running applications. In this module, you can create rules for applications and the incoming schedule.

An anti-virus with a threat description database scans the file system and launched programs. The size of the database is directly related to the speed of search, therefore, to speed up and save resources, you can reduce the working area of the threat database. Within the system, it is possible to install and manage many running antivirus engines.

Figure 3 shows the system in terms of server and client. All key modules are listed. From the server side, the following modules can be distinguished: the global location database 395, the administrator console 351, which can set 352 configuration rules (for example, red, yellow, green security levels), more detailed settings 353 that obey the settings rules, and also a dual-gateway system 375 and 380 screens, 370 spam databases, 365 backup storage and threat descriptions 355, 360 anti-virus engine, balancing module 390, means for (decrypting) encryption of 325 transmitted data. The 385 spam and DoS analyzer model can be removed from the system in hardware - i.e. presented as a separate computer.

On the user's side, in a minimal version, there is a control console 305 with user-defined settings 310 (they were initially set by default), a user database of locations 340. With a more complete installation, modules of a separate firewall 330, antivirus 320 with database 315, and encryption devices are also available to maintain a secure communication channel with server 325, as well as a database of backup storage 335. Full installation of all components will allow the user to work autonomously and in an insecure network, and in protected, it becomes possible to reduce the load on the server.

The client system includes three layers: business logic, which is presented directly to the user, services that represent user data (for example, a request in a browser) in an understandable form for the applications themselves (for example, the same browser). When accessing the server from a client device, a connection is created that is processed through a system that includes a double firewall, as well as a web server with server services. The web server is designed to establish user sessions, authenticate users, and server services provide communication with databases and other services. This architecture allows you to improve the security of the system, since web servers in this case transmit only the data that is required by the client.

A special mention deserves the load balancing system. This system can also be configured by an administrator. The balancing system can distribute the load between the processor cores, and can also parallelize the load between the processing cores of the system, which allows more efficient use of server computing resources.

The spam and DoS analyzer is a honeypot system designed as a separate computer or virtual system. The bait system can perform not only the functions of a spam and malicious mail filter, but also be used to timely detect DoS and other hacker attacks from an external network to a host from a secure network. Using the decoy system as a spam analyzer consists in creating a second mailbox (or user profile) of a user with the same name from a protected system, which allows you to filter spam and various messages (not just email) with embedded malware using various methods even before how these messages reach the user. The system also allows you to update the spam database and respond to new threats, which is reflected in the development of counteraction rules.

The user can always use the backup, storing the data he needs in a backup database. In this case, the user can be allocated the appropriate quota, which can be configured using the administrator. Also, the user can save all the data he needs on his computer. Figure 4 shows examples of installation of the present system. It can be fully installed, as shown in Fig. 4a, and then the user can be sure that the system is protected no matter where the network is connected. In this case, the option of reducing the load on the MVU 400 (computer) can be selected if it is in a secure network - the security module 410 installed on the server 420 will take on the entire load. This type of installation is shown in Fig.4b. If the user IDP has low resources (for example, a communicator), then it selects the minimum installation, which is shown in Fig. 4c, in which it will be safe in a secure network, and in an unprotected network, it will use its device at its own risk and peril Communication through a secure connection to a security server.

As a rule, a person in his life is connected with a small number of information networks: home, work, public place (cafe, metro, etc.). Each network has different levels of information security, but you can select the appropriate profiles, which are shown in Figure 5. It can be noted that public networks (mobile, wifi in restaurants and the metro) are less secure and in most cases are accessed by anonymous users (do not require authentication). This makes them more vulnerable and more attractive to attackers. Figure 6 shows a database of localization profiles, a model of which can be represented in the form of two related tables. The first table of localization profiles 610 lists the types of profiles defined by the degree of security: as safe globally, i.e. protected by a security system installed on the servers, as shown in figa, and safe from the point of view of the user. The user can also define various locations as conditionally safe depending on their considerations, and depending on the data received from the global database. The profile of potentially dangerous networks may include networks about which there is little information or in which there is a large virus / hacker activity and a large number of vulnerabilities. In turn, potentially secure networks may include networks that have established themselves as reliable. The global database includes all places that are provided with this security system. The user can update his location database after connecting to the nearest server on which this security system is installed. Location is determined using packet metric calculations. Profile settings table 620 contains a list of networks and their attributes, such as: name, location, minimum security settings, danger risks.

It is possible to determine the location without the GSM module. If the MVU 720 is connected by wireless means (GSM, wi-fi, etc.), as shown in Fig. 7a, it can determine the distances to reach (which signal will reach and from which) access points 710. They are transmitting and receiving antennas. The level of the received signal decreases with increasing distance between the MVD 720 and the access point 710 according to a certain law (as a rule, the character of decrease is one). Signal quality can be defined as the response time of a given access point. Alternatively, on Windows, the ping application performs this function. By determining the response time and signal strength, you can find the distance to the access point. Repeating the action for other access points, we obtain the nth number of vectors (from the MVP to the access point). Knowing the coordinates of access points 710 that are stored on the global server, you can determine the coordinates of the MVU 720. The number of available access points 710 determine the accuracy of the calculation of coordinates. Another way to determine the coordinates is to trace packets. It is shown in Fig.7b. A sequence of hosts 730 is built, through which the MVD 720 is connected, for example, to a global server. Based on these data, an autonomous network, provider, network address, and subnet are determined. Based on the registration information of the providers, it is possible to determine the location accurate to the district and home, depending on the network topology. If desired, you can use several methods at the same time.

On Fig shows a structural diagram of a security management system for a mobile device. The key device in the system is the control module for the security module 800, which includes the protection services depicted in FIG. 3. As input parameters, the device uses the battery level, localization profile, user type and technical parameters of the device. The technical parameters of the device are standard for each model, and can be downloaded from the system information or from the global server 810, which stores the basic configurations of well-known MVPs. Typically, the information contains performance characteristics, battery capacity. This data is necessary to determine the dependencies of battery power consumption on processor load. The positioning device 820 determines the location using the GPS module or using the trace and metric of network packets, as shown in Fig.7. The location is necessary to determine the localization profile 830, in which the MVP is currently operating. If the name of the network / provider can be determined from the connection data, then this information allows you to more accurately select a profile, for example, in cases where several providers provide Internet access at once. After a localization profile of 830 is set by location and connection information, there is a risk of working with this connection, which the user is notified about, and the appropriate settings for the 850 security module and 860 protection services included in it are determined. The search is performed on the basis of profiles localization, an example of which is described in Fig.6. The battery charge monitor 840 measures the remaining battery capacity, the amount of power consumed in a certain period of time, calculates the operating time of the mobile device without recharging, depending on the number of protection services included. Having collected the input parameters, the control device selects the settings of the 850 safety module that satisfy the selected priorities. For example, if a user has determined that security is the highest priority for him, then with a large battery charge all protection services with a high level of efficiency will work, if the priority is given to the productivity of user applications, the optimal setting specified in the localization profile 810 will be selected. As the battery charge decreases, services will be turned off. The number of protection services and their effectiveness also depends on the type of user to which the user belongs according to his actions in the IDP. There are certain user profiles that have similar behavior in the system: they launch a certain number of applications, visit a limited circle of web resources, and so on. An example of a user class can be an "active user" who installs several applications per month, visits new web resources every day, uses several network connections. This type of user requires more reliable protection and, accordingly, a larger number of included protection services 860. The user type is set in the user type determination device 870, which keeps a record of all actions taken by the user in this MVU. After the data is collected, the device 860 compares it with the existing user profiles in the database 880 and finds the most suitable type. Then, for this type, certain settings of the security module 850 are loaded.

An exemplary scheme for selecting modules for resource use is shown in Fig.9. Different modules turn off at different times depending on the battery charge. First of all, the management console 900 is turned off (more precisely, minimized), i.e. interface. If all traffic goes through encrypted channel 910, then the encryption device will need to be disconnected last (if the user allows this step). Otherwise, we can assume that the user's device can provide protection on their own. If the navigation device is turned off or there is no movement of the IDP for a certain period of time (determined at step 930), you can disable the database of localization profiles 940, because she will have no place to take fresh data from. Then, at step 950, you can minimize the firewall and antivirus, leaving only current applications under surveillance. At the last step 960, the user can specify a complete shutdown of all remaining modules of the described system.

However, in addition to disabling and enabling protection services, there are more detailed settings, such as the optimization of anti-virus databases, which is illustrated in Figure 10. When working on the IDP, the user creates a specific system configuration: installs applications, installs various script interpreters, sets up file upload rules, (not) saves personal data. Thus, for each MVU and each account, you can select a specific set of system attributes, which includes: a list of installed applications 1000 (a full list of installed programs), a list of supported file formats 1010, settings for saving personal information 1020, the choice of downloadable file types 1030. The 1050 virus databases contain signatures of all known malicious programs. In this case, the database can be sorted by the type of malicious file: archive, executable code, script or media file. Another way to classify the database is the format of the malware (the format of the files distributed with this malware): exe, rar, js, vbs, etc. Also, all programs can be divided by functionality, i.e. by the actions that they perform: downloaders, trojans, viruses, etc. This may be necessary when the user cannot be attacked by a specific class of virus, for example, keyloggers (programs that intercept keyboard input) if the user does not have a keyboard (and uses a virtual keyboard). Another example may be the case when the user does not save personal data, such as passwords, logins, search queries and temporary authentication files (cookies). In this case, Trojans that intercept this kind of information cannot be harmful. Executable files are often written and compiled for a specific operating system, and will not work in others, so the anti-virus database can also be sorted by the runtime environment. Having the ability to classify the database in this way, it becomes possible to reduce the size of downloaded updates by several times. For this, the configuration file of the IDP at the beginning of the update session is sent to the server, where a special selection is implemented, which is sent to the user.

11 illustrates the possibility of improving data transmission through an encrypted channel. This channel can be used if MVU 1100 is located outside a secure network and wants to use its resources, and also wants to use Internet resources, relying on a security system (for example, a user wants to view his bank accounts while on vacation). To create a connection with the security server 130, not only a VPN connection 1120 is used, but also another encrypted connection 1110, in which a VPN connection 1120 is embedded, can be optionally used. Encryption is based on the client ID, which may depend on various parameters, such as user’s personal data or hardware parameters (for example, a specific netbook). All these parameters can be created by the user before he wants to use this encryption algorithm. After the client 1100 has established a connection with the secure network 1130, it can take advantage of its resources or work safely with external resources via connection 1140. The encrypted connection 1110 can also maintain the integrity of the VPN connection, trying to restore the connection if it is disconnected. for any reason.

If several networks are available at once, which are protected to varying degrees, data about which is available in the database or analyzed by connection parameters, the user will have to make a choice through which network to connect. The system is able to compare connections and select the most secure, based on the availability of data in the database of localization profiles, connection security (encryption), certificates, etc. Further, depending on the system settings, the connection is made to a more secure network by default or by informing the user and offering to confirm or deny the choice of the system.

12 illustrates the operation of a dual firewall in a more detailed manner. From client 1200, requests 1210 are sent to the global security system, which sends him response data packets 1220. Requests 1210 first pass through the first firewall 1230a, which, after filtering the packets, transmits data to one of the web servers 1240. The task of the web server 1240 is to process requests from user maintaining his sessions. The web server 1240 also transmits data via an encrypted channel to the dispatcher module 1250 (via the second firewall 1230b), which decrypts the data and transfers it directly to the server services 1260 for processing, as well as confirms access for client applications. It is also possible to use the 1270 reporting system, which the administrator can use.

13 shows a table of user types in which data can be stored in the user profile database. It contains fields: user types, actions, danger risks and settings of the security module. For a specific user, actions that characterize him, such as connecting to several networks, visiting web resources and installing new applications, are highlighted. At the same time, depending on the statistics of these actions, the risk of danger can vary from low to high and, depending on this user, will be assigned to the corresponding type. For example, passive and active types are indicated, with which the security module settings are set: with low and high levels of protection efficiency. Comparing current indicators with the data from this table, the user is correlated with a certain type and subsequently set the appropriate settings until he is assigned a different type or other critical events occur that change the settings of the security module, such as changing the battery charge or working in the protected information space.

You can display the comparative characteristics of various mobile devices and, depending on their configuration, determine their performance.

Name Display Processor Drive Battery Communication Asus EEE PC 900 8.9 " 900 MHz Celeron 8 Gb SSD 4400-5200 mAh, up to 3h 30 min Ethernet, 802.11 b / g Msi wind 10" 1.6 GHz Atom 80-160 Gb SATA 2200-5200 mAh, 2.5-5.5h Ethernet, 802.11 b / g HP 2133 Mini-Note PC 8.9 " VIA C7 1.0-1.6 GHz SSD, SATA 4400-5200 mAh, 2.5-4h Ethernet, 802.11 a / b / g Dell Inspiron Mini 9 8.9 " 1.6 GHz Atom 4-16 Gb SSD 2200-3600 mAh, up to 5h Ethernet .802.11 b / g Nanobook 7 " VIA C7 1.2 GHz 30 Gb HDD up to 4.5h Ethernet .802.11 b / g Sony Vaio UX Micro PC 4.5 " Intel Core Solo 1.06-1.33 GHz SSD, HDD 1.5-7h 802.11 b / g Samsung SCH-i730 2.8 " Intel PXA 520 MHz SD standby - up to 180-280h 802.11 b

Since there are few such devices and (which is very important) their configuration is set by the manufacturer once and for all (there is the opportunity to replace the battery, increase the amount of memory or hard disk), you can attach some performance index to each model.

Device Performance rating Device 1 1000 Device 2 7000 Device 5 32000 Device 16 18000

In this case, the relative performance of the device is indicated. Conditional performance values can be taken from various tests - company experts can do this themselves using popular packages (for example, PCMark Vantage or Sysmark, which are suitable only for Windows platforms or other tests that can only rely on computing power). Also, in this case, a simple list of devices (Device No.) is given so that at this stage not to affect the interests of any companies.

Depending on the performance index, the user may be offered various installation options.

As an example, the following numbers can be given (in a real operating system, numbers may be different):

Performance rating Installation type <1000 Base (Management console, locations database, encryption tool) 1000-10000 Advanced (Added Antivirus, Firewall) > 10,000 All (Added Backup tool, Full base of intrusions description)

This will increase the flexibility of our system for various devices.

In conclusion, it should be noted that the information given in the description are only examples that do not limit the scope of the present utility model described by the formula. The person skilled in the art will understand that there may be other options for implementing this utility model, consistent with the nature and scope of this utility model.

Claims (20)

1. The security management system of a mobile device containing a battery monitoring device for monitoring the level and consumption of electricity associated with the control device of a custom security module; a custom security module for implementing security services of a mobile device associated with a control device for a custom security module; a localization device for determining a location of a mobile device associated with a database of localization profiles; a database of localization profiles, designed to store information about the risks of danger of many points of entry into the network with various locations associated with the control device of the custom security module; a user classification device designed to classify a user as a user according to actions taken in a mobile computing device by comparing actions with user models stored in a user profile database associated with a security module control device; a user action analysis device for collecting statistics of user actions in a mobile device and transmitting the received data to a user classification device; a user profile database for storing user models containing at least data about user behavior and user activity statistics that is associated with a user type determination device; a database of mobile device settings for storing mobile device settings associated with a custom security module control device; a custom security module control device for assessing hazard risk using localization profiles stored in a profile database corresponding to the location of the mobile device, dynamically setting up security services implemented in the security module, associated with a battery monitoring device, user classification device, custom module security, a database of mobile device parameters, a database of localization profiles. 2. The system according to claim 1, in which the mobile computing device may be such devices as a laptop, netbook, smartphone, mobile phone, communicator, thin client and contains at least a processor, memory, battery and communication device that provides connection for a mobile device. 3. The system of claim 2, wherein the communication device uses standard communication protocols to connect. 4. The system according to claim 1, in which the control device for the custom security module is also designed to assess the risk of danger using the parameters of the mobile device, which are stored in the database of the parameters of the mobile device. 5. The system according to claim 1, in which the parameters of the mobile device include at least the model name, battery capacity, processor performance, data rate. 6. The system according to claim 1, in which the battery monitoring device is designed to measure the remaining battery charge, the amount of power consumed, calculating the operating time of the mobile device without recharging, depending on the number of protection services included. 7. The system according to claim 1, in which the security module includes the following security services: antivirus, designed at least for signature and heuristic analysis; anti-spam designed to filter the email messages of a mobile device; an application control device that monitors application access to critical areas of the operating system and unauthorized actions; a firewall designed to control the connection to a mobile device over the network; backup system; system (dec-) data encryption. 8. The system according to claim 7, in which the protection services have an efficiency setting, depending on which the level of security of the mobile device and the power consumption of the battery change, and the power consumption is greater, the higher the level of efficiency of the protection service. 9. The system according to claim 1, in which the localization device is designed to determine the location by GPS, and / or using positioning in cellular networks, and / or by positioning relative to Wi-Fi stations, and / or using network services of the stack TCP / IP 10. The system according to claim 1, in which the localization profile includes at least the name of the local network, its location, the degree of risk of danger in this network and the minimum settings of the security module and is stored in a database, with one location There may be several local area networks. 11. The system according to claim 1, in which the database of localization profiles is stored on a remote server connected to the mobile device by means of a communication device, and / or in the memory of the mobile device. 12. The system according to claim 1, in which the set of entry points to the network is a set of devices that connect mobile devices to each other and connect the mobile device to Internet resources. 13. The system of claim 12, which prompts the user and / or automatically connects the mobile computing device to the most secure network if several network entry points are available at once. 14. The system according to claim 1, in which the control device for a custom security module for a specific location positioning device is designed to locate local networks corresponding to this location in the database of localization profiles, and for this network finds danger risks. 15. The system according to claim 1, in which the control device for said custom security module is configured to determine the name of the local network from the information about connecting to it and for this local network finds danger risks in the database of localization profiles. 16. The system of claim 14, wherein the control device for the custom security module is configured to connect protection services depending on the risk of danger and change their level of effectiveness, and the greater the risk, the greater the number of included services and the higher their level of effectiveness. 17. The system according to clause 15, in which the control device for the custom security module is configured to connect protection services depending on the risk of danger and change their level of effectiveness, and the greater the risk, the greater the number of included services and the higher the level of their effectiveness. 18. The system of claim 14, wherein the control device for the custom security module, depending on the data received from the battery monitoring device, connects protection services and changes their level of efficiency, and the larger the remaining battery capacity, the greater the number of included services and the higher the level their effectiveness. 19. The system of clause 15, in which the control device for a custom security module, depending on the data received from the battery monitoring device, connects protection services and changes their level of efficiency, and the larger the remaining battery capacity, the greater the number of included services and the higher the level their effectiveness. 20. The system according to claim 1, in which if the number of working protection services is determined by the battery level and / or location and / or type of user and / or efficiency settings determined by the battery level and / or location , and / or the type of user are different, the user is prompted to choose between the settings.