Application Permission Notification via API Sensitivity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often have low awareness and visibility regarding application permissions during the installation of applications, which can lead to unauthorized access to sensitive data, especially when multiple applications are downloaded to a device.
Innovation Solution
A system and method for managing application permissions that includes detecting API calls, determining their sensitivity level, and providing notifications to users through secure mechanisms like SSL protocol and visual indicators, ensuring only authorized applications access sensitive data by verifying the author's trustworthiness through trusted entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If application permissions are granted during installation without real-time notifications, then application installation and operation are simplified, but user awareness and visibility of sensitive data access are reduced
Solution Approach 1:
The patent implements real-time notification mechanisms that provide feedback to users whenever an application accesses sensitive data through API calls. This feedback loop maintains user awareness without interfering with the installation process, as notifications are triggered only during actual data access events rather than during installation.
Solution Approach 2:
The patent establishes permission frameworks and notification mechanisms in advance during system setup, but these mechanisms remain dormant until actually needed. The preliminary action involves setting up the monitoring infrastructure without requiring user intervention during installation, then activating notifications only when sensitive data access occurs.
2Reliability
If real-time notifications and secure access controls are implemented, then user security and awareness are enhanced, but system complexity and processing overhead increase
Solution Approach 1:
The patent segments the permission management system into distinct modules: API call detection components, sensitivity level determination components, and notification generation components. This segmentation allows each module to perform its specific function efficiently without requiring the entire system to be complex, maintaining reliability while managing complexity through modular architecture.
Solution Approach 2:
The patent introduces intermediary components that act as mediators between applications and the operating system's permission system. These intermediaries detect API calls, determine sensitivity levels, and manage notification triggers, thereby simplifying the overall system architecture by centralizing complex logic in dedicated intermediary layers rather than distributing complexity throughout the entire system.
3Reliability
If sensitivity levels are determined for all API calls, then data protection is improved, but processing time and computational resources are consumed
Solution Approach 1:
The patent applies sensitivity determination selectively rather than uniformly to all API calls. The system identifies and applies sensitivity level determination only to API calls that match predefined sensitive data categories or patterns, allowing most routine API calls to proceed without the overhead of sensitivity analysis, thereby protecting sensitive data while minimizing processing time impacts.
Solution Approach 2:
The patent implements partial sensitivity checking where only necessary portions of API call parameters are analyzed for sensitivity. Rather than examining every detail of every API call, the system performs targeted sensitivity determination on relevant parameters only, achieving adequate data protection with reduced computational overhead and processing time.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Methods, systems, and computer-readable media for granting application permissions and providing notifications of API activity are provided. An example method may include receiving a first API call by an installed application. The method may further include determining a sensitivity level of the received first API call. The method may further include when the determined sensitivity level of the received first API call is associated with a restricted API classification, determining whether an author of the installed application is an authorized author, and when the author of the installed application is determined to be an authorized author, allowing the received first API call access to its associated API. An example system may include instructions that, when executed by the one or more processors, cause the one or more processors to detect an API call by an application, the API call for accessing data associated with a computing device, determine a sensitivity level of the API call based on the associated data, and provide an indication of the API call based on the determined sensitivity level.