Mobile App Hash Screening for Enterprise Security and User Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively assess and mitigate risks posed by applications on mobile devices, potentially leading to malicious activities that compromise privacy and security, especially in enterprise networks, without violating user privacy or requiring direct access to device information.
Innovation Solution
A method and system that generate and compare cryptographic representations of application information, using a risk control system to identify and remediate risky applications by quarantining or retiring them, while maintaining user privacy through anonymized data transmission and whitelisting/blacklisting mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic representations of application information are transmitted to a risk control system for analysis, then security risk detection capability is improved, but user privacy protection is maintained through anonymization
Solution Approach 1:
The patent extracts only the cryptographic representation (hash) of application information from the mobile device and transmits it to the risk control system, leaving the actual application data and user privacy information on the device. This extraction principle allows security analysis without compromising user privacy.
Solution Approach 2:
The patent introduces a cryptographic hash function as an intermediary that transforms application information into a cryptographic representation. This intermediary enables the risk control system to analyze application risks without directly accessing or exposing sensitive user data, thus maintaining privacy while detecting security threats.
2Reliability
If the risk control system analyzes application information to detect malicious applications, then security protection is improved, but system complexity increases due to cryptographic operations and database comparisons
Solution Approach 1:
The patent creates a cryptographic copy (hash) of the application information that can be stored and compared in the risk control system's database. This copying approach allows for efficient security checks without requiring the system to handle or analyze the complex original application data, thus reducing system complexity while maintaining security protection.
3Productivity
If automated remediation actions are taken against risky applications, then security response efficiency is improved, but user convenience may be reduced due to automatic application removal or device quarantine
Solution Approach 1:
The patent implements automated remediation where the risk control system automatically takes actions such as blocking network access or quarantining devices based on the cryptographic analysis results. This self-service approach improves security response efficiency by eliminating manual intervention, while the automated nature ensures consistent and timely responses to security threats.
Data Source
AI summary
Systems and methods for analyzing applications (“apps”) on a mobile device for security risks for a company while maintaining the mobile device owner's privacy and confidentiality concerning the applications. The mobile device may be a user's personal device (a “bring your own device”). In an example method, a process generates one or more cryptographic representations of application information for each application on the mobile device. The cryptographic representations may comprise a hash or composite hash. The cryptographic representations may be transmit outside the mobile device to a system which makes a determination and provides an indication whether the application is permitted or not permitted for use at the company. The company can be associated with a hashed permitted or not permitted list. The application information can include application name, executable code, and a version number. The method may include automatically remediating the application if it matches a known risk.