Application Resource Access Control via Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users are often unaware of additional computing resources accessed by applications during runtime, leading to undesirable permission requests and potential security concerns, as these resources may not be identified in the application's installation manifest.
Innovation Solution
A method to indicate during application installation that certain computing resources will be accessed, even if not initially listed in the manifest, minimizing runtime permission requests and enhancing user awareness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the installation manifest is updated to include all computing resources accessed by an application, then user awareness and security are improved, but the complexity of manifest maintenance and accuracy increases
Solution Approach 1:
The system performs preliminary analysis of the application binary to identify computing resources before installation. This advance action allows the manifest to be pre-populated with accurate resource information, eliminating the need for manual updates and reducing maintenance complexity while improving user awareness.
Solution Approach 2:
The system uses automated static analysis of the application binary to self-generate the list of computing resources. This self-service approach replaces manual manifest maintenance with an automated process that extracts resource information directly from the application code, reducing human effort and potential errors.
2Reliability
If permission requests are displayed during application execution, then runtime security control is improved, but user experience deteriorates due to disruptive prompts
Solution Approach 1:
Permission requests are displayed during installation rather than during runtime execution. This preliminary action allows users to review and approve all computing resources before the application starts, eliminating disruptive prompts during use while maintaining security control through informed user consent.
3Productivity
If the installation manifest is incomplete, then application installation speed is improved, but runtime permission requests increase and security awareness decreases
Solution Approach 1:
The manual process of creating and maintaining installation manifests is replaced with automated static analysis of the application binary. This substitution extracts computing resource information directly from the application code, ensuring completeness without adding manual overhead, thus maintaining installation speed while improving accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and devices for controlling access to computing resources are disclosed herein. In one example embodiment, the method comprises: executing an application at a first computing device, wherein an attempt to access a computing resource on the computing device is made by the application; determining that the application is not configured to access the computing resource, in response to the attempt; displaying, in a user interface of the computing device, a permission request to allow the application to access the computing resource; and transmitting data from the computing device to the application server, the data notifying the application server that the attempt to access the computing resource was made by the application when the application was not configured to access the computing resource, and the data being usable by the application server to determine whether a corresponding computing resource on at least one different computing device is likely to be accessed when the application is executed on the at least one different computing device.