App Security Enforcement Layer for Mobile Device Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The proliferation of apps on mobile devices poses security risks due to vulnerabilities in data transmission and potential damage to devices, with existing anti-virus approaches failing to effectively contain damage from malware-infected apps without requiring kernel alterations or specialized secure programming from app authors.

Innovation Solution

An app security enforcement layer is integrated into mobile devices to secure app execution, allowing unsecured apps to run safely by applying security policies that control interactions with the operating system, enabling actions such as allowing, enhancing, blocking, or terminating app calls, and providing transparent security measures to users.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional anti-virus approaches are used, then some malware detection is possible, but damage done by apps cannot be removed and security protection is insufficient

Engineering Contradiction:

Improvesecurity protectionVSAvoiddamage from malware-infected apps

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

An app security enforcement layer is introduced as an intermediary component between the app and the device operating system. This enforcement layer intercepts and controls all calls from apps to the OS, enabling security policies to be applied without modifying the app itself or the device kernel. The enforcement layer acts as a mediator that can allow, block, enhance, or terminate app calls based on security assessments.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If black listing of apps is used, then some protection is provided, but it is not adequate for containing damage from infected apps and requires manual updates

Engineering Contradiction:

Improvedevice protectionVSAvoidability to contain damage from new malware

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary security assessments of apps before they are allowed to execute or cause damage. The enforcement layer evaluates apps against security policies in advance, and can prevent malicious apps from executing harmful operations. This preliminary action approach allows the system to contain damage from new malware strains without requiring manual blacklisting updates.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If kernel alteration is used to secure apps, then security control is improved, but device complexity increases and existing devices cannot be secured

Engineering Contradiction:

Improveapp execution securityVSAvoidkernel modification requirements

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The security enforcement functionality is segmented into a separate, standalone component (the enforcement layer) that operates independently from the device kernel. This segmentation allows the security mechanism to be added as a separate layer without modifying or complicating the existing kernel codebase, making it compatible with existing devices while providing robust security control.

Inventive Principle:

Principle #1Segmentation

4Reliability

If secure programming training is required from app authors, then app security is improved, but ease of app development decreases

Engineering Contradiction:

Improveapp securityVSAvoidapp development process

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The app security enforcement system operates autonomously without requiring app developers to implement security code or undergo security training. The enforcement layer automatically assesses and controls app behavior based on security policies, allowing developers to continue writing apps using standard practices while the system provides self-service security protection.

Inventive Principle:

Principle #25Self-service

5Reliability

If security measures are added to devices, then security protection is improved, but device complexity and user transparency are affected

Engineering Contradiction:

Improvedevice securityVSAvoiduser transparency of security measures

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The enforcement layer serves as an invisible intermediary that transparently mediates between apps and the operating system. Users interact with apps normally without being aware of the security enforcement mechanisms. The enforcement layer handles security assessments and control decisions in the background, maintaining user convenience while providing robust security protection.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8955142B2Secure execution of unsecured apps on a device

Publication Date: 2015.02.10 BLUE CEDAR NETWORKS INC

AI summary

Devices are pre-deployed with an app security mechanism to ensure that apps that are downloaded onto the device do not cause data loss, data leakage, or other harm to the device. A user can start using the device and downloading apps in a conventional or typical manner and be assured that security measures are being taken to minimize potential harm for unsecured and secured apps. An app security enforcement layer or engine operates with, for example, a Type 2 hypervisor on the device, and ensures that any calls by the apps to the operating system of the device are generally safe. Measures such as enhancing or modifying the call, obfuscating the call, or terminating the app may be taken to protect the operating system. These actions are taken based on a policy that may be either interpreted or compiled by the enforcement engine with respect to app execution. The security measures are generally transparent to the user of the device.