Device-Specific Security Policy Generation via Application Interaction Monitoring

Solution Overview

Problem

Traditional security systems are ineffective in generating customized security policies for applications across various computing environments, as they fail to account for device-specific configurations and unique security threats, requiring manual and time-consuming administrator intervention.

Innovation Solution

A system and method that monitors application interactions with the computing environment to identify required resources and potential security concerns, generating device-specific security policies that allow necessary access while mitigating risks, by installing the application in a container and using a backend security server to enforce policies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional security systems create general security policies, then policy implementation is simple, but the policies are ineffective against device-specific security threats

Engineering Contradiction:

Improvesecurity effectivenessVSAvoidpolicy customization complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs preliminary monitoring of application interactions with the computing environment before generating security policies. The monitoring module observes application behavior, identifies required computing resources, and detects potential security concerns during a monitoring period, then uses this pre-collected information to generate accurate device-specific security policies that are effective against device-specific threats.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system enables self-service by automatically generating security policies without requiring manual administrator intervention. The generation module autonomously creates device-specific security policies based on monitored application behavior and identified security concerns, eliminating the need for administrators to manually analyze computing resources and configure policies on each device.

Inventive Principle:

Principle #25Self-service

2Reliability

If administrators manually create customized security policies for each device, then policies can be tailored to device-specific threats, but the process is time-consuming and tedious

Engineering Contradiction:

Improvedevice-specific security protectionVSAvoidpolicy creation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system enables self-service by automatically generating security policies without requiring manual administrator intervention. The generation module autonomously creates device-specific security policies based on monitored application behavior and identified security concerns, eliminating the need for administrators to manually analyze computing resources and configure policies on each device.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system implements feedback by continuously monitoring application interactions and using this information to generate and refine security policies. The monitoring module provides ongoing data about application behavior and security concerns, which the generation module uses to create accurate policies, and the system can update policies based on new monitoring data, creating a continuous improvement loop.

Inventive Principle:

Principle #23Feedback

3Measurement precision

If administrators manually analyze all computing resources and security threats, then comprehensive security policies can be created, but administrators are unable to comprehensively analyze all resources

Engineering Contradiction:

Improvesecurity analysis comprehensivenessVSAvoidadministrative burden

Core Design Contradiction:

Measurement precisionVSEase of operation

Solution Approach 1:

The system enables self-service by automatically generating security policies without requiring manual administrator intervention. The generation module autonomously creates device-specific security policies based on monitored application behavior and identified security concerns, eliminating the need for administrators to manually analyze computing resources and configure policies on each device.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system replaces the mechanical process of manual administrator analysis with automated computational processes. The monitoring module automatically observes and records application interactions, the analysis module processes this data to identify security concerns, and the generation module creates policies, substituting human administrative effort with automated systems that can comprehensively analyze all computing resources.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10243963B1Systems and methods for generating device-specific security policies for applications

Publication Date: 2019.03.26 GEN DIGITAL INC

AI summary

The disclosed computer-implemented method for generating device-specific security policies for applications may include (1) installing, onto a computing device, an application requested by the computing device, (2) while the application is running on the computing device, monitoring interactions between the application and a computing environment in which the computing device operates to identify (A) computing resources within the computing environment required by the application and (B) potential security concerns related to the application within the computing environment, and then (3) generating, based on the monitored interactions, a set of device-specific security policies to enforce for the application while the application runs on the computing device that allow the application to access the required computing resources while mitigating the potential security concerns. Various other methods, systems, and computer-readable media are also disclosed.