Mobile App Physical Device Detection via Attribute Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile applications running on software-based platforms, such as emulators and virtual machines, are vulnerable to security attacks as existing communication protocols lack validation for the legitimacy of requests, making it difficult to distinguish between physical and non-physical device executions.
Innovation Solution
A mobile application collects attributes related to the device and operating environment, which are then sent to a web server for processing using a client security component, allowing the server to determine if the application is running on a physical device, thereby enhancing security by validating legitimate requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mobile applications use traditional mobile APIs for communication with web servers, then the ease of operation and data exchange capability is improved, but the security and ability to validate legitimate requests deteriorates
Solution Approach 1:
The patent introduces device attributes as an intermediary element between the mobile application and web server. These attributes serve as a mediator that carries information about the execution environment (physical device vs. emulator) without changing the underlying mobile API communication mechanism. The attributes are added to existing request parameters, allowing security validation to occur within the established communication framework without disrupting ease of operation.
2Adaptability or versatility
If software-based platforms like emulators and virtual machines are used to run mobile applications, then the adaptability and versatility are improved, but the security vulnerability and ease of exploitation increases
Solution Approach 1:
The patent changes the parameter space by introducing new device attributes that describe the execution environment. These attributes (such as those indicating physical device characteristics) modify the information available to both client and server, enabling differentiation between legitimate physical device executions and software-based emulator executions. This parameter change allows security mechanisms to adapt to the diverse execution environments while maintaining the versatility of running applications on different platforms.
3Ease of manufacture
If existing communication protocols are used without additional security techniques, then the simplicity and ease of manufacture are improved, but the ability to detect and prevent malicious requests deteriorates
Solution Approach 1:
The patent applies preliminary action by collecting device attributes on the client side before the request is sent to the web server. The mobile application or intermediary component gathers information about the execution environment in advance and includes these attributes in the request parameters. This preliminary collection and preparation of security-related information enables the server to perform detection and validation without adding complex security mechanisms to the communication protocol itself, maintaining simplicity while improving detection capability.
Data Source
AI summary
Techniques to facilitate detection of whether or not applications are executed on physical devices are disclosed herein. In at least one implementation, a mobile application that generates a web service request is executed on a computing system. The computing system executes a client security component of the mobile application to collect attributes associated with the computing system and an operating environment on which the mobile application is executing, and utilizes a mobile application programming interface to transfer the web service request including the attributes for delivery to a web server. The web server executes a server security component of a web service to extract the attributes from the web service request and process the attributes to determine whether or not the mobile application is being executed on a physical mobile device.