Mobile App Risk Analysis Using Privacy-Preserving Hash Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively assess and mitigate risks posed by applications on mobile devices, potentially leading to malicious activities that compromise privacy and security, especially when these devices access enterprise networks.
Innovation Solution
A method and system that utilize cryptographic representations of application information to compare against a database, allowing for automatic remediation of risky applications by quarantining or retiring them if they match known risks, while maintaining user privacy by not logging identifying information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional application security analysis methods are used to detect malicious applications on mobile devices, then security risk detection capability is improved, but user privacy is compromised due to logging of identifying information
Solution Approach 1:
The patent extracts only the cryptographic hash of application information from the mobile device for transmission to the risk control system, leaving out all identifying information such as application names, version numbers, and device identifiers. This extraction approach enables security analysis while preserving user privacy.
Solution Approach 2:
The patent introduces cryptographic hash functions as an intermediary mechanism that transforms application information into a form that can be analyzed for security risks without revealing the original identifying information. The hash acts as a mediator between security detection requirements and privacy protection goals.
2Measurement precision
If comprehensive application information is collected for security analysis, then detection accuracy is improved, but system complexity and data transmission overhead increase
Solution Approach 1:
The patent extracts only the essential cryptographic hash of application information for transmission to the risk control system, eliminating the need to collect and process comprehensive application details. This extraction approach maintains detection accuracy while significantly reducing system complexity and data transmission overhead.
3Speed
If real-time application risk assessment is implemented, then security response time is improved, but computational resources and energy consumption increase
Solution Approach 1:
The patent extracts only the cryptographic hash of application information for transmission and analysis, avoiding the need to process and analyze comprehensive application data in real-time. This approach enables fast security response while minimizing computational resource requirements and energy consumption on mobile devices.
Data Source
AI summary
Systems and methods for analyzing applications (“apps”) on a mobile device for security risks for a company while maintaining the mobile device owner's privacy and confidentiality concerning the applications. The mobile device may be a user's personal device (a “bring your own device”). In an example method, a process generates one or more cryptographic representations of application information for each application on the mobile device. The cryptographic representations may comprise a hash or composite hash. The cryptographic representations may be transmit outside the mobile device to a system which makes a determination and provides an indication whether the application is permitted or not permitted for use at the company. The company can be associated with a hashed permitted or not permitted list. The application information can include application name, executable code, and a version number. The method may include automatically remediating the application if it matches a known risk.