Mobile App Risk Analysis Using Privacy-Preserving Hash Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively assess and mitigate risks posed by applications on mobile devices, potentially leading to malicious activities that compromise privacy and security, especially when these devices access enterprise networks.
Innovation Solution
A method and system that utilize cryptographic representations of application information to compare against a database, allowing for automatic remediation of risky applications by quarantining or retiring them if they match known risks, while maintaining user privacy by not logging identifying information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If cryptographic representations of application information are used for security analysis, then user privacy is maintained, but the ability to detect and remediate risky applications is reduced
Solution Approach 1:
A cryptographic intermediary layer is introduced between the application information and the security analysis system. The mobile device management system generates cryptographic representations (hashes) of application information locally on the user's device, then transmits only these cryptographic representations to the application risk control system for analysis. This intermediary cryptographic transformation allows the system to analyze applications for security risks without exposing the actual application data, thereby maintaining user privacy while enabling effective risk detection.
2Reliability
If comprehensive application information is collected for security analysis, then risk detection accuracy is improved, but user privacy is compromised
Solution Approach 1:
The system extracts only the essential cryptographic characteristics of application information needed for security analysis, while leaving the actual application data on the user's device. Specifically, the mobile device management system extracts application identifiers, hashes, and other cryptographic representations from the application information, then transmits only these extracted cryptographic elements to the application risk control system. This extraction approach provides sufficient data for accurate risk detection while preserving the privacy of the complete application information.
3Productivity
If automatic remediation is implemented for detected risks, then security response time is reduced, but system complexity increases
Solution Approach 1:
The system performs preliminary configuration of remediation actions and policies before security incidents occur. The mobile device management system pre-establishes remediation policies, thresholds, and response procedures in the application risk control system. When risky applications are detected through cryptographic analysis, the pre-configured remediation actions can be automatically executed without requiring complex real-time decision-making logic. This preliminary preparation enables rapid automated response while keeping the system architecture relatively simple.
Data Source
AI summary
Systems and methods for analyzing applications (“apps”) on a mobile device for security risks for a company while maintaining the mobile device owner's privacy and confidentiality concerning the applications. The mobile device may be a user's personal device (a “bring your own device”). In an example method, a process generates one or more cryptographic representations of application information for each application on the mobile device. The cryptographic representations may comprise a hash or composite hash. The cryptographic representations may be transmit outside the mobile device to a system which makes a determination and provides an indication whether the application is permitted or not permitted for use at the company. The company can be associated with a hashed permitted or not permitted list. The application information can include application name, executable code, and a version number. The method may include automatically remediating the application if it matches a known risk.