Mobile Device Application Scanning via Intermediary Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in securing personal mobile devices used by employees for work purposes, as they cannot control or vet all applications installed on these devices, leading to a risk of malware infections from various sources, including third-party application stores.
Innovation Solution
Integration of malware scanning into mobile device management software deployed by enterprises, which scans client applications for compliance with predefined policies, identifies and remediates unauthorized or malicious applications, and ensures only approved applications are installed on enrolled devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If enterprises allow employees to install applications freely on personal mobile devices, then ease of operation and user autonomy are improved, but security reliability deteriorates due to malware infection risks from unvetted sources
Solution Approach 1:
The patent introduces an intermediary scanning service that acts as a mediator between the application installation process and the device. This service receives application information, scans it for malware, and provides scan results back to the device before installation occurs. This intermediary layer enables free application installation while maintaining security through pre-installation scanning, directly resolving the contradiction between user autonomy and device security.
2Reliability
If enterprises implement rigorous application vetting and scanning processes, then security reliability is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent extracts the complex scanning and vetting operations from the mobile device itself and relocates them to an external scanning service. The device only needs to communicate application information to the service and receive scan results, while the heavy lifting of malware detection is performed remotely. This extraction reduces device complexity while maintaining rigorous security scanning capabilities.
Solution Approach 2:
The patent uses copying by transmitting application information (such as package names, hashes, or metadata) to the scanning service for analysis, rather than requiring the full application binary to be present on the device during scanning. This copying approach simplifies the scanning process and reduces the computational burden on the device while maintaining security effectiveness.
3Reliability
If enterprises block installation from third-party application stores, then security reliability is improved, but adaptability and access to legitimate applications deteriorate
Solution Approach 1:
The patent implements preliminary scanning of applications before installation, regardless of their source. By scanning applications in advance from any source (including third-party stores) and only blocking those that fail the security check, the system maintains both high security reliability and broad adaptability. Users can access legitimate applications from third-party stores while malware is prevented through pre-installation scanning.
Data Source
AI summary
Disclosed are various approaches for integrating application scanning into a mobile enterprise computing management system. A management service instructs the client device to provide a list of installed applications to the management service and receives the list of installed applications from the client device. The management service then adds the list of installed applications to an aggregate listing of applications representing a list of client applications installed on one or more client devices. Subsequently, the management service sends to a scanning service a policy comprising an identifier of a client application that is prohibited on the client device. The management service also sends the aggregate listing of applications to the scanning service. The management service then receives a notification from the scanning service that the prohibited client application is present in the aggregate listing of applications. In response, the management service determines whether the prohibited client application is installed on the client device and instructs the client device perform a remedial action specified by the policy.