Mobile App Security via User Behavior Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile applications lack effective security measures to differentiate between real human user interactions and automated processes, making them vulnerable to malicious attacks, particularly in transactions involving financial data or sensitive information.
Innovation Solution
Incorporating a client security component within mobile applications to collect user behavior attributes such as navigation velocity, input sequence, and error rates, which are then transmitted to a server security component for validation, determining the legitimacy of user interactions and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mobile applications use traditional mobile APIs to communicate with web services, then data exchange between client and server is simplified, but security validation to differentiate human users from automated processes is lost
Solution Approach 1:
The patent segments the mobile application into distinct functional components: a security component that collects user behavior attributes, an API component that handles data exchange, and a coordination layer that integrates them. This segmentation allows the security functionality to be added without disrupting the simplified data exchange flow of traditional mobile APIs.
Solution Approach 2:
The patent introduces user behavior attributes as an intermediary element between the mobile application and web service. These attributes serve as a mediator that carries security validation information through the existing API communication channel, enabling security validation without breaking the simplified data exchange mechanism.
2Reliability
If security components are added to mobile applications to collect user behavior attributes, then ability to detect real user interaction is improved, but device processor and memory loads increase
Solution Approach 1:
The security component collects a selective subset of user behavior attributes that are most indicative of human interaction patterns, rather than monitoring all possible device activities. This partial action approach provides sufficient security validation while minimizing the processing and memory resources required.
Solution Approach 2:
The security component leverages existing device resources and ongoing application operations to collect user behavior attributes, rather than creating separate dedicated monitoring processes. By utilizing already-running system services and existing data flows, the component achieves security detection with minimal additional energy consumption.
3Measurement precision
If user behavior attributes are collected and transmitted with each web service request, then security validation accuracy is improved, but network communication overhead increases
Solution Approach 1:
The patent applies different levels of security validation by transmitting user behavior attributes selectively based on the specific web service request and its security requirements. Critical operations receive comprehensive attribute validation, while less sensitive operations use simplified validation, optimizing the balance between accuracy and network overhead.
Solution Approach 2:
The system dynamically adjusts the level of detail in user behavior attributes transmitted based on contextual factors such as request type, user authentication state, and security risk assessment. This parameter change approach maintains high validation accuracy for critical operations while reducing network data volume for routine operations.
Data Source
AI summary
Techniques to facilitate detection of real user interaction with mobile applications are disclosed herein. In at least one implementation, a mobile application that generates a web service request is executed on a wireless communication device. The wireless communication device executes a client security component of the mobile application to include user behavior attributes in the web service request, and utilizes a mobile application programming interface to transfer the web service request including the user behavior attributes for delivery to a web server. The web server executes a server security component of a web service to extract the user behavior attributes from the web service request and process the user behavior attributes to determine whether or not the mobile application is being operated by a human user.