Mobile App Security via Server-Side Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems for managing applications on mobile devices face challenges in ensuring secure information exchange without constant connectivity and risk high exposure of sensitive corporate data, especially when applications are stored locally.

Innovation Solution

A system that employs a server to manage applications by authenticating users, supplementing applications with AppGuard code for validation, and monitoring network access, allowing for secure regulation of information exchange and application functionality, even without persistent connections.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If applications are stored locally on the appliance, then the user can work with the application without constant connection, but the security of sensitive information is compromised

Engineering Contradiction:

Improveability to work without constant connectionVSAvoidsecurity of sensitive information

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system segments the application into two parts: the core application functionality stored locally on the appliance, and the sensitive corporate data remaining on the server. The application communicates with the server through controlled interfaces, allowing local execution while maintaining security through separation of concerns.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The server acts as an intermediary between the local application and corporate resources. It provides a controlled interface that allows the application to access necessary data and services while enforcing security policies, authentication, and authorization mechanisms that prevent unauthorized access to sensitive information.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If applications are downloaded to the appliance, then remote working is enabled, but corporate intellectual property may be exposed

Engineering Contradiction:

Improveremote working capabilityVSAvoidexposure of corporate intellectual property

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by implementing security controls, authentication mechanisms, and data protection measures before the application is deployed to the appliance. Security policies are pre-configured on the server to control what data can be accessed, when, and under what conditions, preventing exposure before it can occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Different security measures are applied to different parts of the system. The appliance receives only the minimum necessary data for local operation, while sensitive corporate intellectual property remains protected on the server with appropriate access controls. Each component has security properties tailored to its specific function and risk profile.

Inventive Principle:

Principle #3Local quality

3Reliability

If a persistent connection is maintained between appliance and server, then security is improved, but network limitations and signal quality issues are exacerbated

Engineering Contradiction:

Improvesecurity through persistent connectionVSAvoidnetwork connectivity requirements

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

Instead of maintaining a persistent connection, the system uses periodic authentication and validation. The appliance connects to the server periodically to verify its authorization status, receive security updates, and synchronize data. This approach maintains security through regular server verification while minimizing continuous network dependency.

Inventive Principle:

Principle #19Periodic action

Data Source

PatentEP4093075A1System and methods to store, retrieve, manage, augment and monitor applications on appliances

Publication Date: 2022.11.23 MALIKIE INNOVATIONS LTD

Figure 1
Figure 2A
Figure 2B

AI summary

A method at a server for controlling an application held on a mobile device, comprising: receiving a request to download an application; responsive to receipt of the request, providing the application supplemented with executable supplemental code to the mobile device; maintaining permission settings associated with the application and the mobile device; receiving a request from the mobile device for permission to access the application, including data regarding an environmental condition of the mobile device comprising: the location of, or a relation to user accessories of the mobile device, the request having been caused to be sent by execution of the supplemental code; based on the received data regarding the mobile device and the permission settings, determining whether the permission to access the application is valid or invalid; in response to determining an invalid permission, providing permission data indicating that access from the application to persistent data within the mobile device is denied; and in response to determining a valid permission, providing permission data indicating that access from the application to the persistent data within the mobile device is permitted.