Mobile Threat Logging With Privacy-Preserving Event Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile devices lack system-wide threat detection capabilities due to privacy concerns, as applications cannot access data across both work and personal domains, limiting the effectiveness of security products in detecting security threats originating from the personal side without compromising user privacy.
Innovation Solution
Implement on-device detection modules that analyze both personal and work profiles, generating threat events, and an endpoint resilience framework that filters and anonymizes data before transmission to remote entities, ensuring privacy is maintained.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If applications can access data across both work and personal domains to detect security threats systemwide, then threat detection capability is improved, but user privacy is compromised
Solution Approach 1:
The system segments data access by maintaining separate work and personal domains while allowing the detection module to access both through the OEM framework. This enables threat detection across both domains without applications directly accessing personal data, thus preserving user privacy while improving detection capability.
Solution Approach 2:
The OEM framework acts as an intermediary between applications and data domains. It provides a controlled interface that allows detection modules to access both work and personal data for security analysis without applications having direct access to personal domain data, thereby maintaining privacy boundaries while enabling systemwide threat detection.
2Object-affected harmful factors
If no data leaves the device to protect user privacy, then user privacy is maintained, but the ability to implement security defenses is limited
Solution Approach 1:
The system performs preliminary threat detection and analysis locally on the device before any data sharing occurs. The detection module analyzes data from both domains and generates security events locally, enabling security defenses to be implemented without requiring data to leave the device for analysis purposes.
Solution Approach 2:
The device performs self-diagnosis and self-protection by executing detection modules that can access both work and personal domains through the OEM framework. The system serves its own security needs by generating and processing security events locally, eliminating the need to export data for external analysis while maintaining both privacy and security defense capabilities.
3Adaptability or versatility
If detection modules access both personal and work profiles to detect threats, then systemwide threat detection is improved, but data privacy restrictions are violated
Solution Approach 1:
The OEM framework provides universal access rights to the detection module, enabling it to access both work and personal profiles for security analysis. This multi-functional access capability allows systemwide threat detection without requiring separate access mechanisms for each domain, simplifying the overall data access control architecture while improving detection versatility.
Data Source
AI summary
To detect security threats to an enterprise mobile device with a personal profile and a work profile, detection modules on the enterprise mobile device receive events describing security threats detected in data from the personal profile and the work profile. The received events are stored in a security log on the enterprise mobile device. When requests from a remote entity for stored events, to evaluate security threats against the enterprise mobile device, the events are filtered to remove private data prior to transmission to the remote entity, such that the events are anonymized. The filtering may occur either prior to or after storing the events in the security log.