Private Mobile App Risk Analysis Using Cryptographic Hashes

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing systems lack effective methods to assess and mitigate risks posed by applications on mobile devices, potentially leading to malicious activities that compromise network security and user privacy, especially in environments where personal devices are used to access enterprise networks.

Innovation Solution

A method and system that utilize cryptographic representations of application information to compare against a database, automatically remediating applications identified as security risks, while maintaining user privacy by not logging identifying information, and employing a risk scoring system to determine if an application should be permitted or quarantined based on its behavior and risk score.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional application analysis methods are used to detect security risks, then security risk detection capability is improved, but user privacy is compromised due to logging of identifying information

Engineering Contradiction:
Improvesecurity risk detection capabilityVSAvoiduser privacy
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent extracts only the cryptographic hash of application information from the mobile device, leaving identifying information behind. This allows the server to perform security analysis on application behavior without obtaining user-identifiable data, thus resolving the contradiction between security detection and privacy protection

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces cryptographic hash values as an intermediary representation of application information. This mediator enables the server to analyze application risks without directly accessing or logging sensitive identifying information, achieving both security monitoring and privacy preservation

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If the system accesses mobile device configuration directly to analyze applications, then security analysis accuracy is improved, but device complexity and user privacy are compromised

Engineering Contradiction:
Improvesecurity analysis accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent creates a cryptographic copy (hash) of the application information that preserves the essential characteristics needed for security analysis while eliminating the need for direct device access. This copy enables accurate risk assessment without increasing system complexity or compromising privacy

Inventive Principle:
Principle #26Copying

3Reliability

If comprehensive application monitoring is implemented to detect malicious activities, then network security is improved, but user privacy and device autonomy are reduced

Engineering Contradiction:
Improvenetwork securityVSAvoiduser privacy
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The mobile device autonomously generates cryptographic hashes of its application information and submits them for analysis without requiring user intervention or surrendering identifying information. This self-service approach enables security monitoring while preserving user privacy and device autonomy

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3213243B1Systems and methods for privately performing application security analysis
Publication Date: 2020.09.09 PROOFPOINT INC
  • EP3213243B1 patent drawingFigure 1
  • EP3213243B1 patent drawingFigure 2
  • EP3213243B1 patent drawingFigure 3

AI summary

Systems and methods for analyzing applications on a mobile device for risk so as to maintain the privacy of the application user are provided. In the example method, the process receives a request from a mobile device. The request includes a cryptographic representation of application information for an application residing on a mobile device. The method includes comparing the cryptographic representation to an application information database that includes cryptographic representations of applications. The method also includes automatically remediating, e.g., quarantining and retiring, the application if the application matches an application that is a known risk in the database. Exemplary embodiments provide companies with controls to prevent specific applications - which have specific behaviors and are present on mobile devices being used by employees - from being used by employees, without the company having any visibility into what particular applications are being used by the employees on the mobile device.