Security Decision Module for Application Permission Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious software can infiltrate computing devices through seemingly legitimate applications, leading to unauthorized data collection and transmission, posing a challenge in mitigating its effects effectively.
Innovation Solution
A dedicated module on the computing device, referred to as the Security Decision Module, receives information from a malicious software detector to control application permissions, inhibiting specific permissions to applications suspected of being malicious, thereby mitigating their harmful effects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system grants all requested permissions to applications, then application functionality is maximized, but malicious software can access and transmit unauthorized data
Solution Approach 1:
The patent applies local quality by differentiating permission grants based on application trustworthiness. Trusted applications receive full permission sets, while untrusted or suspicious applications receive limited or restricted permissions. This localized differentiation allows the system to maximize functionality for legitimate applications while preventing data access by malicious software, resolving the contradiction between security and functionality.
Solution Approach 2:
The patent implements preliminary action through pre-installation of trusted application lists and pre-configured permission policies. Before an application can access data, the system preliminarily checks whether the application is on the trusted list or has been verified as safe. This advance preparation enables the system to automatically grant or restrict permissions without requiring real-time user intervention, thus maintaining both security and ease of operation.
2Reliability
If the system restricts permissions for applications, then data protection is improved, but legitimate applications may be hindered from functioning properly
Solution Approach 1:
The patent employs feedback mechanisms where the system continuously monitors application behavior and updates trust assessments. When an application demonstrates trusted behavior patterns, the system feedbacks by granting fuller permission access. Conversely, when suspicious behavior is detected, permissions are restricted. This dynamic feedback loop ensures that legitimate applications maintain full functionality while malicious software is progressively denied access, balancing protection with productivity.
Solution Approach 2:
The patent applies dynamics by making permission grants adjustable and adaptable rather than static. The system dynamically modifies permission levels based on real-time application behavior, user actions, and threat intelligence. This dynamic approach allows the system to grant full permissions to benign applications (maintaining productivity) while automatically tightening restrictions on potentially malicious applications (ensuring data protection).
3Object-affected harmful factors
If the system implements comprehensive permission control, then malicious software impact is reduced, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary layer in the form of a permission management module that sits between applications and the operating system. This intermediary handles all permission decisions, abstraction, and enforcement logic, shielding users and simplifying the overall system architecture. The intermediary translates complex security policies into simple allow/deny decisions, reducing the burden on both applications and users while effectively limiting malware impact through centralized control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for mitigating the effects of a malicious software application are disclosed. A dedicated module on the computing device receives from a malicious software detector a message indicating whether the application is malicious or has a malicious component. The dedicated module obtains a set of permissions to be granted to the application, and instructs software on the computing device that controls the permissions of the application to grant the set of permissions.