OFF-DEVICE ANTI-MALWARE PROTECTION FOR MOBILE DEVICES

• US 20130227636A1
• Filed: 01/11/2013
• Published: 08/29/2013
• Est. Priority Date: 02/24/2012
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Appthority Incorporated (Gen Digital Inc.)
• Inventors: Bettini, Anthony John, Watkins, Kevin, Guerra, Domingo J., Price, Michael
• Granted Patent: US 8,918,881 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

Techniques for off-device anti-malware protection for mobile devices are disclosed. In some embodiments, off-device anti-malware protection for mobile devices includes receiving a software inventory for a mobile device, in which the software inventory identifies a plurality of applications installed on the mobile device; and determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on a policy. In some embodiments, the off-device anti-malware protection for mobile devices further includes enforcing the policy on the mobile device. In some embodiments, the off-device anti-malware protection for mobile devices is provided as a cloud service.

Claims

1. A system for off-device anti-malware protection for mobile devices, comprising:

a processor configured to;

receive a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device; and

determine whether one or more of the plurality of applications identified in the software inventory are associated with malware based on a policy; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the software inventory for the mobile device is received at a cloud service for providing off-device anti-malware protection for mobile devices.

3. The system recited in claim 1, wherein the policy includes one or more of the following:

a malware policy, a privacy policy, and an enterprise configured application security policy.

4. The system recited in claim 1, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, and wherein the MDM provisioning profile generates the software inventory for the mobile device.

5. The system recited in claim 1, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated to a cloud service for providing off-device anti-malware protection for mobile devices.

6. The system recited in claim 1, wherein a mobile device management (MDM) provisioning profile is installed on the mobile device, wherein the MDM provisioning profile periodically generates an updated software inventory for the mobile device, wherein the mobile device periodically synchronizes with a mobile device management (MDM) service to provide an updated software inventory for the mobile device, and wherein the periodically updated software inventory for the mobile device is communicated from the MDM service to a cloud service for providing off-device anti-malware protection for mobile devices.

7. The system recited in claim 1, wherein a certificate is installed on the mobile device, and wherein the certificate is used to generate the software inventory that is communicated to a service for providing off-device anti-malware protection for mobile devices.

8. The system recited in claim 1, wherein the mobile device is an Apple iOS based device, wherein a certificate is installed on the mobile device, and wherein the certificate is used to generate the software inventory that is communicated to a service for providing off-device anti-malware protection for mobile devices.

9. The system recited in claim 1, wherein the processor is further configured to:

enforce the policy on the mobile device.

10. The system recited in claim 1, wherein the processor is further configured to:

send results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the policy to a mobile device management (MDM) service, wherein the MDM service enforces the policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware is based on the policy.

11. The system recited in claim 1, wherein the processor is further configured to:

determine an application is in violation of one or more aspects of the policy.

12. The system recited in claim 1, wherein the processor is further configured to:

determine an application is risky based on the policy.

13. A method for off-device anti-malware protection for mobile devices, comprising:

receiving a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device; and

determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on a policy.

14. The method of claim 13, further comprising:

enforcing the policy on the mobile device.

15. The method of claim 13, further comprising:

sending results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the policy to a mobile device management (MDM) service, wherein the MDM service enforces the policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the policy.

16. The method of claim 13, further comprising:

determining an application is in violation of one or more aspects of the policy.

17. The method of claim 13, further comprising:

determining an application is risky based on the policy.

18. A computer program product for off-device anti-malware protection for mobile devices, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

receiving a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device; and

determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on a policy.

19. The computer program product recited in claim 18, further comprising computer is instructions for:

enforcing the policy on the mobile device.

20. The computer program product recited in claim 18, further comprising computer instructions for:

sending results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the policy to a mobile device management (MDM) service, wherein the MDM service enforces the policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the policy.

21. The computer program product recited in claim 18, further comprising computer instructions for:

determining an application is in violation of one or more aspects of the policy.

22. The computer program product recited in claim 18, further comprising computer instructions for:

determining an application is risky based on the policy.

23. A system for off-device anti-malware protection for mobile devices, comprising:

a processor configured to;

automatically analyze a plurality of applications for a mobile device platform to determine whether any of the plurality of applications violates an anti-malware policy; and

generate a data feed identifying one or more of the plurality of applications that were determined to be associated with malware based on the anti-malware policy; and

a memory coupled to the processor and configured to provide the processor with instructions.

24. The system recited in claim 23, wherein the data feed is provided to an enterprise for enforcing the anti-malware policy on mobile devices used to access data resources in the enterprise, and wherein the policy includes one or more of the following:

a malware policy, a privacy policy, and an enterprise configured application security policy.

25. The system recited in claim 23, wherein the data feed is provided to a mobile device management (MDM) service for enforcing the anti-malware policy on a plurality of mobile devices managed by the MDM service.