Apparatus and methods for detection and management of unauthorized executable instructions on a wireless device

• US 7,770,785 B2
• Filed: 05/15/2006
• Issued: 08/10/2010
• Est. Priority Date: 06/13/2005
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Jha, Sanjay K., Cassett, Tia Manning, Abdi, Behrooz L., Hwang, Jihyun, Scott, Clifton Eugene, Fok, Kenny
• Primary Examiner(s): Labaze; Edwyn
• Application Number:
  US11/435,049
• Publication Number:
  US 20060278694A1
• Time in Patent Office: 1,548 Days
• Field of Search: 235/379, 235/375, 235/487, 235/383, 235/472.02, 705 7- 8
• US Class Current: 235/379
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

Detection and management methods and apparatus for wireless devices may include an executable instruction authorization module operable to scan executable instructions on a wireless device, generate a log indicative of a virus or otherwise unauthorized executable instructions based on a received authorization configuration, and forward the log to a user manager. The user manager may be operable to analyze the log and generate an authorization report which may be viewable by an operator to determine the disposition of unauthorized executable instructions. At least one of the executable instruction authorization module, the user manager, and the operator may be operable to generate a control command operable to delete, or otherwise disable, unauthorized executable instructions on the wireless device, or to restore the executable instructions on the wireless device.

Claims

1. A wireless communication device, comprising:

a memory comprising executable instructions, a device type corresponding to wireless device, and an authorization configuration having an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based on the device type; and

an executable instruction authorization module resident in the memory, the executable instruction authorization module comprising authorization logic operable to scan the memory and generate a log based upon the authorization configuration, the log comprising an identification of the executable instructions determined to be unauthorized based upon the authorization schema.

2. The device of claim 1, wherein the executable instructions comprises at least one of applications files and data files.

3. The device of claim 1, wherein the authorization configuration is received by the wireless device from across a wireless network.

4. The device of claim 1, wherein the authorization schema comprises a predetermined test and a predetermined result, and wherein the executable instruction authorization module is operable to execute the predetermined test to generate a test result, and further operable to compare the predetermined result to the generated test result to determine an authorization of the executable instructions.

5. The device of claim 4, wherein the authorization schema comprises at least one of a redundancy check, a test for a predetermined value at a predetermined location within the executable instructions, a check of signature information, and a test for a predetermined result of applying a predetermined function to at least a portion of the executable instructions.

6. The device of claim 1, wherein the executable instruction authorization module is operable to transmit the generated log to another device to determine whether or not the executable instructions are authorized.

7. The device of claim 6, wherein the executable instruction authorization module is operable to transmit the generated log across a wireless network.

8. The device of claim 1, wherein the generated log comprises at least one of an application name, an application version, an application creation date/time stamp, an application creator, a data file version, a data file size, and a data file creation date/time stamp.

9. The device of claim 1, wherein the authorization configuration comprises an action parameter that identifies an action to take when a predetermined unauthorized executable instruction is discovered by the authorization logic.

10. The device of claim 1, wherein the authorization configuration further comprises at least one of a tracking parameter selected from a plurality of tracking parameters and a reporting parameter selected from a plurality of reporting parameters, wherein the tracking parameter identifies when to scan the executable instructions, and wherein the reporting parameter identifies when to transmit the log across a wireless network.

11. The device of claim 1, wherein the executable instruction authorization module is further operable to establish a limited-access communications channel across the wireless network, wherein the limited-access communications channel is based on a predefined limited service configuration.

12. The device of claim 11, wherein the limited-access communications channel is not available to an end user of the device.

13. The device of claim 1, further comprising a device control module operable to execute a control command to change a status of the executable instructions.

14. The device of claim 13, wherein the device control module is operable to receive the control command from across a wireless network.

15. The device of claim 13, wherein the control command comprises at least one of a disable command, a delete command, and a restore command, wherein the disable command makes the executable instructions non-operable, wherein the restore command makes disabled executable instructions operational, and wherein the delete command effectively removes the executable instructions from the wireless device.

16. The device of claim 13, wherein the device control module is operable to verify an intent to execute the control command before executing the control command.

17. The device of claim 13, wherein the control command comprises a user identification and a control activity, and wherein the device control module further comprises permission logic operable to determine an authorization for executing the control command based on at least one of the user identification and the control activity.

18. The device of claim 13, wherein the log comprises an action record of executed control commands.

19. The device of claim 1, wherein the executable instruction authorization module is operable to monitor wireless device resource utilization of the executable instructions based upon the authorization schema.

20. An apparatus for managing executable instructions on a wireless device, comprising:

a configuration generator operable to generate and transmit an authorization configuration for receipt by a wireless device, the authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

an information repository operable to receive and store a log, the log comprising unauthorized executable instructions on the wireless device based on the authorization configuration; and

an executable instruction control module comprising an analyzer operable to generate an authorization report based on the log.

21. The apparatus of claim 20, wherein the analyzer further comprises a predetermined authorization test and a predetermined authorization result, wherein the log comprises an authorization test result generated by the wireless device, and wherein the analyzer is operable to compare the generated authorization test result to the predetermined authorization result to generate the authorization report.

22. The apparatus of claim 20, wherein the authorization schema comprises a predetermined authorization result selected for the wireless device.

23. The apparatus of claim 22, wherein the authorization schema comprises at least one of an application name, an application version, an application creation date/time stamp, an application creator, a data file version, a data file size, and a data file creation date/time stamp.

24. The apparatus of claim 20, wherein the executable instruction control module is operable to transmit at least a portion of the authorization report across a wireless network for analysis.

25. The apparatus of claim 24 further comprising a user manager module is operable to select the authorization schema from a plurality of authorization schemas and operable to transmit the authorization configuration across a wireless network.

26. The apparatus of claim 20, wherein the executable instruction control module is operable to allow an authorized user to access the authorization report.

27. The apparatus of claim 20, further comprising a device control module operable to send a control command to change an operational characteristic of executable instructions on the wireless device.

28. The apparatus of claim 27, wherein the device control module further comprises permission logic operable to verify an intent to execute the control command before sending the control command.

29. The apparatus of claim 27, wherein the control command comprises a user identification and a control activity, and wherein the device control module further comprises permission logic operable to determine an authorization for executing the control command before sending the control command, the authorization based, on at least one of the user identification and the control activity.

30. The apparatus of claim 27, wherein the device control module is operable to receive the control command from another computer device.

31. The apparatus of claim 30, wherein the other computer device is located across a wireless network.

32. The apparatus of claim 20, wherein the authorization configuration further comprises at least one of a tracking parameter selected from a plurality of tracking parameters, a reporting parameter selected from a plurality of reporting parameters, and an action parameter selected from a plurality of action parameters, wherein the tracking parameter dictates when to apply the authorization schema to executable instructions on the wireless device, wherein the reporting parameter identifies when to transmit the log across a wireless network, and wherein the action parameter identifies an action to take when a predetermined unauthorized executable instruction is discovered.

33. The apparatus of claim 32, wherein the tracking parameter identifies when to scan wireless device resources and correlate resource activity with application operation.

34. A method of managing executable instructions on a wireless device, comprising:

generating an authorization configuration executable to initiate scanning and logging of executable instructions resident on a wireless device, the authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

forwarding the authorization configuration for receipt by the wireless device;

receiving a generated log from the wireless device based on the authorization configuration; and

generating an authorization report based on the received log.

35. The method of claim 34, further comprising transmitting at least a portion of the authorization report to another computer device.

36. The method of claim 34, further comprising sending a control command to the wireless device, where the control command is based on the authorization report and is operable to initiate an action selected from the group consisting of a delete, a disable and a restore of executable instructions on the wireless device.

37. The method of claim 36, further comprising verifying the control command before sending the control command to the wireless device.

38. The method of claim 36, further comprising determining whether or not the control command is authorized.

39. The method of claim 38, where the control command comprises a user identification and a control activity, and where determining whether or not the control command is authorized further comprises comparing at least one of the user identification and the control activity with a plurality of control permissions correlated with a plurality of user identifications.

40. The method of claim 34, further comprising selecting the authorization schema from a plurality of authorization schemas based on at least one of a type of the wireless device, an identity of a network service provider associated with the wireless device, and a type of the executable instructions.

41. A method of managing executable instructions on a wireless device, comprising:

obtaining an authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

scanning executable instructions based upon the authorization configuration;

logging at least portions of the scanned executable instructions into a log based upon the authorization schema; and

forwarding the log to another device to determine a disposition of the logged executable instructions.

42. The method of claim 41, further comprising analyzing the scanned executable instructions based on a authorization schema, wherein the authorization schema includes at least one of a redundancy check, a test for a predetermined value at a predetermined location within the scanned executable instructions, a check of signature information, and a test for a predetermined result of applying a predetermined function to at least a portion of the scanned executable instructions.

43. The method of claim 41, wherein the authorization schema is selected from a plurality of authorization schemas based on at least one of a type of the wireless device, an identity of a network service provider associated with the wireless device, and a type of the executable instructions.

44. The method of claim 41, wherein receiving the authorization configuration further comprises receiving at least one of a tracking parameter selected from a plurality of tracking parameters, a reporting parameter selected from a plurality of reporting parameters, and an action parameter selected from a plurality of action parameters.

45. The method of claim 41, further comprising establishing a limited-access communications channel across a wireless network based on a predefined limited service configuration.

46. The method of claim 41, further comprising receiving a control command, the control command dictation at least one of deleting executable instructions and disabling executable instructions, where the control command is based on the log.

47. A machine-readable medium comprising instructions which, when executed by a machine, cause the machine to perform operations comprising:

obtaining an authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

scanning executable instructions based upon the authorization configuration;

logging at least portions of the scanned executable instructions into a log based upon the authorization schema; and

forwarding the log to another device to determine a disposition of the logged executable instructions.

48. At least one processor configured to perform the actions of:

obtaining an authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines, if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

scanning executable instructions based upon the authorization configuration;

logging at least portions of the scanned executable instructions into a log based upon the authorization schema; and

forwarding the log to another device to determine a disposition of the logged executable instructions.

49. A wireless device, comprising:

means for obtaining an authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

means for scanning executable instructions based upon the authorization configuration;

means for logging at least portions of the scanned executable instructions into a log based upon the authorization schema; and

means for forwarding the log to another device to determine a disposition of the logged executable instructions.

50. A machine-readable medium comprising instructions which, when executed by a machine, cause the machine to perform operations comprising:

generating an authorization configuration executable to initiate scanning and logging of executable instructions resident on a wireless device, the authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

forwarding the authorization configuration for receipt by the wireless device;

receiving a generated log from the wireless device based on the authorization configuration; and

generating an authorization report based on the received log.

51. At least one processor configured to perform the actions of:

generating an authorization configuration executable to initiate scanning and logging of executable instructions resident on a wireless device, the authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

forwarding the authorization configuration for receipt by the wireless device;

receiving a generated log from the wireless device based on the authorization configuration; and

generating an authorization report based on the received log.

52. An apparatus, comprising:

means for generating an authorization configuration executable to initiate scanning and logging of executable instructions resident on a wireless device, the authorization configuration comprising an authorization schema that identifies at least one of authorized executable instructions and unauthorized executable instructions, wherein the authorization schema determines if the executable instructions are authorized or unauthorized based upon a device type associated with the wireless device;

means for forwarding the authorization configuration for receipt by the wireless device;

means for receiving a generated log from the wireless device based on the authorization configuration; and

means for generating an authorization report based on the log.