System and method for server-coupled malware prevention
First Claim
1. A method for assessing a data object present on a mobile communication device, the assessment provided by a server computer, the method comprising:
- before receiving data identifying at least a portion of the data object present on the mobile communication device at the server computer, determining if previously stored definition information stored in a local store at the mobile communication device corresponds to the data identifying at least a portion of the data object present on the mobile communication device, the local store storing a corresponding assessment for the previously stored definition information;
if the previously stored definition information in the local store at the mobile communication device does not correspond to the data identifying at least a portion of the data object present on the mobile communication device, then at the server computer, receiving data identifying at least a portion of the data object present on the mobile communication device;
at the server, determining if previously stored definition information for a data object corresponds to the received data, the definition information stored in a data store accessible by the server, the data store storing a corresponding assessment for the definition information;
if the previously stored definition information corresponds to the received data from the mobile communication device, then at the server, providing the assessment of the data object present on the mobile communication device corresponding to the previously stored definition information.
8 Assignments
0 Petitions
Accused Products
Abstract
This disclosure is directed to a system and method for preventing malware, spyware and other undesirable applications from affecting mobile communication devices (e.g., smartphones, netbooks, and tablets). A mobile communication device uses a server to assist in identifying and removing undesirable applications. When scanning an application, a device transmits information about the application to a server for analysis. The server receives the information, produces an assessment for the application, and transmits the assessment to the device. By performing analysis on a server, the invention allows a device to reduce the battery and performance cost of protecting against undesirable applications. The servers transmits notifications to devices that have installed applications that are discovered to be undesirable. The server receives data about applications from many devices, using the combined data to minimize false positives and provide comprehensive protection against known and unknown threats.
-
Citations
38 Claims
-
1. A method for assessing a data object present on a mobile communication device, the assessment provided by a server computer, the method comprising:
-
before receiving data identifying at least a portion of the data object present on the mobile communication device at the server computer, determining if previously stored definition information stored in a local store at the mobile communication device corresponds to the data identifying at least a portion of the data object present on the mobile communication device, the local store storing a corresponding assessment for the previously stored definition information; if the previously stored definition information in the local store at the mobile communication device does not correspond to the data identifying at least a portion of the data object present on the mobile communication device, then at the server computer, receiving data identifying at least a portion of the data object present on the mobile communication device; at the server, determining if previously stored definition information for a data object corresponds to the received data, the definition information stored in a data store accessible by the server, the data store storing a corresponding assessment for the definition information; if the previously stored definition information corresponds to the received data from the mobile communication device, then at the server, providing the assessment of the data object present on the mobile communication device corresponding to the previously stored definition information. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
-
-
17. A method for assessing a data object present on a mobile communication device by a server computer comprising:
-
receiving data from the mobile communication device by the server computer, the received data identifying the data object present on the mobile communication device; at the server computer, analyzing the received data by a known good component resident on the server computer to provide an assessment of the data object present on the mobile communication device; if the analysis of the received data by the known good component on the server computer results in an assessment that the data object is allowed, then at the server computer, transmitting instructions to the mobile communication device allowing the mobile communication device to access the assessed data object present on the mobile communication device; if, at the server computer, the analysis of the received data by the known good component on the server computer does not result in an assessment that the data object is allowed, then, at the server computer, analyzing the received data by a known bad component resident on the server computer to provide an assessment of the data object present on the mobile communication device; and if, at the server computer, the analysis of the received data by the known bad component on the server computer results in an assessment that the data object is undesirable, then, at the server computer, transmitting instructions to the mobile communication device preventing the mobile communication device from accessing the data object present on the mobile communication device. - View Dependent Claims (18, 19, 20, 21, 22, 23, 24, 25, 26)
-
-
27. A method for assessing a data object present on a mobile communication device, the assessment provided by a server computer, the method comprising:
-
at the mobile communication device, determining, by the mobile communication device, if previously stored definition information in a local store corresponds to the data object present on the mobile communication device; if the determination at the mobile communication device shows that the previously stored definition information in the local store does not correspond to the data object present on the mobile communication device, then, at a server computer, receiving data identifying at least a portion of the data object present on the mobile communication device; determining, by the server computer, if previously stored definition information for a data object corresponds to the received data, the definition information stored in a data store accessible to the server, the data store storing a corresponding assessment for the definition information; if the previously stored definition information corresponds to the received data, then, at the server, providing the assessment corresponding to the previously stored definition information; and
,if the previously stored definition information in the data store accessible to the server does not correspond to the received data, then analyzing, by the server, at least a portion of the received data identifying at least a portion of the data object present on the mobile communication device to determine an assessment corresponding to the data object present on the mobile communication device. - View Dependent Claims (28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38)
-
Specification