Methods for analyzing application privacy and devices thereof

• US 8,918,632 B1
• Filed: 01/22/2014
• Issued: 12/23/2014
• Est. Priority Date: 01/23/2013
• Status: Active Grant

• Current Assignee: The Privacy Factor LLC
• Original Assignee: The Privacy Factor LLC
• Inventors: Sartor, Mark A.
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US14/161,462
• Time in Patent Office: 335 Days
• US Class Current: 713/152
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method, non-transitory computer readable medium, and policy rating server device that receives a request from a client computing device for one or more privacy ratings. The request identifies at least one application, such as an application installed on the client computing device for example. A policy associated with the identified application is obtained. The obtained policy is analyzed to identify a plurality of key words or phrases associated with use by the at least one application of functionality of, or personal information stored on, the client computing device. One or more privacy ratings are generated based on numerical values assigned to each of the identified key words or phrases. The generated one or more privacy ratings are output to the client computing device in response to the request.

Claims

1. A method for analyzing application operation with respect to associated policy provisions, the method comprising:

monitoring, with a client computing device, at least one application or web site during execution to identify actual interactions of the application or web site with the client computing device, wherein the interactions include at least use of functionality of the client computing device or use of personal information stored on the client computing device;

determining, with the client computing device, whether one of the actual interactions of the application or web site deviate from one or more interactions of the application or web site identified by one or more provisions of a policy associated with the application or web site, wherein the policy is retrieved from an external source associated with a provider of the application or web site; and

performing, with the client computing device, a default action, when the one actual interaction is determined to deviate from the interactions identified by the one or more provisions of the policy associated with the application or web site.

2. The method of claim 1, further comprising:

identifying, with the client computing device, a plurality of applications or web sites;

retrieving, with the client computing device, provisions of at least one policy associated with each of the identified applications or web sites, the provisions identifying interactions of the application or web site with the client computing device; and

storing, with the client computing device, the retrieved provisions as associated with a corresponding one of the identified applications or web site.

3. The method of claim 1, further comprising obtaining, with the client computing device, application or web site interaction preferences including one or more actions to be performed when the one actual interaction is determined to deviate from the interactions identified by the one or more provisions of the policy associated with the application or web site, wherein the action is performed based on at least one of a default policy or one or more of the application interaction preferences.

4. The method of claim 1, wherein the default action comprises providing a notification to a user of the client computing device regarding the deviation, obfuscating data associated with the one actual interaction, recommending an action to the user of the client computing device, or preventing the one actual interaction.

5. A client computing device comprising a processor and a memory coupled to the processor which is configured to be capable of executing programmed instructions comprising and stored in the memory to:

monitor at least one application or web site during execution to identify actual interactions of the application or web site with the client computing device, wherein the interactions include at least use of functionality of the client computing device or use of personal information stored on the client computing device;

determine whether one of the actual interactions of the application or web site deviate from one or more interactions of the application or web site identified by one or more provisions of a policy associated with the application or web site, wherein the policy is retrieved from an external source associated with a provider of the application or web site; and

perform a default action, when the one actual interaction is determined to deviate from the interactions identified by the one or more provisions of the policy associated with the application or web site.

6. The client computing device of claim 5, wherein the processor coupled to the memory is further configured to be capable of executing additional programmed instructions comprising and stored in the memory to:

identify a plurality of applications or web sites;

retrieve provisions of at least one policy associated with each of the identified applications or web sites, the provisions identifying interactions of the application or web site with the client computing device; and

store the retrieved provisions as associated with a corresponding one of the identified applications or web site.

7. The client computing device of claim 5, wherein the processor coupled to the memory is further configured to be capable of executing at least one additional programmed instruction comprising and stored in the memory to obtain application or web site interaction preferences including one or more actions to be performed when the one actual interaction is determined to deviate from the interactions identified by the one or more provisions of the policy associated with the application or web site, wherein the action is performed based on at least one of a default policy or one or more of the application interaction preferences.

8. The client computing device of claim 5, wherein the default action comprises providing a notification to a user of the client computing device regarding the deviation, obfuscating data associated with the one actual interaction, recommending an action to the user of the client computing device, or preventing the one actual interaction.

9. A non-transitory computer readable medium having stored thereon instructions for analyzing application operation with respect to associated policy provisions comprising executable code which when executed by a processor, causes the processor to perform steps comprising:

monitoring at least one application or web site during execution to identify actual interactions of the application or web site with a client computing device, wherein the interactions include at least use of functionality of the client computing device or use of personal information stored on the client computing device;

determining whether one of the actual interactions of the application or web site deviate from one or more interactions of the application or web site identified by one or more provisions of a policy associated with the application or web site, wherein the policy is retrieved from an external source associated with a provider of the application or web site; and

performing a default action, when the one actual interaction is determined to deviate from the interactions identified by the one or more provisions of the policy associated with the application or web site.

10. The non-transitory computer readable medium of claim 9, wherein the executable code when executed by the processor further causes the processor to perform additional steps comprising:

identifying a plurality of applications or web sites;

retrieving provisions of at least one policy associated with each of the identified applications or web sites, the provisions identifying interactions of the application or web site with the client computing device; and

storing the retrieved provisions as associated with a corresponding one of the identified applications or web site.

11. The non-transitory computer readable medium of claim 9, wherein the executable code when executed by the processor further causes the processor to perform at least one additional step comprising obtaining application or web site interaction preferences including one or more actions to be performed when the one actual interaction is determined to deviate from the interactions identified by the one or more provisions of the policy associated with the application or web site, wherein the action is performed based on at least one of a default policy or one or more of the application interaction preferences.

12. The non-transitory computer readable medium of claim 9, wherein the default action comprises providing a notification to a user of the client computing device regarding the deviation, obfuscating data associated with the one actual interaction, recommending an action to the user of the client computing device, or preventing the one actual interaction.