Determining source of side-loaded software

• US 9,589,129 B2
• Filed: 06/04/2015
• Issued: 03/07/2017
• Est. Priority Date: 06/05/2012
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Richardson, David, Farrakha, Ahmed Mohamed, Robinson, William Neil, Buck, Brian James
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Stoica, Adrian
• Application Number:
  US14/731,273
• Publication Number:
  US 20160321452A1
• Time in Patent Office: 642 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A source of side-loaded software is determined. An action may be performed in response to the determination of the source. In one case, the handling of an application on a mobile device may be based on whether the source of the application is trusted or untrusted. If a software application being newly-installed on a mobile device of a user is determined to be untrusted, installation or execution is blocked. In one approach, the determination of the source includes: determining whether a first source identifier of a first application matches a white list of source identifiers or a black list of source identifiers; and sending the first source identifier and a first application identifier for the first application to a different computing device.

Claims

1. A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a first computing device to:

store, in memory, a device state of the first computing device, the device state to vary between states comprising trusted, untrusted, and unknown;

determine, by at least one processor of the first computing device, whether a first source identifier of a first application matches a first list of source identifiers;

in response to determining that the first source identifier does not match the first list;

set the device state to unknown, and send, by the at least one processor, over a network to a second computing device, at least one message comprising the first source identifier and a first application identifier for the first application;

receive, over the network, a first message from the second computing device, the first message comprising a value of a first state designation for the first application, wherein the first state designation can be set to values including trusted and untrusted, and the second computing device is configured to set the value for the first state designation; and

in response to receiving the first message, change, in the memory, the device state from unknown to the value of the first state designation received in the first message.

2. The non-transitory computer-readable storage medium of claim 1, wherein the first list is a white list or a black list.

3. The non-transitory computer-readable storage medium of claim 1, wherein the computer-readable instructions further cause the first computing device to determine whether the first source identifier matches a second list of source identifiers.

4. The non-transitory computer-readable storage medium of claim 3, wherein the first list is a white list and the second list is a black list.

5. The non-transitory computer-readable storage medium of claim 4, wherein the determining whether the first source identifier matches the black list is performed in response to the first source identifier not matching the white list.

6. The non-transitory computer-readable storage medium of claim 4, wherein the determining whether the first source identifier matches the white list is performed in response to the first source identifier not matching the black list.

7. The non-transitory computer-readable storage medium of claim 4, wherein the determining whether the first source identifier matches the white list is performed simultaneously with the determining whether the first source identifier matches the black list.

8. The non-transitory computer-readable storage medium of claim 1, wherein the at least one message further comprises the device state.

9. The non-transitory computer-readable storage medium of claim 1, wherein the at least one message further comprises the first application state, and wherein the computer-readable instructions further cause the first computing device to, in response to the first source identifier not matching the first list, set a first application state for the first application to unknown.

10. The non-transitory computer-readable storage medium of claim 1, wherein the computer-readable instructions further cause the first computing device to store data for a plurality of applications, including the first application, the data comprising an application state and a source identifier for each of the applications, wherein each application state can be set to values including known and unknown, and the source identifier for the first application is the first source identifier.

11. The non-transitory computer-readable storage medium of claim 1, wherein the computer-readable instructions further cause the first computing device to, prior to determining whether the first source identifier matches the first list, receive the first list from the second computing device.

12. A method, comprising:

receiving, by a first computing device from at least one of plurality of computing devices, a first application identifier and a first source identifier, each for a first application;

setting, by the first computing device, a first state designation for the first application, wherein the first state designation is to be used for setting a device state on a second computing device, the device state stored in a memory of the second computing device, the device state to vary between states comprising trusted, untrusted, and unknown, and the first state designation set by the first computing device to values including trusted and untrusted; and

sending, by the first computing device, a value of the first state designation to the second computing device to cause the changing of the device state from unknown to the value of the first state designation.

13. The method of claim 12, further comprising accessing, by the first computing device, data for a plurality of applications associated with the plurality of computing devices, the data comprising a state designation for each of the applications.

14. The method of claim 12, wherein the setting the first state designation comprises:

sending, by the first computing device, over a network, the first application identifier and the first source identifier to a third computing device;

receiving, from the third computing device, a second state designation for the first application; and

setting the first state designation based on the second state designation.

15. The method of claim 12, wherein the setting the first state designation comprises:

determining whether the first source identifier matches a list of source identifiers; and

in response to the first source identifier matching the list, setting the first state designation.

16. The method of claim 12, wherein the setting the first state designation comprises:

determining whether the first source identifier matches a first list of source identifiers; and

in response to the first source identifier not matching the first list, determining whether the first source identifier matches a second list of source identifiers.

17. The method of claim 12, wherein the setting the first state designation comprises, in response to determining that the first source identifier matches a black list, setting the first state designation to untrusted.

18. The method of claim 12, wherein the setting the first state designation comprises, in response to determining that the first source identifier does not match a black list:

sending the first application identifier and the first source identifier to a third computing device; and

setting the first state designation based on a second state designation received from the third computing device.

19. The method of claim 18, further comprising updating the black list based on the second state designation.

20. A system, comprising:

at least one processor; and

memory storing instructions configured to instruct the at least one processor to;

receive, from a first computing device, a first application identifier and a first source identifier, each for a first application of the first computing device;

determine whether the first source identifier matches at least one of a white list of source identifiers or a black list of source identifiers;

send the first application identifier and the first source identifier over a network to a second computing device;

receive, from the second computing device, a first state designation for the first application;

set a second state designation to a value based on the first state designation, wherein the second state designation can be set to values including trusted and untrusted; and

send the value of the second state designation to the first computing device, the sending to cause a device state stored in a memory of the first computing device to be changed from unknown to the value of the second state designation, wherein the device state varies between states comprising trusted, untrusted, and unknown.

21. The system of claim 20, wherein the determining whether the first source identifier matches comprises determining that the first source identifier does not match the white list, and in response to the first source identifier not matching the white list, determining whether the first source identifier matches the black list.

22. The system of claim 20, wherein the sending the first application identifier and the first source identifier to the second computing device is performed in response to the first source identifier not matching the black list.

23. The system of claim 20, wherein the instructions are further configured to instruct the at least one processor to update the white list based on the first state designation.

24. The system of claim 20, further comprising a database storing data for a plurality of applications associated with the first computing device, the data comprising a source identifier and a state designation for each of the applications, wherein each state designation can be set to values including trusted and untrusted.

25. The system of claim 20, wherein the first source identifier is based on a signature of the first application.

26. The system of claim 20, wherein the instructions are further configured to instruct the at least one processor to receive a trusted source identifier from the second computing device, and update the white list or black list based on the trusted source identifier.