Systems and methods for privately performing application security analysis

• US 9,838,391 B2
• Filed: 10/30/2015
• Issued: 12/05/2017
• Est. Priority Date: 10/31/2014
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Proofpoint Incorporated
• Inventors: Jevans, David Alexander
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US14/929,067
• Publication Number:
  US 20160127367A1
• Time in Patent Office: 767 Days
• Field of Search: None
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H03K 19/17728 Reconfigurable logic blocks, e.g. lookup tables
• CPC Class Codes: H03K 19/17768 for security
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04W 12/10 Integrity

Abstract

Systems and methods for analyzing applications on a mobile device for risk so as to maintain the privacy of the application user are provided. In the example method, the process receives a request from a mobile device. The request includes a cryptographic representation of application information for an application residing on a mobile device. The method includes comparing the cryptographic representation to an application information database that includes cryptographic representations of applications. The method also includes automatically remediating, e.g., quarantining and retiring, the application if the application matches an application that is a known risk in the database. Exemplary embodiments provide companies with controls to prevent specific applications—which have specific behaviors and are present on mobile devices being used by employees—from being used by employees, without the company having any visibility into what particular applications are being used by the employees on the mobile device.

Claims

1. A method, comprising:

receiving a request from a mobile device, the request comprising a cryptographic representation of application information for an application residing on a mobile device, the cryptographic representation further comprising a company identifier for a particular company associated with the mobile device;

comparing the cryptographic representation to an application information database that comprises cryptographic representations of applications and information that indicates whether the applications are a security risk, the cryptographic representations being stored in whitelists and blacklists for respective companies; and

automatically remediating the application if the application matches an application that is a known risk in the application information database, the application being on a blacklist associated with the company identifier.

2. The method of claim 1, wherein the automatically remediating comprises quarantining.

3. The method of claim 2, wherein the quarantining comprises at least one of:

locking the mobile device, and

retiring the mobile device by preventing the mobile device from accessing an enterprise network or enterprise services of an enterprise system.

4. The method of claim 1, wherein the application information comprises executable code of the application.

5. The method of claim 1, wherein the application information comprises at least one of an application name and a version number of the application.

6. The method of claim 4, wherein the cryptographic representation includes a hash value of the executable code of the application, a name of the application, as well as a version number for the application and a company name.

7. The method of claim 1, further comprising:

receiving application behaviors for the application;

determining if the application behaviors constitute a risk; and

selecting a remediating action if any of the application behaviors constitute the risk.

8. The method of claim 7, wherein the determining if the application behaviors constitute a risk comprises:

evaluating the application for privacy, data leakage, or malicious behavior;

calculating a risk score for the application based on the evaluating; and

determining whether the application meets or exceeds a risk score threshold.

9. The method of claim 7, wherein the application is one of a plurality of applications on the mobile device, the method being performed for each of the plurality of applications.

10. The method of claim 7, wherein the determining if the application behaviors constitute a risk comprises determining if the application behaviors constitute a risk to a mobile device management system, the mobile device management system being for controlling control configuration of the mobile device;

wherein the remediation from the application is from the mobile device management system.

11. The method of claim 1, wherein the automatically remediating comprises transmitting a warning to a user of the mobile device or a system administrator.

12. The method of claim 1, wherein hashing comprising at least one of MD5, SHA1, and SHA256 is utilized for the cryptographic representation of application information.

13. The method of claim 1, wherein a designated application of the applications resident on the mobile device makes the request, the designated application being the only one of the applications which knows the identity of the rest of the applications on the mobile device, the designated application being configured for communicating the cryptographic representations for the applications to an application risk control system outside the mobile device, the application risk control system is configured to perform the comparing and does not log the identity of the mobile device making the request, such that identifying information about the mobile device is not transferred from the mobile device.

14. A system, comprising:

a mobile device management system, stored in memory and executable using one or more processors, for controlling, at least in part, configuration of a mobile device, the controlling including controlling whether the mobile device is permitted to access an enterprise network with enterprise services; and

an application risk control system, stored in the memory and executable using the one or more processors, configured to utilize;

an application information database comprising application information for applications, the application information comprising at least one of application behaviors, application names, cryptographic representations of applications, and risk scores of applications; and

an application cryptographic table comprising the cryptographic representations of applications associated with at least one of a whitelist or a blacklist for a respective company;

the application risk control system being further configured to;

receive a cryptographic representation of application information for an application residing on the mobile device, the cryptographic representation including a company identifier for a particular company associated with the mobile device;

compare the cryptographic representation to the application information database and the application cryptographic table; and

automatically remediate the mobile device if the application matches an application that is a known risk as determined from the comparison with the application information database and the application cryptographic table.

15. The system of claim 14, wherein the cryptographic representation includes a hash value of executable code of the application, a name of the application, as well as a version number for the application and a company name.

16. The system of claim 14, wherein the remediation is from the mobile device management system, and the mobile device is for use, if permitted by the mobile device management system, to access the enterprise network.

17. The system of claim 14, wherein the application information database is accessible on a first interface and the application cryptographic table is accessible on a second interface.

18. The system of claim 17, wherein the application risk control system receives company information over the second interface but not the first interface.

19. The system of claim 14, wherein the application cryptographic table is implemented as a domain name system (DNS) responder.

20. The system of claim 14, wherein the mobile device management system and the application risk control system are communicatively coupled using a control interface that allows for remediation of the mobile device.

21. The system of claim 14, wherein the application risk control system communicates directly with an operating system of the mobile device.

22. The system of claim 14, wherein the remediation comprises at least one of quarantining the application and retiring the mobile device.

23. The system of claim 14, wherein the application risk control system is configured to receive status communicated from the mobile device, the status being status regarding compliance or non-compliance, the status being other than information about the applications on the mobile device.

24. A method, comprising:

receiving a request from a mobile device, the request comprising at least one of;

a list of application behaviors for an application that resides on the mobile device, the request not comprising identifying information for the application;

a cryptographic representation of the application; and

a risk score calculated for the application;

comparing the list of application behaviors to approved and disapproved application behaviors;

comparing a cryptographic representation of the application that resides on the mobile device, the cryptographic representation including a company identifier for a particular company associated with the mobile device, to an application information database that comprises blacklisted and whitelisted applications for respective companies;

comparing the risk score to a risk score threshold; and

remediating at least one of the application and the mobile device if at least one of;

the list of application behaviors includes at least one disapproved application behavior;

the cryptographic representation of the application matches a blacklisted application on a blacklist associated with the company identifier; and

the risk score exceeds the risk score threshold.

25. The method of claim 24, further comprising generating the application information database that comprises cryptographic representations of applications, each of the cryptographic representations being placed onto a blacklist or a whitelist.

26. The method of claim 24, wherein the cryptographic representation of the application further comprises an application version number and a company name.