SYSTEM AND METHOD FOR WHITELISTING APPLICATIONS IN A MOBILE NETWORK ENVIRONMENT

• US 20130097660A1
• Filed: 10/17/2011
• Published: 04/18/2013
• Est. Priority Date: 10/17/2011
• Status: Abandoned Application

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Das, Sudeep, Divakarla, Jayasankar, Dang, Amit, Khare, Praneet, Shukla, Alok
• Application Number:
  US13/275,308
• Publication Number:
  US 20130097660A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

An application is identified as installed on a particular mobile device. An action involving the application is identified, the action to be performed using the particular mobile device. It is determined whether the action is an approved action based on at least one policy associated with the particular mobile device. A determination that the action is unapproved can results in an attempt to prevent the action. Further, in certain instances, a whitelist or blacklist can be generated based on determinations of whether identified application actions conform to one or more policies associated with the particular mobile device.

Claims

1. A method comprising:

identifying an application installed on a particular mobile device;

identifying an action involving the application to be performed using the particular mobile device; and

determining whether the action is an approved action based on at least one policy associated with the particular mobile device, wherein a determination that the action is unapproved results in an attempt to prevent the action.

2. The method of claim 1, wherein determining whether the action is an approved action includes identifying whether the action is included in a whitelist of approved actions, wherein the whitelist is based at least in part on conformance of actions with the at least one policy.

3. The method of claim 2, wherein the whitelist includes a listing of a plurality of actions, each action paired to at least one application.

4. The method of claim 3, wherein approval of an action is based, at least in part, on a reputation of the paired application.

5. The method of claim 4, wherein the reputation of a particular application is based at least in part on user feedback data received for the particular application identifying user security assessments of the particular application.

6. The method of claim 3, wherein approval of the action is approved for a first application, and unapproved for a second application.

7. The method of claim 2, wherein the whitelist is maintained by a whitelist server and at least a portion of the whitelist is downloaded to one or more mobile devices remote from the whitelist server.

8. The method of claim 7, further comprising identifying an update to the whitelist and causing the update to be automatically downloaded to the one or more mobile devices.

9. The method of claim 2, wherein the whitelist is a particular one of a plurality of whitelists, wherein each whitelist in the plurality of whitelists is associated with a corresponding set of policies, and each set of policies is associated with a corresponding entity.

10. The method of claim 9, wherein the particular whitelist governs a set of mobile devices in a system of an entity, the set of mobile devices including the particular mobile.

11. The method of claim 10, wherein the set of mobile devices includes the particular mobile device utilizing a first operating system and at least one second mobile device utilizing a second operating system.

12. The method of claim 1, determining whether the action is an approved action includes identifying whether the action is included in a blacklist of unapproved actions, wherein the blacklist is based at least in part on failures of actions to conform with the at least one policy.

13. The method of claim 1, wherein the action includes a function of the application, and at least some functions of an application remain allowed during prevention of a particular action determined to be unapproved.

14. The method of claim 1, wherein the action includes an attempt to update the application, and unapproved updates are prevented from being downloaded to the particular mobile device.

15. The method of claim 1, wherein the action includes initiating running of the application on the particular mobile device, wherein the application is prevented from running based on a determination that the application violates the at least one policy.

16. The method of claim 1, wherein the action includes an attempt to communicate with at least one remote computing resource, wherein determining whether to prevent the application'"'"'s communication with the at least one remote computing resource is based on a reputation of the at least one computing resource.

17. The method of claim 1, wherein the action is identified in connection with an attempt to perform the action using the particular mobile device.

18. The method of claim 1, wherein a determination of a particular unapproved action of a particular application causes downloading of the particular application to be blocked for mobile devices whereon the particular application is not yet installed.

19. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying an application installed on a particular mobile device;

identifying an action involving the application to be performed using the particular mobile device; and

determining whether the action is an approved action based on at least one policy associated with the particular mobile device, wherein a determination that the action is unapproved results in an attempt to prevent the action.

20. A system comprising:

a memory configured to store data; and

a processor operable to execute instructions associated with the data;

a reputation engine, adapted when executed by the at least one processor device to;

identify an application installed on a particular mobile device;

identify an action involving the application to be performed using the particular mobile device; and

determine whether the action is an approved action based on at least one policy associated with the particular mobile device, wherein a determination that the action is unapproved results in an attempt to prevent the action.

21. The system of claim 20, further comprising generating a whitelist including a listing of each approved application action identified as conforming to the at least one policy.