METHOD AND SYSTEM FOR APPLICATION-BASED POLICY MONITORING AND ENFORCEMENT ON A MOBILE DEVICE

• US 20130232540A1
• Filed: 03/02/2012
• Published: 09/05/2013
• Est. Priority Date: 03/02/2012
• Status: Active Grant

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Saidi, Hassen, Xu, Rubin
• Granted Patent: US 8,844,036 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method and system for application-based monitoring and enforcement of security, privacy, performance and/or other policies on a mobile device includes incorporating monitoring and policy enforcement code into a previously un-monitored software application package that is installable on a mobile device, and executing the monitoring and policy enforcement code during normal use of the software application by a user of the mobile device.

Claims

1. A method comprising:

with at least one computing device;

processing a software application executable by a mobile device to obtain a plurality of executable components of the software application;

associating at least one second component with at least one of the components of the software application without modifying or replacing any of the executable components of the software application, the at least one second component configured to, during execution of the software application, determine whether the software application is attempting to perform a potentially unauthorized activity; and

creating a software application package comprising the executable components of the software application and the at least one second component, the software application package adapted for installation on the mobile device.

2. The method of claim 1, wherein the mobile device comprises at least one computer-accessible medium and an operating system stored in the at least one computer-accessible medium, comprising installing the at least one second component on the mobile device without modifying the operating system.

3. The method of claim 1, wherein the components of the software application comprise unsecured compiled components and the at least one second component comprises at least one compiled component configured to secure the software application against potentially unauthorized activity.

4. The method of claim 1, comprising creating a single executable file based on the components of the software application and the at least one second component without modifying the components of the software application.

5. The method of claim 1, comprising configuring the software application package so that after the software application is started, at least one of the second components executes prior to executing the software application.

6. The method of claim 1, wherein the software application is embodied in a first software application package comprising a manifest file, comprising updating the manifest file to cause at least one of the second components to execute after the software application is started and prior to execution of the software application.

7. The method of claim 1, wherein the software application is embodied in a first software application package and the first software application package comprises a first digital certificate, comprising signing the software application package with a second digital certificate.

8. The method of claim 1, wherein the mobile device comprises a device-specific security system, comprising installing the second software application package on the mobile device without modifying the device-specific security system.

9. The method of claim 1, comprising defining at least one policy for determining whether the software application is attempting to perform a potentially unauthorized activity and using the at least one policy to configure at least one of the second components.

10. The method of claim 9, comprising receiving input from a user of the mobile device and defining the at least one policy based on the input from the user.

11. The method of claim 9, comprising defining at least policy relating to at least one of:

application security, application performance, device security, privacy, network security, privilege escalation, a sequence of events, native code, and non-native code.

12. A method comprising:

after a software application comprising code interpretable as a system call to an operating system object is launched by a user and loaded into memory for execution by a mobile device, and prior to the execution of the software application by the mobile device;

temporarily associating the operating system object with a security and/or privacy monitoring routine, such that during the execution of the software application, the security and/or privacy monitoring routine is executed prior to execution of the at least one system call.

13. The method of claim 12 comprising determining a memory address of the operating system object, and at least temporarily associating the operating system object with a memory address of the security and/or privacy monitoring routine.

14. The method of claim 12, wherein the mobile device comprises a device-specific security system, comprising associating the operating system object with a memory address of the security and/or privacy monitoring routine independently of the device-specific security system.

15. The method of claim 12, comprising using dynamic linking to at least temporarily associate the operating system object with a memory address of a security and/or privacy monitoring routine.

16. A method comprising:

with at least one computing device;

processing an original application package, the original application package comprising a software application executable by a mobile device and at least one other file, to obtain a plurality of executable components of the software application;

associating at least one second component with at least one of the executable components of the software application without modifying or replacing any of the executable components of the software application, the at least one second component configured to;

after the software application is launched by a user and prior to execution of the software application, change a dynamic link to an external function that is called by the software application during execution of the software application to point to a memory location of application monitoring code, and during execution of the software application follow the changed dynamic link to evaluate a call to the external function using the application monitoring code; and

creating a new software application package comprising the components of the software application and the at least one second component, the software application package adapted for installation on the mobile device.

17. The method of claim 16, comprising preserving the memory location of the dynamically-linked external function prior to changing the dynamic link.

18. The method of claim 16, comprising defining a runtime priority so that the at least one second component executes prior to the execution of the software application.