# US 12,001,558 B2 · Methods, systems, articles of manufacture and apparatus to verify application permission safety > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,558 B2 - Document ID: US12001558B2 - Status: Granted - Kind: B2 - Application number: 17/240,610 - Filed: 2021-04-26 - Published: 2021-10-07 - Granted: 2024-06-04 - Earliest claimed: 2018-05-07 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Dattatraya Kulkarni; Himanshu Srivastava; Raj Vardhan; Raja Sinha; Srikanth Nalluri; Tirumaleswar Reddy Konda - Web page: https://patentgrep.com/patent/US12001558B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/629: {to features or functions of an application} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods, apparatus, systems and articles of manufacture are disclosed to verify application permission safety. An example apparatus to identify unsafe permissions associated with a candidate app disclosed herein includes an app classifier interface to retrieve a cluster of apps associated with the candidate app, the candidate app including a requested permission set (RPS), a white knight (WK) identifier to identify a set of WK apps within the cluster, the set of WK apps associated with a designation of trust, a safe permission set (SPS) evaluator to generate an SPS list associated with the set of WK apps within the cluster, and an RPS identifier to determine whether permissions of the RPS are listed in the SPS list, the SPS evaluator further to designate first respective ones of the permissions of the RPS as safe when the first respective ones of the permissions are listed in the SPS list, and designate second respective ones of the permissions of the RPS as unsafe when the second respective ones of the permissions are absent from the SPS list. ## Claims ### Claim 1 An apparatus to improve app permission authorization security, the apparatus comprising: app permission evaluator circuitry to retrieve a directive associated with a candidate app to be installed on a client device; and recommendation generator circuitry to: determine whether to apply the directive to configure a permission associated with the candidate app; when the directive is to be applied, determine whether the directive is prohibitionary or discretionary; when the directive is prohibitionary, cause the permission to be denied on the client device; and when the directive is discretionary, invoke a selection prompt on the client device to enable a user to at least one of allow or deny the permission. ### Claim 2 (depends on 1) The apparatus as defined in claim 1, wherein the recommendation generator circuitry is to cause a deviation index to be displayed on the client device when the directive is of type discretionary. ### Claim 3 (depends on 1) The apparatus as defined in claim 1, wherein the app permission evaluator circuitry is to identify an indication of safety associated with the permission when the directive is to be ignored. ### Claim 4 (depends on 3) The apparatus as defined in claim 3, wherein the recommendation generator circuitry is to invoke a recommendation to deny the permission when the indication of safety is unsafe. ### Claim 5 (depends on 3) The apparatus as defined in claim 3, wherein the recommendation generator circuitry is to invoke a recommendation to allow the permission when the indication of safety is affirmative. ### Claim 6 A system to identify unsafe permissions associated with a candidate app, the system comprising: means for retrieving a cluster of apps associated with the candidate app, the candidate app including a requested permission set (RPS); means for identifying a set of trusted apps (TAs) within the cluster, the set of TAs including a designation of trust; means for generating a safe permission set (SPS) list associated with the set of TAs within the cluster; and means for determining whether permissions of the RPS are listed in the SPS list, the determining means to: designate first respective ones of the permissions of the RPS as safe when the first respective ones of the permissions are listed in the SPS list; and designate second respective ones of the permissions of the RPS as unsafe when the second respective ones of the permissions are absent from the SPS list. ### Claim 7 (depends on 6) The system as defined in claim 6, further including means for determining a deviation index for one of the second respective ones of the permissions of the RPS. ### Claim 8 (depends on 7) The system as defined in claim 7, wherein the determining means is to identify a first quantity value of apps within the cluster of apps associated with the candidate app that do not include the one of the second respective ones of the permissions in an RPS of respective ones of the cluster of apps associated with the candidate app, the cluster of apps indicative of a second quantity value. ### Claim 9 (depends on 8) The system as defined in claim 8, wherein the determining means is to calculate the deviation index based on a ratio of the second quantity value and the first quantity value. ### Claim 10 (depends on 7) The system as defined in claim 7, further including means for evaluating if the deviation index satisfies a deviation index threshold. ### Claim 11 (depends on 10) The system as defined in claim 10, further including means for generating a prohibition directive when the deviation index satisfies the deviation index threshold, the generating means to generate a discretionary directive when the deviation index does not satisfy the deviation index threshold. ### Claim 12 (depends on 11) The system as defined in claim 11, wherein the prohibition directive is to cause a client device to deny the one of the second respective ones of the permissions of the RPS associated with the candidate app. ### Claim 13 (depends on 11) The system as defined in claim 11, wherein the discretionary directive is to cause a client device to permit a selection of at least one of allowing or denying the one of the second respective ones of the permissions of the RPS associated with the candidate app. ### Claim 14 (depends on 11) The system as defined in claim 11, further including means for transmitting the prohibition directive or the discretionary directive to a client device. ### Claim 15 At least one non-transitory computer readable storage media comprising computer readable instructions that, when executed, cause processor circuitry to, at least: retrieve a directive associated with a candidate app to be installed on a client device; determine whether to apply the directive to configure a permission associated with the candidate app; when the directive is to be applied, determine whether the directive is prohibitionary or discretionary; when the directive is prohibitionary, cause the permission to be denied on the client device; and when the directive is discretionary, invoke a selection prompt on the client device to enable a user to at least one of allow or deny the permission. ### Claim 16 (depends on 15) The at least one non-transitory storage media as defined in claim 15, further including causing a deviation index to be displayed on the client device when the directive is of type discretionary. ### Claim 17 (depends on 15) The at least one non-transitory storage media as defined in claim 15, further including identifying an indication of safety associated with the permission when the directive is to be ignored. ### Claim 18 (depends on 17) The at least one non-transitory storage media as defined in claim 17, further including invoking a recommendation to deny the permission when the indication of safety is unsafe. ### Claim 19 (depends on 17) The at least one non-transitory storage media as defined in claim 17, further including invoking a recommendation to allow the permission when the indication of safety is affirmative.