# US 12,120,519 B2 · Determining a security state based on communication with an authenticity server > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,519 B2 - Document ID: US12120519B2 - Status: Granted - Kind: B2 - Application number: 17/674,285 - Filed: 2022-02-17 - Published: 2022-06-02 - Granted: 2024-10-15 - Earliest claimed: 2015-05-01 - Assignees: Lookout, Inc. - Applicants: Lookout, Inc. - Inventors: David Richardson; Ahmed Mohamed Farrakha; William Neil Robinson; Brian James Buck - Web page: https://patentgrep.com/patent/US12120519B2 ## CPC - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 2221/033: Test or assess software - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract For increased security, a source is determined for software to be installed on a computing device. In one approach, a side-load server receives, from a mobile device, data regarding an application to be installed on the mobile device. The server determines a source of the application, then sends, to an authenticity server, data regarding the source. The server receives, from the authenticity server, a first state designation for the application. In response to receiving the first state designation, the server sets a second state designation, and sends the second state designation to the mobile device (e.g., to permit or block installation of the application). ## Claims ### Claim 1 A system, comprising: at least one processor; and memory storing instructions configured to instruct the at least one processor to: receive, from a first computing device, data regarding a first application; in response to receiving the data regarding the first application, determine a source of the first application; send, over a network to an authenticity server, first data regarding the source; receive, from the authenticity server, a first state designation for the first application, wherein the authenticity server determines the first state designation based on the first data; in response to receiving the first state designation, set a second state designation that is different from the first state designation; and send the second state designation to the first computing device. ### Claim 2 (depends on 1) The system of claim 1, wherein the instructions are further configured to instruct the at least one processor to: send the first data regarding the source to an administrator server configured to provide a third state designation based on the first data; and receive, from the administrator server, the third state designation; wherein the second state designation is set based on the first state designation and the third state designation. ### Claim 3 (depends on 1) The system of claim 1, wherein the authenticity server stores first component data regarding applications installed on other computing devices, and the authenticity server compares the first component data to second component data regarding the first application. ### Claim 4 (depends on 1) The system of claim 1, wherein an icon corresponding to an application store is presented on a display of the first computing device, and the first application is selected from the application store for installation on the first computing device. ### Claim 5 (depends on 1) The system of claim 1, wherein the instructions are further configured to instruct the at least one processor to provide a notification regarding installation of the first application on a display of the first computing device. ### Claim 6 (depends on 5) The system of claim 5, wherein the notification requests approval for installation of the first application, or indicates the first application is untrusted or potentially dangerous. ### Claim 7 (depends on 1) The system of claim 1, wherein the first data is determined based on monitoring network activity associated with the first computing device. ### Claim 8 (depends on 1) The system of claim 1, wherein: the first data includes an IP address, a domain, or a uniform resource locator; and the first state designation includes a trusted state or an untrusted state. ### Claim 9 (depends on 1) The system of claim 1, wherein access by the first computing device to a network location is denied based on a policy for the first computing device set by the authenticity server. ### Claim 10 (depends on 1) The system of claim 1, wherein sending the second state designation causes the first computing device to set an application state to untrusted. ### Claim 11 (depends on 1) The system of claim 1, wherein sending the second state designation causes the first computing device to perform at least one of block installation of the first application, block execution of the first application, disable execution of one or more components of the first application, deny the first application access to a network, or uninstall the first application. ### Claim 12 (depends on 1) The system of claim 1, wherein the instructions are further configured to instruct the at least one processor to: compare data regarding a source of the first application to at least one of a white list or a black list; and based on the comparing, cause blocking of installation of the first application on the first computing device. ### Claim 13 (depends on 1) The system of claim 1, wherein setting the second state designation is based on comparing data regarding the first application to at least one of a white list or a black list. ### Claim 14 A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a server to: receive, from a mobile device, data regarding a first application to be installed on the mobile device, wherein the mobile device stores a device state that can include states of trusted, untrusted, or unknown; determine a source of the first application; send, to an authenticity server, data regarding the source; receive, from the authenticity server, a first state designation for the first application, wherein the first state designation received from the authenticity server can include states of trusted or untrusted; in response to receiving the first state designation, set a second state designation; and send the second state designation to the mobile device, wherein sending the second state designation to the mobile device causes changing of the device state from unknown to the first state designation. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the first state designation is determined by the authenticity server based at least in part on the data regarding the source. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the authenticity server stores data regarding previously-known applications, and the first state designation is based on comparing the data regarding the first application to the data regarding the previously-known applications. ### Claim 17 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the authenticity server sets the first state designation to untrusted in response to determining that a source identifier of the first application matches a black list. ### Claim 18 A method comprising: receiving, from a first computing device, data regarding a first application; in response to receiving the data regarding the first application, determining first data regarding a source of the first application; sending the first data regarding the source over a network to an authenticity server; receiving, from the authenticity server, a first state designation for the first application, wherein the authenticity server determines the first state designation based on the first data; in response to receiving the first state designation, setting a second state designation that is different from the first state designation; and sending the second state designation to the first computing device. ### Claim 19 (depends on 18) The method of claim 18, wherein: the first computing device stores a device state; and sending the second state designation causes the first computing device to change the device state from unknown to trusted or untrusted.