US 9,438,631 B2Granted

Off-device anti-malware protection for mobile devices

AssigneeAppthority, Inc.

InventorsAnthony John Bettini, Kevin Watkins, Domingo J. Guerra, Michael Price

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for off-device anti-malware protection for mobile devices are disclosed. In some embodiments, off-device anti-malware protection for mobile devices includes receiving a software inventory for a mobile device, in which the software inventory identifies a plurality of applications installed on the mobile device; and determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on a policy. In some embodiments, the off-device anti-malware protection for mobile devices further includes enforcing the policy on the mobile device. In some embodiments, the off-device anti-malware protection for mobile devices is provided as a cloud service.

Claims31

Dependent claims

A system for off-device anti-malware protection for mobile devices, comprising:

a processor configured to:
receive a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device;
determine whether one or more of the plurality of applications identified in the software inventory are associated with malware based on an enterprise policy that includes custom rules for scanning of apps based on security requirements for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware comprises to:
perform the following:
determine whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job;
in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determine that the one or more of the plurality of applications are associated with malware;
determine whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services;
and
in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determine that the one or more of the plurality of applications are associated with malware;
and
send results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the enterprise policy to a mobile device management (MDM) service, wherein the MDM service enforces the enterprise policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the enterprise policy;
and
a memory coupled to the processor and configured to provide the processor with instructions.

10 more elements

A method for off-device anti-malware protection for mobile devices, comprising:

receiving a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device;
determining whether one or more of the plurality of applications identified in the software inventory are associated with malware using a processor based on an enterprise policy that includes custom rules for scanning of apps based on security requirements for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware comprises:
performing the following:
determining whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job;
in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determining that the one or more of the plurality of applications are associated with malware;
determining whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services;
and
in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determining that the one or more of the plurality of applications are associated with malware;
and
sending results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the enterprise policy to a mobile device management (MDM) service, wherein the MDM service enforces the enterprise policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the enterprise policy.

7 more elements

A computer program product for off-device anti-malware protection for mobile devices, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving a software inventory for a mobile device, wherein the software inventory identifies a plurality of applications installed on the mobile device;
determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on an enterprise policy that includes custom rules for scanning of apps based on security requirements for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment, wherein the determining of whether the one or more of the plurality of applications identified in the software inventory are associated with the malware comprises:
performing the following:
determining whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job;
in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determining that the one or more of the plurality of applications are associated with malware;
determining whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services;
and
in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determining that the one or more of the plurality of applications are associated with malware;
and
sending results of determining whether one or more of the plurality of applications identified in the software inventory are associated with malware based on the enterprise policy to a mobile device management (MDM) service, wherein the MDM service enforces the enterprise policy by uninstalling one or more applications on the mobile device that were identified as being associated with malware based on the enterprise policy.

7 more elements

A system for off-device anti-malware protection for mobile devices, comprising:

a processor configured to:
automatically analyze a plurality of applications for a mobile device platform to determine whether any of the plurality of applications violates an enterprise policy that includes custom rules for scanning of apps based on security requirements, wherein the automatically analyzing of the plurality of applications for a mobile device platform to determine whether any of the plurality of applications violates an enterprise policy comprises to:
perform the following:
determine whether the one or more of the plurality of applications track a location of the mobile device and a user of the mobile device has a predetermined position or job;
in the event that the one or more of the plurality of applications track the location of the mobile device and the user of the mobile device has the predetermined position or job, determine that the one or more of the plurality of applications are associated with malware;
determine whether the one or more of the plurality of applications use encryption for secure communications or client-side encryption for cloud based storage services;
and
in the event that the one or more of the plurality of applications do not use encryption for secure communications or client-side encryption for cloud based storage services, determine that the one or more of the plurality of applications are associated with malware;
generate a data feed identifying one or more of the plurality of applications that were determined to be associated with malware based on the enterprise policy for scanning apps for risk assessment, wherein the enterprise policy includes a security policy for scanning apps for risk assessment;
and
send the data feed to a mobile device management (MDM) service of an enterprise subscriber for enforcing the enterprise policy associated with the enterprise subscriber on a plurality of mobile devices managed by the MDM service;
and
a memory coupled to the processor and configured to provide the processor with instructions.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/541,007Filed 13 Nov 2014 · continuation
Priority: 24 Feb 2012
Published: US 2015/0143455 A121 May 2015
Granted: 6 Sep 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
G06F 21/568
Computer malware detection or handling, e.g. anti-virus arrangements: eliminating virus, restoring damaged files
H04L 63/0823
For authentication of entities: using certificates
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection

Family

Application61/603,146Us provisional application · filed 24 Feb 2012
Application13/740,051Parent of this continuation · filed 11 Jan 2013
US 2015/0143455 A1Pre-grant publication · published 21 May 2015
US 8,918,881 B2Parent of this continuation
US 2013/0227636 A1Published application
US 9,438,631 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key