Application privacy scanning systems and related meihods

Patent metadata

Field	Value
Publication number	US-11334681-B2
Application number	US-202117463775-A
Country	US
Kind code	B2
Filing date	Sep 1, 2021
Priority date	Jun 10, 2016
Publication date	May 17, 2022
Grant date	May 17, 2022

Abstract

An application privacy analysis system is described, where the system obtains an application and analyzes it for privacy related data use. The system may determine privacy related activities of the application from established sources of such data and/or may decompile the application and analyze the resulting code to determine the privacy related activities of the application. The system may execute the application and monitor the communications traffic exchanged by the application to determine privacy related activities of the application. The system may store the results of such analyses for future reference.

First claim

What is claimed is:

1. A method comprising:
determining, by computing hardware, identifying information for a mobile device application;
querying, by the computing hardware, a software development kit database using the identifying information to identify a software development kit used to generate the mobile device application;
analyzing, by the computing hardware, computer code for the mobile device application and the software development kit to identify a use of at least one of a privacy-related function, a privacy-related attribute, or a privacy-related characteristic within the mobile device application, wherein identifying the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises identifying use of personal data of a user within the mobile device application;
generating, by the computing hardware, a recommendation for addressing the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic within the mobile device application; and
providing, by the computing hardware, a graphical user interface for displaying the recommendation on a computing device to the user.

2. The method of claim 1 , wherein identifying the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises identifying the mobile device application accessing of at least one of device component permissions or a device storage of a mobile device on which the mobile device application is executing.

3. The method of claim 2 , wherein the device component permissions comprise at least one of permissions to access a camera, a microphone, photographs, a calendar, contacts or location determination residing on the mobile device.

4. The method of claim 2 , wherein the device storage comprises at least one of shared storage, an application database, a key chain, private key information, public key information, blockchain information, advertising identifiers, or encrypted storage residing on the mobile device.

5. The method of claim 1 , wherein the identifying the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises identifying use of an application programming interface call within the mobile device application configured to transmit the personal data of the user of the mobile device application.

6. The method of claim 5 , further comprising:
determining, by the computing hardware, a geographical destination of the personal data transmitted; and
determining, by the computing hardware, at least one of an applicable privacy law or regulation on transmitting the personal data based on the geographical destination, wherein the recommendation is based on the applicable privacy law or regulation.

7. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
querying a software development kit database using identifying information for a mobile device application to identify a software development kit used to generate the mobile device application;
analyzing computer code for the mobile device application and the software development kit to identify a use of at least one of a privacy-related function, a privacy-related attribute, or a privacy-related characteristic within the mobile device application, wherein the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises use of personal data of a user of the mobile device application; and
generating a recommendation for addressing the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic within the mobile device application, wherein the recommendation is provided for display on a graphical user interface on a computing device to the user.

8. The system of claim 7 , wherein the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises access of at least one of device component permissions or a device storage of a mobile device on which the mobile device application is executing.

9. The system of claim 8 , wherein the device component permissions comprise at least one of permissions to access a camera, a microphone, photographs, a calendar, contacts or location determination residing on the mobile device.

10. The system of claim 8 , wherein the device storage comprises at least one of shared storage, an application database, a key chain, private key information, public key information, blockchain information, advertising identifiers, or encrypted storage residing on the mobile device.

11. The system of claim 7 , wherein the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises use of an application programming interface call to transmit the personal data of the user of the mobile device application.

12. The system of claim 11 , wherein the operations further comprise:
determining a geographical destination of the personal data transmitted; and
determining at least one of an applicable privacy law or regulation on transmitting the personal data based on the geographical destination.

13. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
querying a software development kit database using identifying information for a mobile device application to identify a software development kit used to generate the mobile device application;
analyzing computer code for the mobile device application and the software development kit to identify a use of at least one of a privacy-related function, a privacy-related attribute, or a privacy-related characteristic within the mobile device application, wherein identifying the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises use of personal data of a user of the mobile device application; and
generating a recommendation for addressing the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic within the mobile device application, wherein the recommendation is provided for display on a graphical user interface on a computing device to the user.

14. The non-transitory computer-readable medium of claim 13 , wherein the use of at least one of the privacy-related function, the privacy-related attribute, or the privacy-related characteristic comprises access of at least one of device component permissions or a device storage of a mobile device on which the mobile device application is executing.

15. The non-transitory computer-readable medium of claim 14 , wherein the device component permissions comprise at least one of permissions to access a camera, a microphone, photographs, a calendar, contacts or location determination residing on the mobile device.

16. The non-transitory computer-readable medium of claim 14 , wherein the device storage comprises at least one of shared storage, an application database, a key chain, private key information, public key information, blockchai

Assignees

• Onetrust Llc

Inventors

• Jones Kevin
• Deweese William
• Devenish Justin
• Pitchaimani Saravanan
• Brannon Jonathan Blake

Classifications

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F16/901

  Indexing; Data structures therefor; Storage structures (for retrieval from the web G06F16/951) · CPC title

• G06F16/904

  Browsing; Visualisation therefor (for navigating the web G06F16/954; browsing optimisation for the web G06F16/957) · CPC title

• G06F16/9558

  Details of hyperlinks; Management of linked annotations · CPC title

• G06F2221/033

  Test or assess software · CPC title