Remote permissions monitoring and control

Patent metadata

Field	Value
Publication number	US-11487866-B2
Application number	US-201916655181-A
Country	US
Kind code	B2
Filing date	Oct 16, 2019
Priority date	Jul 4, 2016
Publication date	Nov 1, 2022
Grant date	Nov 1, 2022

Abstract

A security application may monitor applications attempting to be installed on a user device. In one example, various steps may include at least one of: receiving an application access operation on a computing device, identifying at least one application action associated with the application access operation, retrieving an application security profile stored in memory, identifying at least one application security restriction in the application security profile related to the at least one application action, restricting the at least one application action from occurring based on the at least one application security restriction and notifying a pre-registered device responsive to restricting the at least one application action.

First claim

What is claimed is:

1. A method, comprising:
initiating an install procedure of an application on a computing device;
detecting application permissions requested by the application from the computing device during the install procedure;
determining a flag has been set on an application permission from among the detected application permissions based on an application security profile;
temporarily blocking the install procedure of the application from continuing on the computing device based on the flagged application permission;
identifying, by a security module installed on the computing device where the application is temporarily blocked, a phone number of a remote user device stored within a security profile of the computing device; and
transmitting, via a network, a request to the remote user device based on the identified phone number, the request comprising an identification of the flagged application permission and a request for a user input via the remote user device to resume the temporarily blocked install procedure;
receiving, by the security module installed on the computing device where the application is temporarily blocked, a response from the remote user device indicating whether or not to allow the application to access to the flagged application permission.

2. The method of claim 1 , comprising receiving an application access operation on the computing device which comprises receiving an install request message.

3. The method of claim 1 , wherein the flagged application permission comprises one or more of permission for in-app purchases and permission to access a contacts list stored on the computing system.

4. The method of claim 1 , wherein the transmitting the request comprises transmitting a prompt to a user interface of the remote user device which requests a user input from a guardian.

5. The method of claim 1 , wherein the flagged application permission comprises one or more of access to location information, access to contacts, access to an e-mail account, access to an instant message account, access to a social network profile, access to photographs, access to multi-media, and access to documents.

6. The method of claim 1 , wherein the method further comprises displaying a list of the detected application permissions requested during the install procedure via a user interface of the computing device.

7. The method of claim 1 , wherein the detecting comprises intercepting the application permissions requested by the application via a security module that is installed locally on the computing device.

8. The method of claim 4 , wherein the input from the guardian overrides the temporarily blocked install procedure on the computing device.

9. An apparatus, comprising:
a processor configured to:
initiate an install procedure of an application on a computing device;
detect application permissions requested by the application from the computing device daring the install procedure;
determine a flag has been set on an application permission from among the detected application permissions based on an application security profile;
temporarily block the install procedure of the application from continuing on the computing device based on the flagged application permission;
identify, by a security module installed on the computing device where the application is temporarily blocked, a phone number of a remote user device stored within the application security profile; and
a network interface configured to transmit, via a network, a request to the remote user device based on the identified phone number, the request comprising an identification of the flagged application permission and a request for a user input via the remote user device to resume the temporarily install procedure;
receiving, by the security module installed on the computing device where the application is temporarily blocked, a response from the remote user device indicating whether or not to allow the application to access to the flagged application permission.

10. The apparatus of claim 9 , wherein the processor is further configured to receive an application access operation on the computing device which comprises receipt of an install request message.

11. The apparatus of claim 9 , wherein the flagged application permission comprises one or more of permission for in-app purchases and permission to access a contacts list stored on the computing system.

12. The apparatus of claim 9 , wherein the request comprises a prompt transmitted to a user interface of the remote user device which requests a user input from a guardian.

13. The apparatus of claim 9 , wherein the flagged application permission comprises one or more of access to location information, access to contacts, access to an e-mail account, access to an instant message account, access to a social network profile, access to photographs, access to multi-media, and access to documents.

14. The apparatus of claim 9 , wherein the processor is further configured to display a list of the detected application permissions requested during the install procedure via a user interface of the computing device.

15. The apparatus of claim 12 , wherein the input from the guardian overrides the temporarily blocked install procedure on the computing device.

16. A non-transitory computer readable storage medium configured to store instructions that when executed causes a processor to perform:
initiating an install procedure of an application on a computing device;
detecting application permissions requested by the application from the computing device during the install procedure;
determining a flag has been set on an application permission from among the detected application permissions based on an application security profile;
temporarily blocking the install procedure of the application from continuing on the computing device based on the flagged application permission;
identifying, by a security module installed on the computing device where the application is temporarily blocked, a phone number of a remote user device stored within a security profile of the computing device; and
transmitting, via a network, a request to the remote user device based on the identified phone number, the request comprising an identification of the flagged application permission and a request for a user input via the remote user device to resume the temporarily blocked install procedure;
receiving, by the security module installed on the computing device where the application is temporarily blocked, a response from the remote user device indicating whether or not to allow the application to access to the flagged application permission.

17. The non-transitory computer readable storage medium of claim 16 , comprising receiving an application access operation on the computing device which comprises receiving an install request message.

18. The non-transitory computer readable storage medium of claim 16 , wherein the flagged application permission comprises one or more of permission for in-app purchases and permission to access a contacts list stored on the computing system.

19. The non-transitory computer readable storage medium of claim 16 , wherein the transmitting the request comprises transmitting a prompt to a user interface of the remote user device which requests a user input from a guardian.

20. The non-transitory computer readable storage medium of claim 16 , wherein the flagged application permission comprises one or more of access to location information, access to contacts, access to a

Assignees

• IBM

Inventors

• Bender Michael
• Childress Rhonda L
• Kumhyr David B
• Spisak Michael John

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F8/60

  Software deployment · CPC title

• G06F21/629

  to features or functions of an application · CPC title