Mobile application security assessment

Patent metadata

Field	Value
Publication number	US-9264445-B2
Application number	US-201414480234-A
Country	US
Kind code	B2
Filing date	Sep 8, 2014
Priority date	May 22, 2012
Publication date	Feb 16, 2016
Grant date	Feb 16, 2016

Abstract

The security of mobile applications may be assessed and used to enhance the security of mobile devices. In one example, a method may include determining security scores of one or more mobile applications, the security scores defining a level of security risk corresponding to the one or more mobile applications. The method may further include receiving a policy relating to mobile applications that are permitted to be used by the mobile device, the policy including a threshold security score value; and receiving the requested security scores. The method may further include restricting use of selected ones of the one or more mobile applications when a security score corresponding to the one or more mobile applications is below the threshold security score value.

First claim

What is claimed is:

1. A method comprising:
requesting, by a mobile device, one or more security scores of one or more mobile applications,
the one or more security scores defining a level of security risk corresponding to the one or more mobile applications, and
a security score, of the one or more security scores, being based on:
a first security review performed on a mobile application of the one or more mobile applications,
the first security review resulting in a modified initial security score including a value within a first range, and

a second security review performed on the mobile application,
the second security review being different than the first security review, and
the second security review resulting in a further modified initial security score including a value within a second range,
 the second range including an upper limit that is greater than an upper limit of the first range;

receiving, by the mobile device, a policy relating to mobile applications that are permitted to be used by the mobile device,
the policy including a threshold security score value;

receiving, by the mobile device, the requested one or more security scores; and
restricting, by the mobile device, use of a selected mobile application, of the one or more mobile applications, when a security score, of the one or more received security scores, corresponding to the selected mobile application is below the threshold security score value.

2. The method of claim 1 , where the restricting the use of the selected mobile application includes:
preventing the selected mobile application from being installed on the mobile device;
preventing the selected mobile application from being executed by the mobile device;
providing a user of the mobile device with a notification when the selected mobile application is executed by the mobile device; or
uninstalling the selected mobile application from the mobile device.

3. The method of claim 1 , further comprising:
providing a graphical indication of a plurality of mobile applications that are installed on the mobile device and corresponding security scores of the installed plurality of mobile applications.

4. The method of claim 1 , where the requested one or more security scores correspond to security scores of mobile applications installed at the mobile device.

5. The method of claim 1 , where the requested one or more security scores include security scores determined, at least in part, through a manual analysis of the mobile applications.

6. The method of claim 1 , further comprising:
providing, for presentation, the requested one or more security scores.

7. The method of claim 1 , where
when requesting the one or more security scores, the method includes:
requesting a first security score, of the one or more security scores, for a first mobile application of the one or more mobile applications; and
requesting a second security score, of the one or more security scores, for a second mobile application of the one or more mobile applications,

when receiving the requested one or more security scores, the method includes:
receiving the first security score, and
receiving the second security score, and

the method further includes:
providing, for presentation, the received first security score and the received second security score.

8. A device comprising:
a processor to:
request one or more security scores for one or more mobile applications,
the one or more security scores defining a level of security risk corresponding to the one or more mobile applications, and
a security score, of the one or more security scores, being based on:
a first security review performed on a mobile application of the one or more mobile applications,
 the first security review resulting in a modified initial security score including a value within a first range, and
a second security review performed on the mobile application,
 the second security review being different than the first security review, and
 the second security review resulting in a further modified initial security score including a value within a second range,
 the second range including an upper limit that is greater than an upper limit of the first range;

receive a policy relating to mobile applications that are permitted to be used by the device,
the policy including a threshold security score value;

receive the requested one or more security scores; and
restrict use of a selected mobile application, of the one or more mobile applications, when a security score, of the one or more received security scores, corresponding to the selected mobile application is below the threshold security score value.

9. The device of claim 8 , where, when restricting the use of the selected mobile application, the processor is to:
prevent the selected mobile application from being installed on the device;
prevent the selected mobile application from being executed by the device;
provide a user of the device with a notification when the selected mobile application is executed by the device; or
uninstall the selected mobile application from the device.

10. The device of claim 8 , where the processor is further to:
provide a graphical indication of all a plurality of mobile applications that are installed on the device and corresponding security scores of the installed plurality of mobile applications.

11. The device of claim 8 , where the requested one or more security scores correspond to security scores of mobile applications installed at the device.

12. The device of claim 8 , where the requested one or more security scores include security scores determined, at least in part, through a manual analysis of the mobile applications.

13. The device of claim 8 , where the processor is further to:
provide, for presentation, the requested one or more security scores.

14. The device of claim 8 , where
the processor, when requesting the one or more security scores, is to:
request a first security score, of the one or more security scores, for a first mobile application of the one or more mobile applications; and
request a second security score, of the one or more security scores, for a second mobile application of the one or more mobile applications,

the processor, when receiving the requested one or more security scores, is to:
receive the first security score, and
receive the second security score, and

the processor is further to:
provide, for presentation, the received first security score and the received second security score.

15. A non-transitory computer readable medium storing instructions, the instructions comprising:
one or more instructions which, when executed by a processor of a device, cause the processor to:
request one or more security scores for one or more applications,
the one or more security scores defining a level of security risk corresponding to the one or more applications, and
a security score, of the one or more security scores, being based on:
a first security review performed on an application of the one or more applications,
 the first security review resulting in a modified initial security score including a value within a first range, and
a second security review performed on the application,
 the second security review being different than the first security review, and
 the second security review resulting in a further modified initial security score including a value within a second range,
 the second range including an upper limit that is greater than an upper limit of the first range;

receive a policy relating to app

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Archer Steven T
• Tippett Peter S
• Crawford Gregory P
• Hubbard Paul
• Ganley Gina M
• Joels Jo Ann

Classifications

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F2221/033

  Test or assess software · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title