Security, fraud detection, and fraud mitigation in device-assisted services systems
Secure architectures and methods for improving the security of mobile devices are disclosed. Also disclosed are apparatuses and methods to detect and mitigate fraud in device-assisted services implementations.
1. An end-user device, comprising:
one or more modems for enabling the wireless end-user device to communicate over at least a first wireless access network;
memory configured to store
a first application program configured to execute on the wireless end-user device and access one or more data services over at least the first wireless access network,
a known-application credential associated with the first application program,
a first policy comprising one or more first policy instructions to be applied when the first application program initiates or attempts to initiate a communication over the first wireless access network; and
one or more device agents configured to execute from a secure memory partition to
detect an attempted installation of update software on the end-user device, the update software purporting to be a modification, update, or replacement of the first application program,
obtain an update-software credential associated with the update software,
determine whether the update-software credential passes a verification check,
based at least in part on the update-software credential passing the verification check, allow the update software to be installed on the wireless end-user device,
at runtime for the first application program, obtain a runtime credential for the first application credential, and compare the runtime credential to the known-application credential,
based at least in part on a match between the runtime credential and the known-application credential, allow execution of the first application program,
determine when the first application program initiates or attempts to initiate a communication over the first wireless access network, and
apply the first policy when the first application program initiates or attempts to initiate a communication over the first wireless access network.
2. The end-user device of claim 1 , wherein the one or more device agents include the first application program.
3. The end-user device of claim 1 , wherein the first application program comprises a kernel component and/or a library.
4. The end-user device of claim 1 , wherein the known-application credential is stored in a secure location in the memory.
5. The end-user device of claim 1 , wherein the known-application credential comprises a hash of the software application program.
6. The end-user device of claim 1 , wherein the known-application credential comprises a secure signature and/or certificate.
7. The end-user device of claim 1 , the one or more device agents further configured to supply the runtime credential to a secure server.
8. The end-user device of claim 1 , the one or more device agents further configured to obtain the runtime credential from a secure hash of the first application program.
9. The end-user device of claim 8 , wherein the secure hash is based on a key provided by a secure server.
10. The end-user device of claim 1 , wherein to determine whether the update-software credential passes a verification check comprises to:
generate a signed application credential using the update-software credential and a device credential;
send the signed application credential to a secure server; and
receive, from the secure server, a message regarding the authenticity of the update software.
11. The end-user device of claim 10 , wherein to generate a signed application credential using the update-software credential and a device credential comprises combining the update-software credential and the device credential in a hash.
12. The end-user device of claim 1 , wherein to determine whether the update-software credential passes a verification check comprises to:
receive a signed application credential from a secure server, the signed application credential combining an application credential and a device credential; and
evaluate the signed application credential using the device credential.
13. The end-user device of claim 1 , wherein configured to execute in a secure memory partition comprises storing executable code for the one or more device agents in a secure encrypted form.