Method and system for application authenticity attestation
A method at a network element for attestation of applications, the method including sending a challenge to an application at an electronic device; receiving a response from the electronic device; processing the response; and upon determining that the response is invalid based on the processing, taking an enforcement action against the application.
1. A method at a network element for attestation of applications, the method comprising:
sending a challenge to an application at an electronic device, the challenge including a nonce;
setting a grace period for receiving a response;
when the grace period expires before the response is received, taking an enforcement action against the application;
receiving the response from the electronic device, the response including a hash of the nonce with a plurality of identifiers stored at the electronic device;
obtaining the plurality of identifiers from a trusted network server to recompute the hash;
comparing the hash in the response with the recomputed hash; and
upon determining that the response is invalid based on the comparing, taking the enforcement action against the application.
2. The method of claim 1 , wherein the plurality of identifiers includes a team identifier stored in an operating system of the electronic device and obtainable from the network server.
3. The method of claim 2 , wherein the processing further comprises:
receiving, in the response, a device check token;
adding authentication information to the device check token;
sending the device check token with the added authentication information to a device check server; and
receiving a response from the device check server to indicate whether the device check token is valid.
4. The method of claim 1 , wherein the enforcement action comprises at least one of: reporting the failure; blocking the application from accessing network resources; instructing the electronic device to wipe the application; instructing the electronic device to prompt a user to perform an action on the application; and instruct the electronic device to block running of the application.
5. The method of claim 1 , wherein the sending the challenge is performed on activation of the application.
6. The method of claim 1 , wherein the sending the challenge is performed at a configurable challenge frequency.
7. A network element configured for attestation of applications, the network element comprising:
a processor; and
a communications subsystem,
wherein the network element is configured to:
send a challenge to an application at an electronic device, the challenge including a nonce;
set a grace period for receiving a response;
when the grace period expires before the response is received, take an enforcement action against the application;
receive the response from the electronic device, the response including a hash of the nonce with a plurality of identifiers stored at the electronic device;
obtain the plurality of identifiers from a trusted network server to recompute the hash;
compare the hash in the response with the recomputed hash; and
upon determining that the response is invalid based on the comparing, take the enforcement action against the application.
8. The network element of claim 7 , wherein the plurality of identifiers includes a team identifier stored in an operating system of the electronic device and obtainable from the network server.
9. The network element of claim 8 , wherein the network element is further configured to process by:
receiving, in the response, a device check token;
adding authentication information to the device check token;
sending the device check token with the added authentication information to a device check server; and
receiving a response from the device check server to indicate whether the device check token is valid.
10. The network element of claim 7 , wherein the enforcement action comprises at least one of: reporting the failure; blocking the application from accessing network resources; instructing the electronic device to wipe the application; instructing the electronic device to prompt a user to perform an action on the application; and instruct the electronic device to block running of the application.
11. The network element of claim 7 , wherein the network element is configured to send the challenge on activation of the application.
12. The network element of claim 7 , wherein the network element if configured to send the challenge at a configurable challenge frequency.
13. A non-transitory computer readable medium for storing instruction code, which, when executed by a processor of a network element configured for attestation of applications cause the network element to:
send a challenge to an application at an electronic device, the challenge including a nonce;
set a grace period for receiving a response;
when the grace period expires before the response is received, take an enforcement action against the application;
receive the response from the electronic device, the response including a hash of the nonce with a plurality of identifiers stored at the electronic device;
obtain the plurality of identifiers from a trusted network server to recompute the hash;
compare the hash in the response with the recomputed hash; and
upon determining that the response is invalid based on the comparing, take the enforcement action against the application.