Screen-analysis based device security

• US 10,078,803 B2
• Filed: 06/15/2015
• Issued: 09/18/2018
• Est. Priority Date: 06/15/2015
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Sharifi, Matthew, Wang, Kai, Petrou, David
• Primary Examiner(s): Doan, Trang
• Application Number:
  US14/739,107
• Publication Number:
  US 20160366126A1
• Time in Patent Office: 1,191 Days
• Field of Search: None
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Systems and methods are provided for a content-based security for computing devices. An example method includes identifying content rendered by a mobile application, the content being rendered during a session, generating feature vectors from the content and determining that the feature vectors do not match a classification model. The method also includes providing, in response to the determination that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device. Another example method includes determining a computing device is located at a trusted location, capturing information from a session, the information coming from content rendered by a mobile application during the session, generating feature vectors for the session, and repeating this until a training criteria is met. The method also includes training a classification model using the feature vectors and authenticating a user of the device using the trained classification model.

Claims

1. A mobile device comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the mobile device to;

identify content rendered by a mobile application, the content being rendered by one or more screen capture events occurring during a session,

generate feature vectors from the content,

determine that the feature vectors do not match a classification model, and

provide, in response to the determination that the feature vectors do not match the classification model, a challenge using content captured from a prior screen capture event, the challenge being configured to authenticate a user of the mobile device;

wherein providing the challenge using the content captured from the prior screen capture event is based on the prior screen capture event occurring during a previous session that included previous session feature vectors that matched the classification model or that were verified using a trusted location, and wherein the previous session is distinct from the session.

2. The mobile device of claim 1, wherein providing the challenge using the content captured from the prior screen capture event is based on the prior screen capture event occurring during the previous session that included previous session feature vectors that matched the classification model.

3. The mobile device of claim 1, wherein providing the challenge using the content captured from the prior screen capture event is based on the prior screen capture event occurring during the previous session that included previous session feature vectors verified using the trusted location.

4. The mobile device of claim 1, wherein the challenge is configured to prompt the user to complete information missing from the screen capture event that occurred in the previous session.

5. The mobile device of claim 1, wherein providing the challenge includes:

extracting information from the prior screen capture event that occurred in a previous session that included feature vectors matching the classification model; and

generating a multiple choice question that uses the extracted information.

6. The mobile device of claim 1, wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to:

receive a response to the challenge; and

lock the mobile device when the response fails the challenge.

7. The mobile device of claim 1, wherein the challenge includes a series of sub-challenges.

8. A method comprising:

determining that a mobile device is located at a trusted location;

capturing information from a session occurring at the trusted location, the information coming from content obtained from one or more screen capture events occurring during the session;

generating feature vectors for the session based on the information captured from the session, wherein generating the feature vectors based on the information is based on the session occurring at the trusted location;

repeating the capturing and determining until a training criteria is met;

training a classification model using at least some of the feature vectors as positive examples; and

authenticating a user of the mobile device using the trained classification model.

9. The method of claim 8, wherein the training criteria includes a minimum quantity of sessions or a minimum classification accuracy.

10. The method of claim 8, wherein authenticating the user using the trained classification model includes:

determining a current session based on content rendered by a mobile application;

generating feature vectors for the session; and

providing, in response to determining that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device.

11. The method of claim 8, wherein determining the mobile device is located at a trusted location includes:

accessing a user profile associated with the mobile device to determine a trusted location; and

determining that the mobile device is currently located at the trusted location.

12. The method of claim 11, wherein the trusted location is represented by global positioning system (GPS) coordinates and the mobile device uses current GPS coordinates to determine whether the mobile device is current at the trusted location.

13. The method of claim 11, wherein the trusted location is represented by a wireless network identifier and the mobile device determines whether a wireless network the mobile device is connected to matches the wireless network identifier.

14. A mobile device comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the mobile device to;

identify content rendered by a mobile application, the content being rendered by one or more screen capture events occurring during a session,

generate feature vectors from the content,

apply a classification model to the feature vectors,

determine whether the feature vectors match a first user profile based on application of the classification model, the first user profile differing from a second user profile, the mobile device being currently associated with the second user profile,

initiate a profile switch responsive to determining that the feature vectors match the first user profile; and

provide, responsive to determining that the feature vectors match no user profiles, a challenge using content captured from a prior screen capture event, the challenge being configured to authenticate a user of the mobile device;

wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to train the classification model by;

determining that the mobile device is located in a trusted environment associated with the second user profile;

recognizing additional content rendered by the mobile application, or an additional mobile application, running on the mobile device, the additional content being associated with an additional session;

generating additional feature vectors for the additional content;

repeating the recognizing and generating for at least a minimum quantity of sessions; and

training the classification model using the feature vectors as positive examples, the positive examples being associated with the second user profile.

15. The mobile device of claim 14, the session being a first session and the prior screen capture event occurred during a previous session distinct from the first session, the previous session including feature vectors that matched the classification model.

16. The mobile device of claim 15, wherein the previous session is associated with the second user profile, the previous session being associated with feature vectors consistent with the second user profile according to the classification model.

17. The mobile device of claim 15, wherein the previous session is associated with the first user profile when the classification model determines the first user profile has a higher confidence score than the second user profile with regard to the feature vectors.

18. The mobile device of claim 14, wherein positive examples associated with the first user profile are used as negative examples for the second user profile in training the classification model.