Methods and systems for causing mobile communications devices to emit sounds with encoded information

• US 10,419,936 B2
• Filed: 03/13/2018
• Issued: 09/17/2019
• Est. Priority Date: 02/17/2009
• Status: Active Grant

• Current Assignee: F-Secure Corporation (F-Secure Oyj)
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin Patrick, Hering, John G., Burgess, James David, Grkov, Vance, Richardson, David Luke, Mandal, Ayan, Mangat, Cherry, Buck, Brian James, Robinson, William
• Primary Examiner(s): Htun, San
• Application Number:
  US15/920,305
• Publication Number:
  US 20180206124A1
• Time in Patent Office: 553 Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/7652 shared by users
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/025 using location based information parameters
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A method is provided for comparing a usage of a mobile communications device to a stored pattern of usage. When a measure associated with a difference between the usage and the stored usage pattern exceeds a threshold, the mobile communications device is caused to emit a sound encoded with information that may be decoded by another electronic device.

Claims

1. A method comprising:

detecting, by a first security component on a first mobile communications device, a usage of the first mobile communications device;

comparing, by the first security component, the detected usage to a stored usage pattern associated with an authorized user of the first mobile communications device to determine if there is a difference between the detected usage and the stored usage pattern;

associating, by the first security component, a measure with the stored usage pattern, the measure representing a difference between the detected usage and the stored usage pattern;

determining, by the first security component using the measure, that the detected usage was not caused by the authorized user of the first mobile communications device; and

in response to the determination, issuing a command by the first security component, the command causing the first mobile communications device to emit a sound encoded with information identifying the first mobile communications device and with information identifying a location of the first mobile communications device, the encoded information decodable only by electronic devices, the emitted sound having no specified recipient, wherein emitting the sound by the first mobile communication device initiates;

decoding the emitted sound by an electronic device programmed to decode the encoded information within the sound; and

sending, by the electronic device, the decoded information to a first server.

2. The method of claim 1, wherein the information identifying a location of the first mobile communications device includes an identity of a Wi-Fi access point.

3. The method of claim 1, wherein the information identifying a location of the first mobile communications device includes a location of the electronic device.

4. The method of claim 1, wherein the sound is sub-audible or super-audible.

5. The method of claim 1, wherein the encoded information is received by the electronic device and decoded by a second security component executing on the electronic device and wherein the sending, by the electronic device, the decoded information to the first server includes the electronic device sending a message to the first server, the message containing the information identifying the first mobile communications device and the information identifying the location of the first mobile communications device.

6. The method of claim 1 further comprising:

initiating, by the first security component in response to the determination that the detected usage was not caused by the authorized user, at least one of;

the suspending of access credentials;

the sending of a message to a second server, the second server having a trust relationship with the first mobile communications device, the message indicating that the first mobile communications device may be compromised;

the sending of a message to an administrator, the message indicating that the first mobile communications device may be compromised;

the provisioning of a second mobile communications device with at least one of a functionality from the first mobile communications device, or data from the first mobile communications device;

the sending of instructions to at least one of an administrator, or a different device associated with the authorized user, the instructions relating to replacing the first mobile communications device;

the redirection of a push notification from the first mobile communications device to a different device associated with the authorized user;

or

the sending of a notification to at least one of an administrator, or the authorized user, the notification informing of a response to the determination that the detected usage was not caused by the authorized user, the notification providing the at least one of an administrator and the authorized user an ability to approve or reject the response.

7. The method of claim 1 further comprising:

initiating, in response to the determination that the detected usage was not caused by the authorized user, the display of a status of the first mobile communications device on a web page, the status indicating that the first mobile communications device may be compromised, the web page for displaying the security status of a plurality of mobile communications devices to an administrator.

8. The method of claim 7, wherein the web page provides the administrator with a graphical user interface that can be used to reduce an ability of an unauthorized user to access data stored on the first mobile communications device.

9. The method of claim 1, wherein the comparing, by the first security component, the detected usage to a stored usage pattern includes at least one of:

a. comparing a browsing history of the detected usage to a browsing history of the stored usage pattern;

b. comparing a call history of the detected usage to a call history of the stored usage pattern;

c. comparing a messaging history of the detected usage to a messaging history of the stored usage pattern;

or

d. comparing a travel pattern of the detected usage to a travel pattern of the stored usage pattern.

10. A method comprising:

detecting, by a first security component on a first server, a usage of a first mobile communications device;

comparing, by the first security component, the detected usage to a stored usage pattern associated with an authorized user of the first mobile communications device to determine if there is a difference between the detected usage and the stored usage pattern;

associating, by the first security component, a measure with the stored usage pattern, the measure representing a difference between the detected usage and the stored usage pattern;

determining, by the first security component using the measure, that the detected usage was not caused by the authorized user of the first mobile communications device; and

in response to the determination, issuing a command by the first security component, the command causing the first mobile communications device to emit a sound encoded with information identifying the first mobile communications device and with information identifying a location of the first mobile communications device, the encoded information decodable only by electronic devices, the sound having no specified recipient, wherein emitting the sound by the first mobile communication device initiates;

decoding the emitted sound by an electronic device programmed to decode the encoded information within the sound; and

sending, by the electronic device, the decoded information to the first server.

11. The method of claim 10, wherein the information identifying a location of the first mobile communications device includes an identity of a Wi-Fi access point.

12. The method of claim 10, wherein the information identifying a location of the first mobile communications device includes a location of the electronic device.

13. The method of claim 10, wherein the sound is sub-audible or super-audible.

14. The method of claim 10, wherein the encoded information is received by the electronic device and decoded by a second security component executing on the electronic device, the method further comprising:

receiving, by the first security component from the electronic device a message containing the information identifying the first mobile communications device and the information identifying the location of the first mobile communications device.

15. The method of claim 10 further comprising:

initiating, by the first security component in response to the determination that the detected usage was not caused by the authorized user, at least one of;

the suspending of access credentials;

the sending of a message to a second server, the second server having a trust relationship with the first mobile communications device, the message indicating that the first mobile communications device may be compromised;

the sending of a message to an administrator, the message indicating that the first mobile communications device may be compromised;

the provisioning of a second mobile communications device with at least one of;

a functionality from the first mobile communications device, or data from the first mobile communications device;

the sending of instructions to at least one of;

an administrator, or a different device associated with the authorized user, the instructions relating to replacing the first mobile communications device;

the redirection of a push notification from the first mobile communications device to a different device associated with the authorized user;

or

the sending of a notification to at least one of an administrator, or the authorized user, the notification informing of a response to the determination that the detected usage was not caused by the authorized user, the notification providing the at least one of an administrator and the authorized user an ability to approve or reject the response.

16. The method of claim 10 further comprising:

generating a web page by the first server, the web page for displaying the security status of a plurality of mobile communications devices to an administrator; and

displaying on the web page, in response to the determination that the detected usage was not caused by the authorized user, a status of the first mobile communications device, the status indicating that the first mobile communications device may be compromised.

17. The method of claim 16, wherein the web page provides the administrator with a graphical user interface that can be used to reduce an ability of an unauthorized user to access data stored on the first mobile communications device.

18. The method of claim 10, wherein the comparing, by the first security component, the detected usage to a stored usage pattern includes at least one of:

e. comparing a browsing history of the detected usage to a browsing history of the stored usage pattern;

f. comparing a call history of the detected usage to a call history of the stored usage pattern;

g. comparing a messaging history of the detected usage to a messaging history of the stored usage pattern;

or

h. comparing a travel pattern of the detected usage to a travel pattern of the stored usage pattern.

19. A non-transitory, computer-readable storage medium having stored thereon a plurality of instructions, which, when executed by a processor of a mobile communications device, cause the mobile communications device to:

detect a usage of the first mobile communications device;

compare the detected usage to a stored usage pattern associated with an authorized user of the first mobile communications device to determine if there is a difference between the detected usage and the stored usage pattern;

associate a measure with the stored usage pattern, the measure representing a difference between the detected usage and the stored usage pattern;

determine using the measure, that the detected usage was not caused by the authorized user of the first mobile communications device; and

in response to the determination, issue a command by the first security component, the command causing the first mobile communications device to emit a sound encoded with information identifying the first mobile communications device and with information identifying a location of the first mobile communications device, the encoded information decodable only by electronic devices, the emitted sound having no specified recipient, wherein emitting the sound by the first mobile communication device initiates;

decoding the emitted sound by an electronic device programmed to decode the encoded information within the sound; and

sending, by the electronic device, the coded information to a first server.

20. The computer-readable storage medium of claim 19, wherein the information identifying a location of the first mobile communications device includes an identity of a Wi-Fi access point.

21. The computer-readable storage medium of claim 19, wherein the information identifying a location of the first mobile communications device includes a location of the electronic device.

22. A system, comprising a mobile communications device with at least one processor and memory and instructions that when executed by the at least one processor cause the mobile communications device to:

detect a usage of the first mobile communications device;

compare the detected usage to a stored usage pattern associated with an authorized user of the first mobile communications device to determine if there is a difference between the detected usage and the stored usage pattern;

associate a measure with the stored usage pattern, the measure representing a difference between the detected usage and the stored usage pattern;

determine using the measure, that the detected usage was not caused by the authorized user of the first mobile communications device; and

in response to the determination, issue a command by the first security component, the command causing the first mobile communications device to emit a sound encoded with information identifying the first mobile communications device and with information identifying a location of the first mobile communications device, the encoded information decodable only by electronic devices, the emitted sound having no specified recipient, wherein emitting the sound by the first mobile communication device initiates;

decoding the emitted sound by an electronic device programmed to decode the encoded information within the sound; and

sending, by the electronic device over a network interface, the decoded information to a. first server.

23. The system of claim 22, wherein the information identifying a location of the first mobile communications device includes an identity of a Wi-Fi access point.

24. The system of claim 22, wherein the information identifying a location of the first mobile communications device includes a location of the electronic device.