Systems and methods for computing device protection

• US 10,489,862 B2
• Filed: 05/18/2015
• Issued: 11/26/2019
• Est. Priority Date: 05/18/2015
• Status: Active Grant

• Current Assignee: F-Secure Corporation (F-Secure Oyj)
• Original Assignee: Lookout Incorporated
• Inventors: Hering, John Gunther, Mahaffey, Kevin, Buck, Brian James, Robinson, William Neil
• Primary Examiner(s): Ebersman, Bruce I
• Assistant Examiner(s): Poe, Kevin T
• Application Number:
  US14/715,198
• Publication Number:
  US 20160343083A1
• Time in Patent Office: 1,653 Days
• Field of Search: 705 4
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: H04M 1/72454 according to context-related or environment-related conditions
• CPC Class Codes: H04M 2250/12 including a sensor for measuring a physical value, e.g. temperature or motion

Abstract

Embodiments of the present disclosure help protect computing devices by, among other things, identifying events that may pose a risk to a computing device based on data from sensors coupled to the computer device.

Claims

1. A computer-implemented method comprising:

receiving sensor data pertaining to a computing device from a plurality of sensors coupled to the computing device, wherein the sensors include an accelerometer and a gyroscope;

obtaining data from the gyroscope, the data indicating an extent of rotation of the computing device during a period of free fall;

identifying, based on the sensor data, occurrence of an event posing a risk of damage to the computing device, wherein identifying the event includes;

determining a plurality of computing devices having a characteristic in common with the computing device,

selecting a threshold associated with a force of impact based on historical data associated with screen damage for the plurality of computing devices, wherein the historical data includes sensor data associated with damage that is received from computing devices other than the computing device,

determining that the sensor data for the computing device exceeds the threshold,

determining, based on data from the accelerometer, that the computing device experiences deceleration,

determining that the computing device is dropped based on the period of free fall and the deceleration, and

determining based on the data from the accelerometer and the data from the gyroscope that the computing device was accidentally dropped;

obtaining results of diagnostics for the computing device, wherein the results of diagnostics include an image or video from a camera of the computing device, the image or video including at least a portion of a screen of the computing device, and wherein the results of diagnostics further include diagnostics from a diagnostics program operating on the computing device;

identifying a force of impact experienced by the computing device;

identifying, based on the results of the diagnostics and the identified force of impact, damage or potential damage to the computing device;

transmitting, to a different computing device, an electronic message including the sensor data for the computing device, the results of the diagnostics, and identification information for the computing device, wherein the different computing device is configured to send a reply communication;

in response to receiving the reply communication, transmitting an electronic message to the computing device regarding the event; and

modifying, based on the sensor data for the computing device, risk data for the plurality of computing devices.

2. The method of claim 1, wherein the sensors further include a thermal detector, and determining that the sensor data exceeds the threshold includes determining that a temperature measured by the thermal detector is below a first threshold or above a second threshold.

3. The method of claim 1, wherein the sensors further include a location detector and determining that the sensor data exceeds the threshold includes determining that the computing device is within a predetermined distance of another computing device.

4. The method of claim 1, wherein the sensors further include a moisture sensor and determining that the sensor data exceeds the threshold includes determining that a level of moisture measured by the moisture detector exceeds a predetermined amount.

5. The method of claim 1, wherein the sensors further include an altimeter and determining that the sensor data exceeds the threshold includes determining that an altitude measured by the altimeter exceeds a predetermined level.

6. The method of claim 1, wherein the sensors further include a location detector and identifying occurrence of the event posing the risk to the computing device further includes determining, based on the data from the location detector, that the computing device is in one or more of:

an unexpected location, or a location associated with an elevated risk of damage to the computing device.

7. The method of claim 1, wherein identifying occurrence of the event posing the risk to the computing device further includes analyzing the sensor data for the computing device in conjunction with previously-received sensor data for the computing device.

8. The method of claim 1, wherein identifying occurrence of the event posing the risk to the computing device further includes detecting malware on the computing device based on the results of the diagnostics.

9. A non-transitory, computer-readable medium storing instructions that, when executed by one or more computing devices, cause the one or more computing devices to:

receive sensor data pertaining to a first computing device from a plurality of sensors coupled to the first computing device, wherein the sensors include an accelerometer and a gyroscope;

obtain data from the gyroscope, the data indicating an extent of rotation of the first computing device during a period of free fall;

identify, based on the sensor data for the first computing device, occurrence of an event posing a risk of damage to the first computing device, wherein identifying the event includes;

determining a plurality of computing devices having a characteristic in common with the first computing device,

selecting a threshold associated with a force of impact based on historical damage data for the plurality of computing devices, wherein the historical damage data includes sensor data associated with damage that is received from computing devices other than the first computing device,

determining that the sensor data for the first computing device exceeds the threshold,

determining, based on data from the accelerometer, that the first computing device experiences deceleration,

determining that the first computing device is dropped based on the period of free fall and the deceleration, and

determining based on the data from the accelerometer and the data from the gyroscope that the first computing device was accidentally dropped;

obtain results of diagnostics for the first computing device, wherein the results of diagnostics include an image or video from a camera of the first computing device, the image or video including at least a portion of a screen of the first computing device, and wherein the results of diagnostics further include diagnostics from a diagnostics program operating on the first computing device;

identify a force of impact experienced by the first computing device;

identify, based on the results of the diagnostics and the identified force of impact, damage or potential damage to the first computing device;

transmit, to a second computing device, an electronic message including the sensor data for the first computing device, the results of the diagnostics, and identification information for the first computing device, wherein the second computing device is configured to send a reply communication;

in response to receiving the reply communication, transmit an electronic message to the first computing device regarding the event; and

modify, based on the sensor data for the first computing device, risk data for the plurality of computing devices.

10. A system comprising:

one or more computing devices; and

memory in communication with the one or more computing devices and storing instructions that, when executed by the one or more computing devices, cause the one or more computing devices to;

receive sensor data pertaining to a first computing device from a plurality of sensors coupled to the first computing device, wherein the sensors include an accelerometer and a gyroscope;

obtain data from the gyroscope, the data indicating an extent of rotation of the computing device during a period of free fall;

identify, based on the sensor data for the first computing device, occurrence of an event posing a risk of damage to the first computing device, wherein identifying the event includes;

determining a plurality of computing devices having a characteristic in common with the first computing device,

selecting a threshold associated with a force of impact based on historical damage data for the plurality of computing devices, wherein the historical damage data includes sensor data associated with damage that is received from computing devices other than the first computing device,

determining that the sensor data for the first computing device exceeds the threshold,

determining, based on data from the accelerometer, that the first computing device experiences deceleration,

determining that the first computing device is dropped based on the period of free fall and the deceleration, and

determining based on the data from the accelerometer and the data from the gyroscope that the first computing device was accidentally dropped;

obtain results of diagnostics for the first computing device, wherein the results of diagnostics include an image or video from a camera of the first computing device, the image or video including at least a portion of a screen of the first computing device, and wherein the results of diagnostics further include diagnostics from a diagnostics program operating on the first computing device;

identify a force of impact experienced by the first computing device;

identify, based on the results of the diagnostics and the identified force of impact, damage or potential damage to the first computing device;

transmit, to a second computing device, an electronic message including the sensor data for the first computing device, the results of the diagnostics, and identification information for the first computing device, wherein the second computing device is configured to send a reply communication;

in response to receiving the reply communication, transmit an electronic message to the first computing device regarding the event; and

modify, based on the sensor data for the first computing device, risk data for the plurality of computing devices.