Methods and systems for enhancing electronic device security by causing the device to go into a mode for lost or stolen devices

• US 10,623,960 B2
• Filed: 07/16/2019
• Issued: 04/14/2020
• Est. Priority Date: 02/17/2009
• Status: Active Grant

• Current Assignee: F-Secure Corporation (F-Secure Oyj)
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin Patrick, Hering, John G., Burgess, James David, Grkov, Vance, Richardson, David Luke, Mandal, Ayan, Mangat, Cherry, Buck, Brian James, Robinson, William
• Primary Examiner(s): Htun, San
• Application Number:
  US16/513,615
• Publication Number:
  US 20190342759A1
• Time in Patent Office: 273 Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/7652 shared by users
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/025 using location based information parameters
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

Systems and methods for enhancing the security of an electronic device by causing the electronic device to go into a mode for lost or stolen devices after a security component receives information regarding an event at the electronic device and determines that the event indicates the electronic device is lost or stolen.

Claims

1. A method comprising:

receiving, by a processor, event information regarding an event at a first electronic device;

determining, by the processor, the event from the event information;

determining, by the processor, that the event indicates the first electronic device is lost or stolen by;

comparing the event against a set of events indicative of the first electronic device being lost or stolen, and

determining that the event is one of the set of events indicative of the first electronic being lost or stolen;

transmitting, by the processor, an instruction to the first electronic device representing a request to enter a lost or stolen mode responsive to determining that the event is indicative of the first electronic device being lost or stolen;

receiving, by the processor from a second electronic device, second authentication information;

determining, by the processor using verification information received from the first electronic device, that the second authentication information matches first authentication information provided to the first electronic device;

responsive to determining that the second authentication information matches the first authentication information;

creating, by the processor, a remote access credential using the second authentication information and a salt, the salt representing random data used to safeguard passwords in storage; and

transmitting, by the processor, the remote access credential to the first electronic device, wherein the first electronic device follows the transmitted instruction responsive to the first electronic device determining that the remote access credential is valid.

2. The method of claim 1, wherein:

the received event information includes a request from a user to send a command to the first electronic device;

the determining, by the processor, the event from the event information includes determining the requested command from the request; and

the determining, by the processor, that the event indicates the first electronic device is lost or stolen by includes;

comparing the requested command against a set of commands indicative of the first electronic device being lost or stolen, and

determining that the requested command is one of the set of commands indicative of the first electronic device being lost or stolen.

3. The method of claim 2, wherein in response to receiving the transmitted instruction to enter the lost or stolen mode, the first electronic device automatically performs at least one action.

4. The method of claim 3, wherein the at least one action includes:

hiding a software component;

hiding an interface component related to the software component;

preventing removal of the software component;

reporting a location of the first electronic device;

reporting actions performed on the first electronic device;

or

entering a lockdown mode.

5. The method of claim 3, wherein the at least one action results in the first electronic device acquiring data, the first electronic device subsequently transmitting the acquired data to the server, the at least one action including one or more of:

taking a picture;

recording audio;

recording video;

collecting device state data;

collecting device usage data;

collecting physical information associated with the first electronic device;

or

determining a location of the first electronic device.

6. The method of claim 3, wherein the at least one action includes initiating a telephone call to a client device.

7. The method of claim 2 further comprising displaying, by a remote access web page, at least one of:

an indication that the first electronic device is lost or stolen;

a location of the first electronic device;

a list of actions performed on the first electronic device;

or

data received from the first electronic device.

8. The method of claim 2, further comprising:

sending, by the processor, an email to a client device associated with the user, the email providing a first link corresponding to the user knowing the location of the first electronic device and a second link corresponding to the user not knowing the location of the first electronic device.

9. The method of claim 2 further comprising:

notifying, by the processor, an administrator that the first electronic device has been instructed to enter the lost or stolen mode, the notification prompting the administrator to verify that the first electronic device entered the lost or stolen mode.

10. The method of claim 1, wherein the event includes one of:

a SIM card replacement;

a SIM card removal;

a leaving of an area;

an entering of the area;

a motion of the first electronic device;

an entering of an incorrect passcode;

an attempt to uninstall an application;

or an attempt to wipe the first electronic device.

11. The method of claim 1, wherein:

the event includes the first electronic device not communicating with the server for a predetermined amount of time; and

entering the lost or stolen mode results in the first electronic device being locked.

12. The method of claim 11 further comprising:

determining, by the processor, whether communications with the server have been re-established; and

automatically unlocking the first electronic device, by the processor, when the determination is that communications with the server have been re-established.

13. The method of claim 11 further comprising:

unlocking the first electronic device, by the processor while the first electronic device is not able to communicate with the server, in response to an entry of a password.

14. The method of claim 1, wherein the first electronic device includes the processor and the event information regards an activity involving the first electronic device.

15. A non-transitory, computer-readable storage medium having stored thereon a plurality of instructions, which, when executed by a processor of a server, cause the server to perform actions comprising:

receiving event information regarding an event at a first electronic device;

determining the event from the event information;

determining that the event indicates the first electronic device is lost or stolen by;

comparing the event against a set of events indicative of the first electronic device being lost or stolen, and

determining that the event is one of the set of events indicative of the first electronic being lost or stolen;

transmitting an instruction to the first electronic device representing a request to enter a lost or stolen mode responsive to determining that the event is indicative of the first electronic device being lost or stolen;

receiving, from a second electronic device, second authentication information;

determining, using verification information received from the first electronic device, that the second authentication information matches first authentication information provided to the first electronic device;

responsive to determining that the second authentication information matches the first authentication information;

creating a remote access credential using the second authentication information and a salt, the salt representing random data used to safeguard passwords in storage; and

transmitting the remote access credential to the first electronic device, wherein the first electronic device follows the transmitted instruction responsive to the first electronic device determining that the remote access credential is valid.

16. The non-transitory, computer-readable storage medium of claim 15, wherein:

the received event information includes a request from a user to send a command to the first electronic device;

the determining the event from the event information includes determining the requested command from the request; and

the determining that the event indicates the first electronic device is lost or stolen by includes;

comparing the requested command against a set of commands indicative of the first electronic device being lost or stolen, and

determining that the requested command is one of the set of commands indicative of the first electronic device being lost or stolen.

17. The non-transitory, computer-readable storage medium of claim 15, wherein the event includes one of:

a SIM card replacement;

a SIM card removal;

a leaving of an area;

an entering of the area;

a motion of the first electronic device;

an entering of an incorrect passcode;

an attempt to uninstall an application;

or an attempt to wipe the first electronic device.

18. A system, comprising a server with a network interface and at least one processor and memory and instructions that when executed by the at least one processor cause the server to perform actions comprising:

receiving event information regarding an event at a first electronic device;

determining the event from the event information;

determining that the event indicates the first electronic device is lost or stolen by;

comparing the event against a set of events indicative of the first electronic device being lost or stolen, and

determining that the event is one of the set of events indicative of the first electronic being lost or stolen;

transmitting an instruction to the first electronic device representing a request to enter a lost or stolen mode responsive to determining that the event is indicative of the first electronic device being lost or stolen;

receiving, from a second electronic device, second authentication information;

determining, using verification information received from the first electronic device, that the second authentication information matches first authentication information provided to the first electronic device;

responsive to determining that the second authentication information matches the first authentication information;

creating a remote access credential using the second authentication information and a salt, the salt representing random data used to safeguard passwords in storage; and

transmitting the remote access credential to the first electronic device, wherein the first electronic device follows the transmitted instruction responsive to the first electronic device determining that the remote access credential is valid.

19. The system of claim 18, wherein:

the received event information includes a request from a user to send a command to the first electronic device;

the determining the event from the event information includes determining the requested command from the request; and

the determining that the event indicates the first electronic device is lost or stolen by includes;

comparing the requested command against a set of commands indicative of the first electronic device being lost or stolen, and

determining that the requested command is one of the set of commands indicative of the first electronic device being lost or stolen.

20. The system of claim 18, wherein the event includes one of:

a SIM card replacement;

a SIM card removal;

a leaving of an area;

an entering of the area;

a motion of the first electronic device;

an entering of an incorrect passcode;

an attempt to uninstall an application;

or an attempt to wipe the first electronic device.