Tuning product policy using observed evidence of customer behavior

• US 20060107306A1
• Filed: 09/12/2005
• Published: 05/18/2006
• Est. Priority Date: 11/15/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ahdout, Isaac P., Thirumalai, Gokul P.
• Granted Patent: US 8,336,085 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06Q 20/26 Debit schemes, e.g. "pay now"
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03

Abstract

A computer adapted for pay-as-you go or other metered use has a policy for determined what measurements to take to detect fraud as well as steps to take when fraud is found. To optimize between good performance and sufficient tests to reduce the risk of fraud, a policy is developed based on observation of the users behavior, using data taken at the computer, data from a payment processor or both. After analysis, an updated policy is securely loaded at the computer to determine what, and how often to measure for suspected fraud.

Claims

1. A method of determining and enforcing a policy on an electronic device comprising:

collecting operational data corresponding to operation of the electronic device;

determining a risk factor based on the data;

setting the policy corresponding to the risk factor, the policy including measurement criteria and sanctions for non-compliance to the policy;

collecting measurement data, according to the measurement criteria, at a secure component within the electronic device, for determining compliance to the policy.

2. The method of claim 1, further comprising:

analyzing the measurement data at the secure component to determine compliance with the policy; and

imposing sanctions on the electronic device when the secure component determines non-compliance to the policy.

3. The method of claim 1, wherein collecting the operational data comprises collecting the data at a server separate from the electronic device, the data corresponding to at least financial transactions corresponding to the electronic device.

4. The method of claim 1, wherein collecting the data comprises collecting the data at the electronic device and reporting the data to a server separate from the electronic device.

5. The method of claim 1, wherein determining the risk factor comprises evaluating information corresponding to the electronic device available at a server, the information comprising at least one of an amount of money paid over a period of time, a frequency of payments, and contact with a support center.

6. The method of claim 5, wherein determining the risk factor further comprises evaluating information from the electronic device corresponding to at least one of a component verification, a metering activity, a clock verification, a previous enforcement action, a provisioning packet activity, and an application usage.

7. The method of claim 6, further comprising programmatically exposing the risk factor for use by an external entity.

8. The method of claim 1, wherein the setting the policy for measuring the electronic device further comprises setting criteria corresponding to at least one of an operating system heartbeat, a verification of designated files, a verification of a system clock, an operating mode, a frequency of memory access, and time between provisioning cycles.

9. A computer adapted for pay-per-use or pay-as-you-go operation in compliance with a policy corresponding to the pay-per-use or pay-as-you-go operation comprising:

a processing unit;

a memory, coupled to the processing unit, storing executable instructions for implementing;

setting at least one operational parameter corresponding to monitoring compliance to the policy;

setting sanctioning parameters corresponding to enforcing the policy; and

enforcing a sanction according to the sanctioning parameters after determining the computer is operating outside the at least one operational parameter.

10. The computer of claim 9, wherein the memory further stores executable instructions for gathering first data corresponding to operation of the computer.

11. The computer of claim 10, wherein the memory further stores executable instructions for developing the at least one operational parameter from the first data.

12. The computer of claim 10, wherein the first data includes at least one of component verification, metering activity, clock verification, prior enforcement action, application usage and provisioning cycles.

13. The computer of claim 10, further comprising a communications circuit for sending the first data to a server.

14. The computer of claim 13, wherein the communications circuit receives the at least one operational parameter from the server, the operational parameter corresponding to the first data.

15. The computer of claim 9, further comprising a communications circuit for receiving the at least one operational parameter from a server.

16. The computer of claim 9, further comprising the memory storing fourth executable instructions for monitoring computer performance to determine compliance to the policy.

17. A computer-readable media storing computer-executable instructions for use on a server in a network having at least one metered-use computer, the computer executable instructions implementing a method comprising:

acquiring data corresponding to user behavior corresponding to the metered-use computer;

developing at least one parameter corresponding to monitoring for compliance to a policy for execution at the metered-use computer;

sending the at least one parameter to the metered-use computer.

18. The computer-readable media of claim 17, wherein the computer-executable instructions for acquiring data corresponding to user behavior further comprises receiving data from the metered-use computer corresponding to operational characteristics monitored at the computer;

and the method further comprises

developing the at least one parameter corresponding to monitoring compliance to the policy based on the operational characteristics monitored at the computer.

19. The computer-readable media of claim 17, wherein the computer-executable instructions wherein the computer-executable instructions for acquiring data corresponding to user behavior further comprises acquiring records corresponding to metered use purchases for operation of the metered-use computer.

20. The computer-readable media of claim 17, further comprising monitoring for compliance according to the at least one parameter.