METHOD AND SYSTEM FOR PROVIDING A HONEYPOT MODE FOR AN ELECTRONIC DEVICE

• US 20080018927A1
• Filed: 07/21/2006
• Published: 01/24/2008
• Est. Priority Date: 07/21/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Martin, Daryl Joseph, Hassan, Ahmed E., Wilson, J.F. Sean
• Granted Patent: US 8,479,288 B2
• Time in Patent Office: Days
• US Class Current: 358/1.15
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A method and system are described of providing an electronic device with a software environment having a honeypot mode of operation to which the device is capable of switching upon recognition of a message from an external device or of a pre-determined internal state. Switching to the honeypot mode of operation may include instituting an automatic sending of reports based on usage of the electronic device to an external device, modifying the non-user-observable behaviour of certain user-invokable operations, and manipulating data stored on the electronic device.

Claims

1. A method for surreptitiously tracking usage of an electronic device, the electronic device being capable of communicating with at least one external system, the method comprising steps of:

providing the electronic device with a software environment having a normal mode of operation and a honeypot mode of operation and with a predetermined condition, wherein, in said normal mode of operation, said software environment provides a plurality of user-invokable operations, and wherein, in said honeypot mode of operation, said software environment provides at least one of said user-invokable operations;

detecting at the electronic device the predetermined condition;

in response to said detection, switching the software environment to said honeypot mode of operation; and

,

when in said honeypot mode of operation, enabling the electronic device to automatically send a non-user-detectable report regarding usage of said at least one of said user-invokable operations to a predetermined external system.

2. The method of claim 1, wherein the step of providing includes providing the electronic device with the software environment through at least one connection from the following group:

a direct, wired connection;

a direct, wireless connection;

a private network connection; and

a virtual private network connection.

3. The method of claim 1, wherein said step of providing includes receiving at the electronic device a communication provisioning the software environment from an external source, authenticating the communication as authorized, and installing the software environment on the electronic device.

4. The method of claim 3, wherein said communication comprises a software update.

5. The method of claim 1, wherein said step of detecting the predetermined condition includes determining that a predetermined state of the electronic device exists.

6. The method of claim 5, wherein said step of determining includes determining that a predefined maximum number of failed password attempts have been made.

7. The method of claim 1, wherein said step of detecting the predetermined condition includes receiving from an external device a predetermined message.

8. The method of claim 7, wherein said step of receiving includes authenticating said predetermined message.

9. The method of claim 1, wherein said step of switching includes modifying a non-user-observable behaviour of said at least one of said user-invokable operations.

10. The method of claim 1, wherein said step of providing includes providing said at least one user-invokable operation with a normal function and a modified function, and wherein said modified function includes performing a non-user-detectable operation, and wherein the step of switching includes causing said at least one user-invokable operation to switch from said normal function to said modified function.

11. The method of claim 10, wherein said non-user-detectable operation includes generating said non-user-detectable report.

12. The method of claim 10, wherein the electronic device is capable of voice communication and said user-invokable operation comprises initiating a voice call, and wherein said modified function comprises at least one of the following:

simulating placing said call;

placing said call both to an intended party and to a predetermined party; and

automatically sending said non-user-detectable report, wherein said non-user-detectable report includes information regarding said call-placing operation.

13. The method of claim 10, wherein the electronic device is capable of sending electronic messages and said user-invokable operation comprises initiating a send message operation, and wherein said modified function comprises at least one of the following:

simulating sending a message;

sending the message to an intended recipient and sending a doubly blind carbon copy of the message to a predetermined recipient, with the predetermined recipient excluded from all fields of both the message received by the intended recipient and the sent copy stored on the electronic device;

sending the message only to a predetermined recipient, with the sent copy stored on the electronic device indicating it was sent to the intended recipient rather than the predetermined recipient; and

sending said non-user-detectable report regarding said attempt to said predetermined external system.

14. The method of claim 1, wherein said step of switching includes manipulating at least a portion of the stored data, said step of manipulating including at least one of the following steps:

encrypting stored data, deleting stored data, sending stored data to a predetermined external device, moving stored data within the memory, storing in the memory data received from a predetermined external device, and changing access permissions associated with stored data.

15. The method of claim 14, wherein said step of encrypting stored data includes use of at least one of the following encryption methods:

the Advance Encryption Standard (AES), and the Triple Data Encryption Algorithm (TDEA).

16. The method of claim 14, wherein the moving of stored data within the memory comprises moving data to a portion of memory that is inaccessible to all user-invokable operations while the electronic device is operating in said honeypot mode.

17. The method of claim 14, wherein the moving of stored data within the memory has a steganographic effect.

18. The method of claim 1, wherein the electronic device has a user-invokable wipe operation for re-initializing the state of the electronic device, and wherein said step of switching includes storing information regarding said honeypot mode in a persistent non-user-observable portion of stored memory such that said software environment remains in said honeypot mode of operation following invocation of said wipe operation.

19. The method of claim 1, further including detecting usage of said at least one of said user-invokable operations and automatically sending said non-user-detectable report regarding said usage.

20. An electronic device, configured to enable surreptitious tracking of usage of the electronic device, the electronic device comprising:

a communication subsystem for enabling communications with at least one external system;

memory storing a software environment having a normal mode of operation and a honeypot mode of operation and storing a predetermined condition, wherein, in said normal mode of operation, said software environment provides a plurality of user-invokable operations, and wherein, in said honeypot mode of operation, said software environment provides at least one of said user-invokable operations;

a processor for executing said software environment; and

a mode-switch module for detecting the predetermined condition and, in response to said detection, switching the software environment to said honeypot mode of operation,

wherein, when in said honeypot mode of operation, said software environment is adapted to automatically send a non-user-detectable report regarding usage of said at least one of said user-invokable operations to a predetermined external system.

21. The electronic device of claim 20, wherein the communication subsystem is adapted to receive a communication from an external source providing said software environment, and wherein the communication subsystem is adapted to establish at least one connection from the following group:

a direct, wired connection;

a direct, wireless connection;

a private network connection; and

a virtual private network connection.

22. The electronic device of claim 21, further including an authentication component for authenticating said communication.

23. The electronic device of claim 22, wherein said communication comprises a software update.

24. The electronic device of claim 20, wherein said predetermined condition comprises a device state, and wherein said mode-switch module is adapted to determine that said device state exists.

25. The electronic device of claim 24, said device state includes a state in which a predefined maximum number of failed password attempts have been made.

26. The electronic device of claim 20, wherein said predetermined condition includes reception of a predetermined message from an external device.

27. The electronic device of claim 26, wherein said mode-switch module is adapted to authenticate said predetermined message.

28. The electronic device of claim 20, said mode-switch module is adapted to modify a non-user-observable behaviour of said at least one of said user-invokable operations.

29. The electronic device of claim 20, wherein said at least one user-invokable operation is configured to have a normal function and a modified function, and wherein said modified function includes a non-user-detectable operation, and wherein said mode-switch module is adapted to cause said at least one user-invokable operation to switch from said normal function to said modified function.

30. The electronic device of claim 29, wherein said non-user detectable operation includes generating said non-user-detectable report.

31. The electronic device of claim 29, wherein the electronic device is capable of voice communication and said at least one user-invokable operation comprises initiating a voice call, and wherein said modified function comprises at least one of the following:

simulating placing said call;

placing said call both to an intended party and to a predetermined party; and

automatically sending said non-user-detectable report, wherein said non-user-detectable report includes information regarding said call-placing operation.

32. The electronic device of claim 29, wherein the electronic device is capable of sending electronic messages and said at least one user-invokable operation comprises initiating a send-message operation, and wherein said modified function comprises at least one of the following:

simulating sending a message;

sending the message to an intended recipient and sending a doubly blind carbon copy of the message to a predetermined recipient, with the predetermined recipient excluded from all fields of both the message received by the intended recipient and the sent copy stored on the electronic device;

sending the message only to a predetermined recipient, with the sent copy stored on the electronic device indicating it was sent to the intended recipient rather than the predetermined recipient; and

sending a report of said attempt to said predetermined external system.

33. The electronic device of claim 20, wherein said mode-switch module includes a component for manipulating at least a portion of the stored data, wherein said component is adapted to perform at least one of the following operations:

encrypting stored data, deleting stored data, sending stored data to a predetermined external device, moving stored data within the memory, storing in the memory data received from a predetermined external device, and changing access permissions associated with stored data.

34. The electronic device of claim 33, wherein the moving of stored data within the memory comprises moving data to a portion of memory that is inaccessible to all user-invokable operations while the electronic device is operating in said honeypot mode.

35. The electronic device of claim 33, wherein the moving of stored data within the memory has a steganographic effect.

36. The electronic device of claim 20, wherein the electronic device induces a user-invokable wipe operation for re-initializing the state of the electronic device, and wherein said mode-switch module stores information regarding said honeypot mode in a persistent non-user-observable portion of stored memory such that said software environment remains in said honeypot mode of operation following invocation of said wipe operation.

37. A computer program product comprising a computer-readable medium having encoded therein computer-executable instructions for surreptitiously tracking usage of an electronic device, the electronic device being capable of communicating with at least one external system, the instructions comprising:

instructions for providing the electronic device with a software environment having a normal mode of operation and a honeypot mode of operation and with a predetermined condition, wherein, in said normal mode of operation, said software environment provides a plurality of user-invokable operations, and wherein, in said honeypot mode of operation, said software environment provides at least one of said user-invokable operations;

instructions for detecting at the electronic device the predetermined condition;

instructions for, in response to said detection, switching the software environment to said honeypot mode of operation; and

instructions for, when in said honeypot mode of operation, automatically sending a non-user-detectable report regarding usage of said at least one of said user-invokable operations to a predetermined external system.