SYSTEM FOR MONITORING THE UNAUTHORIZED USE OF A DEVICE

• US 20090249460A1
• Filed: 04/01/2008
• Published: 10/01/2009
• Est. Priority Date: 04/01/2008
• Status: Active Grant

• Current Assignee: Blancco Technology Group Ip Oy
• Original Assignee: Inhance Technology
• Inventors: Fitzgerald, William, Bermingham, Peter, Prendergast, Paul, Hannigan, Frank
• Granted Patent: US 8,719,909 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2139 Recurrent verification
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

The invention is directed to systems and methods for detecting the loss, theft or unauthorized use of a device and/or altering the functionality of the device in response. In one embodiment, a device monitors its use, its local environment, and/or its operating context to determine that the device is no longer within the control of an authorized user. The device may receive communications or generate an internal signal altering its functionality, such as instructing the device to enter a restricted use mode, a surveillance mode, to provide instructions to return the device and/or to prevent unauthorized use or unauthorized access to data. Additional embodiments also address methods and systems for gathering forensic data regarding an unauthorized user to assist in locating the unauthorized user and/or the device.

Claims

1. A tracking and loss mitigation system comprising:

a mobile device, the device comprising;

a user interface including a display and a data entry interface; and

a communications interface to a security authority;

wherein the mobile device is configured to;

provide, by the user interface of the mobile device, a notification describing how to return the mobile device to an authorized user;

detect that a security compromise event has occurred; and

determine whether the function of the device should be altered in response to said security event.

2. The system as disclosed in claim 1, wherein the communications interface to the security authority further comprises at least one of:

a wired Internet connection;

a wireless Internet connection;

a cellular telephone network connection;

a wireless LAN connection;

a wireless WAN connection; and

an optical connection.

3. The system as disclosed in claim 1, wherein the mobile device is further configured to detect that a security compromise event has occurred by receiving a message from the security authority.

4. The system as disclosed in claim 1, wherein the message is at least one of:

an SMS text message;

a voice mail message;

an email message; and

a predetermined sequence of one or more DTMF tones.

5. The system as disclosed in claim 1, further comprising in response to instructions from the authorized user, causing the security authority to send the message to the mobile device in response to a perceived security threat.

6. The system as disclosed in claim 1, wherein the mobile device is further configured to detect that a security compromise event has occurred by:

associating the mobile device with a companion device; and

determining that the mobile device has been disassociated with the companion device.

7. The system as disclosed in claim 6, wherein associating the mobile device with a companion device further comprises pairing the mobile device with a companion device via at least one of a wired link and a wireless link.

8. The system as disclosed in claim 7, wherein the wireless link is implemented with a communications protocol selected from the group consisting of:

an ISO 14443 protocol;

an ISO 18000-6 protocol;

a Bluetooth protocol;

a Zigbee protocol;

a Wibree protocol;

an IEEE 802.15 protocol;

an IEEE 802.11 protocol;

an IEEE 802.16 protocol;

an ultra-wideband (UWB) protocol;

an IrDA protocol; and

combinations thereof.

9. The system as disclosed in claim 7, wherein the wired link is implemented with at least one of a computer network connection, a USB connection, a mobile device synchronization port connection, a power connection, and a security cable.

10. The system as disclosed in claim 6, wherein determining that the mobile device has been has been disassociated with the companion device comprises determining that a connection between the wired link and the mobile device has been severed.

11. The system as disclosed in claim 6, wherein determining that the mobile device has been disassociated with the companion device comprises:

measuring a current power level of a wireless signal transmitted by the companion device; and

determining that the measured current power level has decreased below a predetermined threshold level.

12. The system as disclosed in claim 1, further comprising a hardware identity module in communication with the mobile device, wherein the mobile device is further configured to detect that a security compromise event has occurred by:

determining that an identifier of the hardware identity module does not match one or more predetermined authorized identifiers.

13. The system as disclosed in claim 12, wherein the one or more predetermined authorized identifiers include at least one of an electronic serial number, a local area identity identifier, an integrated circuit identifier, an international mobile subscriber identifier, an authentication key identifier, and an operator-specific emergency number identifier.

14. The system as disclosed in claim 12, wherein the hardware identity module comprises at least one of a universal subscriber identity module or a removable user identity module.

15. The system as disclosed in claim 12, wherein the mobile device is further configured to detect that a security compromise event has occurred by recording the identifier of the hardware identity module in a storage medium.

16. The system as disclosed in claim 15, wherein the security authority further comprises a database in communication with a host server, the mobile device is further configured to detect that a security compromise event has occurred by transmitting the recorded identifier to the host server.

17. The system as disclosed in claim 1, wherein the mobile device is further configured to detect that a security compromise event has occurred by:

compiling a usage profile of the mobile device over a predetermined time period;

accumulating information regarding continued usage of the mobile device, and

determining that the continued usage deviates from the usage profile by a predetermined threshold.

18. The system as disclosed in claim 17, wherein the predetermined time period is specified by the authorized user of the mobile device.

19. The system as disclosed in claim 17, wherein the predetermined time period shifts in time as the mobile device is utilized.

20. The system as disclosed in claim 17, wherein the accumulated information is captured from the continued usage of the mobile device over a predetermined usage period.

21. The system as disclosed in claim 17, wherein the accumulated information includes usage indicia selected from the group consisting of:

a ratio of number of calls placed from numbers residing within a contact list within the mobile device to numbers not residing within the contact list;

a time of day that one or more calls were placed by the mobile device;

a mean time interval between button presses;

a pressed button type;

a mean pressure exerted when pressing buttons;

a number of times within a predetermined time interval that a password was input incorrectly;

a number of consecutive times that a password was input incorrectly; and

combinations thereof.

22. The system as disclosed in claim 21, wherein determining that the continued usage deviates from the usage profile by a predetermined threshold further comprises:

determining that a predetermined plurality of the usage indicia have deviated from the usage profile by a predetermined voting threshold.

23. The method as disclosed in claim 17, further comprising prompting a current user of the mobile device to enter a password.

24. The system as disclosed in claim 1, wherein the mobile device is further configured to detect that a security compromise event has occurred by:

measuring a first environmental parameter at a first time point and a second environmental parameter at a second time point;

comparing the first environmental parameter and second environmental parameter to a predetermined authorized use condition; and

determining that the mobile device has been moved from a first location.

25. The system as disclosed in claim 24 wherein measuring a first environmental parameter at a first time point and a second environmental parameter at a second time point further comprises:

activating a camera in communication with the mobile device; and

capturing first and second images at the respective first time point and second time point.

26. The system as disclosed in claim 25 further comprising:

comparing the first and second captured images to characterize a change in at least one of an average brightness level, an image saturation histogram, and an image pattern; and

determining that the change exceeds a predetermined threshold.

27. The system as disclosed in claim 24 further comprising transmitting at least one of the first and second measured environmental parameter to a security authority.

28. The system as disclosed in claim 24 wherein measuring a first environmental parameter at a first time point and a second environmental parameter at a second time point further comprises:

activating a wireless receiver in communication with the mobile device; and

sensing one or more wireless network addresses from one or more signals received by the mobile device at the first time point and the second time point.

29. The system as disclosed in claim 28 further comprising:

comparing the one or more network addresses respectively sensed at the first time point and the second time point to determine whether the sensed network addresses differ.

30. The system as disclosed in claim 24 wherein measuring a first environmental parameter at a first time point and a second environmental parameter at a second time point further comprises:

receiving, by the mobile device, a signal comprising geolocation information; and

decoding first and second location signals received at the respective first time point and second time point to produce a first sampled location and a second sampled location.

31. The system as disclosed in claim 30 further comprising

comparing the first and second sampled locations to determine whether a distance between two sampled locations exceeds a predetermined threshold.

32. The system as disclosed in claim 1, wherein:

the mobile device further comprises a biometric measurement interface; and

the mobile device is further configured to detect that a security compromise event has occurred by;

obtaining a biometric measurement of a current user through the biometric measurement interface;

comparing the biometric measurement to a previously stored reference value; and

determining that the biometric measurement exceeds a predetermined threshold variance from the previously stored reference value.

33. The system as disclosed in claim 32, wherein the biometric measurement interface further includes at least one of:

a fingerprint scanner;

an iris scanner;

a retinal scanner;

a microphone;

a breath analyzer; and

a camera.

34. The method as disclosed in claim 33, wherein obtaining a biometric measurement includes at least one of:

scanning a fingerprint of the current user of the mobile device;

scanning an iris of the current user of the mobile device;

scanning a retina of the current user of the mobile device;

obtaining a voice sample of the current user of the mobile device;

obtaining a breath sample of the current user of the mobile device; and

taking a photograph of at portion of the body of the current user of the mobile device.

35. The system as disclosed in claim 1, wherein the mobile device is further configured to detect that a security compromise event has occurred by:

detecting a current hardware configuration of the mobile device;

comparing the current hardware configuration to a previously stored hardware configuration; and

determining that the current hardware configuration includes changes that exceed a predetermined threshold.

36. The system as disclosed in claim 1, wherein the mobile device is selected from a group consisting of:

a laptop computer;

a desktop computer;

a mobile subscriber communication device;

a mobile phone;

a personal digital assistant (PDA);

a data tablet;

a digital camera;

a video camera;

a video game console;

a media player;

a USB key;

a global positioning system (GPS); and

combinations thereof.

37. The system as disclosed in claim 1, wherein the security compromise event is selected from the group consisting of:

loss of control of the mobile device by the authorized user;

theft of the mobile device;

loss of knowledge as to the whereabouts of the mobile device;

intrusion of an electronic threat including at least one of an electronic virus, an electronic worm, an electronic trojan horse;

unauthorized access to private information in the mobile device; and

use of the mobile device in a manner not authorized by a wireless service provider.

47. The system as disclosed in claim 1, wherein the mobile device is configured to detect that an unauthorized user has tampered with a security feature of the mobile device.

48. The system as disclosed in claim 47, wherein detecting that an unauthorized user has tampered with a security measure further comprises at least one of:

determining that the unauthorized user has attempted to mask a reported location of the mobile device;

determining that the unauthorized user has attempted to re-route an electronic address in the mobile device;

determining that the unauthorized user has attempted to bypass a password prompt provided by the mobile device;

determining that the unauthorized user has attempted a brute force password attack on the mobile device; and

determining that the unauthorized user has attempted to install applications intended to thwart operation system security.

51. The system as disclosed in claim 1, wherein the mobile device is configured to detect that a security compromise event has occurred by receiving a message from a security authority, and determining, based on the content of the message, that a security compromise event has occurred.

52. The system as disclosed in claim 51, wherein the mobile device is configured to receive the message while in a quiescent state;

and determine, based on the content of the received message, that a security compromise event has occurred.

53. The system as disclosed in claim 51, wherein the mobile device is configured to periodically:

transition from a quiescent state to an active state;

poll a security authority to determine whether a message is available;

download the message; and

determine that a security compromise event exists based on the content of the message.

38. A tracking and loss mitigation system comprising:

a mobile device comprising a communications interface;

a database, coupled to the mobile device, including situational information indicating that operation of a device is to be modified;

wherein the mobile device is configured to;

present to a current user information regarding returning the device to an authorized user;

determine that the use of the device is to be restricted; and

modify a permitted functionality set of the device from a first feature set to a second feature set.

39. The system as disclosed in claim 38 wherein the mobile device is configured to determine that the use of the device is to be restricted by determining, based on a measurement from the communications interface and a location value in the database, that the use of the device is to be restricted.

40. The system as disclosed in claim 38 wherein the mobile device is configured to determine that the use of the device is to be restricted by attempting communications with a second device, wherein a communication link between the mobile device and the second device cannot be initiated.

41. The system as disclosed in claim 38 wherein the mobile device is configured to determine that the use of the device is to be restricted by attempting communications with a second device, wherein a signal received from the attempted communication comprises information indicating that access to the mobile device should be restricted.

42. The system as disclosed in claim 38 wherein the differences between the first feature set and the second feature set are selected based on the context of use of the mobile device.

43. The system as disclosed in claim 38, wherein the mobile device further comprises a storage element, wherein:

data stored in the storage element is partitioned into one or more logically disjoint data groups; and

each of the data groups is encrypted with a respective unique encryption key.

44. The system as disclosed in claim 43, wherein the storage element comprises a plurality of physical storage media.

45. The system as disclosed in claim 44, wherein the plurality of physical storage media comprises a RAID array.

46. The system as disclosed in claim 38, wherein the mobile device further comprises a storage element, wherein the mobile device is further configured to:

encrypt designated files that are not open for use by the operating system;

intercept operating system calls to open a file, and thereupon;

decrypt the file; and

open the file; and

intercept operating system calls to close a file, and thereupon;

close the file; and

encrypt the file.

49. A tracking and loss mitigation system comprising:

a mobile device, the device comprising;

a user interface including a display and a data entry interface; and

a communications interface to a security authority;

wherein the mobile device is configured to;

provide instructions regarding how to return the mobile device to an authorized user;

detect that a security compromise event has occurred;

determine whether the function of the device should be altered in response to said security compromise event;

alter the function of the mobile device in response to said security compromise event to mitigate loss of control by the authorized user.

50. A method comprising:

providing, by a mobile device, a notification describing how to return the mobile device to an authorized user;

detecting, by the mobile device, that a security compromise event has occurred;

determining whether the function of the device should be altered in response to said security compromise event; and

altering the function of the mobile device in response to said security compromise event to mitigate loss of control by the authorized user.