METHOD FOR MONITORING THE UNAUTHORIZED USE OF A DEVICE

• US 20090249497A1
• Filed: 09/03/2008
• Published: 10/01/2009
• Est. Priority Date: 04/01/2008
• Status: Active Grant

• Current Assignee: Blancco Technology Group Ip Oy
• Original Assignee: Inhance Technology
• Inventors: Fitzgerald, William, Bermingham, Peter, Prendergast, Paul, Hannigan, Frank
• Granted Patent: US 8,932,368 B2
• Time in Patent Office: Days
• US Class Current: 726/35
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 8/183 Processing at user equipment or user record carrier

Abstract

The invention is directed to systems and methods for detecting the loss, theft or unauthorized use of a device and/or altering the functionality of the device in response. In one embodiment, a device monitors its use, its local environment, and/or its operating context to determine that the device is no longer within the control of an authorized user. The device may receive communications or generate an internal signal altering its functionality, such as instructing the device to enter a restricted use mode, a surveillance mode, to provide instructions to return the device and/or to prevent unauthorized use or unauthorized access to data. Additional embodiments also address methods and systems for gathering forensic data regarding an unauthorized user to assist in locating the unauthorized user and/or the device.

Claims

1. A method comprising:

providing, by a mobile device, a notification describing how to return the mobile device to an authorized user;

detecting, by the mobile device, that a security compromise event has occurred; and

determining whether the function of the device should be altered in response to said security compromise event.

2. The method as disclosed in claim 1, wherein detecting that a security compromise event has occurred further comprises detecting that a SIM card associated with the mobile device has been exchanged.

3. The method as disclosed in claim 1, wherein detecting that a security compromise event has occurred further comprises detecting that a SIM card associated with the mobile device has been removed from the mobile device.

4. The method as disclosed in claim 1, wherein detecting that a security compromise event has occurred further comprises:

obtaining from the authorized user a set of criteria indicating unauthorized use of the mobile device; and

determining that at least one of the criteria indicating unauthorized use has occurred.

5. The method as disclosed in claim 4, wherein the criteria indicating unauthorized use of the mobile device comprise at least one of:

a maximum number of calls that may be placed to numbers not included in a pre-stored authorized number list;

a maximum number of calls that may be received by numbers not included in the pre-stored authorized number list; and

a call being placed to a country code not included in the pre-stored authorized number list.

6. The method as disclosed in claim 1, wherein detecting, by the mobile device, that a security compromise event has occurred further comprises:

associating the mobile device with a companion device; and

determining that the mobile device has been moved relative to the location of the companion device.

7. The method as disclosed in claim 6, further comprising:

formatting a message for transmission to a security authority, the message comprising regarding movement of the mobile device with respect to the companion device;

wherein the message is formatted by the companion device.

8. The method as disclosed in claim 1, wherein detecting, by the mobile device, that a security compromise event has occurred further comprises:

associating the mobile device with a companion device; and

determining that the mobile device has been disassociated from the companion device.

9. The method as disclosed in claim 8, further comprising:

formatting a message for transmission to a security authority, the message comprising information regarding the disassociation of the mobile device with the companion device;

wherein the message is formatted by the companion device.

10. The method as disclosed in claim 8, wherein associating the mobile device with a companion device further comprises pairing the mobile device with a companion device via at least one of a wired link and a wireless link.

11. The method as disclosed in claim 10, wherein the wired link is implemented with at least one of a computer network connection, a USB connection, a mobile device synchronization port connection, a power connection, and a security cable.

12. The method as disclosed in claim 11, wherein determining that the mobile device has been has been disassociated from the companion device comprises determining that a connection between the wired link and the mobile device has been severed.

13. The method as disclosed in claim 8, wherein determining that the mobile device has been disassociated from the companion device comprises:

measuring a current power level of a wireless signal transmitted by the companion device; and

determining that the measured current power level has decreased below a predetermined threshold level.

14. The method as disclosed in claim 8, wherein determining that the mobile device has been disassociated from the companion device comprises:

measuring a current power level of a wireless signal transmitted by the companion device; and

determining that the measured current power level has decreased by a predetermined amount.

15. The method as disclosed in claim 8, wherein determining that the mobile device has been disassociated from the companion device comprises:

measuring a plurality of power levels of a wireless signal transmitted by the companion device;

computing an average power level from the plurality of measured power levels;

measuring a current power level of a wireless signal transmitted by the companion device;

determining that the measured current power level has varied from the average power level by a predetermined amount.

16. The method as disclosed in claim 15, wherein determining that the measured current power level has varied from the an average power level by a predetermined amount further comprises:

computing a standard deviation of the plurality of measured power levels; and

determining that the current power level exceeds an allowed signal range determined by a predetermined constant times the standard deviation of the plurality of measured signals.

17. The method as disclosed in claim 16, wherein the predetermined constant is 1.

18. The method as disclosed in claim 8, wherein determining that the mobile device has been disassociated from the companion device comprises:

measuring a plurality of power levels of a wireless signal transmitted by the companion device;

computing an average power level from the plurality of measured power levels;

measuring a plurality of current power levels of a wireless signal transmitted by the companion device;

determining that for a predetermined number of times within a predetermined time period, one of the plurality of current power levels has varied from the average power level by a predetermined amount.

19. The method as disclosed in claim 8, wherein determining that the mobile device has been disassociated from the companion device comprises transmitting a message to the companion device and determining that a message was not received from the companion device that satisfies a predetermined confirmation criterion.

20. The method as disclosed in claim 8, wherein determining that the mobile device has been disassociated from the companion device comprises determining that an amount of incident light illuminating at least one surface of the mobile device has varied from a predetermined threshold range.