ELECTRONIC DEVICES HAVING ADAPTIVE SECURITY PROFILES AND METHODS FOR SELECTING THE SAME

• US 20120284779A1
• Filed: 05/04/2011
• Published: 11/08/2012
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Ingrassia, Michael I. Jr., Lee, Jeffery T.
• Granted Patent: US 8,683,556 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/21 for social networking applications

Abstract

Adaptive security profiles are supported on an electronic device. One or more security profiles may be automatically or selectively applied to the device based on the device'"'"'s location and one or more geographic zone definitions. The security profiles may be used to determine the level of authentication or number of invalid authentication attempts for a particular feature or application or set of features or applications.

Claims

1. A method for selectively adjusting a security profile of an electronic device, the method comprising:

maintaining a database that defines expected zones in which the electronic device may be located;

obtaining a current location of the electronic device;

determining whether the current location is located in, or near, one of the expected zones; and

selectively applying one of a plurality of different security profiles based on the determination of whether the current location is located in, or near, one of the expected zones.

2. The method of claim 1, wherein the expected zone is a geographic zone.

3. The method of claim 2, wherein the expected zone is based at least on a determination of a user'"'"'s routine.

4. The method of claim 3, wherein the determination of a user'"'"'s routine comprises:

enabling a tracking mode on the electronic device;

sampling location data;

ending the tracking mode; and

storing an expected zone in the database, wherein the sampled location data is used to define geographic boundaries of that expected zone.

5. The method of claim 1, wherein maintaining a database of expected zones comprises:

receiving user defined parameters for one of the expected zones.

6. The method of claim 1, wherein maintaining a database of expected zones comprises:

automatically defining one or more of the expected zones using location data, a calendar, a social network, or a combination thereof.

7. The method of claim 1, wherein the plurality of security profiles includes first and second security profiles, wherein the first security profile is more device restrictive than the second security profile, and upon determining that the device is located in an expected zone, selectively applying the second security profile, and upon determining that the device is not located in an expected zone, selectively applying the first security profile.

8. The method of claim 1, wherein each of the plurality of security profiles has a different authentication paradigm.

9. The method of claim 1, further comprising:

receiving user defined parameters for each of the plurality of security profiles.

10. An electronic device for supporting adaptive security profiles, the device comprising:

a location module configured to determine the location of the electronic device;

a data storage device operative to store at least one expected zone and at least one security profile; and

a processing module coupled to the memory and the location module, the processing module operative to;

compare the determined location of the electronic device to the at least one expected zone; and

apply at least one electronic device security profile based on the comparison.

11. The system of claim 10, wherein the at least one expected zone is automatically defined using information from a calendar.

12. The system of claim 11, wherein the information from a calendar represents a travel itinerary.

13. The system of claim 10, wherein the at least one expected zone is defined using information from a social network.

14. The system of claim 13, wherein the information from a social network comprises location and time metadata of a photograph posted by a user of the electronic device on the social network.

15. The system of claim 13, wherein the information from a social network comprises location information derived from a checked-in entry posted by a user of the electronic device on the social network.

16. The system of claim 10, wherein the security profile comprises authentication options for a plurality of features and applications on the electronic device.

17. The system of claim 10, wherein the security profile comprises a number of permissible invalid authentication attempts for a plurality of features and applications on the electronic device.

18. A method for supporting adaptive security profiles on a electronic device, the method comprising:

determining an expected zone of the electronic device;

determining, based at least in part upon data from a location module, whether the electronic device is located in an expected zone; and

in response to a determination that the electronic device is not in an expected zone, reducing a number of invalid authentication attempts a user is permitted to attempt.

19. The method of claim 18, wherein the reducing a number of invalid authentication attempts is part of an increased security profile.

20. The method of claim 18, wherein the reducing a number of invalid authentication attempts applies to powering-on the electronic device.

21. The method of claim 18, wherein the reducing a number of invalid authentication attempts applies to accessing one or more features or functions of the electronic device.

22. The method of claim 18, wherein if the user exceeds an allowed number of invalid authentication requests, the electronic device enters a reduced functionality mode.

23. The method of claim 22, wherein the reduced functionality mode comprises disabling the electronic device.