METHOD AND SYSTEM FOR MONITORING AND RESTRICTING USE OF MOBILE DEVICES

• US 20140113593A1
• Filed: 10/22/2013
• Published: 04/24/2014
• Est. Priority Date: 10/22/2012
• Status: Active Grant

• Current Assignee: Pervasive Group, Inc.
• Original Assignee: Pervasive Group, Inc.
• Inventors: Zhou, Zheng, Bromham, Richard
• Granted Patent: US 9,942,753 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security

Abstract

A system and method for promoting safe usage of a mobile device. The system allows one or more administrators (or patents) to transparently and automatically implement preconfigured use restriction policies (e.g., restricted time periods, restricted features of the device, restricted vehicle speed) on multiple managed devices. The restriction policies may be stored locally at a managed mobile device and/or remotely at a remote server and database. The mobile device can be controlled locally by a client application or remotely by the remote server based on the restriction policies.

Claims

1. A computer-implemented method for managing and restricting usage of a managed mobile device, comprising the steps of:

receiving, by at least one of a server, a master device and the managed mobile device, a first administrator credential for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

storing in a database the first administrator credential and the restriction policy;

implementing a user events controller at the managed mobile device for monitoring and acting on a user event at the managed mobile device; and

implementing an execution module at the at least one of the managed mobile device, the server, and the master device for enforcing the restriction policy, evaluating the user event and determining whether the user event prevents or disrupts enforcement of the restriction policy.

2. The method of claim 1, further comprising the steps of disrupting the user event if the user event prevents or disrupts enforcement of the restriction policy, and allowing the user event to continue if the user event does not prevent or disrupt enforcement of the restriction policy.

3. The method of claim 1, wherein the step of receiving includes receipt of a managed mobile device identifier for identifying the managed mobile device, and further comprising the step of associating the restriction policy with the managed mobile device identifier.

4. The method of claim 1, wherein the managed mobile device includes a communication interface for communicating with at least one of the server and the master device.

5. The method of claim 4, wherein the database is located at a local database of the managed mobile device and at a remote database physically distinct from the managed mobile device, and the execution module synchronizes at least one of the restriction policy associated with the managed device identifier and the first administrator credential across the local and remote databases.

6. The method of claim 1, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

7. The method of claim 1, further comprising the steps of receiving a second administrator credential from a second administrator from one of the server, the master device or the managed mobile device after authenticating the first administrator credential from the administrator, and then updating the database.

8. The method of claim 1, wherein the user event is one of an instantiation of a software application at the managed mobile device, modification of operational parameters of the managed mobile device, rendering of multimedia content, initiating or receiving a call, initiating or receiving a text message, initiating or receiving a Multimedia Message Service message, or initiating or receiving an email.

9. The method of claim 1, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

10. The method of claim 9, wherein the restriction policy includes an instruction to the execution module for processing an ongoing or future user event.

11. The method of claim 1, further comprising the step of determining by the execution module if an action can be taken preemptively to prevent a user from tampering with the enforcement of a restriction policy.

12. The method of claim 1, further comprising the step of determining by the execution module whether to enforce further restrictions to prevent a user from disrupting or terminating enforcement of a restriction policy that is yet to be enforced.

13. The method of claim 1, further comprising the step of preventing a user from modifying device operational parameters or instantiating one or more software application after a particular restriction policy is set up but before it is activated.

14. The method of claim 1, wherein the user event is a direct or indirect action or input initiated or triggered by a user of the managed mobile device or by another user of a different device that is in operable communication with the managed mobile device.

15. The method of claim 1, wherein the restriction policy is enforced by blocking or preventing a user from accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and multimedia content including, music, video, apps and etc. based on ratings of these types of contents.

16. The method of claim 15, wherein the restriction policy is enforced by preventing the user from installation or deletion or launching of a software application.

17. The method of claim 1, further comprising the step of validating the first administrator credential prior to allowing a restriction policy to be changed.

18. The method of claim 1, wherein the first administrator credential includes at least one of password and biometric identification data.

19. The method of claim 9, wherein the screen lock is deactivated upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

20. The method of claim 19, wherein the command is a Short Messaging Service message.

21. The method of claim 1, wherein each of the managed mobile device, the master device and the server has a communications interface and is in operable communication with each other via at least one of Short Messaging Service, internet protocol and application protocols running on top of internet protocol, Near Field Communication interface, and Blue Tooth interface.

22. The method of claim 3, wherein the managed mobile device identifier includes one of International Mobile Equipment Identifier (IMEI), Mobile Equipment Identifier (MEID, Integrated Circuit Card ID (ICCID), Unique Device Identifier (UDID), and a unique identifier generated by one of the managed mobile device, master device and server.

23. A computer-implemented method for managing and restricting usage of a managed mobile device, comprising the steps of:

receiving, by a server a first administrator credential for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

storing in a database the first administrator credential and the restriction policy; and

implementing an execution module at the server for enforcing the restriction policy

24. The method of claim 23, wherein the step of receiving includes receipt of a managed mobile device identifier for identifying the managed mobile device, and further comprising the step of associating the restriction policy with the managed mobile device identifier.

25. The method of claim 23, wherein the managed mobile device includes a communication interface for communicating with the server either directly or indirectly.

26. The method of claim 25, wherein the database is located at a remote database accessible by the server.

27. The method of claim 23, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

28. The method of claim 23, further comprising the steps of receiving a second administrator credential from a second administrator by the server after authenticating the first administrator credential from the administrator, and then updating the database.

29. The method of claim 23, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

30. The method of claim 23, wherein the restriction policy is enforced by blocking or preventing a user from accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and multimedia content including, music, video, apps and etc. based on ratings of these types of contents.

31. The method of claim 23, wherein the restriction policy is enforced by preventing the user from installation or deletion or launching of a software application,

32. The method of claim 23, further comprising the step of validating the first administrator credential prior to allowing a restriction policy to be changed.

33. The method of claim 23, wherein the first administrator credential includes at least one of password, biometric identification data, and certificate.

34. The method of claim 29, wherein the screen lock is deactivated upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

35. A managed mobile device, comprising:

an interface for receiving a first administrator credential for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

a database for storing the first administrator credential and the restriction policy;

a user events controller for monitoring and identifying a user event at the managed mobile device; and

an execution module for enforcing the restriction policy, evaluating the user event and determining whether the user event prevents or disrupts enforcement of the restriction policy.

36. The device of claim 35, wherein the execution module disrupts the user event if the user event prevents or disrupts enforcement of the restriction policy, and allowing the user event to continue if the user event does not prevent or disrupt enforcement of the restriction policy.

37. The device of claim 35, further including a communication interface for communicating with a peer device.

38. The method of claim 35, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

39. The device of claim 35, wherein the interface receives a second administrator credential from a second administrator after authenticating the first administrator credential from the administrator, and then updating the database.

40. The device of claim 35, wherein the user event is one of an instantiation of a software application at the managed mobile device, modification of operational parameters of the managed mobile device, rendering of multimedia content, initiating or receiving a call, initiating or receiving a text message, initiating or receiving a Multimedia Message Service message, or initiating or receiving an email

41. The device of claim 35, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

42. The device of claim 35, wherein the restriction policy includes an instruction to the execution module for processing an ongoing or future user event.

43. The device of claim 35, wherein the execution module determines if an action can be taken preemptively to prevent a user from tampering with the enforcement of a restriction policy.

44. The method of claim 35, wherein the execution module determines whether to enforce further restrictions to prevent a user from disrupting or terminating enforcement of a restriction policy that is yet to be enforced.

45. The device of claim 35, wherein the execution module prevents a user from modifying device operational parameters or instantiating one or more software application while setting up the restriction policy or after the restriction policy is set up but before it is activated.

46. The device of claim 35, wherein the user event is a direct or indirect action or input initiated or triggered by a user of the managed mobile device or by another user of a different device that is in operable communication with the managed mobile device.

47. The device of claim 35, wherein the restriction policy is enforced by blocking or preventing a user from accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and multimedia content including, music, video, apps and etc. based on ratings of these types of contents.

48. The device of claim 35, wherein the restriction policy is enforced by preventing the user from installation or deletion or launching of a software application,

49. The device of claim 35, wherein the execution module validates the first administrator credential prior to allowing a restriction policy to be changed.

50. The device of claim 35, wherein the first administrator credential includes at least one of password and biometric identification data.

51. The device of claim 35, wherein the screen lock is deactivated upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

52. The device of claim 51, wherein the command is a Short Messaging Service message.

53. The device of claim 35, further comprising a communications interface for communication with a peer device via at least one of Short Messaging Service, internet protocol and application protocols running on top of internet protocol, Near Field Communication, and Blue Tooth interface.

54. A system for managing and restricting usage of a managed mobile device, comprising the steps of:

receiving, by at least one of a server, a master device and the managed mobile device, a first administrator credential for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

storing in a database the first administrator credential and the restriction policy;

implementing a user events controller at the managed mobile device for monitoring and acting on a user event at the managed mobile device; and

implementing an execution module at the at least one of the managed mobile device, the server, and the master device for enforcing the restriction policy, evaluating the user event and determining whether the user event prevents or disrupts enforcement of the restriction policy.

55. The system of claim 54, wherein the execution module disrupts the user event if the user event prevents or disrupts enforcement of the restriction policy, and allows the user event to continue if the user event does not prevent or disrupt enforcement of the restriction policy.

56. The system of claim 54, wherein the at least one of a server, a master device and the managed mobile device receives a managed mobile device identifier for identifying the managed mobile device, and further comprising the step of associating the restriction policy with the managed mobile device identifier.

57. The system of claim 54, wherein the managed mobile device includes a communication interface for communicating with at least one of the server and the master device.

58. The system of claim 57, wherein the database is located at a local database of the managed mobile device and at a remote database physically distinct from the managed mobile device, and the execution module synchronizes at least one of the restriction policy associated with the managed device identifier and the first administrator credential across the local and remote databases.

59. The system of claim 54, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

60. The system of claim 54, wherein the at least at least one of a server, a master device and the managed mobile device receives a second administrator credential from a second administrator from one of the server, the master device or the managed mobile device after authenticating the first administrator credential from the administrator, and then updating the database.

61. The system of claim 54, wherein the user event is one of an instantiation of a software application at the managed mobile device, modification of operational parameters of the managed mobile device, rendering of multimedia content, initiating or receiving a call, initiating or receiving a text message, initiating or receiving a Multimedia Message Service message, or initiating or receiving an email

62. The system of claim 54, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

63. The system of claim 54, wherein the restriction policy includes an instruction to the execution module for processing an ongoing or future user event.

64. The system of claim 54, wherein the execution module determines if an action can be taken preemptively to prevent a user from tampering with the enforcement of a restriction policy.

65. The system of claim 54, wherein the execution module determines whether to enforce further restrictions to prevent a user from disrupting or terminating enforcement of a restriction policy that is yet to be enforced.

66. The system of claim 54, wherein the execution module prevents a user from modifying device operational parameters or instantiating one or more software application after a particular restriction policy is set up but before it is activated.

67. The system of claim 54, wherein the user event is a direct or indirect action or input initiated or triggered by a user of the managed mobile device or by another user of a different device that is in operable communication with the managed mobile device.

68. The system of claim 54, wherein the restriction policy is enforced by blocking or preventing a user from accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and multimedia content including, music, video, apps and etc. based on ratings of these types of contents.

69. The system of claim 54, wherein the restriction policy is enforced by preventing the user from installation or deletion or launching of a software application,

70. The system of claim 54, wherein the execution module validates the first administrator credential prior to allowing a restriction policy to be changed.

71. The system of claim 54, wherein the first administrator credential includes at least one of password and biometric identification data.

72. The system of claim 62, wherein the screen lock is deactivated by the execution module upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

73. The system of claim 72, wherein the command is a Short Messaging Service message.

74. The system of claim 54, wherein each of the managed mobile device, the master device and the server has a communications interface and is in operable communication with each other via at least one of Short Messaging Service, internet protocol and application protocols running on top of internet protocol, Near Field Communication, and Blue Tooth interface.

75. The system of claim 56, wherein the managed mobile device identifier includes one of International Mobile Equipment Identifier (IMEI), Mobile Equipment Identifier (MEID, Integrated Circuit Card ID (ICCID), Unique Device Identifier (UDID), and a unique identifier generated by one of the managed device, master device and server.