SCREEN-ANALYSIS BASED DEVICE SECURITY

• US 20160366126A1
• Filed: 06/15/2015
• Published: 12/15/2016
• Est. Priority Date: 06/15/2015
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: WANG, Kai, SHARIFI, Matthew, PETROU, David
• Granted Patent: US 10,078,803 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Systems and methods are provided for a content-based security for computing devices. An example method includes identifying content rendered by a mobile application, the content being rendered during a session, generating feature vectors from the content and determining that the feature vectors do not match a classification model. The method also includes providing, in response to the determination that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device. Another example method includes determining a computing device is located at a trusted location, capturing information from a session, the information coming from content rendered by a mobile application during the session, generating feature vectors for the session, and repeating this until a training criteria is met. The method also includes training a classification model using the feature vectors and authenticating a user of the device using the trained classification model.

Claims

1. A mobile device comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the mobile device to;

identify content rendered by a mobile application, the content being rendered during a session,

generate feature vectors from the content,

determine that the feature vectors do not match a classification model, and

provide, in response to the determination that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device.

2. The mobile device of claim 1, the session being a first session and the challenge being based on a previous session distinct from the first session, the previous session including feature vectors that matched the classification model.

3. The mobile device of claim 1, the session being a first session and the challenge being based on a previous session distinct from the first session, the previous session including feature vectors verified using a trusted location.

4. The mobile device of claim 1, the session being a first session and the challenge being based on a previous session distinct from the first session, the previous session including feature vectors verified by a previous challenge.

5. The mobile device of claim 1, wherein the challenge is configured to prompt the user to complete information missing from a screen displayed by the mobile device in a previous session that included feature vectors that matched the classification model.

6. The mobile device of claim 1, wherein providing the challenge includes:

extracting information from a screen displayed by the mobile device in a previous session that included feature vectors matching the classification model; and

generating a multiple choice question based on the extracted information.

7. The mobile device of claim 1, wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to:

receive a response to the challenge; and

lock the mobile device when the response fails the challenge.

8. The mobile device of claim 1, wherein the challenge includes a series of sub-challenges.

9. A method comprising:

determining that a mobile device is located at a trusted location;

capturing information from a session, the information coming from content rendered by a mobile application running on the mobile device during the session;

generating feature vectors for the session;

repeating the capturing and determining until a training criteria is met;

training a classification model using at least some of the feature vectors; and

authenticating a user of the mobile device using the trained classification model.

10. The method of claim 9, wherein the training criteria includes a minimum quantity of sessions or a minimum classification accuracy.

11. The method of claim 9, wherein authenticating the user using the trained classification model includes:

determining a current session based on content rendered by a mobile application;

generating feature vectors for the session; and

providing, in response to determining that the feature vectors do not match the classification model, a challenge configured to authenticate a user of the mobile device.

12. The method of claim 9, wherein determining the mobile device is located at a trusted location includes:

accessing a user profile associated with the mobile device to determine a trusted location; and

determining that the mobile device is currently located at the trusted location.

13. The method of claim 12, wherein the trusted location is represented by global positioning system (GPS) coordinates and the mobile device uses current GPS coordinates to determine whether the mobile device is current at the trusted location.

14. The method of claim 12, wherein the trusted location is represented by a wireless network identifier and the mobile device determines whether a wireless network the mobile device is connected to matches the wireless network identifier.

15. A mobile device comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the mobile device to;

identify content rendered by a mobile application, the content being rendered during a session,

generate feature vectors from the content,

apply a classification model to the feature vectors,

determine whether the feature vectors match a first user profile based on application of the classification model, the first user profile differing from a second user profile, the mobile device being currently associated with the second user profile, and

initiate a profile switch responsive to determining that the feature vectors match the first user profile.

16. The mobile device of claim 15, wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to:

determine that the feature vectors match no user profiles; and

provide a challenge configured to authenticate a user of the mobile device.

17. The mobile device of claim 16, wherein the challenge is based on second content rendered during a previous session associated with the second user profile, the second content being associated with feature vectors consistent with the second user profile according to the classification model.

18. The mobile device of claim 16, wherein the challenge is based on second content rendered during a previous session associated with the first user profile when the classification model determines the first user profile has a higher confidence score than the second user profile with regard to the feature vectors.

19. The mobile device of claim 15, wherein the memory further stores instructions that, when executed by the at least one processor, cause the mobile device to train the classification model by:

determining that a mobile device is located in a trusted environment associated with the second user profile;

recognizing content rendered by a mobile application running on the mobile device, the content being associated with a session;

generating feature vectors for the content;

repeating the recognizing and generating for at least a minimum quantity of sessions; and

training the classification model using the feature vectors as positive examples, the positive examples being associated with the second user profile.

20. The mobile device of claim 19, wherein positive examples associated with the first user profile are used as negative examples for the second user profile in training the classification model.