METHODS AND SYSTEMS FOR CAUSING MOBILE COMMUNICATIONS DEVICES TO EMIT SOUNDS WITH ENCODED INFORMATION

• US 20180206124A1
• Filed: 03/13/2018
• Published: 07/19/2018
• Est. Priority Date: 02/17/2009
• Status: Active Grant

• Current Assignee: F-Secure Corporation (F-Secure Oyj)
• Original Assignee: Lookout Incorporated
• Inventors: Mahaffey, Kevin Patrick, Hering, John G., Burgess, James David, Grkov, Vance, Richardson, David Luke, Mandal, Ayan, Mangat, Cherry, Buck, Brian James, Robinson, William
• Granted Patent: US 10,419,936 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/7652 shared by users
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/025 using location based information parameters
• CPC Class Codes: H04W 4/027 using movement velocity, acceleration information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A method is provided for comparing a usage of a mobile communications device to a stored pattern of usage. When a measure associated with a difference between the usage and the stored usage pattern exceeds a threshold, the mobile communications device is caused to emit a sound encoded with information that may be decoded by another electronic device.

Claims

1. A method comprising:

detecting, by a first security component on a mobile communications device, a usage of the mobile communications device;

comparing, by the first security component, the detected usage to a stored usage pattern associated with an authorized user of the mobile communications device to determine if there is a difference between the detected usage and the stored usage pattern;

associating, by the first security component, a measure with the stored usage pattern when there is a difference between the detected usage and the stored usage pattern;

determining, by the first security component, that the detected usage was not caused by the authorized user of the mobile communications device when the associated measure is beyond a threshold measure; and

in response to the determination, issuing a command by the first security component, the command causing the mobile communications device to emit a sound encoded with information identifying the mobile communications device, the encoded information decodable only by an electronic device.

2. The method of claim 1, wherein the emitted sound is further encoded with information identifying a location of the mobile communications device.

3. The method of claim 2, wherein the information identifying a location of the mobile communications device includes an identity of a Wi-Fi access point.

4. The method of claim 2, wherein the information identifying a location of the mobile communications device includes a location of the electronic device.

5. The method of claim 1, wherein the sound is sub-audible or super-audible.

6. The method of claim 2, wherein the encoded information causes an electronic device running a second security component, upon the electronic device receiving the encoded information, to send a message to a server, the message containing information allowing the server to identify the mobile communications device and to identify the location of the mobile communications device.

7. The method of claim 1 further comprising:

initiating, by the first security component in response to the determination that the detected usage was not caused by the authorized user, at least one of;

the suspending of access credentials;

the sending of a message to a server, the server having a trust relationship with the mobile communications device, the message indicating that the mobile communications device may be compromised;

the sending of a message to an administrator, the message indicating that the mobile communications device may be compromised;

the provisioning of a second mobile communications device with at least one of a functionality from the first mobile communications device and data from the first mobile communications device;

the sending of instructions to at least one of an administrator and a different device associated with the authorized user, the instructions relating to replacing the first mobile communications device;

the redirection of a push notification from the first mobile communications device to a different device associated with the authorized user; and

the sending of a notification to at least one of an administrator and the authorized user, the notification informing of a response to the determination that the detected usage was not caused by the authorized user, the notification providing the at least one of an administrator and the authorized user an ability to approve or reject the response.

8. The method of claim 1 further comprising:

initiating, in response to the determination that the detected usage was not caused by the authorized user, the display of a status of the mobile communications device on a web page, the status indicating that the mobile communications device may be compromised, the web page for displaying the security status of a plurality of mobile communications devices to an administrator.

9. The method of claim 8, wherein the web page provides the administrator with a graphical user interface that can be used to reduce an ability of an unauthorized user to access data stored on the mobile communications device.

10. The method of claim 1, wherein the comparing, by the first security component, the detected usage to a stored usage pattern includes at least one of:

a. comparing a browsing history of the detected usage to a browsing history of the stored usage pattern;

b. comparing a call history of the detected usage to a call history of the stored usage pattern;

c. comparing a messaging history of the detected usage to a messaging history of the stored usage pattern; and

d. comparing a travel pattern of the detected usage to a travel pattern of the stored usage pattern.

11. A method comprising:

detecting, by a first security component on a first server, a usage of a mobile communications device;

comparing, by the first security component, the detected usage to a stored usage pattern associated with an authorized user of the mobile communications device to determine if there is a difference between the detected usage and the stored usage pattern;

associating, by the first security component, a measure with the stored usage pattern when there is a difference between the detected usage and the stored usage pattern;

determining, by the first security component, that the detected usage was not caused by the authorized user of the first mobile communications device when the associated measure is beyond a threshold measure; and

in response to the determination, issuing a command by the first security component, the command causing the first mobile communications device to emit a sound encoded with information identifying the first mobile communications device, the encoded information decodable only by an electronic device.

12. The method of claim 11, wherein the sound is further encoded with information identifying a location of the mobile communications device.

13. The method of claim 12, wherein the information identifying a location of the mobile communications device includes an identity of a Wi-Fi access point.

14. The method of claim 12, wherein the information identifying a location of the mobile communications device includes a location of the electronic device.

15. The method of claim 11, wherein the sound is sub-audible or super-audible.

16. The method of claim 11, the method further comprising:

receiving, by the first security component from an electronic device running a second security component, a message containing information allowing the first server to identify the mobile communications device and to identify the location of the mobile communications device, the message sent by the electronic device after receiving the encoded information.

17. The method of claim 11 further comprising:

initiating, by the first security component in response to the determination that the detected usage was not caused by the authorized user, at least one of;

the suspending of access credentials;

the sending of a message to a second server, the second server having a trust relationship with the mobile communications device, the message indicating that the mobile communications device may be compromised;

the sending of a message to an administrator, the message indicating that the mobile communications device may be compromised;

the provisioning of a second mobile communications device with at least one of a functionality from the first mobile communications device and data from the first mobile communications device;

the sending of instructions to at least one of an administrator and a different device associated with the authorized user, the instructions relating to replacing the first mobile communications device;

the redirection of a push notification from the first mobile communications device to a different device associated with the authorized user; and

the sending of a notification to at least one of an administrator and the authorized user, the notification informing of a response to the determination that the detected usage was not caused by the authorized user, the notification providing the at least one of an administrator and the authorized user an ability to approve or reject the response.

18. The method of claim 11 further comprising:

generating a web page by the first server, the web page for displaying the security status of a plurality of mobile communications devices to an administrator; and

displaying on the web page, in response to the determination that the detected usage was not caused by the authorized user, a status of the mobile communications device, the status indicating that the mobile communications device may be compromised.

19. The method of claim 18, wherein the web page provides the administrator with a graphical user interface that can be used to reduce an ability of an unauthorized user to access data stored on the mobile communications device.

20. The method of claim 11, wherein the comparing, by the first security component, the detected usage to a stored usage pattern includes at least one of:

a. comparing a browsing history of the detected usage to a browsing history of the stored usage pattern;

b. comparing a call history of the detected usage to a call history of the stored usage pattern;

c. comparing a messaging history of the detected usage to a messaging history of the stored usage pattern; and

d. comparing a travel pattern of the detected usage to a travel pattern of the stored usage pattern.