System for mitigating the unauthorized use of a device

• US 8,248,237 B2
• Filed: 04/02/2008
• Issued: 08/21/2012
• Est. Priority Date: 04/02/2008
• Status: Active Grant

• Current Assignee: Blancco Technology Group Ip Oy
• Original Assignee: Inhance Technology
• Inventors: Prendergast, Paul, Fitzgerald, William, Bermingham, Peter, Hannigan, Frank
• Primary Examiner(s): Nguyen, Nam V
• Application Number:
  US12/060,865
• Publication Number:
  US 20090251282A1
• Time in Patent Office: 1,602 Days
• Field of Search: 340/571, 340/5.31, 340/426, 340/457, 705/75, 705/50, 713/185, 713/186, 455/410, 455/411, 455/418
• US Class Current: 340/571
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

The invention is directed to systems and methods for detecting the loss, theft or unauthorized use of a device and/or altering the functionality of the device in response. In one embodiment, a device monitors its use, its local environment, and/or its operating context to determine that the device is no longer within the control of an authorized user. The device may receive communications or generate an internal signal altering its functionality, such as instructing the device to enter a restricted use mode, a surveillance mode, to provide instructions to return the device and/or to prevent unauthorized use or unauthorized access to data. Additional embodiments also address methods and systems for gathering forensic data regarding an unauthorized user to assist in locating the unauthorized user and/or the device.

Claims

1. A tracking and loss mitigation system comprising:

a mobile device, the device comprising;

a user interface including a display and a data entry interface; and

a communications interface to a security authority;

wherein the mobile device is configured to;

provide instructions regarding how to return the mobile device to an authorized user;

detect that a security compromise event has occurred; and

alter the function of the mobile device in response to said security

compromise event to mitigate loss of control by the authorized user by;

obtaining from the authorized user a first list of zero or more data elements stored within the mobile device to be deleted upon occurrence of the security compromise event, and upon occurrence of the security compromise event, deleting the first list data elements from in the mobile device;

obtaining from the authorized user a second list of zero or more data elements stored within the mobile device to be encrypted upon occurrence of the security compromise event, and upon occurrence of the security compromise event, encrypting, by the mobile device, the second list data elements in the mobile device with a password known by at least one of the security authority and the authorized user.

2. The system as disclosed in claim 1, wherein the mobile device is selected from a group consisting of:

a laptop computer;

a desktop computer;

a mobile subscriber communication device;

a mobile phone;

a personal digital assistant (PDA);

a data tablet;

a digital camera;

a video camera;

a video game console;

a media player;

a USB key;

a global positioning system (GPS); and

combinations thereof.

3. The system as disclosed in claim 1, wherein the security compromise event is selected from the group consisting of:

loss of control of the mobile device by the authorized user;

theft of the mobile device;

loss of knowledge as to the whereabouts of the mobile device;

intrusion of an electronic threat including at least one of an electronic virus, an electronic worm, an electronic trojan horse;

unauthorized access to private information in the mobile device; and

use of the mobile device in a manner not authorized by a wireless service provider.

4. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by presenting an automated message when a current user of the mobile device attempts to utilize the mobile device, wherein the automated message comprises at least one of a notification:

that the mobile device has been lost or stolen;

that a reward is offered for the prompt return of the mobile device; and

that the user may press any button to initiate contact with a security authority;

providing instructions for return of the mobile device to the authorized user.

5. The system as disclosed in claim 4, wherein the message includes at least one of an audio message, a textual message, and a video message.

6. The system as disclosed in claim 4, wherein the message is presented while the current user is utilizing the mobile device to place a telephone call.

7. The system as disclosed in claim 1, wherein the mobile device is further configured to initiate contact with a security authority when any button on the mobile device is depressed.

8. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by modulating display illumination in the mobile device to draw attention to the mobile device.

9. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by playing over a loudspeaker in the mobile device a unpleasant sound.

10. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by sending a message to the authorized user, the message comprising information selected from the group consisting of:

a phone number called by the mobile device;

a current operational status of the mobile device;

a location of the mobile device;

a statement that the mobile device has been removed from a predetermined location;

a statement that the mobile device is in motion;

a date and time stamp indicating when the device was first used after occurrence of the security event; and

instructions to call a security authority to initiate a recovery process.

11. The system as disclosed in claim 1, wherein

the security authority further comprises a database comprising authorized user information and related mobile device information;

and

the security authority is further configured to

obtain a theft notification record for the authorized user from the database; and

contact the authorized user by at least one of;

a phone call placed to a phone number specified in the theft notification record, whereupon audio instructions are provided to the authorized user regarding how to contact the current user of the mobile device to recover the mobile device; and

a text message sent electronically to an address specified in the theft notification record, whereupon textual instructions are provided to the authorized user regarding how to contact the current user of the mobile device to recover the mobile device; and

a printed message sent by conventional mail to an address specified in the theft notification record, whereupon textual instructions are provided to the authorized user regarding how to contact the current user of the mobile device to recover the mobile device.

12. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

obtaining a list of features to be restricted upon occurrence of the security event; and

restricting the function of the mobile device to unrestricted features.

13. The system as disclosed in claim 12, wherein obtaining a list of features to be restricted further comprises:

accessing, by the authorized user, a web interface presenting a list of features available for restriction upon a loss of control of the mobile device;

accepting, by the security authority, inputs from the authorized user regarding features available for restriction; and

transferring the accepted inputs to the mobile device.

14. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by executing a command selected from the group consisting of:

preventing phone calls from being placed from the mobile device;

restricting phone numbers that may be called from the mobile device to a predetermined list of numbers;

requiring entry of a password before the mobile device may be used by a current user;

shutting down the mobile device;

commanding the mobile device to perform a destructive function that renders the mobile device inoperable;

presenting frequent messages prompting a current user of the mobile device to contact a security authority to initiate return of the mobile device to the authorized user, the messages comprising at least one of a text message or an audio message;

playing DTMF tones on a loudspeaker of the mobile device while the mobile device is in use; and

allowing phone calls to be initiated only to one or more predetermined numbers within a contact list on the mobile device; and

combinations thereof.

15. The system as disclosed in claim 14, wherein requiring entry of a password further comprises:

detecting entry of an invalid password; and

introducing a delay before entry of another password may be attempted by the current user.

16. The system as disclosed in claim 14, wherein the security compromise event includes the mobile device being reported stolen or lost by the authorized user, and wherein the mobile device is insured against loss or theft.

17. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

providing on the display a prompt for a current user to enter of a user id and password; and

providing a selectable indicia that provides the instructions regarding how to return the mobile device, the instructions being provided without a current user needing to enter a valid user id and password.

18. The system as disclosed in claim 17 further comprising:

prompting the current user to enter identification information;

receiving and storing the identification information on the mobile device;

searching for a communications connection to the security authority; and

transferring the stored identification information to the security authority.

19. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

locking a subscriber identity module to prevent unfettered use of the mobile device; and

prompting a current user for entry of a personal unblocking code.

20. The method as disclosed in claim 19 further comprising forwarding, by the security authority, a personal unblocking code to a predetermined address specified by the authorized user.

21. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

receiving a phone number from a current user of the mobile device;

intercepting a call placed by the current user of the mobile device; and

routing the call to at least one of the security authority and the authorized user.

22. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

receiving indicia that the mobile device is engaging in a telephone call; and

alerting at least one of the authorized user and the security authority that the mobile device is engaging in a telephone call.

23. The system as disclosed in claim 22, further comprising:

receiving a request to access the telephone call; and

establishing a conference connection to the telephone call with a third party, wherein;

the third party includes one of the authorized user and a security authority; and

the third party may actively participate in the conversation or listen to the conversation surreptitiously.

24. The system as disclosed in claim 1 further comprising overwriting the deleted data elements a predetermined number of times, the overwriting selected from the group consisting of:

random data;

alternating data values;

predetermined data patterns; and

a combination thereof.

25. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

obtaining from the authorized user a list of data elements stored within the mobile device to be archived upon occurrence of the security compromise event; and

upon occurrence of the security compromise event, archiving the data elements, wherein the data elements include at least one of;

a software application;

a data file;

a media file; and

a license.

26. The method as disclosed in claim 25, wherein archiving the data elements further includes archiving licensing information for one or more of the data elements.

27. The system as disclosed in claim 25, wherein the data is archived by transmitting the data to at least one of the security authority and a device accessible by the authorized user.

28. The system as disclosed in claim 27, further comprising:

requesting, by the authorized user that an archived data element be retrieved from the archive;

specifying, by the authorized user, a destination address to receive the archived data element; and

transmitting the archived data element to the destination address.

29. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

establishing within the mobile device a specified location to store one or more sensitive data elements;

upon occurrence of the security compromise event executing a function selected from the group consisting of;

encrypting one or more of the sensitive data elements with a password known to at least one of the authorized user and a security authority;

deleting one or more of the sensitive data elements;

multiply overwriting one or more of the sensitive data elements; and

transmitting one or more of the sensitive data elements to an address specified by the authorized user.

30. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

encrypting designated files that are not open for use by an operating system running on the mobile device;

intercepting operating system calls to open a file, and thereupon;

decrypting the file; and

opening the file; and

intercepting operating system calls to close a file, and thereupon;

closing the file; and

encrypting the file.

31. The system as disclosed in claim 30, further comprising designating, by the authorized user, a list of file types that are to be encrypted.

32. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

sensing a network address assigned to the mobile device;

storing the sensed network address; and

transmitting the sensed network address to the security authority.

33. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

sensing at least one wireless network address from one or more signals received by the mobile device;

storing the sensed network address; and

transmitting the sensed network address to the security authority.

34. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

sensing one or more wireless access point identifiers from one or more signals received by the mobile device;

storing the wireless access point identifiers; and

transmitting the sensed wireless access point identifiers to a security authority.

35. The system as disclosed in claim 34, further comprising determining, based on the transmitted wireless access point identifiers, a location of the mobile device.

36. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

receiving, by the mobile device, a signal comprising geolocation information;

obtaining the geolocation information from the received signal;

storing the geolocation information on the mobile device; and

transmitting the stored geolocation information to the security authority.

37. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

retrieving location information from a security authority;

presenting the location information on a display including a map, the map indicating movement of the mobile device over time.

38. The system as disclosed in claim 37, further comprising displaying indicia of time and date where each location information was obtained.

39. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by storing in the mobile device phone numbers called by the mobile device after occurrence of the security compromise event.

40. The system as disclosed in claim 39, further comprising transmitting the stored phone numbers to the security authority.

41. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

activating a camera in communication with the mobile device;

capturing and storing an image from the camera in the mobile device; and

transmitting the stored image to the security authority.

42. The system as disclosed in claim 41, further comprising deactivating the camera to preserve battery life.

43. The system as disclosed in claim 41, further comprising prompting a current user of the mobile device to undertake an activity that requires looking at the mobile device.

44. The system as disclosed in claim 43, wherein the activity comprises at least one of:

prompting the user to enter a password on the mobile device;

playing an audio sequence on the mobile device;

strobing a light source on the audio device;

annunciating that the current user has won a prize and please watch for prize redemption details; and

displaying a video sequence.

45. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

activating a microphone in communication with the mobile device;

capturing and storing an audio sample from the microphone; and

transmitting the stored audio sample to a security authority.

46. The system as disclosed in claim 45, further comprising deactivating the microphone to preserve battery life.

47. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

activating a microphone in communication with the mobile device;

initiating a surreptitious communication session with the security authority; and

relaying

audio data captured by the microphone to the security authority.

48. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

activating a camera in communication with the mobile device;

capturing a video segment;

storing the video segment in the mobile device; and

transmitting the video segment to the security authority.

49. The system as disclosed in claim 48, further comprising deactivating the camera to preserve battery life.

50. The system as disclosed in claim 48, further comprising prompting a current user of the mobile device to undertake an activity that requires looking at the mobile device.

51. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

activating a camera in communication with the mobile device;

initiating a surreptitious communication session with the security authority; and

relaying video data captured by the camera to the security authority.

52. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

obtaining, by the mobile device, a sample of a current user'"'"'s voice;

storing the voice sample in the mobile device; and

transmitting the stored voice sample to the security authority.

53. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by activating a key logger, wherein a record of each key depressed on the mobile device is stored on the mobile device.

54. The system as disclosed in claim 53, further comprising transmitting the record to a security authority.

55. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

logging into a remote access service by at least one of the security authority and the authorized user, wherein the remote access service is configured to communicate with the mobile device;

activating an application programming interface in the mobile device to allow the remote viewing service to forward to the remote viewing service at least one of;

a current status of the mobile device;

a current location of the mobile device;

an image taken by a camera in communication with the mobile device;

a real-time video captured by a camera in communication with the mobile device;

a list of keys pressed on the mobile device; and

a list of services currently running on the mobile device.

56. The method as disclosed in claim 55 further comprising:

transmitting a command to the mobile device to initiate a chat session; and

providing an interface on the mobile device for enabling text-based interaction between the current user and at least one of the authorized user and the security authority.

57. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

initiating a wireless connection between the mobile device and least one wireless transceiver; and

relaying, through the at least one wireless transceiver, information regarding the current location of the mobile device to the security authority.

58. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

initiating a wireless connection between the mobile device and least one wireless transceiver; and

transmitting to the wireless transceiver a message indicating that a lost or stolen device is present within a signal range accessible by the transceiver.

59. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

initiating a wireless connection between the mobile device and least one wireless transceiver;

determining a signal strength for the wireless connection between the mobile device and the least one wireless transceiver;

obtaining identifying indicia for the at least one wireless transceiver; and

transmitting to a second wireless transceiver a message including the identifying indicia for the at least one wireless transceiver and the signal strength for the wireless connection between the mobile device and the least one wireless transceiver.

60. The system as disclosed in claim 59 further comprising:

transmitting to the second wireless transceiver a message indicating that a mobile device within communication range of the second wireless transceiver has been reported lost or stolen.

61. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

initiating a wireless connection between the mobile device and least one wireless transceiver;

transmitting a message to the at least one wireless transceiver, the message including identifying indicia of the mobile device, and wherein the message includes at least one of the following;

a request for response that includes the physical location of the at least one wireless transceiver;

a request that a person in communication with the at least one wireless transceiver report that a lost or stolen device is within its communication range;

a phone number for the authorized user;

a phone number for a security authority; and

a request to place a call to the security authority.

62. The system as disclosed in claim 1, wherein the mobile device is further configured to alter the function of the mobile device by:

initiating a wireless connection between the mobile device and least one wireless transceiver;

transmitting a message to the at least one wireless transceiver, wherein the message requests that a response be provided that includes the physical location of the at least one wireless transceiver.

63. The system as disclosed in claim 1 wherein the mobile device is configured to modify a display on the mobile device, wherein the display includes only information regarding return of the mobile device to at least one of the authorized user and the security authority.

64. The system as disclosed in claim 63 further comprising restricting the features of the mobile device to operate only to assist with return of the mobile device to at least one of a security authority and the authorized user.

65. The system as disclosed in claim 1 wherein the security authority is configured to format a message for transmission to the mobile device, wherein the message comprises a command to be decoded by the mobile device.

66. The system as disclosed in claim 65 wherein the command comprises an instruction to disable at least one feature of the mobile device.

67. The system as disclosed in claim 65 wherein the message is selected from the group consisting of an SMS Text message, an encoded graphic image, an audio file, a proprietary data file, a CAB file, a ZIP file, an encryption key, a file identifier, an alternate password, a file type, an applet, sections of executable code, interpretable scripts, software updates, and combinations thereof.

68. The system as disclosed in claim 65 wherein the command comprises an instruction to display a notification using an application residing on the mobile device.

69. The system as disclosed in claim 68 wherein the application comprises at least one of a web browser, a text editor, graphic image displayer, a message screen, or a bitmap displayer.

70. The method as disclosed in claim 68 wherein a link residing on the SIM card is used with a browser to reference the application from a remote server.

71. The system as disclosed in claim 68 wherein the application resides on a SIM card in the mobile device.

72. The system as disclosed in claim 65 wherein the message is steganographically encoded in a file containing a digital image.

73. The system as disclosed in claim 65 wherein the command comprises an instruction to initiate data gathering of forensic evidence regarding recovery of the mobile device.

74. The system as disclosed in claim 73 wherein gathering forensic evidence further comprises at least one of:

capturing an image of at least one portion of the body of the current user;

measuring a voice sample of the current user;

tracking phone numbers dialed by the current user;

tracking keys entered by the current user;

logging websites visited by the current user; and

recording email addresses of messages addressed by the current user.

75. The system as disclosed in claim 65 wherein the gathered forensic information is transmitted to the security authority.

76. The system as disclosed in claim 65 wherein the command executes in the mobile device without knowledge of the current user.

77. The system as disclosed in claim 65 wherein the execution of the command by the mobile device causes a display to be presented to the current user, said display providing information regarding how to return the mobile device to at least one of the authorized user and a security authority.

78. The system as disclosed in claim 1 wherein the security authority is configured to:

determine that;

the mobile device was insured against loss or theft; and

the mobile device has been reported lost or stolen; and

transmit a command to the mobile device, wherein the command alters a function in the mobile device.

79. The method as disclosed in claim 78 wherein altering a function further comprises at least one of:

disabling use of the mobile device;

detecting attempted use of the mobile device; and

tracking the location of the mobile device.

80. The system as disclosed in claim 1 further comprising:

formatting, by a security authority, a message for transmission to a mobile device;

steganographically encoding within the message a command for execution by the mobile device; and

transmitting the message to the mobile device.

81. The system as disclosed in claim 80 further comprising:

decoding, by the mobile device, the steganographically encoded command, and

executing the command by the mobile device.

82. The system as disclosed in claim 81 wherein the command comprises an instruction to disable at least one feature of the mobile device.

83. The system as disclosed in claim 81 wherein the message is selected from the group consisting of an SMS Text message, an encoded graphic image, an audio file, a proprietary data file, a CAB file, a ZIP file, an encryption key, a file identifier, an alternate password, a file type, an applet, executable code, and combinations thereof.

84. The system as disclosed in claim 81 wherein the command comprises an instruction to initiate data gathering of forensic evidence regarding recovery of the mobile device.

85. The system as disclosed in claim 84 wherein gathering forensic evidence further comprises at least one of:

capturing an image of at least one portion of the body of the current user;

measuring a voice sample of the current user;

tracking phone numbers dialed by the current user;

tracking keys entered by the current user;

logging websites visited by the current user; and

recording email addresses of messages addressed by the current user.

86. The system as disclosed in claim 84 wherein the gathered forensic information is transmitted to a security authority.

87. The system as disclosed in claim 81 wherein the command executes in the mobile device without knowledge of the current user.

88. The system as disclosed in claim 81 wherein the execution of the command by the mobile device causes a display to be presented to the current user, said display providing information regarding how to return the mobile device to at least one of the authorized user and a security authority.

89. The system as disclosed in claim 1 wherein the mobile device is further configured to alter the function of the mobile device based on a command received from a security authority through the communication interface.

90. A tracking and loss mitigation system comprising:

a mobile device, the device comprising;

a user interface including a display and a data entry interface; and

a communications interface to a security authority;

wherein the mobile device is configured to;

provide instructions regarding how to return the mobile device to an authorized user;

detect that a security compromise event has occurred;

determine whether the function of the device should be altered in response to said security compromise event;

alter the function of the mobile device in response to said security compromise event to mitigate loss of control by the authorized user; and

wherein the mobile device is further configured to alter the function of the mobile device by;

establishing within the mobile device a specified location to store one or more sensitive data elements;

upon occurrence of the security compromise event executing a function selected from the group consisting of;

encrypting one or more of the sensitive data elements with a password known to at least one of the authorized user and a security authority;

deleting one or more of the sensitive data elements;

multiply overwriting one or more of the sensitive data elements; and

transmitting one or more of the sensitive data elements to an address specified by the authorized user.

91. A tracking and loss mitigation system comprising:

a mobile device, the device comprising;

a user interface including a display and a data entry interface; and

a communications interface to a security authority wherein;

an authorized user may specify an alternative caller identification indicia;

wherein the mobile device is configured to;

provide instructions regarding how to return the mobile device to the authorized user;

detect that a security compromise event has occurred;

determine whether the function of the device should be altered in response to said security compromise event;

alter the function of the mobile device in response to said security compromise event to mitigate loss of control by the authorized user by;

obtaining from the authorized user a first list of zero or more data elements stored within the mobile device to be deleted upon occurrence of the security compromise event, and upon occurrence of the security compromise event, deleting the first list data elements from in the mobile device;

obtaining from the authorized user a second list of zero or more data elements stored within the mobile device to be encrypted upon occurrence of the security compromise event, and upon occurrence of the security compromise event, encrypting, by the mobile device, the second list data elements in the mobile device with a password known by at least one of the security authority and the authorized user.

92. The tracking and loss mitigation system as disclosed in claim 91, wherein the caller identification indicia comprise caller ID data.