Systems and methods for identifying unauthorized users of an electronic device

• US 8,289,130 B2
• Filed: 02/19/2009
• Issued: 10/16/2012
• Est. Priority Date: 02/19/2009
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Nakajima, Taido L., Rahul, Pareet, Lin, Gloria
• Primary Examiner(s): BLOUNT, ERIC
• Application Number:
  US12/389,106
• Publication Number:
  US 20100207721A1
• Time in Patent Office: 1,335 Days
• Field of Search: 340/5.3, 340/572.1, 709/222, 455/411
• US Class Current: 340/5.3
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

This is generally directed to identifying unauthorized users of an electronic device. In some embodiments, an unauthorized user of the electronic device can be detected by identifying particular activities that may indicate suspicious behavior. In some embodiments, an unauthorized user can be detected by comparing the identity of the current user to the identity of the owner of the electronic device. When an unauthorized user is detected, various safety measures can be taken. For example, information related to the identity of the unauthorized user, the unauthorized user'"'"'s operation of the electronic device, or the current location of the electronic device can be gathered. As another example, functions of the electronic device can be restricted. In some embodiments, the owner of the electronic device can be notified of the unauthorized user by sending an alert notification through any suitable medium, such as, for example, a voice mail, e-mail, or text message.

Claims

1. A method for identifying an unauthorized user of an electronic device, the method comprising:

monitoring with the electronic device usage of at least one memory of the electronic device;

detecting with the electronic device a sudden increase in the monitored memory usage; and

determining with the electronic device that a current user of the electronic device is the unauthorized user in response to the detecting.

2. The method of claim 1, wherein

the detecting comprises detecting that the monitored memory usage increases a particular amount within a predetermined period of time.

3. The method of claim 1, further comprising:

in response to the determining, gathering with the electronic device information regarding at least one operation of the electronic device.

4. The method of claim 3, further comprising, in response to the detecting, identifying with the electronic device that an unauthorized application is being run by the electronic device.

5. The method of claim 3, wherein the gathering further comprises gathering at least one of:

at least one screenshot of the electronic device, keylogs, communications packets served to the electronic device, and information related to a host device that is coupled to the electronic device.

6. The method of claim 1, further comprising transmitting with the electronic device an alert notification to an external device in response to the determining.

7. The method of claim 3 further comprising transmitting with the electronic device the gathered information to an external device.

8. The method of claim 1, further comprising:

gathering information related to a location of the electronic device in response to the determining.

9. The method of claim 1, further comprising:

restricting with the electronic device at least one function of the electronic device in response to the determining.

10. The method of claim 1, further comprising:

transmitting with the electronic device sensitive data from the electronic device to a remote storage in response to the determining; and

erasing with the electronic device the sensitive data from the electronic device in response to the transmitting.

19. The method of claim 4, wherein the identifying comprises identifying that a hacking program is being run on the electronic device.

20. The method of claim 6, wherein the alert notification comprises a message indicating that the unauthorized user has been detected.

11. An electronic device operable to detect an unauthorized user of the electronic device, the electronic device comprising:

a memory; and

a processor operable to;

monitor a usage of the memory;

detect a sudden increase in the monitored usage; and

determine that a current user of the electronic device is the unauthorized user in response to the detection of the sudden increase.

12. The electronic device of claim 11, further comprising:

a microphone operable to record a voice of the current user, wherein the processor is operable to determine that the current user is the unauthorized user by;

comparing the recorded voice with at least one voice print of at least one authorized user of the electronic device; and

determining that the recorded voice does not match the at least one voice print based on the comparison.

13. The electronic device of claim 11, further comprising:

a heartbeat sensor operable to detect at least one heartbeat of the current user, wherein the processor is operable to determine that the current user is the unauthorized user by;

comparing the detected at least one heartbeat with a heart signature of each authorized user of a plurality of authorized users of the electronic device; and

determining that the detected at least one heartbeat does not match the heart signature of any authorized user of the plurality of authorized users of the electronic device.

14. The electronic device of claim 11, further comprising:

an input device operable to receive an authenticating input for authenticating a user of the electronic device, wherein the processor is operable to determine that the current user is the unauthorized user by;

determining that a predetermined number of successive incorrect authenticating inputs have been received by the input device.

15. The electronic device of claim 11, further comprising:

a camera operable to capture photographs of a vicinity of the electronic device; and

positioning circuitry operable to determine current location information of the electronic device, wherein the processor is further operable to;

direct the camera to capture a photograph of the vicinity of the electronic device;

direct the positioning circuitry to determine the current location information; and

geotag the captured photograph by associating the captured photograph with the determined current location information.

16. The electronic device of claim 11, further comprising:

an accelerometer operable to record a vibration profile of the electronic device, wherein the processor is further operable to compare the recorded vibration profile with a library of vibration profiles to determine a current mode of transportation of the electronic device.

21. The electronic device of claim 11, wherein the processor is operable to detect the sudden increase by detecting that the monitored usage increases by a particular amount within a predetermined period of time.

22. The electronic device of claim 11, wherein the processor is further operable to, in response to the detection of the sudden increase, identify that an unauthorized application is being run by the electronic device.

17. Non-transitory machine-readable media for identifying unauthorized users of an electronic device, comprising machine-readable instructions recorded thereon for:

monitoring with the electronic device usage of at least one memory of the electronic device;

detecting with the electronic device a sudden increase in the monitored usage; and

determining with the electronic device that a current user of the electronic device is an unauthorized user in response to the detecting.

18. The non-transitory machine-readable media of claim 17,

wherein the detecting comprises detecting that the monitored usage increases by a particular amount within a predetermined period of time.

23. A method comprising:

determining with an electronic device that the electronic device is at least one of turned on and unlocked;

in response to the determining;

capturing with the electronic device at least one photograph of a current user of the electronic device; and

detecting with the electronic device at least one current operation that is being performed by the electronic device; and

storing with the electronic device the captured at least one photograph and the detected at least one current operation in a log of the electronic device.

24. The method of claim 23 further comprising:

analyzing with the electronic device the captured at least one photograph; and

determining with the electronic device an identity of the current user based on the analyzing.

25. The method of claim 23 further comprising presenting the log with the electronic device.

26. The method of claim 25, wherein the presenting comprises displaying at least the stored at least one photograph and the stored at least one current operation on a remote device remote from the electronic device.

27. The method of claim 23, wherein the detecting comprises detecting at least one call that is being made via the electronic device.

28. The method of claim 23, wherein the detecting comprises detecting at least one application of the electronic device that is being run on the electronic device.

29. The method of claim 23, wherein the detecting comprises recording at least one screenshot of the electronic device.

30. The method of claim 23, wherein the detecting comprises recording at least one user input that is received by an input unit of the electronic device.