Privacy management for tracked devices

• US 8,625,799 B2
• Filed: 07/17/2009
• Issued: 01/07/2014
• Est. Priority Date: 07/18/2008
• Status: Active Grant

• Current Assignee: Absolute Software Corporation
• Original Assignee: Absolute Software Corporation
• Inventors: McCarthy, Charles Chad, Loveland, Damien, Wiebe, Trevor
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US12/505,425
• Publication Number:
  US 20100014676A1
• Time in Patent Office: 1,635 Days
• Field of Search: 380/277, 380/278, 380/279, 726/1, 726/4, 726/27, 726/29
• US Class Current: 380/277
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2109 Game systems
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/20 Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A system is disclosed that protects private data of users while permitting the monitoring or tracking of electronic devices that are shared for both business and private purposes. The electronic devices are configured to selectively encrypt location data, and/or other types of data, before such data is transmitted to a monitoring center. For example, data collected or generated on a user device outside of work hours may be encrypted with a private key of the device'"'"'s user prior to transmission to the monitoring center, so that the data is not accessible to the employer. Data collected or generated during work hours may be transmitted without such encryption.

Claims

1. A method performed by a user computing device to enable a location of the user computing device to be monitored from a remote location, the method comprising:

receiving over a network, from a monitoring system, a conditional data encryption rule that specifies criteria for the user computing device to determine whether to encrypt at least device location data with a private key of a user of the device before transmitting the device location data to the monitoring system, said device location data representing a location of the user computing device, said criteria including time-based criteria corresponding to an employment work schedule of the user;

storing the conditional data encryption rule in a memory of the user computing device;

repeatedly reporting a location of the user computing device to the monitoring system according to the conditional data encryption rule such that said location is reported during both employment work hours and non-work hours of the user, wherein repeatedly reporting the location comprises;

obtaining location data reflective of a location of the user computing device;

determining, based at least partly on whether the location data was obtained during employment work hours associated with the user, as determined using the conditional data encryption rule, whether to encrypt the location data with the private key;

when a determination is made to encrypt the location data with the private key, encrypting the location data with the private key to generate encrypted location data, and transmitting the encrypted location data on a network to the monitoring system; and

when a determination is made not to encrypt the location data with the private key, transmitting the location data on the network to the monitoring system without first encrypting the location data with the private key;

wherein the method is performed under the control of program code executed by the user computing device.

2. The method of claim 1, wherein the determination is based on a comparison of a date and time associated with the location data with a schedule of work hours.

3. The method of claim 1, wherein the method is performed as a background task substantially invisibly to the user.

4. The method of claim 1, wherein the method further comprises transmitting application data to said monitoring system to enable said application data to be remotely backed up, said application data being distinct from said location data.

5. The method of claim 4, further comprising determining, based at least partly on whether the application data was generated during the employment work hours, whether to encrypt the application data with the private key prior to transmission to the monitoring system.

6. The method of claim 1, wherein the conditional data encryption rule is based in part on a vacation schedule of the user.

7. The method of claim 1, wherein the user computing device is owned by an employer of the user, and the conditional data encryption rule reflects the employment work schedule of the user with said employer.

8. The method of claim 1, further comprising using the transmitted location data, including the encrypted location data, to attempt to recover the user computing device following a theft.

9. The method of claim 1, wherein the location data comprises Global Positioning System (GPS) data generated by a GPS receiver of the user computing device.

14. The method of claim 1, further comprising, at least when a determination is made not to encrypt the location data with the private key of the user, encrypting the location data with an employer key.

15. The method of claim 1, wherein the encryption of the location data with the private key is conditional upon user entry of a correct password.

16. The method of claim 8, further comprising decrypting the encrypted location data only back to an approximate time of the theft.

17. The method of claim 8, further comprising decrypting the encrypted location data only back to a time of a report of the theft.

18. The method of claim 8, further comprising receiving an amended data encryption rule following the theft.

19. The method of claim 18, wherein the amended data encryption rule causes the computing device to cease all encryption with the private key.

10. A non-transitory computer readable medium which stores program code that instructs a user computing device to perform a method that comprises:

receiving over a network, from a monitoring system, a conditional data encryption rule that specifies criteria for the user computing device to determine whether to encrypt at least device location data with a private key of a user of the device before transmitting the device location data to the monitoring system, said device location data representing a location of the user computing device, said criteria including time-based criteria corresponding to an employment work schedule of the user with an employer;

storing the conditional data encryption rule in a memory of the user computing device;

repeatedly reporting a location of the user computing device to the monitoring system according to the conditional data encryption rule such that said location is reported during both employment work hours and non-work hours of the user, wherein repeatedly reporting the location comprises;

obtaining location data reflective of a location of the user computing device;

determining, based at least partly on a schedule of work hours associated with the employer, as determined using the conditional data encryption rule, whether the location data is associated with an employment use of the user computing device;

when a determination is made that the location data is not associated with an employment use of the device, encrypting the location data with the private key of the user to generate encrypted location data, and transmitting the encrypted location data on a network to the monitoring system; and

when a determination is made that the location data is associated with an employment use of the device, transmitting the location data on the network to the monitoring system without first encrypting the location data with the private key.

11. A method of monitoring a location of a user computing device such that user privacy is preserved, the method comprising:

transmitting over a network, from a monitoring system to the user computing device, a conditional data encryption rule that specifies criteria for the user computing device to determine whether to encrypt at least device location data with a private key of a user of the device before transmitting the device location data to the monitoring system, said device location data representing a location of the user computing device, said criteria including time-based criteria corresponding to an employment work schedule of the user with an employer;

receiving from the user computing device, over a network, and storing in computer storage of the monitoring system, a first set of location data that is encrypted with the private key of the user, said first set of location data representing a monitored location of the user computing device during non-work hours of the user, said first set of location data encrypted with the private key by the user computing device based on the conditional data encryption rule;

receiving from the user computing device, over a network, and storing in computer storage of the monitoring system, a second set of location data that is not encrypted with the private key of the user, said second set of location data representing a monitored location of the user computing device during work hours of the user;

receiving the private key of the user in connection with a reported theft of the user computing device, and using the private key to decrypt the first set of location data; and

using the decrypted first set of location data and the second set of location data to attempt recovery of the user computing device following the reported theft.

12. The method of claim 11, wherein the user computing device is owned by the employer.

13. The method of claim 11, wherein the conditional data encryption rule reflects a vacation schedule of the user.