Unauthorized location detection and countermeasures

• US 9,119,063 B2
• Filed: 11/04/2013
• Issued: 08/25/2015
• Est. Priority Date: 12/22/2010
• Status: Active Grant

• Current Assignee: Skyhook Holding, Inc. (Liberty Broadband Corp.)
• Original Assignee: TruePosition Incorporated
• Inventors: Beckley, Frederic A., Anderson, Robert J., Ward, Matthew L.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Ho, Thomas
• Application Number:
  US14/070,899
• Publication Number:
  US 20140059655A1
• Time in Patent Office: 659 Days
• Field of Search: 726/22, 726/26
• US Class Current: 1/1
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

A location sentry system is provided for use within a mobile device. The sentry system can be configured to detect unauthorized attempts to locate mobile devices by monitoring messages passed between the mobile device and the wireless network and/or messages passed between components of the mobile device, and determining that one or more of the messages is/are indicative of an attempt to locate the mobile device. In response to a determination that an unauthorized attempt has been detected, the location sentry can be configured to take one or more actions. For example, the location sentry system could prevent location information from being sent back to the wireless network and/or the location sentry system could cause incorrect information to be sent to the wireless network.

Claims

1. A mobile device operable to communicate with a wireless network and configured to detect unauthorized location attempts, comprising:

a processor; and

a memory coupled to the processor, the memory including instructions that upon execution cause the processor to execute an operational procedure, the memory comprising;

instructions for identifying a sequence of events that includes an event indicating that a location subsystem of the mobile device was activated;

instructions for determining that the sequence of events is indicative of an unauthorized attempt to locate the mobile device, wherein the instructions for determining that the sequence of events is indicative of an unauthorized attempt to locate the mobile device comprise instructions for determining that the sequence of events includes an event indicating that a global positioning system receiver of the mobile device was activated, and an event indicating that data used to assist in a location calculation was received from a wireless network; and

instructions for responding to a location request by sending a default location or a spoofed location to the wireless network, including;

instructions for sending location information for a default location to the wireless network;

instructions for sending location information for a previous location to the wireless network;

instructions for sending inaccurate satellite measurement information to the wireless network;

instructions for sending inaccurate location-related signal measurement data to the wireless network;

instructions for sending a cell-ID identifier randomly selected from a group of active set cells to the wireless network; and

instructions for sending identifiers for a subset of detected beacon signals to the wireless network.

2. The mobile device of claim 1, wherein the instructions for determining that the sequence of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that the sequence of events includes an event indicating that location information was placed in an outgoing message queue.

3. The mobile device of claim 1, wherein the instructions for determining that the sequence of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that the sequence of events includes an event indicating that the mobile device entered into a scanning mode for receiving beacon timing information from a plurality of base stations.

4. The mobile device of claim 1, wherein the instructions for determining that the sequence of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that the sequence of events includes an event indicating that a request for location information was received from the wireless network.

5. The mobile device of claim 1, wherein the instructions for determining that the sequence of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that the sequence of events includes an event indicating that a program executing on the mobile device requested to access the location subsystem; and

instructions for determining that the program is not authorized to access the location subsystem.

6. The mobile device of claim 5, wherein the program is a program stored on a SIM card.

7. The mobile device of claim 1, wherein the instructions for determining that the sequence of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that the sequence of events includes an event indicating that the mobile device transitioned from an idle mode to an active mode.

8. The mobile device of claim 1, wherein the memory further comprises:

instructions for displaying an alert indicating that an unauthorized attempt to locate the mobile device was identified.

9. The mobile device of claim 1, wherein the memory further comprises:

instructions for sending an error message to the wireless network indicating that the mobile device cannot support a location attempt.

10. The mobile device of claim 1, wherein the memory further comprises:

instructions for sending a message to the wireless network that indicates that the mobile device does not include a location subsystem.

11. The mobile device of claim 1, wherein the memory further comprises:

instructions for sending information to the wireless network indicating that satellite coverage is inadequate to receive satellite signals.

12. The mobile device of claim 1, wherein the memory further comprises:

instructions for a receiver-location sentry client application that encapsulates an application program interface for a wireless receiver, wherein the receiver-location sentry client application is configured to analyze incoming messages received by the wireless receiver;

instructions for a transmitter-location sentry client application that encapsulates an application program interface for a wireless transmitter, wherein the transmitter-location sentry client application is configured to analyze messages placed into an outgoing queue for transmission to the wireless network; and

instructions for a location-subsystem-location sentry client application that encapsulates an application program interface for the location subsystem, wherein the location-subsystem-location sentry client application is configured to analyze messages sent to the location subsystem.

13. The mobile device of claim 1, wherein the memory further comprises:

instructions for running an operating system for the mobile device within a virtualization environment, wherein the virtualization environment is configured to monitor messages received by the wireless receiver, messages placed into an outgoing queue for transmission to the wireless network, and messages sent to the location subsystem for messages indicative of attempts to locate the mobile device.

14. The mobile device of claim 1, wherein the memory further comprises:

instructions for a wireless receiver application program interface, wherein the wireless receiver application program interface is configured to monitor incoming messages for messages that include location requests and/or messages that include data used to assist in a location calculation;

instructions for a wireless transmitter application program interface, wherein the wireless transmitter application program interface is configured to monitor outgoing messages for messages that include location information; and

instructions for a location subsystem application program interface, wherein the location subsystem application program interface is configured to monitor messages sent to the location subsystem for unauthorized attempts to activate the location subsystem.

15. A non-transitory computer-readable storage medium including a location sentry system for use in a mobile device, the computer-readable storage medium comprising:

instructions for logging a group of events in a database of the mobile device;

instructions for detecting, in the group of events, an event indicating that location information was placed in an outgoing message queue for transmission to a base station;

instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device;

instructions for logging the group of events as an attempt to locate the mobile device; and

instructions for transmitting a default location or a spoofed location, including;

instructions for transmitting location information for a default location;

instructions for transmitting location information for a previous location;

instructions for transmitting inaccurate satellite measurement information;

instructions for transmitting inaccurate location-related signal measurement data;

instructions for transmitting a cell-ID identifier randomly selected from a group of active set cells; and

instructions for transmitting identifiers for a subset of detected beacon signals;

wherein the instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device further comprise at least one of;

(a) instructions for determining that an event is present within the group of events that indicates that a location subsystem was accessed;

(b) instructions for determining that an event is present within the group of events that indicates that a global positioning system receiver of the mobile device was activated;

(c) instructions for determining that an event is present within the group of events that indicates that the mobile device entered into a scanning mode for receiving beacon timing information from a plurality of base stations; and

(d) instructions for determining that an event is present within the group of events that indicates that data used to assist in a location calculation was received by the mobile device.

16. The computer-readable storage medium of claim 15, wherein the instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that an event is present within the group of events that indicates that a location subsystem was accessed.

17. The computer-readable storage medium of claim 15, wherein the instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that an event is present within the group of events that indicates that the mobile device entered into a scanning mode for receiving beacon timing information from a plurality of base stations.

18. The computer-readable storage medium of claim 15, wherein the instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that an event is present within the group of events that indicates that a request for location information was received.

19. The computer-readable storage medium of claim 15, wherein the instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that an event is present within the group of events that indicates that an unauthorized program executing on the mobile device attempted to access the location subsystem.

20. The computer-readable storage medium of claim 15, wherein the instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that an event is present within the group of events that indicates that data used to assist in a location calculation was received from a wireless network.

21. The computer-readable storage medium of claim 15, wherein the instructions for determining that the group of events is indicative of an unauthorized attempt to locate the mobile device further comprise:

instructions for determining that an event is present within the group of events that indicates that the mobile device transitioned from an idle mode to an active mode.

22. The computer-readable storage medium of claim 15, further comprising:

instructions for displaying an alert indicating that an attempt to locate the mobile device was detected.

23. The computer-readable storage medium of claim 15, further comprising:

instructions for removing the location information from the outgoing message queue.

24. The computer-readable storage medium of claim 15, further comprising:

instructions for sending an error message to the network responsive to the determination that the group of events is indicative of an unauthorized attempt to locate the mobile device.

25. The computer-readable storage medium of claim 15, further comprising:

instructions for sending a message to the network that indicates that the mobile device does not include a location subsystem in response to the determination that the group of events is indicative of an unauthorized attempt to locate the mobile device.

26. The computer-readable storage medium of claim 15, further comprising:

instructions for sending information that indicates inadequate satellite coverage to a wireless network in response to the determination that the group of events is indicative of an unauthorized attempt to locate the mobile device.

27. The computer-readable storage medium of claim 15, further comprising:

instructions for a receiver-module that encapsulates an application program interface for a wireless receiver, wherein the receiver-module is configured to analyze incoming messages for requests for location information and/or data used to assist in a location calculation;

instructions for a transmitter-module that encapsulates an application program interface for a wireless transmitter, wherein the transmitter-module is configured to analyze messages placed into an outgoing queue for unauthorized attempts to transmit location information; and

instructions for a location-subsystem-module that encapsulates an application program interface for the location subsystem, wherein the location-subsystem-module is configured to analyze messages for unauthorized attempts to access the location subsystem.

28. The computer-readable storage medium of claim 15, further comprising:

instructions for running an operating system for the mobile device within a virtualization environment, wherein the virtualization environment is configured to analyze messages received by the wireless receiver, messages placed into an outgoing queue for transmission to a wireless network, and messages sent to location the subsystem for messages indicative of unauthorized attempts to locate the mobile device.

29. The computer-readable storage medium of claim 15, further comprising:

instructions for a wireless receiver application program interface, wherein the wireless receiver application program interface is configured to monitor incoming messages for messages that include location requests and/or messages that include data used to assist in a location calculation;

instructions for a wireless transmitter application program interface, wherein the wireless transmitter application program interface is configured to monitor outgoing messages for unauthorized attempts to transmit location information; and

instructions for a location subsystem application program interface, wherein the location subsystem application program interface is configured to monitor for unauthorized attempts to activate the location subsystem.