Systems and methods for identifying unauthorized users of an electronic device

• US 9,213,810 B2
• Filed: 09/13/2013
• Issued: 12/15/2015
• Est. Priority Date: 02/19/2009
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Nakajima, Taido, Rahul, Pareet, Lin, Gloria
• Primary Examiner(s): BLOUNT, ERIC
• Application Number:
  US14/026,944
• Publication Number:
  US 20140090050A1
• Time in Patent Office: 823 Days
• Field of Search: 340/541, 340/500, 340/539.1, 340/539.11, 340/568.1, 340/571, 340/5.3
• US Class Current: 1/1
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

This is generally directed to identifying unauthorized users of an electronic device. In some embodiments, an unauthorized user of the electronic device can be detected by identifying particular activities that may indicate suspicious behavior. In some embodiments, an unauthorized user can be detected by comparing the identity of the current user to the identity of the owner of the electronic device. When an unauthorized user is detected, various safety measures can be taken. For example, information related to the identity of the unauthorized user, the unauthorized user'"'"'s operation of the electronic device, or the current location of the electronic device can be gathered. As another example, functions of the electronic device can be restricted. In some embodiments, the owner of the electronic device can be notified of the unauthorized user by sending an alert notification through any suitable medium, such as, for example, a voice mail, e-mail, or text message.

Claims

1. A method for identifying unauthorized usage of an electronic device, the method comprising:

at the electronic device;

monitoring a utilization of a memory included in the electronic device; and

in response to determining, based on a usage increase of the memory by a particular amount within a predetermined period of time, that unauthorized usage of the electronic device is occurring;

configuring the electronic device to, upon being communicatively coupled to a computing device, collect information from the computing device.

2. The method of claim 1, wherein the information includes at least one of an Internet Protocol (IP) address associated with the computing device and an Internet provider associated with the computing device.

3. The method of claim 1, further comprising, in response to determining:

gathering information regarding at least one operation of the electronic device.

4. The method of claim 3, wherein the usage corresponds to applications installed on the electronic device, and the usage of the electronic device is unauthorized when an unauthorized application is installed on the electronic device.

5. The method of claim 1, further comprising, in response to determining:

gathering at least one item selected from the following;

a screenshot of a graphical user interface (GUI) being presented on a display of the electronic device, keylog information, and communications packets communicated by the electronic device.

6. The method of claim 1, further comprising, in response to determining:

transmitting an alert notification to another electronic device.

7. The method of claim 1, further comprising, in response to determining:

restricting access to at least one application installed on the electronic device.

8. The method of claim 1, further comprising, in response to determining:

erasing or blocking access to specific data managed by the electronic device.

9. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in an electronic device, cause the electronic device to identify unauthorized usage of the electronic device, by carrying out steps that include:

monitoring a utilization of a memory included in the electronic device; and

in response to determining, based on a usage increase of the memory by a particular amount within a predetermined period of time, that unauthorized usage of the electronic device is occurring;

configuring the electronic device to, upon being communicatively coupled to a computing device, collect information from the computing device.

10. The non-transitory computer readable storage medium of claim 9, wherein the information includes at least one of an Internet Protocol (IP) address associated with the computing device and an Internet provider associated with the computing device.

11. The non-transitory computer readable storage medium of claim 9, wherein the steps further include, in response to determining:

gathering information regarding at least one operation of the electronic device.

12. The non-transitory computer readable storage medium of claim 11, wherein the usage corresponds to applications installed on the electronic device, and the usage of the electronic device is unauthorized when an unauthorized application is installed on the electronic device.

13. The non-transitory computer readable storage medium of claim 9, wherein the steps further include, in response to determining:

gathering at least one item selected from the following;

a screenshot of a graphical user interface (GUI) being presented on a display of the electronic device, keylog information, and communications packets communicated by the electronic device.

14. The non-transitory computer readable storage medium of claim 9, wherein the steps further include, in response to determining:

transmitting an alert notification to another electronic device.

15. The non-transitory computer readable storage medium of claim 9, wherein the steps further include, in response to determining:

restricting access to at least one application installed on the electronic device.

16. The non-transitory computer readable storage medium of claim 9, wherein the steps further include, in response to determining:

erasing or blocking access to specific data managed by the electronic device.

17. An electronic device configured to identify unauthorized usage of the electronic device, the electronic device comprising:

a memory; and

a processor configured to carry out steps that include;

monitoring a utilization of the memory; and

in response to determining, based on a usage increase of the memory by a particular amount within a predetermined period of time, that unauthorized usage of the electronic device is occurring;

configuring the electronic device to, upon being communicatively coupled to a computing device, collect information from the computing device.

18. The electronic device of claim 17, wherein the information includes at least one of an Internet Protocol (IP) address associated with the computing device and an Internet provider associated with the computing device.

19. The electronic device of claim 17, further comprising, in response to determining:

gathering information regarding at least one operation of the electronic device.

20. The electronic device of claim 19, wherein the usage corresponds to applications installed on the electronic device, and the usage of the electronic device is unauthorized when an unauthorized application is installed on the electronic device.