System and method of enhancing security of a wireless device through usage pattern detection

• US 9,275,210 B2
• Filed: 03/11/2013
• Issued: 03/01/2016
• Est. Priority Date: 01/29/2013
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick, Krzeminski, Marek
• Primary Examiner(s): Brown, Christopher
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US13/793,613
• Publication Number:
  US 20140215550A1
• Time in Patent Office: 1,086 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2117 User registration

Abstract

A method of identifying a user of a device having a security policy and including a touch sensitive input device. The method includes receiving data corresponding to use of the touch sensitive input device by the user and determining from the received data at least one feature. Based on the at least one feature and a signature associated with an identifiable user, the method determines a likelihood that the user is the identifiable user and modifies, based on the likelihood, the security policy on the device.

Claims

1. A method of performing user identification on a device having a security policy and comprising a touch sensitive input device, the method comprising:

receiving data corresponding to use of a virtual keyboard provided on said touch sensitive input device, received data including a set of data points indicating where on a key of the virtual keyboard a touch was registered when the key was actuated, at least a subset of the data points representing a single touch;

determining from said received data a first location on the key of the virtual keyboard, the first location indicating where the key was touched on the virtual keyboard when the data was received, the first location comprising one of the following;

a top left quadrant of the key, a top right quadrant of the key, a bottom left quadrant of the key, or a bottom right quadrant of the key;

determining, based on the first location and a signature associated with a user profile, whether an identity of a user inputting the received data corresponds to the user profile, wherein the signature is calculated based on a second location of the key on the virtual keyboard determined from training data received at the device, the second location indicating where the key on the virtual keyboard was touched when the training data was received, the second location comprising one of the following;

the top left quadrant of the key, the top right quadrant of the key, the bottom left quadrant of the key, or the bottom right quadrant of the key, the training data received in a sample of text to obtain biometric data relating to how the user types on the virtual keyboard;

modifying said security policy on said device, based on said determining of whether the identity of the user inputting the received data corresponds to the user profile, by selecting said security policy from a plurality of different levels of access to said device, each of said plurality of different levels of access associated with a respective conditions of whether unauthorized use has occurred at said device; and

,

repeating, after every N number of touches at the virtual keyboard, where N is based on a level of access to said device as defined in said security policy, the determining from said received data the first location on the key, and the determining whether the identity of the user inputting the received data corresponds to the user profile, said security policy again modified when the identity of the user inputting the received data no longer matches the user profile.

2. The method of claim 1 wherein said device further comprises a connection to a partition, and wherein said modifying said security policy on said device comprises restricting access to said partition through said connection.

3. The method of claim 2 wherein said partition further comprises at least one application, and wherein said modifying said security policy on said device further comprises restricting access to said at least one application.

4. The method of claim 2 wherein said partition further comprises data, and wherein said modifying said security policy on said device further comprises restricting access to at least a portion of said data.

5. The method of claim 1 further comprising:

receiving further data corresponding to use of said touch sensitive input device;

determining from said further received data a third location on the key of the virtual keyboard, the third location indicating where the key was touched on the virtual keyboard when the further data was received;

determining, based on said third location and the signature associated with the user profile, whether the identity of the user inputting the further data corresponds to the user profile; and

modifying, based on said determining whether the identity of the user inputting the further received data corresponds to the user profile, said security policy on said device.

6. A device having a security policy, the device comprising a touch sensitive input device and a computer readable memory storing computer executable instructions thereon that when executed, cause the device to:

receive data corresponding to use of a virtual keyboard provided on said touch sensitive input device, received data including a set of data points indicating where on a key of the virtual keyboard a touch was registered when the key was actuated, at least a subset of the data points representing a single touch;

determine from said received data a first location on the key of the virtual keyboard, the first location indicating where the key was touched on the virtual keyboard when the data was received, the first location comprising one of the following;

a top left quadrant of the key, a top right quadrant of the key, a bottom left quadrant of the key, or a bottom right quadrant of the key;

determine, based on the first location and a signature associated with a user profile, whether an identity of a user inputting the received data corresponds to the user profile, wherein the signature is calculated based on a second location of the key on the virtual keyboard determined from training data received at the device, the second location indicating where the key was touched on the virtual keyboard when the training data was received, the second location comprising one of the following;

the top left quadrant of the key, the top right quadrant of the key, the bottom left quadrant of the key, or the bottom right quadrant of the key, the training data received in a sample of text to obtain biometric data relating to how the user types on the virtual keyboard;

modify said security policy on said device, based on said determining of whether the identity of the user inputting the received data corresponds to the user profile, by selecting said security policy from a plurality of different levels of access to said device, each of said plurality of different levels of access associated with a respective conditions of whether unauthorized use has occurred at said device by selecting said security policy from a plurality of different levels of access to said device, each of said plurality of different levels of access associated with a respective conditions of whether unauthorized use has occurred at said device; and

,

repeat, after every N number of touches at the virtual keyboard, where N is based on a level of access to said device as defined in said security policy, the determining from said received data the first location on the key, and the determining whether the identity of the user inputting the received data corresponds to the user profile, such that a likelihood that an authorized user is or is not the user accessing the device is repeated after every of the N number of touches, said security policy again modified when the identity of the user inputting the received data no longer matches the user profile.

7. A method of modifying a security policy of a device, the method comprising:

receiving data corresponding to use of said device, wherein said data corresponding to use of said device comprises data corresponding to use of a touchscreen;

wherein said data corresponding to use of said touchscreen comprises data corresponding to use of key of a virtual keyboard displayed on said touchscreen;

wherein said use of the key of the virtual keyboard displayed on said touchscreen comprises interacting with said touchscreen at a plurality of areas on said touchscreen; and

wherein said data corresponding to use of said touchscreen further comprises data corresponding to said plurality of areas on said touchscreen;

received data including a set of data points indicating where on the key of the virtual keyboard a touch was registered when the key was actuated, at least a subset of the data points representing a single touch;

determining a level of certainty that an identity of a user inputting the received data corresponds to a user profile, the level of certainty being based on at least one feature determined from said received data, wherein the at least one feature corresponds to a behavioural characteristic associated with how the received data was inputted into the device, the behavioral characteristic comprising where the key was touched when sample text was received to obtain biometric data relating to how the user types on the virtual keyboard;

modifying said security policy on said device to correlate to said level of certainty, by selecting said security policy from a plurality of different levels of access to said device, each of said plurality of different levels of access associated with a respective conditions of whether unauthorized use has occurred at said device;

receiving further data corresponding to further use of said device;

determining, based on said further data, an increased or decreased level of certainty that the identity of the user corresponds to the user profile;

modifying said security policy on said device to correlate to the increased or decreased level of certainty; and

,

repeating, after every N number of touches at the virtual keyboard, where N is based on a level of access to said device as defined in said security policy, the determining the increased or decreased level of certainty that the identity of the user corresponds to the user profile, said security policy again modified when the level of certainty changes.

8. The method of claim 7 wherein said data corresponding to use of said device further comprises data selected from the group consisting of:

(a) data corresponding to use of applications accessible through said device;

(b) data corresponding to use of application features accessible through said device;

(c) data corresponding to use of a physical keyboard;

(d) data corresponding to selection among a plurality of options;

(e) data corresponding to use of phone numbers;

(f) data corresponding to access of websites;

(g) data corresponding to writing style; and

(h) data corresponding to typographical errors.

9. The method of claim 7 wherein said device further comprises a connection to a partition, and wherein at least one of said modifying said security policy on said device to correlate to said level of certainty or said modifying said security policy on said device to correlate to said increased or decreased level of certainty comprises restricting access to said partition through said connection.

10. The method of claim 9 wherein said partition further comprises at least one application, and wherein restricting access to said partition through said connection comprises restricting access to said at least one application.

11. The method of claim 7, wherein

at least one of said determining the level of certainty that the identity of the user inputting the received data corresponds to the user profile or said determining the increased or decreased level of certainty that the identity of the user corresponds to the user profile is based on a signature,

and wherein the signature is calculated based on at least one other feature determined from training data received at the device, the at least one other feature corresponding to the behavioural characteristic associated with how the training data was received at the device.

12. The method of claim 7 wherein said receiving data corresponding to use of said device comprises receiving data corresponding to a first type of use of said device;

and wherein said receiving further data corresponding to further use of said device comprises receiving further data corresponding to said first type of use of said device.

13. The method of claim 7 wherein said receiving data corresponding to use of said device comprises receiving data corresponding to a first type of use of said device;

and wherein said receiving further data corresponding to further use of said device comprises receiving further data corresponding to a second type of use of said device.

14. A device having a security policy, the device comprising a computer readable memory storing computer executable instructions thereon that when executed, cause the device to:

receive data corresponding to use of said device, wherein said data corresponding to use of said device comprises data corresponding to use of a touchscreen;

wherein said data corresponding to use of said touchscreen comprises data corresponding to use of key of a virtual keyboard displayed on said touchscreen;

wherein said use of the key of the virtual keyboard displayed on said touchscreen comprises interacting with said touchscreen at a plurality of areas on said touchscreen; and

wherein said data corresponding to use of said touchscreen further comprises data corresponding to said plurality of areas on said touchscreen;

received data including a set of data points indicating where on the key of the virtual keyboard a touch was registered when the key was actuated, at least a subset of the data points representing a single touch;

determine a level of certainty that an identity of a user inputting the received data corresponds to a user profile, the level of certainty being based on at least one feature determined from said received data, wherein the at least one feature corresponds to a behavioural characteristic associated with how the received data was inputted into the device, the behavioral characteristic comprising where the key was touched when sample text was received to obtain biometric data relating to how the user types on the virtual keyboard;

modify said security policy on said device to correlate to said level of certainty, by selecting said security policy from a plurality of different levels of access to said device, each of said plurality of different levels of access associated with a respective conditions of whether unauthorized use has occurred at said device;

receive further data corresponding to further use of said device;

determine, based on said further data, an increased or decreased level of certainty that the identity of the user corresponds to the user profile;

modify said security policy on said device to correlate to the increased or decreased level of certainty; and

,

repeat, after every N number of touches at the virtual keyboard, where N is based on a level of access to said device as defined in said security policy, the determining the increased or decreased level of certainty that the identity of the user corresponds to the user profile, said security policy again modified when the level of certainty changes.