Electronic devices having adaptive security profiles and methods for selecting the same

• US 9,578,038 B2
• Filed: 02/06/2014
• Issued: 02/21/2017
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Ingrassia, Michael I. Jr., Lee, Jeffery T.
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US14/174,571
• Publication Number:
  US 20140157359A1
• Time in Patent Office: 1,111 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/21 for social networking applications

Abstract

Adaptive security profiles are supported on an electronic device. One or more security profiles may be automatically or selectively applied to the device based on the device'"'"'s location and one or more geographic zone definitions. The security profiles may be used to determine the level of authentication or number of invalid authentication attempts for a particular feature or application or set of features or applications.

Claims

1. A method for adjusting a security profile of an electronic device comprising:

maintaining a database that defines one or more expected zones in which the electronic device may be located;

receiving, via an input of the electronic device, a request to access the electronic device;

automatically determining a current location of the electronic device;

determining whether the current location is located in one or more of the expected zones defined by the database; and

implementing, on the electronic device, a first security profile requiring a first authentication process when the electronic device is located in an expected zone defined by the database, and a second security rule requiring a second authentication process when the electronic device is located outside of any expected zones defined by the database,

wherein the first authentication process authenticates a first set of user inputs that comprises entry of at least one of a first touch input on a touch-sensitive display of the electronic device, pin number, passcode, and biometric indicator, and

the second authentication process authenticates a second set of user inputs that comprises entry of at least one of a second touch input on the touch-sensitive display of the electronic device, pin number, passcode, and biometric indicator, and the second set of user inputs is different from the first set of user inputs.

2. The method of claim 1, comprising automatically updating the database to define one or more expected zones.

3. The method of claim 1, wherein one or more expected zones defined by the database are based at least on a determination of a user'"'"'s routine.

4. The method of claim 1, comprising automatically sampling the electronic device'"'"'s location and defining one or more expected zones in the database based on patterns of the automatically sampling of the electronic device'"'"'s location.

5. The method of claim 1, comprising prompting the user with questions that are used to define one or more expected zones into the database.

6. The method of claim 1, wherein the current location of the electronic device is determined using a global positioning system (GPS) receiver.

7. The method of claim 1, wherein the current location of the electronic device is determined using measurements of a network signal associated with the electronic device.

8. The method of claim 1, wherein the current location of the electronic device is determined based on a wireless network or access point that is in range of the electronic device or based on a wireless network or access point to which the electronic device is currently connected.

9. The method of claim 1, comprising maintaining a database that defines one or more trusted zones in which the electronic device may be located and implementing a third security profile when the electronic device is located in a trusted zone.

10. The method of claim 1, wherein the first security profile is associated with a particular expected zone.

11. The method of claim 1, wherein the first security profile is associated with a group of expected zones.

12. The method of claim 1, wherein the second set of user inputs include the first set of user inputs and at least one additional user input.

13. The method of claim 1, wherein a database entry that defines an expected zone comprises geographical and temporal boundaries.

14. An electronic device with an ability to adjust a security profile, the device comprising:

a user interface configured to receive a request to access the electronic device;

a memory storing a database that defines one or more expected zones in which the electronic device may be located; and

a computer processor configured to;

automatically obtain a current location of the electronic device;

determine whether the current location is located in one or more of the expected zones defined by the database; and

implement, on the electronic device, a first security profile requiring a first authentication process when the electronic device is located in an expected zone defined by the database, and a second security rule requiring a second authentication process when the electronic device is located outside of any expected zones defined by the database,

wherein the first authentication process authenticates a first set of user inputs that comprises entry of at least one of a first touch input on a touch-sensitive display of the electronic device, pin number, passcode, and biometric indicator, and

the second authentication process authenticates a second set of user inputs that comprises entry of at least one of a second touch input on the touch-sensitive display of the electronic device, pin number, passcode, and biometric indicator, and the second set of user inputs is different from the first set of user inputs.

15. The device of claim 14, wherein at least one expected zone in the database is automatically defined by the electronic device.

16. The device of claim 14, wherein at least one expected zone defined by the database is based at least on a determination of a user'"'"'s routine.

17. The device of claim 14, wherein the processor is configured to automatically sample the electronic device'"'"'s location and defining one or more expected zones in the database based on patterns of the automatic sampling of the electronic device'"'"'s location.

18. The device of claim 14, wherein the device is configured to prompt the user with questions that are used to define one or more expected zones in the database.

19. The device of claim 14, wherein the current location of the electronic device is determined using a global positioning system (GPS) receiver.

20. The device of claim 14, wherein the current location of the electronic device is determined using measurements of a network signal associated with the electronic device.

21. The device of claim 14, wherein the current location of the electronic device is determined based on a wireless network or access point that is in range of the electronic device or based on a wireless network or access point to which the electronic device is currently connected.

22. The device of claim 14, wherein the memory further stores a database defining one or more trusted zones in which the electronic device may be located and implementing a third security profile when the electronic device is located in a trusted zone.

23. The device of claim 14, wherein the first security profile is associated with a particular expected zone.

24. The device of claim 14, wherein the first security profile is associated with a group of expected zones.

25. The device of claim 14, wherein the second set of user inputs include the first set of user inputs and at least one additional user input.

26. The device of claim 14, wherein a database entry defining an expected zone comprises geographical and temporal boundaries.

27. A non-transitory computer readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by an electronic device with a computer processor, cause the electronic device to:

maintain a database that defines one or more expected zones in which the electronic device may be located;

receive, via an input of the electronic device, a request to access the electronic device;

automatically obtain a current location of the electronic device;

determine whether the current location is located in one or more of the expected zones defined by the database; and

implement, on the electronic device, a first security profile requiring a first authentication process when the electronic device is located in an expected zone defined by the database, and a second security rule requiring a second authentication process when the electronic device is located outside of any expected zones defined by the database,

wherein the first authentication process authenticates a first set of user inputs that comprises entry of at least one of a first touch input on a touch-sensitive display of the electronic device, pin number, passcode, and biometric indicator, and

the second authentication process authenticates a second set of user inputs that comprises entry of at least one of a second touch input on the touch-sensitive display of the electronic device, pin number, passcode, and biometric indicator, and the second set of user inputs is different from the first set of user inputs.

28. The storage medium of claim 27, wherein at least one expected zone in the database is automatically defined by the electronic device.

29. The storage medium of claim 27, wherein at least one expected zone defined by the database is based at least on a determination of a user'"'"'s routine.

30. The storage medium of claim 27, wherein the one or more programs further cause the electronic device to automatically sample the electronic device'"'"'s location and define one or more expected zones in the database based on patterns of the automatic sampling of the electronic device'"'"'s location.

31. The storage medium of claim 27, wherein the one or more programs further cause the electronic device to prompt the user with questions that are used to define one or more expected zones in the database.

32. The storage medium of claim 27, wherein the current location of the electronic device is determined using a global positioning system (GPS) receiver.

33. The storage medium of claim 27, wherein the current location of the electronic device is determined using measurements of a network signal associated with the electronic device.

34. The storage medium of claim 27, wherein the current location of the electronic device is determined based on a wireless network or access point that is in range of the electronic device or based on a wireless network or access point to which the electronic device is currently connected.

35. The storage medium of claim 27, wherein the one or more programs further cause the electronic device to maintain a further database defining one or more trusted zones in which the electronic device may be located and implementing a third security profile when the electronic device is located in a trusted zone.

36. The storage medium of claim 27, wherein the first security profile is associated with a particular expected zone.

37. The storage medium of claim 27, wherein the first security profile is associated with a group of expected zones.

38. The storage medium of claim 27, wherein the second set of user inputs include the first set of user inputs and at least one additional user input.

39. The storage medium of claim 27, wherein a database entry defining an expected zone comprises geographical and temporal boundaries.