Suspicious portable device movement determination

• US 9,792,462 B2
• Filed: 08/24/2015
• Issued: 10/17/2017
• Est. Priority Date: 08/24/2015
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Almalki, Nazih, Oliver, Robert George, Chen, Zhe, Inwood, Andrew Michael, Cietwierkowski, Marcin
• Primary Examiner(s): Chen, Eric
• Application Number:
  US14/834,156
• Publication Number:
  US 20170061166A1
• Time in Patent Office: 785 Days
• Field of Search: None
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04M 1/67 by electronic means
• CPC Class Codes: H04M 2250/12 including a sensor for measuring a physical value, e.g. temperature or motion
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences

Abstract

A system and method to determine suspicious movement of a portable device are disclosed. A determination is made that an update received by a local device was sent from a remote device different than the local device. A suspicious movement of the local device is determined based upon determining that the local device is moving at a time associated with the update and based upon determining the update originated from the remote device. Based on determining the suspicious movement, a notification of unauthorized device movement is provided.

Claims

1. A method comprising:

determining that a local device received an update, wherein the update originated from a remote device that is different from the local device, and wherein the update comprises data being sent in association with a user account activated on the local device;

determining, at the local device, that the local device is moving at a time associated with the update;

determining a suspicious movement of the local device based upon the determining that the local device is moving at a time associated with the update and based upon determining the update originated from the remote device; and

based upon determining the suspicious movement, providing a notification of unauthorized device movement.

2. The method of claim 1, wherein providing the notification comprises:

prompting for entry of an authorization code on the local device; and

suspending until entry of the authorization code, based on the prompting, at least one function on the local device.

3. The method of claim 1, wherein providing the notification comprises sending a data message indicating the suspicious movement.

4. The method of claim 3, wherein the data message further comprises a geographical location of the local device.

5. The method of claim 1, wherein the user account comprises a user'"'"'s messaging account, wherein the update comprises a message sent from the user'"'"'s messaging account, and wherein determining the update originated from the remote device comprises determining that the message was not entered on the local device.

6. The method of claim 1, wherein the user account comprises data stored on the local device and the remote device, wherein a modification of a data portion associated with the user account on the remote device is synchronized with the data portion on the local device, wherein the update comprises an update indicating the modification of the data portion, and wherein determining the update originated from the remote device comprises determining that the modification was not entered on the local device.

7. The method of claim 1, wherein the user account comprises a user'"'"'s social networking account, wherein the update comprises an update to the user'"'"'s social networking account, and wherein determining the update originated from the remote device comprises determining that the update to the user'"'"'s social networking account was not entered on the local device.

8. The method of claim 1, wherein the time associated with the update comprises at least one of a time the update was sent, or a time the update was received at the local device.

9. A device, comprising:

at least one processor configured to implement;

a message manager that when operating determines that the device received an update, wherein the update originated from a remote device that is different from the device, and wherein the update comprises data being sent in association with a user account activated on the device;

a motion detector that when operating determines that the device is moving at a time associated with the update;

a motion correlator that when operating determines a suspicious movement of the device based upon a determination that the device is moving at a time associated with the update and based upon a determination the update originated from the remote device; and

a notification generator that when operating provides a notification of unauthorized device movement based upon determining the suspicious movement.

10. The device of claim 9, wherein the notification generator when operating further:

prompts for entry of an authorization code on the device; and

suspends until entry of the authorization code, based on a prompt for entry of an authorization code, at least one function on the device.

11. The device of claim 9, wherein the notification generator when operating further sends a data message indicating the suspicious movement.

12. The device of claim 11, wherein the data message further comprises a geographical location of the device.

13. The device of claim 9, wherein the user account comprises a user'"'"'s messaging account, wherein the update comprises a message sent from the user'"'"'s messaging account, and wherein the message manager determines the update originated from the remote device by at least determining that the message was not entered on the device.

14. The device of claim 9, wherein the user account comprises data stored on the device and the remote device, wherein a modification of a data portion associated with the user account on the remote device is synchronized with the data portion on the device, wherein the update comprises an update indicating the modification of the data portion, and wherein message manager determines the update originated from the remote device by at least determining that the modification was not entered on the device.

15. The device of claim 9, wherein the account comprises a user'"'"'s social networking account, wherein the update comprises an update to the user'"'"'s social networking account, and wherein message manager determines the update originated from the remote device by at least determining that the update to the user'"'"'s social networking account was not entered on the device.

16. The device of claim 9, wherein the time associated with the update comprises at least one of a time the update was sent, or a time the update was received at the device.

17. A non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising instructions executable by a processor to:

determine that a local device received an update, wherein the update originated from a remote device that is different from the local device, and wherein the update comprises data being sent in association with a user account activated on the local device;

determine, at the local device, that the local device is moving at a time associated with the update;

determine a suspicious movement of the local device based upon determining that the local device is moving at a time associated with the update and based upon determining the update originated from the remote device; and

based upon determining the suspicious movement, provide a notification of unauthorized device movement.

18. The non-transitory computer readable storage medium of claim 17, wherein the instructions to provide the notification comprise instructions to:

prompt for entry of an authorization code on the local device; and

suspend until entry of the authorization code, based on the prompting, at least one function on the local device.

19. The non-transitory computer readable storage medium of claim 17, wherein the instructions to provide the notification comprise instructions to send a data message indicating the suspicious movement.

20. The non-transitory computer readable storage medium of claim 19, wherein the data message further comprises a geographical location of the local device.