System for monitoring the unauthorized use of a device

• US 9,881,152 B2
• Filed: 09/03/2008
• Issued: 01/30/2018
• Est. Priority Date: 04/01/2008
• Status: Active Grant

• Current Assignee: Blancco Technology Group Ip Oy
• Original Assignee: Inhance Technology
• Inventors: Prendergast, Paul, Hannigan, Frank, Bermingham, Peter, Fitzgerald, William
• Primary Examiner(s): Elhag, Magdi
• Application Number:
  US12/203,835
• Publication Number:
  US 20090247122A1
• Time in Patent Office: 3,436 Days
• Field of Search: 4554041, 4554042, 455405, 455410, 455411, 4554121, 4554122, 455418-420, 4554561
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

The invention is directed to systems and methods for detecting the loss, theft or unauthorized use of a device and/or altering the functionality of the device in response. In one embodiment, a device monitors its use, its local environment, and/or its operating context to determine that the device is no longer within the control of an authorized user. The device may receive communications or generate an internal signal altering its functionality, such as instructing the device to enter a restricted use mode, a surveillance mode, to provide instructions to return the device and/or to prevent unauthorized use or unauthorized access to data. Additional embodiments also address methods and systems for gathering forensic data regarding an unauthorized user to assist in locating the unauthorized user and/or the device.

Claims

1. A tracking and loss mitigation system comprising:

a mobile device, the device comprising;

a user interface including a display and a data entry interface; and

a communications interface to a security authority, the communications interface configured to provide an authenticatable message from the security authority on behalf of an authorized user of the mobile device;

wherein the mobile device is configured to;

provide, by the user interface of the mobile device, a notification describing how to return the mobile device to an authorized user;

receive and decode a communication from the security authority through the communications interface to the security authority, the communication initiated on behalf of a request from the authorized user of the mobile device to the security authority;

authenticate the validity of the decoded communication by one of;

computing a digest of the communication and comparing the digest value to a previously stored authorization digest value; and

decrypting at least part of the message with a public key associated with the sender of the message as part of an asymmetric encryption algorithm;

detect, from the decoding of the communication, that a security compromise event has occurred; and

determine, from the decoded communication, whether the function of the device should be altered in response to said security event; and

wherein the security authority comprises one of a governmental law enforcement organization, private security firm, an insurance agency, and combinations thereof; and

wherein the mobile device is further configured to detect that a security compromise event has occurred by;

associating the mobile device with a companion device; and

determining that the mobile device has been disassociated from the companion device by;

measuring a plurality of power levels of a wireless signal transmitted by the companion device;

computing an average power level from the plurality of measured power levels;

measuring a current power level of a wireless signal transmitted by the companion device; and

determining that the measured current power level has varied from the average power level by a predetermined amount by;

computing a standard deviation of the plurality of measured power levels; and

determining that the current power level exceeds an allowed signal range determined by a predetermined constant times the standard deviation of the plurality of measured signal.

2. The system as disclosed in claim 1, wherein the mobile device is further configured detect that a security compromise event has occurred by determining that a SIM card associated with the mobile device has been exchanged.

3. The system as disclosed in claim 1, wherein the mobile device is further configured detect that a security compromise event has occurred by determining that a SIM card associated has been removed from the mobile device.

4. The system as disclosed in claim 1, wherein the mobile device is further configured detect that a security compromise event has occurred by:

obtaining from the authorized user a set of criteria indicating unauthorized use of the mobile device; and

determining that at least one of the criteria indicating unauthorized use has occurred.

5. The system as disclosed in claim 4, wherein the criteria indicating unauthorized use of the mobile device comprise at least one of:

a maximum number of calls that may be placed to numbers not included in a pre-stored authorized number list;

a maximum number of calls that may be received by numbers not included in the pre-stored authorized number list; and

a call being placed to a country code not included in the pre-stored authorized number list.

6. The system as disclosed in claim 4, wherein the set of criteria indicating unauthorized use of the mobile device are stored in the mobile device.

7. The system as disclosed in claim 4, wherein the set of criteria indicating unauthorized use of the mobile device are stored in a database associated with the security authority.

8. The system as disclosed in claim 1, wherein the mobile device is further configured to execute an application residing in a read-only memory of the mobile device, wherein the application detects that a security compromise event has occurred.

9. The system as disclosed in claim 8 wherein the mobile device is configured to execute instructions inhibiting a current user from terminating the application if the current user is not the authorized user.

10. The system as disclosed in claim 1 wherein the mobile device is further configured to detect that a security compromise event has occurred by:

associating the mobile device with the companion device; and

determining that the mobile device has been moved relative to the location of the companion device.

11. The system as disclosed in claim 1, wherein the mobile device is further configured to format a message for transmission to the security authority, the message comprising information regarding movement of the mobile device with respect to the companion device.

12. The system as disclosed in claim 1, wherein the companion device is further configured to format a message for transmission to the security authority, the message comprising information regarding the disassociation of the mobile device with respect to the companion device.

13. The system as disclosed in claim 12, wherein the companion device is configured to transmit the formatted message to the security authority.

14. The system as disclosed in claim 12, wherein the information regarding the disassociation of the mobile device with the companion device comprises at least one of:

a date that the companion device and the mobile device were disassociated;

a time that the companion device and the mobile device were disassociated;

a location that the companion device and the mobile device were disassociated;

an identifier corresponding to the mobile device;

an identifier corresponding to the companion device; and

an identifier corresponding to a current user of the mobile device.

15. The system as disclosed in claim 1, wherein determining that the mobile device has been disassociated from the companion device comprises:

measuring a current power level of a wireless signal transmitted by the companion device; and

determining that the measured current power level has decreased by a predetermined amount.

16. The system as disclosed in claim 1 wherein the predetermined constant is 1.

17. The system as disclosed in claim 1, wherein determining that the mobile device has been disassociated from the companion device comprises:

measuring a plurality of power levels of a wireless signal transmitted by the companion device;

computing an average power level from the plurality of measured power levels;

measuring a plurality of current power levels of a wireless signal transmitted by the companion device; and

determining that for a predetermined number of times within a predetermined time period, one of the plurality of current power levels has varied from the average power level by a predetermined amount.

18. The system as disclosed in claim 11, wherein the information regarding the disassociation of the mobile device with the companion device comprises at least one of:

a date that the companion device and the mobile device were disassociated;

a time that the companion device and the mobile device were disassociated;

a location that the companion device and the mobile device were disassociated;

an identifier corresponding to the mobile device;

an identifier corresponding to the companion device; and

an identifier corresponding to a current user of the mobile device.