Method and system for monitoring and restricting use of mobile devices

• US 9,942,753 B2
• Filed: 10/22/2013
• Issued: 04/10/2018
• Est. Priority Date: 10/22/2012
• Status: Active Grant

• Current Assignee: Pervasive Group, Inc.
• Original Assignee: Pervasive Group, Inc.
• Inventors: Zhou, Zheng, Bromham, Richard
• Primary Examiner(s): Khan, Mehmood B
• Application Number:
  US14/060,560
• Publication Number:
  US 20140113593A1
• Time in Patent Office: 1,631 Days
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security

Abstract

A system and method for promoting safe usage of a mobile device. The system allows one or more administrators (or patents) to transparently and automatically implement preconfigured use restriction policies (e.g., restricted time periods, restricted features of the device, restricted vehicle speed) on multiple managed devices. The restriction policies may be stored locally at a managed mobile device and/or remotely at a remote server and database. The mobile device can be controlled locally by a client application or remotely by the remote server based on the restriction policies.

Claims

1. A computer-implemented method for preventing tampering of a managed mobile device, comprising the steps of:

receiving, by at least one of a server device, a master device and the managed mobile device, a first administrator credential for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

storing in a database the first administrator credential and the restriction policy;

monitoring a user event at the managed mobile device by a user events controller in the managed mobile device, wherein the user event is one of termination or change of settings of a software application at the managed mobile device, modification of operational parameters of the managed mobile device, power on/off, and screen on/off of the managed mobile device;

enforcing the restriction policy by an execution module at the at least one of the managed mobile device, the server device, and the master device by blocking or preventing the managed mobile device from installation or deletion or launching of a software application and/or accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and contents including music, video, and apps based on ratings of these contents;

determining by the execution module whether the user event is a tampering user event that tampers with enforcement of the restriction policy by (i) deleting configuration and/or policy data from the managed mobile device;

(ii) changing the operational parameters of the managed mobile device;

(iii) stopping one or more system software processes of the managed mobile device that are required for the enforcement of the restriction policy;

(iv) placing mobile device into an inactive state;

or (v) launching an application that can terminate or circumvent the enforcement of the restriction policy; and

disrupting by the user events controller the tampering user event if the tampering user event tampers with enforcement of the restriction policy, and allowing the tampering user event to continue if the tampering user event does not tamper with enforcement of the restriction policy.

2. The method of claim 1, wherein the step of receiving includes receipt of a managed mobile device identifier for identifying the managed mobile device, and further comprising the step of associating the restriction policy with the managed mobile device identifier.

3. The method of claim 1, wherein the managed mobile device includes a communication interface for communicating with at least one of the server device and the master device.

4. The method of claim 3, wherein the database is located at a local database of the managed mobile device and at a remote database physically distinct from the managed mobile device, and further comprising the step of synchronizing by the execution module at least one of the restriction policy associated with the managed device identifier and the first administrator credential across the local and remote databases.

5. The method of claim 1, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

6. The method of claim 1, further comprising the steps of receiving a second administrator credential from a second administrator from one of the server device, the master device or the managed mobile device after authenticating the first administrator credential from the administrator, and then updating the database.

7. The method of claim 1, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

8. The method of claim 1, wherein the restriction policy includes an instruction to the execution module for processing an ongoing or future user event.

9. The method of claim 1, further comprising the step of determining by the execution module if an action can be taken preemptively to prevent a user from tampering with the enforcement of a restriction policy.

10. The method of claim 1, further comprising the step of determining by the execution module whether to enforce further restrictions to prevent a user from disrupting or terminating enforcement of a restriction policy that is yet to be enforced.

11. The method of claim 1, further comprising the step of preventing a user from modifying device operational parameters or instantiating one or more software application after a particular restriction policy is set up but before the particular restriction policy is activated.

12. The method of claim 1, wherein the user event is a direct or indirect action or input initiated or triggered by a user of the managed mobile device or by another user of a different device that is in operable communication with the managed mobile device.

13. The method of claim 1, further comprising the step of validating the first administrator credential prior to allowing a restriction policy to be changed.

14. The method of claim 1, wherein the first administrator credential includes at least one of password and biometric identification data.

15. The method of claim 7, wherein the screen lock is deactivated upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

16. The method of claim 15, wherein the command is a Short Messaging Service message.

17. The method of claim 1, wherein each of the managed mobile device, the master device and the server device has a communications interface and is in operable communication with each other via at least one of Short Messaging Service, Internet Protocol and application protocols running on top of Internet Protocol, Near Field Communication interface, and Blue Tooth interface.

18. The method of claim 2, wherein the managed mobile device identifier includes one of International Mobile Equipment Identifier (IMEI), Mobile Equipment Identifier (MEID, Integrated Circuit Card ID (ICCID), Unique Device Identifier (UDID), and a unique identifier generated by one of the managed mobile device, master device and server device.

19. A computer-implemented method for preventing tampering of a managed mobile device, comprising the steps of:

receiving, by a server device a first administrator credential for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

storing in a database the first administrator credential and the restriction policy;

monitoring a user event at the managed mobile device by a user events controller in the managed mobile device, wherein the user event is one of termination or change of settings of a software application at the managed mobile device, modification of operational parameters of the managed mobile device, power on/off, and screen on/off of the managed mobile device;

receiving by the server device a communication relating to the user event from the managed mobile device;

interpreting the user event and enforcing the restriction policy by an execution module at the server device in response to the communication from the managed mobile device by transmitting to the managed mobile device a command in accordance with the restriction policy, wherein the restriction policy is enforced by blocking or preventing a user from installation or deletion or launching of a software application and/or accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and contents including music, video, and apps based on ratings of these contents;

executing by the user events controller the command from the server device;

determining by the execution module whether the user event is a tampering user event that tampers with enforcement of the restriction policy by (i) deleting configuration and/or policy data from the managed mobile device;

(ii) changing the operational parameters of the managed mobile device;

(iii) stopping one or more system software processes of the managed mobile device that is required for the enforcement of the restriction policy;

(iv) placing mobile device into an inactive state;

or (v) launching an application that can terminate or circumvent the enforcement of the restriction policy; and

disrupting by the user events controller the tampering user event if the tampering user event tampers with enforcement of the restriction policy, and allowing the tampering user event to continue if the tampering user event does not tamper with enforcement of the restriction policy.

20. The method of claim 19, wherein the step of receiving includes receipt of a managed mobile device identifier for identifying the managed mobile device, and further comprising the step of associating the restriction policy with the managed mobile device identifier.

21. The method of claim 19, wherein the managed mobile device includes a communication interface for communicating with the server device either directly or indirectly.

22. The method of claim 21, wherein the database is located at a remote database accessible by the server device.

23. The method of claim 19, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

24. The method of claim 19, further comprising the steps of receiving a second administrator credential from a second administrator by the server device after authenticating the first administrator credential from the administrator, and then updating the database.

25. The method of claim 19, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

26. The method of claim 19, further comprising the step of validating the first administrator credential prior to allowing a restriction policy to be changed.

27. The method of claim 19, wherein the first administrator credential includes at least one of password, biometric identification data, and certificate.

28. The method of claim 25, wherein the screen lock is deactivated upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

29. A managed mobile device having an anti-tampering mechanism, comprising:

an interface for receiving a first administrator credential for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

a database for storing the first administrator credential and the restriction policy; and

a central processing unit configured to include (1) a user events controller for monitoring and identifying a user event at the managed mobile device, wherein the user event is one of termination or change of settings of a software application at the managed mobile device, modification of operational parameters of the managed mobile device, power on/off, and screen on/off of the managed mobile device, (2) an execution module for (a) enforcing the restriction policy by blocking or preventing a user from installation or deletion or launching of a software application and/or accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and contents including music, video, and apps based on ratings of these contents, (b) determining whether the user event is a tampering user event that tampers with enforcement of the restriction policy by (i) deleting configuration and/or policy data from the managed mobile device;

(ii) changing the operational parameters of the managed mobile device;

(iii) stopping one or more system software processes of the managed mobile device that is required for the enforcement of the restriction policy;

(iv) placing mobile device into an inactive state;

or (v) launching an application that can terminate or circumvent the enforcement of the restriction policy, (c) causing the user events controller to disrupt the user event if the tampering user event tampers with enforcement of the restriction policy, and (d) allowing the tampering user event to continue if the tampering user event does not tamper with enforcement of the restriction policy.

30. The device of claim 29, further including a communication interface for communicating with a peer device.

31. The device of claim 29, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

32. The device of claim 29, wherein the interface receives a second administrator credential from a second administrator after authenticating the first administrator credential from the administrator, and then updating the database.

33. The device of claim 29, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

34. The device of claim 29, wherein the restriction policy includes an instruction to the execution module for processing an ongoing or future user event.

35. The device of claim 29, wherein the execution module determines if an action can be taken preemptively to prevent a user from tampering with the enforcement of a restriction policy.

36. The device of claim 29, wherein the execution module determines whether to enforce further restrictions to prevent a user from disrupting or terminating enforcement of a restriction policy that is yet to be enforced.

37. The device of claim 29, wherein the execution module prevents a user from modifying device operational parameters or instantiating one or more software application while setting up the restriction policy or after the restriction policy is set up but before the restriction policy is activated.

38. The device of claim 29, wherein the user event is a direct or indirect action or input initiated or triggered by a user of the managed mobile device or by another user of a different device that is in operable communication with the managed mobile device.

39. The device of claim 29, wherein the execution module validates the first administrator credential prior to allowing a restriction policy to be changed.

40. The device of claim 29, wherein the first administrator credential includes at least one of password and biometric identification data.

41. The device of claim 29, wherein the screen lock is deactivated upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

42. The device of claim 41, wherein the command is a Short Messaging Service message.

43. The device of claim 29, further comprising a communications interface for communication with a peer device via at least one of Short Messaging Service, Internet Protocol and application protocols running on top of Internet Protocol, Near Field Communication, and Blue Tooth interface.

44. A system for preventing tampering of a managed mobile device, comprising:

at least one of a server device, a master device and the managed mobile device for receiving a first administrator credential and for identifying an administrator and a restriction policy for restricting usage of the managed mobile device;

a database for storing the first administrator credential and the restriction policy;

the managed mobile device having a central processing unit configured to include a user events controller for monitoring and acting on a user event at the managed mobile device, wherein the user event is one of termination or change of settings of a software application at the managed mobile device, modification of operational parameters of the managed mobile device, power on/off, and screen on/off of the managed mobile device; and

the at least one of the managed mobile device, the server device, and the master device having a central processing unit configured to include an execution module for enforcing the restriction policy by blocking or preventing the managed mobile device from installation or deletion or launching of a software application and/or accessing at least one of web browser, a camera, a phone dialer for making calls, a messaging application for communicating messages, an app store, and contents including music, video, and apps based on ratings of these contents, (1) determining whether the user event is a tampering user event that tampers with enforcement of the restriction policy by (i) deleting configuration and/or policy data from the managed mobile device;

(ii) changing the operational parameters of the managed mobile device;

(iii) stopping one or more system software processes of the managed mobile device that is required for the enforcement of the restriction policy;

(iv) placing mobile device into an inactive state;

or (v) launching an application that can terminate or circumvent the enforcement of the restriction policy, (2) causing the user events controller to disrupt the tampering user event if the tampering user event tampers with enforcement of the restriction policy, and (3) allowing the tampering user event to continue if the tampering user event does not tamper with enforcement of the restriction policy.

45. The system of claim 44, wherein the at least one of a server device, a master device and the managed mobile device receives a managed mobile device identifier for identifying the managed mobile device, and further comprising the step of associating the restriction policy with the managed mobile device identifier.

46. The system of claim 45, wherein the managed mobile device includes a communication interface for communicating with at least one of the server device and the master device.

47. The system of claim 46, wherein the database is located at a local database of the managed mobile device and at a remote database physically distinct from the managed mobile device, and the execution module synchronizes at least one of the restriction policy associated with the managed mobile device identifier and the first administrator credential across the local and remote databases.

48. The system of claim 44, wherein the restriction policy includes a start time and an end time for locking the managed mobile device.

49. The system of claim 44, wherein the at least at least one of a server device, a master device and the managed mobile device receives a second administrator credential from a second administrator from one of the server device, the master device or the managed mobile device after authenticating the first administrator credential from the administrator, and then updating the database.

50. The system of claim 44, wherein the restriction policy restricts access to the managed mobile device by activating a screen lock on the managed mobile device and rendering a configurable content or text on the screen.

51. The system of claim 44, wherein the restriction policy includes an instruction to the execution module for processing an ongoing or future user event.

52. The system of claim 44, wherein the execution module determines if an action can be taken preemptively to prevent a user from tampering with the enforcement of a restriction policy.

53. The system of claim 44, wherein the execution module determines whether to enforce further restrictions to prevent a user from disrupting or terminating enforcement of a restriction policy that is yet to be enforced.

54. The system of claim 44, wherein the execution module prevents a user from modifying device operational parameters or instantiating one or more software application after a particular restriction policy is set up but before the particular restriction policy is activated.

55. The system of claim 44, wherein the user event is a direct or indirect action or input initiated or triggered by a user of the managed mobile device or by another user of a different device that is in operable communication with the managed mobile device.

56. The system of claim 44, wherein the execution module validates the first administrator credential prior to allowing a restriction policy to be changed.

57. The system of claim 44, wherein the first administrator credential includes at least one of password and biometric identification data.

58. The system of claim 50, wherein the screen lock is deactivated by the execution module upon receipt of a command from the administrator after authenticating the first administrator credential of the administrator.

59. The system of claim 58, wherein the command is a Short Messaging Service message.

60. The system of claim 44, wherein each of the managed mobile device, the master device and the server device has a communications interface and is in operable communication with each other via at least one of Short Messaging Service, Internet Protocol and application protocols running on top of Internet Protocol, Near Field Communication, and Blue Tooth interface.

61. The system of claim 45, wherein the managed mobile device identifier includes one of International Mobile Equipment Identifier (IMEI), Mobile Equipment Identifier (MEID, Integrated Circuit Card ID (ICCID), Unique Device Identifier (UDID), and a unique identifier generated by one of the managed mobile device, master device and server device.