Software tampering detection and reporting process

Patent metadata

Field	Value
Publication number	US-10182062-B2
Application number	US-201514979082-A
Country	US
Kind code	B2
Filing date	Dec 22, 2015
Priority date	Dec 22, 2014
Publication date	Jan 15, 2019
Grant date	Jan 15, 2019

Abstract

A method is disclosed. The method includes determining, by a security software application on a communication device, that the communication device has been accessed by an unauthorized user. The communication device is configured to communicate with a telecommunications network over the air through a first communication channel. The method also includes generating, by the communication device, security notification data and providing the security notification data or a derivative of the security notification data to a host computer via a second communication channel.

First claim

What is claimed is:

1. A method for preventing unauthorized access of data on a mobile device on a cellular phone network, the method comprising:
determining, by a security software application using a hardware processor on the mobile device, that the mobile device has been accessed by an unauthorized user;
determining a type of the security software application on the mobile device that has been accessed;
sending, by the mobile device configured to communicate with a telecommunications network, a communication, wherein the communication is sent over the air through a first communication channel including a long range communication channel, wherein the first communication channel is the cellular phone network;
generating, by the hardware processor on the mobile device, security notification data in response to the determining that the mobile device has been accessed by the unauthorized user, wherein the security notification data comprises the type of the security software application that determined an unauthorized access; and
providing, by the mobile device, the security notification data or a derivative of the security notification data, in a form of a cryptogram to an access device by a short range antenna in the mobile device via a second communication channel, the access device forwarding the cryptogram to a remote server computer, where the remote server computer determines that the unauthorized user has accessed the mobile device by determining that the forwarded cryptogram does not match an expected cryptogram in order to prevent unauthorized access of data on the mobile device on the cellular phone network.

2. The method of claim 1 , wherein the mobile device comprises access credentials.

3. The method of claim 1 , wherein the security software application comprises a security element module.

4. The method of claim 3 , wherein the security element module comprises at least one of an anti-debug module, a root detection module, a checksum module, and a substrate module.

5. The method of claim 1 , wherein the mobile device is a mobile phone comprising a memory comprising a security element module, a cryptogram generation module and a payment module.

6. The method of claim 1 , wherein the access device receives the cryptogram and transmits the cryptogram in an authorization request message comprising a transaction amount to a payment processing network via an acquirer computer.

7. The method of claim 6 , wherein the payment processing network extracts the cryptogram from the authorization request message and provides the cryptogram to a security server computer, which determines if the mobile device has been compromised using the cryptogram.

8. A mobile device comprising:
a hardware processor; and
a non-transitory computer readable medium coupled to the hardware processor, the computer readable medium comprising code, executable by the processor to implement a method for preventing unauthorized access of data on the mobile device on a cellular phone network comprising:
determining that the mobile device has been accessed by an unauthorized user;
determining a type of a security software application on the mobile device that has been accessed;
sending a communication to a telecommunications network, wherein the communication is sent over the air through a first communication channel including a long range communication channel, wherein the first communication channel is the cellular phone network;
generating security notification data in response to the determining that the mobile device has been accessed by the unauthorized user, wherein the security notification data comprises the type of the security software application that determined an unauthorized access; and
providing the security notification data or a derivative of the security notification data, in a form of a cryptogram to an access device by a short range antenna in the mobile device via a second communication channel, the access device forwarding the cryptogram to a remote server computer, where the remote server computer determines that the unauthorized user has accessed the mobile device by determining that the forwarded cryptogram does not match an expected cryptogram in order to prevent unauthorized access of data on the mobile device on the cellular phone network.

9. The mobile device of claim 8 , wherein the computer readable medium further comprises:
a cryptogram generation module configured to create the cryptogram using the security notification data.

10. The mobile device of claim 8 , further comprising:
an antenna coupled to the processor and configured to communicate via the first communication channel.

11. The mobile device of claim 8 , further comprising:
a contactless element coupled to the processor and configured to communicate via the second communication channel.

12. The mobile device of claim 8 , wherein the computer readable medium comprises a security element module.

13. The mobile device of claim 12 , wherein the security element module comprises at least one of an anti-debug module, a root detection module, a checksum module, and a substrate module.

14. A server located remotely from a mobile device running a security software application, the server comprising:
a processor; and
a memory coupled to the processor, the memory storing instructions, which when executed by the processor, cause the server to perform operations including:
receiving, from an access device, an authorization request message including data for a transaction and security notification data or a derivative of security notification data, in a form of a cryptogram, where the access device receives the cryptogram from the mobile device by a short range antenna,
extracting the security notification data or the derivative of the security notification data from the authorization request message,
analyzing the security notification data or the derivative of the security notification data to determine that an unauthorized user has accessed the mobile device, and
generating an authorization response message declining the transaction in order to prevent unauthorized access of data on the mobile device on a cellular phone network.

15. The server of claim 14 , wherein the operations further include:
reporting that the unauthorized user has accessed the mobile device.

16. The server of claim 14 , wherein the operation of analyzing the derivative of the security notification data comprises:
generating an expected cryptogram using the data for the transaction; and
comparing the cryptogram to the expected cryptogram.

17. The server of claim 14 , wherein the operation of analyzing the security notification data or the derivative of the security notification data further comprises:
determining a type of access by the unauthorized user from the security notification data or the derivative of the security notification data.

18. A method comprising:
receiving, by a server located remotely from a mobile device running a security software application, an authorization request message including data for a transaction and security notification data or a derivative of security notification data, in a form of a cryptogram, where the mobile device transmits the cryptogram to an access device by a short range antenna, and where the access device forwards the authorization request message to the server;
extracting, by the server, the security notification data or the derivative of the security notification data from the authorization request message;
analyzing, by the server, the security

Assignees

• Visa Int Service Ass

Inventors

• Aabye Christian
• Youdale Robert
• Nosseir Mohamed
• Singh Brijendra
• Hilliar Paul

Classifications

• G06F21/88

  Detecting or preventing theft or loss · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• G06F21/14 Primary

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title