Mobile security countermeasures

Patent metadata

Field	Value
Publication number	US-11095678-B2
Application number	US-201715648310-A
Country	US
Kind code	B2
Filing date	Jul 12, 2017
Priority date	Jul 12, 2017
Publication date	Aug 17, 2021
Grant date	Aug 17, 2021

Abstract

A method includes generating a user profile for an authorized user of a mobile device based on behavior patterns associated with the authorized user. The method also includes detecting subsequent user behavior of a particular user during an attempt by the particular user to access the mobile device. The method also includes comparing the subsequent user behavior to the behavior patterns of the user profile to determine whether the particular user is authorized or unauthorized. In response to determining that the particular user is an unauthorized user, the method includes detecting activity by the unauthorized user and performing a countermeasure of a plurality of countermeasures in response to detecting the activity. Each countermeasure of the plurality of countermeasures has a different security level and corresponds to a degree of the activity.

First claim

What is claimed is:

1. A computer-implemented method comprising:
generating, at a processor of a mobile device, a user profile for an authorized user of the mobile device based on behavior patterns associated with the authorized user, the behavior patterns determined based on historical data indicating past user behavior of the authorized user, wherein the behavior patterns comprise mobile device usage time patterns of the authorized user;
detecting subsequent user behavior of a particular user attempting to gain access to the mobile device by a login process; and
responsive to determining that the particular user is a potential unauthorized user based on a comparison of first metrics of the behavior patterns of the user profile to second metrics of the subsequent user behavior during the login process and responsive to granting access to the mobile device based on the login process:
detecting activity by the potential unauthorized user after access to the mobile device has been granted;
determining a security level being violated by the activity, wherein a first security level is associated with a first post-access activity by the potential unauthorized user, wherein a second security level is associated with a second post-access activity by the potential unauthorized user, and wherein the first post-access activity is distinct from the second post-access activity;
selecting a particular countermeasure of a plurality of countermeasures based on the security level, wherein the plurality of countermeasures comprise a first countermeasure to be performed responsive to the first security level being violated and a second countermeasure to be performed responsive to the second security level being violated, and wherein the first countermeasure and the second countermeasure are distinct, wherein the first countermeasure comprises:
prompting the potential unauthorized user to touch a particular portion of the mobile device, the particular portion of the mobile device comprising a scanner;
scanning a fingerprint of the potential unauthorized user while the unauthorized potential user touches the particular portion of the mobile device; and
transmitting identity data based on the fingerprint to a second device;

wherein the second countermeasure comprises:
providing false data in response to commands issued by the potential unauthorized user to engage the potential unauthorized user with the mobile device; and
generating information about the potential unauthorized user while the potential unauthorized user is engaged with the mobile device, the information including the fingerprint of the potential unauthorized user, a voice signature of the potential unauthorized user, or both; and

performing the particular countermeasure.

2. The computer-implemented method of claim 1 , further comprising:
detecting second subsequent user behavior of a second particular user during an attempt by the second particular user to access the mobile device;
performing a second comparison of the second subsequent user behavior to the behavior patterns of the user profile to determine whether the second particular user is authorized or unauthorized; and
responsive to determining that the second particular user is a second unauthorized user based on the second comparison:
detecting second activity by the second unauthorized user, the second activity distinct from the activity;
determining the second security level being violated by the second activity;
selecting a second particular countermeasure of the plurality of countermeasures based on the second security level; and
performing the second particular countermeasure.

3. The computer-implemented method of claim 1 , wherein the first security level corresponds to unauthorized access of data stored on the mobile device, and wherein the second security level corresponds to identity theft.

4. The computer-implemented method of claim 1 , wherein the plurality of countermeasures comprises a third countermeasure to be performed responsive to a third security level being violated.

5. The computer-implemented method of claim 4 , wherein the third countermeasure comprises deleting data stored at the mobile device.

6. The computer-implemented method of claim 4 , wherein the third countermeasure comprises:
detecting a request for identity information from the potential unauthorized user, the identity information associated with the authorized user;
generating false identity information in response to detecting the request; and
providing the false identity information to the potential unauthorized user.

7. The computer-implemented method of claim 4 , wherein the third countermeasure enables the mobile device to determine information associated with the potential unauthorized user.

8. The computer-implemented method of claim 7 , wherein performing the third countermeasure comprises generating the voice signature of the potential unauthorized user while the potential unauthorized user speaks into a microphone.

9. The computer-implemented method of claim 4 , wherein performing the third countermeasure comprises activating a camera of the mobile device.

10. The computer-implemented method of claim 4 , wherein the third countermeasure comprises sending a message to an account associated with the authorized user.

11. The computer-implemented method of claim 4 , wherein the third countermeasure comprises initiating a self-destruct processor to destroy a non-volatile memory.

12. The computer-implemented method of claim 11 , wherein the third countermeasure is associated with a third security level corresponding with to detecting criminal activity.

13. The computer-implemented method of claim 1 , wherein the historical data includes physical behavior patterns of the authorized user.

14. The computer-implemented method of claim 1 , wherein the historical data includes geographical locations where the authorized user accesses the mobile device.

15. The computer-implemented method of claim 1 , wherein the determination that the particular user is a potential unauthorized user is generated responsive to the comparison indicating that access data has been manipulated or falsified.

16. An apparatus comprising:
a memory storing a user profile for an authorized user of a mobile device, the user profile generated based on behavior patterns associated with the authorized user, the behavior patterns determined based on historical data indicating past user behavior of the authorized user, wherein the behavior patterns comprise mobile device usage time patterns of the authorized user;
a processor coupled to the memory, the processor configured to:
detect subsequent user behavior of a particular user attempting to gain access the mobile device by a login process; and
in response to a determination that the particular user is a potential unauthorized user based on a weighted comparison of first metrics of the behavior patterns of the user profile to second metrics of the subsequent user behavior during the login process and responsive to granting access to the mobile device based on the login process:
detect activity by the potential unauthorized user after access to the mobile device has been granted;
determine a security level being violated by the activity, wherein a first security level is associated with a first post-access activity by the potential unauthorized user, wherein a second security level is associated with a second post-access activity by the potential unauthorized user, and wherein the first post-access activity is distinct from the second post-access activity;
sel

Assignees

• Boeing Co

Inventors

• Laughlin Brian D
• Glatfelter John William
• Kelsey William David

Classifications

• G06V40/12

  Fingerprints or palmprints · CPC title

• G06F2221/2127

  Bluffing · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title