Method and apparatus for data protection for mobile devices

[0001] The invention relates to the protection of data stored in a mobile device upon the device being stolen or lost.

[0002] Within the prior art, a problem arises with respect to mobile devices such as laptop computers, mobile telephones, personal digital assistants, MP3 audio/data units, etc. The problem is that the amount of data that can now be stored on these devices can easily exceed 50 GB. Users are increasingly storing large amounts of confidential and sensitive data on such devices. In an event of theft or loss, this data can be used to detriment of companies and government agencies, as well as the problem of misuse of personal data. There have been many examples of such loss. One example was the loss of a laptop computer which had the salaries, pension plan totals and social security numbers of all of the employees of a major corporation in the United States.

[0003] One prior art solution for resolving this problem is to force a user to enter a password or PIN every time they want to use the device. Not only is this inconvenient for the user, but short passwords and PINs can be determined utilizing automated systems that try all possibilities. In addition, passwords or PINs that have a large number of characters are extremely inconvenient for users to utilize.

[0004] A similar prior art solution is to encrypt the confidential data on the mobile device. This suffers from the problem as it requires an encryption key to be entered every time the device is used. The main disadvantage of encryption is that the difficulty it; breaking the encryption method is determined by the size of the key that is used to do the encryption. The smaller the key the easier the breaking of the encryption method is.

[0005] Another method for securing mobile devices is to use biometric techniques. One such biometric technique is to require the fingerprint of the user. The problem with biometric techniques is the cost of providing such techniques on a mobile device.

[0006] Another prior art solution is to delete all data on the mobile device once it is detected as being stolen. There are various techniques for determining if a mobile device has been stolen, one is to require that the mobile device automatically report to a central server periodically or when it accesses the Internet or a cellular network. The central server then can delete all of the data on the mobile device.

[0007] A method and apparatus protect data stored in a device by storing data from the device on a backup system upon the device being connected to the backup system; detecting that the device has been lost or stolen; encrypting a set of data stored on the device that has not been stored on the backup system using an encryption key based on another set of data stored on the device and also stored on the backup system; and deleting the other set of data and encryption key from the device.

[0014] In one embodiment, a mobile device upon detection that it had been lost or stolen deletes all data on the device except for any data that had been added to the device but had not yet been backed up to a backup system such as server or personal computer. Before the backed up data is deleted, it is used to generate a large encryption key. This key can then be used to encrypt the non-backed up data. The encryption key would be so large that it would make it virtually impossible to break the encryption method. If the device was not lost or stolen but merely neglected or unused for a period of time, this embodiment has the advantage that backed up and non-backed up data can be retrieved using information stored on the backup system.

[0015] Once the mobile device is recovered, the encryption key can be generated from data backed up on the backup server or personal computer to create the encryption key again. Using this encryption key, the non-backed up data is then recovered and resynchronized with the backup server or personal computer. This embodiment assures that the non-backed up data is not lost while also ensuring that the encryption key generated is large enough to make it virtually impossible for the encryption method to be broken. In an alternative embodiment, the backup system generates the encryption key every time the mobile device is synched to the backup system and stores this key within the mobile device. When it is detected that the mobile device has been lost or stolen, the stored encryption key is utilized to encrypt all of the non-backed up data before deleting the backed up data and the encryption key.

[0016] In one embodiment, the device is determined to have been stolen or lost when the password or PIN is incorrectly entered a predefined number of times. Upon this detection occurring, the backed up data will be deleted and the non-backed up data will be encrypted as outlined in the previous paragraphs. In another embodiment, the device is determined to have been stolen or lost by doing gait analysis utilizing motion sensors within the mobile device to determine that the mobile device is now being carried by a person walking who is not the assigned user of the mobile device.

[0017] In yet another embodiment, the mobile device would have to periodically make contact with a central system via the Internet or some other wide area network or the mobile telephone network. If the periodic connection was not made then the steps of deleting the backed-up data and encrypting the non-backed up data, as outlined in the previous paragraphs, would be performed.

[0018] Also in another embodiment, the mobile device may have to periodically make contact with a specified other device via a wireless or wired connection such as for example a specified Bluetooth enabled device. Such a device could be but is not limited to a printer, headset, personal computer, PDA, etc. Alternatively in this embodiment, the mobile device may have to periodically make contact with specified wireless or wired network such as for example but not limited to a 801.11 wireless network in a home, institution, coffee shop, office location, etc.

[0019] One skilled in the art could envision other techniques for determining that a device had been lost or stolen.

[0020] FIG. 1 illustrates, in flowchart form, operations 100 that are performed to protect data in a mobile device. After being started in block 101, decision block 102 determines if the device has been lost or stolen. If the answer is no, decision block 102 is re-executed. If the answer is yes in decision block 102, decision block 103 determines if there is any non-backed up data. Non-backed up data would be data that is not on the backup system for the device. If the answer is no in decision block 103, control is transferred to block 109 which deletes all data within the device before returning control back to decision block 102.

[0021] If the answer in decision block 103 is yes, block 104 obtains the encryption key. The encryption key will be based on the backed up data. The device may generate this encryption key based on the backed up data when block 104 is executed or the encryption key may have been stored in the device during the last time that data was backed up to the backup system. Block 106 encrypts the non-backed up data using the obtained encryption key. Block 107 deletes the backed up data, and block 108 deletes the encryption key before returning control back to decision block 102.

[0022] The determination performed by decision block 102 could be made by detecting that the incorrect password or PIN had been continuously entered more then a predefined number of times. Other methods for making this determination are discussed with respect to FIGS. 3 and 5.

[0023] FIG. 2 illustrates, in block diagram form, an embodiment of a mobile device. The mobile device could be a laptop, mobile telephone, personal digital assistant, etc. Processor 202 performs all control functions utilizing data and programs stored in memory 201. User interface 204 includes output means so that processor 202 could display information to a user such as a liquid crystal display or CRT. In addition, user interface 204 includes input means such as a keyboard, writing input, touch screen capabilities, buttons, etc. Interface 206 provides an interface to public switching telephone network 216 either via wired or wireless connections. Interface 207 provides an interface to data network 216 which may be the Internet or any other data network. Backup system 217 may be interconnected to the device via PSTN 214 or data network 216. Motion transducers 203 are utilized by gait analysis module 211 to identify the gait of the person carrying the device illustrated in FIG. 2.

[0024] Device control 209 performs the normal mobile device functions utilizing inputs from user interface 204 and interfaces 206 and 207 as well as data stored in data 208.

[0025] Processor 202 periodically executes gait analysis module 211 to identify the gait of the individual carrying the mobile device. The functions performed by gait analysis module 211 are set forth in greater detail in United States Patent Application Publication No. 2006/0080551 A1. This patent application publication is hereby incorporated by reference.

[0026] Once it has been determined that a different user is walking with the mobile device by execution of gait analysis module 211, processor 202 performs the operations illustrated in FIG. 1. By executing deletion control module 213, processor 202 determines what data in data 208 has not been backed up since the last synchronization with the backup system. Processor 202 then executes encryption module 212 to generate the encryption key and to encrypt the non-backed up data in data 208. After this has been done, processor 202 continues to execute deletion control 213 to remove all of the backed up data from 208 as well as the encryption key. Note, in one embodiment, encryption module 212 generates the encryption key based on the backed up data stored in data 208; whereas, in another embodiment the encryption key is already stored in data 208 having been previously stored there by the backup system.

[0027] FIG. 3 illustrates in greater detail the operations performed by processor 202 in executing gait analysis module 211, encryption module 212, and deletion control module 213 of FIG. 2. After being started in block 301, decision block 302 determines if a gait has been detected. If the answer is no, control is transferred to decision block 307.

[0028] If the answer in decision block 302 is yes, decision block 303 determines if the detected gait is the gait of the device's user. If the answer is yes, block 304 resets the stolen flag if it had been set before transferring control to decision block 307. If the answer in decision block 303 is no, block 306 sets the stolen flag before transferring control to decision block 307.

[0029] Decision block 307 determines if there is an attempt to use the device. If the answer is no, control is transferred back to decision block 302. If the answer is yes in decision block 307, decision block 308 determines if the stolen flag is set. If the answer is no, block 313 allows use of the device before returning control to decision block 302.

[0030] If the answer in decision block 308 is yes, in one embodiment block 309 requests the password from the individual attempting to use the device. It is envisioned that this password would be a very complex and lengthy password. After receiving the requested password, decision block 311 determines if the password is correct. One skilled in the art would readily see that blocks 309 and 311 could be executed a pre-defined number of times before it was determined that the password was not correct. If the answer in decision block 311 is yes, block 313 is executed. If the answer in decision block 311 is no, block 312 then performs the encryption and deletion operations as previously described.

[0031] In another embodiment, blocks 309 and 311 are not present and a yes answer in decision block 308 immediately results in the execution of block 312. After block 312 has performed the necessary operations, control is transferred back to decision block 302.

[0032] FIG. 4 illustrates, in block diagram form, another embodiment. Blocks 404, 406, 407, 408, 409, 412, and 413 perform similar functions to those performed by like numbered blocks on FIG. 2. Processor 402 may interconnect to back up system 417 via wired telephone network 414 or data network 416.

[0033] Periodically, processor 402 by execution of system contact module 411 attempts to contact central system 403 via wireless and wired telephone network 414 or data network 416. If after a predetermined amount of time, and contact has not been made, processor 402 will execute encryption module 412 and deletion control module 413 to delete all backed up data and to encrypt the non-backed up data contained in data 408. Further details on the operation of processor 402 when executing system contact module 411 are given in FIG. 5.

[0034] FIG. 5 illustrates, in flowchart form, operations 500 that are performed by processor 402 during the execution of system contact module 411, encryption module 412, and deletion control module 413. After being started in block 501, decision block 502 determines if it is time to check with the central system. This time would occur periodically. If the answer is no, control is transferred to decision block 509.

[0035] If the decision in decision block 502 is yes, block 503 attempts to establish contact with the central system. Decision block 504 determines if the attempt was successful. If the answer in decision block 504 is no, block 506 sets the no-contact flag and transfers control to decision block 509.

[0036] If the answer in decision block 504 is yes, block 507 resets the no-contact flag, if it was set, before transferring control to decision block 508. Decision block 508 determines if the central system wants to delete data. If the answer is yes, control is transferred to block 513 that performs the encryption and deletion operations that were previously described, before returning control back to decision block 502.

[0037] If the answer in decision block 508 is no, decision block 509 determines if there is an attempt to use the device. If the answer is no, control is transferred back to decision block 502.

[0038] If the answer is yes in decision block 509, decision block 511 determines if the contact flag is set. If the answer is yes, control is transferred to block 513. If the answer in decision block 511 is no, block 512 allows the use of the device before transferring control back to decision block 502.

[0039] FIG. 6 illustrates, in block diagram form, Two embodiments of a mobile device that can detect if it has been lost or stolen. Processor 602 performs all control functions utilizing data and programs stored in memory 601. User interface 604 includes output means so that processor 602 could display information to a user such as a liquid crystal display or CRT. In addition, user interface 604 includes input means such as a keyboard, writing input, touch screen capabilities, buttons, etc. Interface 606 provides an interface to public switching telephone network 616 either via wired or wireless connections. Interface 607 provides an interface to data network 616 which may be the Internet or any other data network. Backup system 617 may be interconnected to the device via PSTN 614 or data network 616. In one embodiment of FIG. 6, device interface 603 provides a wireless or wired connection to device 619 which could be but is not limited to a printer, headset, personal computer, PDA, etc. In a second embodiment of FIG. 6, network interface 621 provides a wireless or wired connection to network 622.

[0040] Device control 609 performs the normal mobile device functions utilizing inputs from user interface 604 and interfaces 606 and 607 as well as data stored in data 608.

[0041] In the first embodiment of FIG. 6, processor 602 periodically executes device detection module 611 to establish communication with device 619. If communication can not be established with device 619 within a predefined period of time, processor 602 performs the operations illustrated in FIG. 1.

[0042] In the second embodiment of FIG. 6, processor 602 periodically executes network detection module 611 to establish communication with network 622. If communication can not be established with network 622 within a predefined period of time, processor 602 performs the operations illustrated in FIG. 1.

[0043] Processor 602 performs the following operations of FIG. 1. By executing deletion control module 613, processor 602 determines what data in data 608 has not been backed up since the last synchronization with the backup system. Processor 602 then executes encryption module 612 to generate the encryption key and to encrypt the non-backed up data in data 608. After this has been done, processor 602 continues to execute deletion control 613 to remove all of the backed up data from 608 as well as the encryption key. Note, in one embodiment, encryption module 612 generates the encryption key based on the backed up data stored in data 608; whereas, in another embodiment the encryption key is already stored in data 608 having been previously stored there by the backup system.

[0044] When the operations of a device, computer, processor or server are implemented in software, it should be noted that the software can be stored on any computer-readable medium for use by or in connection with any computer related system or method. In the context of this document, a computer-readable medium is an electronic, magnetic, optical, or other physical device or means that can contain or store a computer program for use by or in connection with a computer related system or method. The device, computer, processor or server can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. In the context of this document, a “computer-readable medium” can be any means that can store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. For example, the computer-readable medium can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM) (electronic), a read-only memory (ROM) (electronic), an erasable programmable read-only memory (EPROM, EEPROM, or Flash memory) (electronic), an optical fiber (optical), and a portable compact disc read-only memory (CDROM) (optical). Note that the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for instance, via optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.

[0045] In an alternative embodiment, where the device, computer or server is implemented in hardware, the device, computer or server can be implemented with any or a combination of the following technologies, which are each well known in the art: a discrete logic circuit(s) having logic gates for implementing logic functions upon data signals, an application specific integrated circuit (ASIC) having appropriate combinational logic gates, a programmable gate array(s) (PGA), a field programmable gate array (FPGA), etc.

[0046] Of course, various changes and modifications to the illustrated embodiments described above will be apparent to those skilled in the art. These changes and modifications can be made without departing from the spirit and scope of the invention and without diminishing its intending advantages. It is therefore intended that such changes and modifications be covered by the following claims except insofar as limited by the prior art.