# US 2020/0401679 A1 · Method and system for preventing unauthorized computer processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401679 A1 - Document ID: US20200401679A1 - Status: Published application - Kind: A1 - Application number: 17/012,473 - Filed: 2020-09-04 - Published: 2020-12-24 - Earliest claimed: 2015-08-17 - Inventors: Dan RAM - Web page: https://patentgrep.com/patent/US20200401679A1 ## CPC - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/445: {by mutual authentication, e.g. between devices or programs} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The invention relates to a system and method for preventing a protected computing device from executing unauthorized processor commands. A data entry database of the system stores encoded data entered by a human user as data entry events. A command verification module of the system implements an authentication algorithm for determining whether a processor command to be executed by the computing device originates from a trusted source. The command verification module determines the trustworthiness of a processor command as a function of parameters of the processor command, which include an association of the command with one or more of the data entry events. Determination can also be made based on other processor command parameters, such as the type of processor command and/or contextual parameters of the processor command. Upon making the determination, the command verification module allows authenticated processor commands to be executed and prevents non-authenticated processor commands from being executed by the computing device. ## Claims ### Claim 1 One or more non-transitory computer-readable media (CRMs), configured with stored instructions for one or more processors to execute a system for preventing a protected computing device from executing unauthorized processor commands, said system comprising: a data entry encoding module for encoding data entered by a human user; a data entry database; and a command verification module; wherein data, entered by said human user via a data entry device and a time of data entry are encoded by said data entry encoding module as a data entry event and stored in said data entry database; wherein said command verification module implements an authentication algorithm for determining whether a processor command, to be executed by said protected computing device, originates from a trusted source; wherein said command verification module determines the trustworthiness of a processor command as a function of processor command parameters selected from a group consisting of: i. the type of processor command to be executed by said protected computing device (e.g., memory operation, data processing operation); ii. contextual parameters of said processor command, said parameters selected from a group comprising the specific computer process that called said processor command; and iii. association of said processor command with one or more specific data entry events encoded by said data encoding module and stored in said data entry database; and wherein said command verification module allows authenticated processor commands to be executed by said protected computing device; wherein said command verification module prevents said protected computing device from executing processor commands determined to be non-authenticated; and wherein said command verification module comprises a first said CRM and processes data in said data entry database for deriving a data entry pattern: said data entry pattern indicates whether a human or non-human agency entered said data. ### Claim 2 (canceled) ### Claim 3 (canceled) ### Claim 4 (canceled) ### Claim 5 (depends on 1) The one or more CRMs of claim 1, wherein said data entry device comprises a keyboard; wherein said data entry event comprises parameters selected from a group consisting of keystroke identification and a data entry timestamp. ### Claim 6 (depends on 1) The one or more CRMs of claim 1, wherein said data entry device is selected from a group of pointing devices consisting of: a mouse, a trackball, a tablet, a joystick, and a gesture detection device; wherein said data entry event comprises parameters selected from a group consisting of GUI (graphic user interface) cursor location, cursor movement data, pointing device button clicks, and a data entry timestamp. ### Claim 7 (canceled) ### Claim 8 (canceled) ### Claim 9 (canceled) ### Claim 10 (canceled) ### Claim 11 (canceled) ### Claim 12 (canceled) ### Claim 13 (canceled) ### Claim 14 (depends on 1) The one or more CRMs of claim 1, wherein said system is configured to protect a plurality of two or more protected computing devices. ### Claim 15 (depends on 14) The one or more CRMs of claim 14, wherein said plurality of two or more protected computing devices is networked within an organization. ### Claim 16 (canceled) ### Claim 17 (canceled) ### Claim 18 (canceled) ### Claim 19 (canceled) ### Claim 20 (canceled) ### Claim 21 (depends on 1) The one or more CRMs of claim 1, wherein said command verification module further processes said data entry pattern for confirming the identity of the specific human user who entered said data. ### Claim 22 (depends on 1) The one or more CRMs of claim 1, wherein said data entry pattern comprises a sequence of said data entry event parameters and the pauses between said data entry events as calculated from their respective times of data entry. ### Claim 23 (depends on 1) The one or more CRMs of claim 1, wherein said data entry encoding module comprises a dedicated encoding device separate from said protected computing device and said dedicated encoding device is physically located externally to said protected computing device; wherein said dedicated encoding device is removable from said protected computing device. ### Claim 24 (depends on 1) The one or more CRMs of claim 1, wherein said command verification module verifies processor commands, to be executed by said protected computing device, at a predetermined frequency. ### Claim 25 (depends on 1) The one or more CRMs of claim 1, wherein said command verification module verifies processor commands, to be executed by said protected computing device, at randomly varying frequencies. ### Claim 26 (depends on 1) The one or more CRMs of claim 1, wherein said command verification module comprises: a. a computing module for processing digital data; b. a non-volatile computer-readable medium (CRM) for storing a computer program; wherein said computer program, stored on said CRM, instructs said computing module to implement said authentication algorithm; and wherein said computing module is embodied by a separate, dedicated computing device executing said authentication algorithm; and wherein said protected computing device is configured to operate as a subordinate device to said dedicated computing device, such that said dedicated computing device can prevent said protected computing device from executing specific processor commands; and wherein said dedicated computing device is embodied as an apparatus external to said protected computing device; wherein said dedicated computing device is removable from said protected computing device. ### Claim 27 A method for preventing a protected computing device from executing unauthorized processor commands, said method comprising steps of providing: a. a data entry encoding module for encoding data entered by a human user; b. a data entry database; and c. a command verification module; wherein data entered by said human user via a data entry device and a time of data entry are encoded by said data entry encoding module as a data entry event and stored in said data entry database; and wherein said command verification module implements an authentication algorithm for determining whether a processor command, to be executed by said protected computing device, originates from a trusted source; and wherein said command verification module determines the trustworthiness of a processor command as a function of processor command parameters selected from a group consisting of: i. the type of processor command to be executed by said protected computing device; ii. contextual parameters of said processor command, said parameters selected from a group comprising the specific computer process that called said processor command; and iii. association of said processor command with one or more specific data entry events encoded by said data encoding module and stored in said data entry database; and wherein said command verification module allows authenticated processor commands to be executed by said protected computing device; wherein said command verification module prevents said protected computing device from executing processor commands determined to be non-authenticated; and wherein said command verification module comprises a first said CRM and processes data in said data entry database for deriving a data entry pattern; said data entry pattern indicates whether a human or non-human agency entered said data. ### Claim 28 (depends on 27) The method of claim 27, further comprising said command verification module processing said data entry pattern for confirming the identity of the specific human user who entered said data. ### Claim 29 (depends on 27) The method of claim 27, further comprising configuring said data entry pattern to comprise a sequence of said data entry event parameters and the pauses between said data entry events as calculated from their respective times of data entry. ### Claim 30 (depends on 27) The method of claim 27, further comprising said command verification module verifying processor commands, to be executed by said protected computing device, at a predetermined frequency. ### Claim 31 (depends on 27) The method of claim 27, further comprising said command verification module verifying processor commands, to be executed by said protected computing device, at randomly varying frequencies. ### Claim 32 One or more non-transitory computer-readable media (CRMs), configured with stored instructions for one or more processors to execute a system for preventing a protected computing device from executing unauthorized processor commands, said system comprising: a. a data entry encoding module for encoding data entered by a human user; b. a data entry database; and c. a command verification module; wherein data, entered by said human user via a data entry device and a time of data entry are encoded by said data entry encoding module as a data entry event and stored in said data entry database; and wherein said command verification module implements an authentication algorithm for determining whether a processor command, to be executed by said protected computing device, originates from a trusted source; and wherein said command verification module determines the trustworthiness of a processor command as a function of processor command parameters selected from a group consisting of: i. the type of processor command to be executed by said protected computing device; ii. contextual parameters of said processor command, said parameters selected from a group comprising the specific computer process that called said processor command; and iii. association of said processor command with one or more specific data entry events encoded by said data encoding module and stored in said data entry database; and wherein said command verification module allows authenticated processor commands to be executed by said protected computing device; and wherein said command verification module prevents said protected computing device from executing processor commands determined to be non-authenticated; and wherein said system further comprises an emulator module comprising a second said CRM, configured to emulate a computing device with an operating system different than said an operating system of said protected computing device. ### Claim 33 (depends on 32) The one or more CRMs of claim 32, wherein said emulating module has attributes of one or more of a. said emulated operating system is older than said protected computing device operating system; and b. said emulating module emulates a specialized simulation or specialized computer equipment.