Securing a device based on atypical user behavior

A method for securing a device comprising:

• a. determining if a first event is a secure event;
• b. in response to determining that the first event is a secure event, determining if the first event is authenticated;
• c. in response to determining that the first event is authenticated, proceeding to step (f);
• d. in response to determining that the first event is not authenticated, determining if an authentication is valid;
• e. in response to determining that the authentication is valid proceeding to step (f);
• f. authorizing the first event and updating rule data for the first event;
• and
• g. in response to determining that the authentication is not valid, securing the device, wherein securing the device comprises at least one item selected from the group comprising:
• locking the device, encrypting application data, and deleting application data;
• h. in response to determining that the first event is not a secure event, proceeding to step (f), wherein secure events require authentication and non-secure events do not require authentication, and wherein the rule data comprises at least one item from the group of:
• which events have been authenticated, a number of times an event occurred, if a user is connected to a docking station, and timer information;
• i. determining if the first event is a static event, and responsive to the first event not being a static event, authorizing the first event and updating the rule data.

A system for securing a device comprising:

• a. an authentication module responsive to a first event being a secure event, for determining if the first event is authenticated;
• b. responsive to the first event not being a secure event, for directing a behavior module to authorize the first event and to update rule data, wherein secure events require authentication and non-secure events do not require authentication, and wherein the rule data comprises at least one item from the group of:
• which events have been authenticated, a number of times an event occurred, if a user is connected to a docking station, and timer information;
• c. responsive to the first event being authenticated, for directing the behavior module to authorize the first event and to update the rule data;
• d. responsive to the first event not being authenticated, for determining if an authentication is valid;
• e. responsive to the authentication not being valid, for directing the behavior module to secure the device;
• f. responsive to the authentication being valid, for directing the behavior module to determine if the first event is a static event;
• g. responsive to the authentication not being valid, for directing the behavior module to secure the device;
• h. the behavior module, adapted to authorize an event, update rule data, and secure the device, the behavior module further for determining if an event is a static event, and responsive to the event not being a static event, for authorizing the event and updating the rule data;
• i. a processor;
• and
• j. a memory storing the behavior module and the authentication module for execution by the processor.