# US 8,789,136 B2 · Securing a device based on atypical user behavior > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,136 B2 - Document ID: US8789136B2 - Status: Granted - Kind: B2 - Application number: 12/202,650 - Filed: 2008-09-02 - Published: 2010-03-04 - Granted: 2014-07-22 - Earliest claimed: 2008-09-02 - Assignees: Avaya Inc. - Applicants: George Erhart; Valentine Matula; David Skiba - Inventors: George Erhart; Valentine Matula; David Skiba - Web page: https://patentgrep.com/patent/US8789136B2 ## CPC - G06F 21/629: {to features or functions of an application} - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - H04W 12/12: Detection or prevention of fraud - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A system and method for securing the mobile device applies the rules to determine if an event associated with an application is a secure event. If the event is a secure event, the system applies the rules to determine if the event is authenticated. If the event is authenticated, the event is authorized and the system updates rule data associated with the event and/or other associated events. Updating the rule data allows other associated events to be authenticated. If the event is not authenticated, the system requests authentication from a user. If the authentication is valid, the event is authorized and the system updates the rule data associated with the event and/or other associated events. If the authentication is not valid, the system secures the mobile device. Authorizing the event enables a user to access the application and/or data associated with the application. ## Claims ### Claim 1 A system for securing a device comprising: a. a behavior module for authorizing events, updating rule data, and securing the device; and b. an authentication module responsive to a first event being a secure event, for determining if the first event is authenticated; c. responsive to the first event being authenticated, for directing the behavior module to authorize the first event and to update the rule data; d. responsive to the first event not being authenticated, for determining if an authentication is valid; e. responsive to the authentication being valid, for directing the behavior module to authorize the first event and update the rule data; f. responsive to the authentication not being valid, for directing the behavior module to secure the device; g. a processor; h. a memory storing the behavior module and the authentication module for execution by the processor; i. wherein the authentication module is responsive to the first event not being a secure event, for directing the behavior module to authorize the first event and update the rule data, wherein secure events require authentication and non-secure events do not require authentication, and j. wherein the authentication module is responsive to the first event authentication being valid, for directing the behavior module to determine if the first event is a static event, and wherein the behavior module is responsive to the first event not being a static event, for authorizing the first event and updating the rule data, the rule data comprising at least one item from the group of: which events have been authenticated, a number of times an event occurred, if a user is connected to a docking station, and timer information. ### Claim 2 (depends on 1) The system of claim 1, wherein the first event is a non-secure event, and wherein the behavior module is further adapted to update the rule data by converting the first event into a secure event. ### Claim 3 (depends on 2) The system of claim 2, wherein the behavior module is adapted to convert the first event into the secure event responsive to the behavior module authorizing a plurality of non-secure events. ### Claim 4 (depends on 1) The system of claim 1, wherein the first event is a secure event, and wherein the behavior module is further adapted for converting the first event into a non-secure event. ### Claim 5 (depends on 1) The system of claim 1, wherein the authentication module is adapted to determine if the authentication is valid based on a prior authentication of the first event. ### Claim 6 (depends on 1) The system of claim 1, wherein the authentication module is adapted to determine if the authentication is valid based on a prior authentication of an associated event. ### Claim 7 (depends on 6) The system of claim 6, wherein the first event and/or the associated event are based on activities of a person. ### Claim 8 (depends on 1) The system of claim 1, wherein the behavior module is adapted to update the rule data for the first event by updating rule data of an associated event. ### Claim 9 (depends on 8) The system of claim 8, wherein the first event and/or the associated event are based on activities of a person. ### Claim 10 (depends on 1) The system of claim 1, wherein the authentication module is adapted to determine if the authentication is valid based on a period of time since the last authentication of the first event. ### Claim 11 (depends on 1) The system of claim 1, wherein the first event is an item from the group comprising: accessing a network, accessing an application, accessing a file, accessing a directory, accessing a memory device, accessing a docking station, removing a memory device, inserting a memory device, receiving an email, sending an email, receiving a file, sending a file, copying a file, accessing a device, entering a secure location, leaving a secure location, connecting to a network, disconnecting from a network, accessing a calendar, receiving a phone call, and placing a phone call. ### Claim 12 (depends on 1) The system of claim 1, wherein the behavior module is adapted to secure the device by at least one item selected from the group comprising: locking the device, encrypting application data, and deleting application data. ### Claim 13 (depends on 1) The system of claim 1, wherein the device is a mobile device. ### Claim 14 A method for securing a device comprising: a. determining if a first event is a secure event; b. in response to determining that the first event is a secure event, determining if the first event is authenticated; c. in response to determining that the first event is authenticated, proceeding to step (f); d. in response to determining that the first event is not authenticated, determining if an authentication is valid; e. in response to determining that the authentication is valid proceeding to step (f); f. authorizing the first event and updating rule data for the first event; and g. in response to determining that the authentication is not valid, securing the device, wherein securing the device comprises at least one item selected from the group comprising: locking the device, encrypting application data, and deleting application data; h. in response to determining that the first event is not a secure event, proceeding to step (f), wherein secure events require authentication and non-secure events do not require authentication, and wherein the rule data comprises at least one item from the group of: which events have been authenticated, a number of times an event occurred, if a user is connected to a docking station, and timer information; i. determining if the first event is a static event, and responsive to the first event not being a static event, authorizing the first event and updating the rule data. ### Claim 15 (depends on 14) The method of claim 14, wherein the first event is a non-secure event and wherein updating the rule data for the first event further comprises converting the first event to a secure event. ### Claim 16 (depends on 15) The method of claim 15, wherein converting the first event to the secure event is based on accessing a plurality of non-secure events. ### Claim 17 (depends on 14) The method of claim 14, wherein the first event is a secure event and wherein updating the rule data further comprises converting the first event into a non-secure event, the rule data comprising at least one item from the group of: which events have been authenticated, a number of times an event occurred, if a user is connected to a docking station, and timer information. ### Claim 18 (depends on 14) The method of claim 14, wherein the step of determining if the authentication is valid, further comprises determining if the first event is a static event, and in response to the first event not being a static event, proceeding to step (f). ### Claim 19 (depends on 14) The method of claim 14, wherein determining if the authentication is valid is based on a prior authentication of the first event. ### Claim 20 (depends on 14) The method of claim 14, wherein determining if the authentication is valid is based on a prior authentication of an associated event. ### Claim 21 (depends on 20) The method of claim 20, wherein the first event and/or the associated event are based on activities of a person. ### Claim 22 (depends on 14) The method of claim 14, wherein updating the rules for the first event further comprises updating rules of an associated event. ### Claim 23 (depends on 22) The method of claim 22, wherein the first event and/or the associated event are based on activities of a person. ### Claim 24 (depends on 14) The method of claim 14, wherein determining if the authentication is valid is based on a period of time since the last authentication of the first event. ### Claim 25 (depends on 14) The method of claim 14, wherein the first event is an item from the group comprising: accessing a network, accessing an application, accessing a file, accessing a directory, accessing a memory device, accessing a docking station, removing a memory device, inserting a memory device, receiving an email, sending an email, receiving a file, sending a file, copying a file, accessing a device, entering a secure location, leaving a secure location, connecting to a network, disconnecting from a network, accessing a calendar, receiving a phone call, and placing a phone call. ### Claim 26 (depends on 14) The method of claim 14, wherein securing the device comprises at least one item selected from the group comprising: locking the device, encrypting application data, and deleting application data. ### Claim 27 (depends on 14) The method of claim 14, wherein the device is a mobile device. ### Claim 28 (depends on 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27) An apparatus for performing the method of one of claims 14 or 15-27. ### Claim 29 A system for securing a device comprising: a. an authentication module responsive to a first event being a secure event, for determining if the first event is authenticated; b. responsive to the first event not being a secure event, for directing a behavior module to authorize the first event and to update rule data, wherein secure events require authentication and non-secure events do not require authentication, and wherein the rule data comprises at least one item from the group of: which events have been authenticated, a number of times an event occurred, if a user is connected to a docking station, and timer information; c. responsive to the first event being authenticated, for directing the behavior module to authorize the first event and to update the rule data; d. responsive to the first event not being authenticated, for determining if an authentication is valid; e. responsive to the authentication not being valid, for directing the behavior module to secure the device; f. responsive to the authentication being valid, for directing the behavior module to determine if the first event is a static event; g. responsive to the authentication not being valid, for directing the behavior module to secure the device; h. the behavior module, adapted to authorize an event, update rule data, and secure the device, the behavior module further for determining if an event is a static event, and responsive to the event not being a static event, for authorizing the event and updating the rule data; i. a processor; and j. a memory storing the behavior module and the authentication module for execution by the processor.