Mobile device system and method for preventing network signal interception and hacking

FIELD OF THE INVENTION

0001The present invention generally relates to protection of mobile device computer systems from malicious activity of unauthorized access via hacking of the device. More particularly, the present invention discloses hacking prevention systems and methods that deploy an application executable to refrain unauthorized access to a user's mobile device and to facilitate bilateral integrated prevention and protection of the system. Unauthorized access via signal interception is not according to the invention and is present for illustration purposes only.

BACKGROUND OF THE INVENTION

0002The following description includes information that may be useful in understanding the present invention. It is not an admission that any of the information provided herein is prior art or relevant to the presently claimed invention, or that any publication specifically or implicitly referenced is prior art.

0003Importantly, although the operational/functional descriptions described herein are understandable by the human mind, they are not abstract ideas of the operations/functions divorced from computational implementation of those operations/functions. Rather, the operations/functions represent a specification for the massively complex computational machines or other means. As discussed in detail below, the operational/functional language must be read in its proper technological context, i.e., as concrete specifications for physical implementations.

0004The logical operations/functions described herein are a distillation of machine specifications or other physical mechanisms specified by the operations/functions such that the otherwise inscrutable machine specifications may be comprehensible to the human mind. The distillation also allows one of skill in the art to adapt the operational/functional description of the technology across many different specific vendors' hardware configurations or platforms, without being limited to specific vendors' hardware configurations or platforms.

0005Some of the present technical description (e.g., detailed description, drawings, claims, etc.) may be set forth in terms of logical operations/functions. As described in more detail in the following paragraphs, these logical operations/functions are not representations of abstract ideas, but rather representative of static or sequenced specifications of various hardware elements. Differently stated, unless context dictates otherwise, the logical operations/functions will be understood by those of skill in the art to be representative of static or sequenced specifications of various hardware elements. This is true because tools available to one of skill in the art to implement technical disclosures set forth in operational/functional formats - tools in the form of a high-level programming language (e.g., C, java, visual basic, etc.), or tools in the form of Very high speed Hardware Description Language ("VHDL," which is a language that uses text to describe logic circuits) - are generators of static or sequenced specifications of various hardware configurations. This fact is sometimes obscured by the broad term "software," but, as shown by the following explanation, those skilled in the art understand that what is termed "software" is a shorthand for a massively complex inter-chaining/specification of ordered-matter elements. The term "ordered-matter elements" may refer to physical components of computation, such as assemblies of electronic logic gates, molecular computing logic constituents, quantum computing mechanisms, etc.

0006As outlined above, the reason for the use of functional/operational technical descriptions is at least twofold. First, the use of functional/operational technical descriptions allows near- infinitely complex machines and machine operations arising from inter chained hardware elements to be described in a manner that the human mind can process (e.g., by mimicking natural language and logical narrative flow). Second, the use of functional/operational technical descriptions assists the person of skill in the art in understanding the described subject matter by providing a description that is more or less independent of any specific vendor's piece(s) of hardware.

0007Mobile phones have become essential tools for communication and information exchange in the last two decades. Many people rely on their mobile phones in their personal lives as well as their businesses. Most mobile phone users exchange very sensitive and private information using their mobile phones assuming that the mobile phone network is reliable and secure.

0008The emerging threats to the data carried across mobile devices are not only affecting private consumers but also having a major impact on business. In today's modern enterprise, BYOD, or bring your own device, has become the standard and allows employees privileged access to sensitive corporate data and applications from their own personal mobile devices. Today 89 percent of employees are accessing work-related information on their mobile phones, and 41 percent are doing so without permission of their companies.

0009The phenomenon, now standard practice in the workplace, means more and more corporate information is at risk thanks to point-and-click spyware attacks against mobile devices. Even when a corporate network is locked down and protected, personal mobile phones are an easy place from which to pilfer data.

0010Mobile devices have become the new personal computers, storing as much data as a PC but providing greater flexibility and portability. However, while smartphones now perform the same functions as a computer, one critical feature is missing - security. Rapid growth in the use of smart phones, with internet access along with the applications that allow users to bank, shop and socially network, means that fraud risks (including theft of financial information and identity theft), which were previously associated with computers and laptops, are becoming increasingly relevant to mobile handsets. Generally, mobile devices are subjected to two major data security threats: tapping and hacking. The most notable threat to mobile phone users' privacy is signal interception (phone tapping), as these devices are connected to the public switched telephone network (PSTN). The signal can be intercepted either at the radio access node or at the core network. The former case can be implemented by detecting the wireless signal, but this needs cracking of the encrypted signal (if it is encrypted), while the latter case can be implemented by tapping the signal in the switches or transmission medium (optical fiber, coaxial cables, or microwave links), but this requires access to the core network infrastructure. Although the two options seem challenging, both options are feasible particularly for operators, law enforcement officers or even individuals with enough expertise and tools. Hacking of the mobile devices connected to the World Wide Web includes but is not limited to physical connection (physical hacking) to the device in an unauthorized manner; network attacks; application attack (malware); spear phishing attack; configuration attack; rooted or jailbroken compromise device; keylogging; and zero day or unknown attack.

0011Malware is software that is designed to engage in malicious behavior on a device and is currently regarded as the greatest threat to mobile phones. Malware can commonly perform actions without a user's knowledge such as making changes to the user's phone bill, sending unsolicited messages to the user's contact list, or giving an attacker remote control of the device. Malware can also be used to steal personal information from a mobile device. Currently much of the malware designed for mobile devices requires the user to download or install the software, but according to recent research, future mobile exploits will allow automatic malware installation. Mobile phones can be infected with malware through an open Bluetooth connection, short messaging service (SMS), multimedia messaging service (MMS) and downloadable applications.

0012Applications distributed through 'app stores' currently pose the greatest malware risk to all mobile operating systems and, according to the experts, will continue to do so in the future. While created as a means to distribute applications to mobile phone users, app stores provide an ideal transport mechanism for the delivery of malicious software to high volumes of mobile devices. Mobile operating system developers manage app stores. They include the Apple App Store, Android Market, Windows Marketplace for Mobile, Blackberry App World, or Nokia's Ovi Store; by known third- party organizations such as Amazon.com or by unknown third party companies. However, the way apps are set up and their relative lack of safeguards makes them soft targets for hackers. Furthermore, the companies that maintain the app stores make no guarantees about the safety or quality of the apps. Users download apps and install them at their own risk. For example, the Google Android platform has seen a 400 per cent increase in malware designed to steal user data since 2010, due to Google's relaxed vetting process where anyone can anonymously create and distribute malicious applications.

0013Another common threat to mobile phone devices is SMiShing. The terms refer to a security attack in which the user is sent an SMS posing as a legitimate service that tricks them into divulging personal information or downloading a virus. For example, a text message may be sent claiming that the recipient's bank account had been blocked and then asks for confirmation of the account details so that a new card could be sent out. Attackers often use email, texts and social networking sites to send links to phishing sites. There is indication that as more people access sensitive accounts and services from their mobile devices, it is expected to see an increase in phishing attacks launched from malware on devices.

0014Several systems and method that are deployed to facilitate vulnerability protection in mobile devices are known. U.S. Patent No. US <patcit id="pcit0001" dnum="US8582567B2"><text>US8582567B2</text></patcit>, System and method for providing network level and nodal level vulnerability protection in VoIP networks, discloses a system, method and apparatus for providing network level and nodal level vulnerability protection in VoIP networks by receiving a communication; filtering the received commumcation using three or more stages selected from the group comprising a media protection and filtering plane, a policy based filtering plane, a signature based filtering plane, a protocol anomaly detection and filtering plane and a behavioral learning based filtering plane; and either allowing or denying the received communication based the filtering step.

0015U.S. Patent Application <patcit id="pcit0002" dnum="US20150312272A1"><text>US20150312272 A1</text></patcit>, Protecting computing assets from resource intensive querying attacks discloses a method and system for managing data traffic and protecting computing assets. The method and system includes intercepting queries and messages, such as EDNS0 queries, and sending probe queries and reply queries to the originating computing device to determine whether the originating computing device may be sufficiently validated so as to justify forwarding resource-intensive queries and messages to the targeted computing device.

0016U.S. Patent Application <patcit id="pcit0003" dnum="US20130097706A1"><text>US 2013/0097706 A1</text></patcit>, A computer-networked system that allows mobile subscribers, and others, to submit mobile applications to be analyzed for anomalous and malicious behavior using data acquired during the execution of the application within a highly instrumented and controlled environment for which the analysis relies on per-execution as well. as comparative aggregate data across many such executions from one or more subscribers.

0017U.S. Patent Application <patcit id="pcit0004" dnum="US20150326587A1"><text>US2015/0326587A1</text></patcit>, A system including one or more "BotMagnet" modules that are exposed to infection by malicious code. The BotMagnets may include one or more virtual machines hosing operating systems in which malicious code may be installed and executed without exposing sensitive data or other parts of a network. In particular, outbound traffic may be transmitted to a Sinkhole module that implements a service requested by the outbound traffic and transmits responses to the malicious code executing within the BotMagnet. The Sinkhole module may implement a proxy mode in which traffic received by the Sinkhole module is transmitted to a destination specified in the traffic but modified to reference the Sinkhole as the source. Events occurring on the BotMagnet and Sinkhole are correlated and used to characterize the malicious code. The characterization may be transmitted to other computer systems in order to detect instances of the malicious code.

0018U.S. Granted Patent <patcit id="pcit0005" dnum="US9306962B1"><text>US9306962B1</text></patcit>, A system for classifying events on a computer network includes an event clustering engine for receiving event and log data related to identifiable actors from a security information and event management (SIEM) or log management module and selecting behavioral groupings of the event and log data. An affinity-based feature generation module assigns a value to each identifiable actor based on occurrences within predetermined time intervals of the identifiable actors having the selected behavioral grouping. A time-based weighting decay module applies a time decaying function to the assigned values for each identifiable actor. A feature engineering storage module stores information relating to the identifiable actors and their associated time-decayed values. A machine learning module generates a prediction model based on information received from the event clustering engine and the time-based weighting decay module, and the prediction model is utilized by a prediction engine on a computer to predict and classify received event and log data as malicious or non-malicious.

0019None of the current technologies and prior art, taken alone or in combination, either address or provide a truly integrated solution in a form of a signal interception and hacking prevention system and method that deploy an application executable to refrain unauthorized access to a user's mobile device and to facilitate bilateral integrated prevention and protection of the system. Unauthorized access via signal interception is not according to the invention and is present for illustration purposes only.

0020Therefore, there is a long felt and unmet need for a system and method that overcomes the problems associated with the prior art.

0021As used in the description herein and throughout the claims that follow, the meaning of "a," "an," and "the" includes plural reference unless the context clearly dictates otherwise. Also, as used in the description herein, the meaning of "in" includes "in" and "on" unless the context clearly dictates otherwise.

0022All methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The use of any and all examples, or exemplary language (e.g. "such as") provided with respect to certain embodiments herein is intended merely to better illuminate the invention and does not pose a limitation on the scope of the invention otherwise claimed. No language in the specification should be construed as indicating any non-claimed element essential to the practice of the invention.

0023Groupings of alternative elements or embodiments of the invention disclosed herein are not to be construed as limitations. Each group member can be referred to and claimed individually or in any combination with other members of the group or other elements found herein. One or more members of a group can be included in, or deleted from, a group for reasons of convenience and/or patentability. When any such inclusion or deletion occurs, the specification is herein deemed to contain the group as modified thus fulfilling the written description of all Markush groups used in the appended claims.

SUMMARY OF THE INVENTION

0024The invention is set out in the appended set of claims.

0025It is thus an object of the present invention to provide a computer-implemented method for preventing an unauthorized access via signal interception to a user's mobile device. Unauthorized access via signal interception is not according to the invention and is present for illustration purposes only The method comprising the steps of: installing an application executable on the user's mobile device to facilitate execution of a sequence of programmed instructions to perform at least one signal transmission between two or more users within a computer-based environment, said at least one signal transmission employs Real-time Transport Protocol (RTP); subsequently, automatically establishing an encrypted channel in a form of an SSL TLS connection between the user's mobile device and an encrypted access node; analyzing whether the at least one signal transmission between two or more users is directed to a known user within the same encrypted access node; if the at least one signal transmission between two or more users is directed to the known user within the same access node, establishing an SRTP session over the SSUTLS connection between the two or more users; if the at least one signal transmission between two or more users is directed to an unknown user within the same access node, denying at least one signal transmission, notifying the user via a mobile device user interface and decrypting at least one signal transmission, forwarding its streaming RTP media via Session Initiation Protocol (SIP) to a separate termination network server, said termination server is configured to retrieve destination ID number unwrapped from the SIP transmission and in turn initiate public switched telephone network (PSTN) transmission to the destination ID number.

0026It is another object of the present invention to provide a computer-implemented method for preventing an unauthorized access via hacking to a user's mobile device, the method comprising the steps of: installing an application executable on the user's mobile device to facilitate a detection engine to perform analysis of at least one signal transmission between two or more users within a computer-based environment; continuously analyzing and detecting an execution anomaly in real-time user's mobile device system parameters and/or system execution of sequence of programmed instructions within a computer-based environment; enacting predetermined risk-based policies to continuously facilitate detection of an attack on the mobile device; and storing and facilitating forensic data to indicate a source of the attack.

0027It is another object of the present invention to provide a computer-implemented system preventing an unauthorized access via signal interception to a user's mobile device. Unauthorized access via signal interception is not according to the invention and is present for illustration purposes only. The system comprising: one or more processors; and a memory system communicatively coupled to the one or more processors, the memory system comprises executable instructions including: installing an application executable on the user's mobile device to facilitate execution of sequence of programmed instructions to perform at least one signal transmission between two or more users within a computer-based environment, said at least one signal transmission employs Real-time Transport Protocol (RTP); subsequently, automatically establishing an encrypted channel in a form of SSL TLS connection between the user's mobile device and an encrypted access node; analyzing whether the at least one signal transmission between two or more users is directed to a known user within the same encrypted access node; if the at least one signal transmission between two or more users is directed to the known user within the same access node, establishing SRTP session over the SSIJTLS connection between the two or more users; if the at least one signal transmission between two or more users is directed to an unknown user within the same access node , denying at least one signal transmission, notifying the user via a mobile device user interface and decrypting at least one signal transmission, forwarding its streaming RTP media via Session Initiation Protocol (SIP) to a separate termination network server, said termination server is configured to retrieve destination ID number unwrapped from the SIP transmission and in turn initiate public switched telephone network (PSTN) transmission to the destination ID number.

0028It is another object of the present invention to provide a computer-implemented system preventing an unauthorized access via hacking to a user's mobile device, the system comprising: one or more processors; and a memory system communicatively coupled to the one or more processors, the memory system comprises executable instructions including: installing an application executable on the user's mobile device to facilitate a detection engine to perform analysis of at least one signal transmission between two or more users within a computer-based environment; continuously analyzing and detecting execution anomaly in realtime user's mobile device system parameters and/or system execution of sequence of programmed instructions within a computer-based environment; enacting predetermined risk- based policies to continuously facilitate detection of an attack on the mobile device; and storing and facilitating forensic data to indicate a source of the attack.

0029The details of one or more embodiments are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.

BRIEF DESCRIPTION OF THE PREFERRED EMBODIMENTS

0030The novel features believed to be characteristics of the invention are set forth in the appended claims. The invention itself, however, as well as the preferred mode of use, further objects and advantages thereof, will best be understood by reference to the following detailed description of illustrative embodiment when read in conjunction with the accompanying drawings. In order to better understand the invention and its implementation in practice, a plurality of embodiments will now be described, by way of non-limiting example only, with reference to the accompanying drawings, in which the following embodiments, as shown in <figref idref="f0001">Figs. 1</figref>, <figref idref="f0002">2</figref>, <figref idref="f0005">5</figref>, <figref idref="f0006">6</figref> and 7A-B, comprising prevention of unauthorized access via signal interception, are not according to the invention and are present for illustration purposes only and in which <ul id="ul0001" list-style="none"><li><figref idref="f0001">FIG. 1</figref> illustrates a method for preventing a third-party interception of a voice or text signal transmitted from a secure a device and addressed to one or more non-secured devices, according to some embodiments of the present invention.</li><li><figref idref="f0002">FIG. 2</figref> illustrates a method for preventing a third-party interception of a voice or text signal received by a secure a device, originating from a non-secured device, according to some embodiments of the present invention.</li><li><figref idref="f0003">FIG. 3</figref> illustrates a method for protecting a secured device from access via hacking, according to some embodiments of the present invention;</li><li><figref idref="f0004">FIG. 4</figref> illustrates an example of a computerized environment for implementing the invention according to a preferred embodiment;</li><li><figref idref="f0005">FIG. 5</figref> illustrates a system for preventing signal interception and hacking of a secured device, according to some embodiments of the present invention.</li><li><figref idref="f0006">FIG. 6</figref> illustrates an operating environment and elements of a system for preventing a third-party interception of a voice or text signal transmitted from a secure a device and addressed to one or more non-secured devices, and/or of a voice or text signal received by a secure a device and originating from a non-secured device, according to some embodiments of the present invention.</li><li>FIG 7A illustrates a configuration of a system for a system for preventing a third-party interception of a voice or text signal transmitted from a secure a device and addressed to one or more non-secured devices, according to some embodiments of the present invention.</li><li>FIG 7B illustrates a configuration of a system for preventing a third-party interception of a voice or text signal received by a secure a device, originating from a non-secured device, according to some embodiments of the present invention.</li><li><figref idref="f0007">FIG. 8</figref> illustrates a typical configuration of hacking attacks.</li><li><figref idref="f0008">FIG. 9</figref> illustrates an example of a system for preventing a secured device from unauthorized access via hacking, according to some embodiments of the present invention.</li><li><figref idref="f0009">FIG. 10</figref> illustrates an example of a neural network used by a detection engine in a system according.</li></ul>

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

0031In the following detailed description of the preferred embodiments, reference is made to the accompanying drawings that form a part hereof, and in which are shown by way of illustration specific embodiments in which the invention may be practiced. It is understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention. The present invention may be practiced according to the claims without some or all of these specific details. The following aspects comprising prevention of unauthorized access via signal interception are not according to the invention and are present for illustration purposes only. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the present invention is not unnecessarily obscured.

0032Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

0033While the technology will be described in conjunction with various embodiment(s), it will be understood that they are not intended to limit the present technology to these embodiments. On the contrary, the present technology is intended to cover alternatives, modifications and equivalents, which may be included within the scope of the various embodiments as defined by the appended claims.

0034Furthermore, in the following description of embodiments, numerous specific details are set forth in order to provide a thorough understanding of the present technology. However, the present technology may be practiced without these specific details. In other instances, well known methods, procedures, components, and circuits have not been described in detail as not to unnecessarily obscure aspects of the present embodiments.

0035Unless specifically stated otherwise as apparent from the following discussions, it is appreciated that throughout the present description of embodiments, discussions utilizing terms such as "transferring", "detecting," "calculating", "processing", "performing," "identifying," "configuring" or the like, refer to the actions and processes of a computer system, or similar electronic computing device. The computer system or similar electronic computing device manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission, or display devices, including integrated circuits down to and including chip level firmware, assembler, and hardware based micro code.

0036As will be explained in further detail below, the technology described herein relates to protection of mobile device computer systems from malicious activity of unauthorized access via signal interception and/or hacking of the device. More particularly, the present invention discloses signal interception and hacking prevention systems and methods that deploy an application executable to refrain unauthorized access to a user's mobile device to facilitate bilateral integrated prevention and protection of the system.

0037The term "mobile device/mobile phone" interchangeably refers, but not limited to any communication device configured to operate within mobile phone systems as hybrid (wireless/wire-lined) communication systems. The connection between the mobile phone and the serving unit (base station) uses wireless communication. Base stations are connected to a sophisticated switching center (mobile switching center) through optical fibers or microwave links. The connection between the base station and the mobile switching center might be direct or through a controlling unit called a base station controller. The mobile switching center connects the mobile phones to other mobile phones or to fixed phones through the public phone network. The connections between the base stations, base station controllers, the mobile switching center, and the public switching telephone network usually use optical fiber or microwave links. The connections between the mobile phones and the base stations constitute the radio access node, while the connections between the base station and the mobile switching centers and between the mobile switching centers to each other and to the public switching telephone network constitute the core network (the fixed network). Early mobile phone systems such as the first generation system (advanced mobile phone system (AMPS)) used analog signal representation and processing. AMPS is the mobile phone system standard developed by Bell Labs, and officially introduced, after the approval of the Federal Communications Commission (FCC), in the Americas in 1983 and Australia in 1987. During the 1980s and into the 2000s, it was the technology that was in vogue in North America and other localities. Such analog mobile phone systems could be intercepted easily using radio receivers called frequency scanners. Second generation systems moved to the digital era but with only voice communication and some sort of data communications as in Global system for mobile communication (GSM), code division multiple access (CDMA) (also known as IS-95 or cdmaONE) and digital AMPS (D-AMPS) (also known as TDMA, IS-54 or IS-136). One of the many advantages of the digital mobile phone systems is the ability of encrypting signals for better privacy and security. Advances in mobile technology led to the proliferation of third generation (3G) systems with added features like multimedia communication, mobile commerce, etc. Third generation systems (also known as cdma2000 and UMTS) are based on CDMA technology. AMPS and D-AMPS are now obsolete. Mobile phone operators provide mainly two systems: GSM and CDMA (cdmaONE, cdma2000, or UMTS). Different mobile phone systems vary widely in system design and underlying technology. However, all second and third generation mobile phone systems try to offer high levels of security and privacy to the user through user authentication, signal encryption and user anonymity. Nevertheless, these techniques, unfortunately, do not guarantee the privacy of mobile users.

0038The term "AES" refers to Advanced Encryption Standard, a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST).

0039The term "antivirus" interchangeably refers, but not limited to software that is used to prevent, detect, and remove malware, including but not limited to viruses, worms, trojans, spyware, and adware.

0040The term "APK" interchangeably refers, but not limited to Android Package (e.g., "filename.apk"), a packaging file format for the Android mobile operating system.

0041The term "botnet" interchangeably refers, but not limited to a collection of software agents, robots, or "zombies" that run autonomously and automatically, typically overtaken by hackers to perform malicious operations.

0042The term "buffer overflow" interchangeably refers, but not limited to (also known as buffer overrun) an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory. Buffer overflows can be triggered by inputs that are designed to execute code or alter the way the program operates. This may result in erratic program behavior, including memory access errors, incorrect results, a crash, or a breach of system security.

0043The term "Denial of Service (DoS)" interchangeably refers, but not limited to an attack which attempts to make a computer or mobile device resource unavailable to its intended users or for its intended use.

0044The term "Data Encryption Standard (DES)" interchangeably refers, but not limited to a block cipher that uses shared secret encryption.

0045The term "Hypertext Transfer Protocol (HTTP)" interchangeably refers, but not limited to a networking protocol for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web.

0046The term "encrypted signal" refers to a signal encrypted by a method or system of the invention. Likewise, an "unencrypted signal" is a signal that is not encrypted by a method or system of the invention.

0047The term "jailbroken" interchangeably refers, but not limited to an Apple iPhone or iPad that has had its Apple iOS operating system covertly "unlocked" to gain full root access, removing all Apple imposed limitations on applications, and essentially exposing all of an application's features.

0048The term "keylogging" interchangeably refers, but not limited to keystroke logging or the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that actions are being monitored. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis.

0049The term "malicious network access" refers to access of a network available either at layers 1 and 2 through interception of an accessible signal (for example, a WiFi signal) or at layers 3 and/or higher through hacking of a client device.

0050The term "malware" interchangeably refers, but not limited to malicious software, a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.

0051The term "Multimedia Messaging Service (MMS)" interchangeably refers, but not limited to a standard way to send messages that include multimedia content to and from mobile devices. MMS extends the core SMS capability that allows exchange of text messages only up to 160 characters in length.

0052The term "phishing" interchangeably refers, but not limited to a way of attempting to acquire sensitive information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social websites, auction sites, online payment processors, or ┌┌ administrators are commonly used to lure unsuspecting users.

0053The term "rootkit" interchangeably refers, but not limited to malware that lurks camouflaged from anti-malware software and administrators by circumventing or interrupting standard operating system or other application functionality, allowing unseen and unwanted privileged access to a device.

0054The term "RTF' refers to Real-time Transport Protocol, a network protocol for delivering audio and video over IP networks.

0055The term "RTCF' refers to RTP Control Protocol (standard RFC-3550), a sister protocol of the Real-time Transport Protocol (RTP). RTCP provides out-of-band statistics and control information for an RTP session.

0056The term "sandbox" interchangeably refers, but not limited to a security mechanism for separating running programs.

0057The term "Secure Shell (SSH)" interchangeably refers, but not limited to a network protocol that allows data to be exchanged using a secure channel between two networked devices. The two major versions of the protocol are referred to as SSH1 (or SSH-1), and SSH2 (or SSH-2). Used primarily on Linux and Unix-based systems to access shell accounts, SSH was designed as a replacement for Telnet and other insecure remote shells, which send information, notably passwords, in plain text, rendering them susceptible to packet analysis.

0058The term "spyware" interchangeably refers, but not limited to a type of malware that collects information and makes it available, usually secretly, to a third party. The presence of spyware is typically hidden from the user and can be difficult to detect.

0059The term "SASL" refers to Simple Authentication and Security Layer (standard RFC 4422), a framework for authentication and data security in Internet protocols. It decouples authentication mechanisms from application protocols, in theory allowing any authentication mechanism supported by SASL to be used in any application protocol that uses SASL.

0060The term "SHA-1" refers to Secure Hash Algorithm 1 (standard RFC-3174), a cryptographic hash function designed by the United States National Security Agency and is a U.S. Federal Information Processing Standard published by the United States NIST. SHA-1 produces a 160-bit hash value known as a message digest. A SHA-1 hash value is typically rendered as a hexadecimal number, 40 digits long.

0061The term "SSL" refers to Secure Sockets Layer, the standard technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers.

0062The term "SRTF' refers to Secure Real-time Transport Protocol, which defines a profile of RTP (Real-time Transport Protocol), intended to provide encryption, message authentication and integrity, and replay protection to the RTP data.

0063The term "TLS/SSL" refers to Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), both of which are frequently referred to as "SSL." They are cryptographic protocols that provide communications security over a computer network.

0064The term "trojan" interchangeably refers, but not limited to software that appears to perform a desirable function while containing malicious and/or undesirable elements.

0065The term "virus definition/signature" interchangeably refers, but not limited to a unique string of bits, or the binary pattern of the machine code of a virus. The term "virus definitions" also typically refers to the database of all current virus signature files used by a particular antivirus software for virus detection. Virus definitions are the primary method of detection for most antivirus software programs.

0066The term "Wireless Application Protocol (WAP)" interchangeably refers, but not limited to an open international standard; commonly used Web browser for small mobile devices such as cell phones or smartphones.

0067The term "XEP-0078" refers to a protocol for authentication with a Jabber/Xabber server, using the SHA1 algorithm.

0068The term "zombie" interchangeably refers, but not limited to an Internet connected mobile device that has been compromised by a virus or trojan that can be used to perform malicious tasks under remote direction, usually from a botnet.

0069The term "end-point (mobile) device" interchangeably refers, but not limited to computers ("machines" and "computers" are used interchangeably herein) and computing or computer systems (for example, physically separate locations or devices), computer and computerized devices, processors, processing systems, computing cores (for example, shared devices), and similar systems, modules and combinations of the aforementioned, servers in a form of a remote computer or remote computer system, or computer program therein, that is accessible over a communications medium, such as a communications network including the Internet, that provides services to other computer programs (and their users), in the same or other computers. A server may also include a virtual machine, a software based emulation of a computer, and/or hardware based emulation (such as VMWare ESXi servers).

0070While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof have been shown by way of example in the drawings and the above detailed description. It should be understood, however, that it is not intended to limit the invention to the particular forms disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the scope of the invention as defined by the appended claims.

PREFERRED EMBODIMENTS

0071The following embodiments comprising prevention of unauthorized access via signal interception are not according to the invention and is present for illustration purposes only.

0072A method 100 for preventing a third-party interception of a voice or text signal transmitted from a secure a device and addressed to one or more non-secured devices, according to some embodiments of the invention, is illustrated in <figref idref="f0001">FIG. 1</figref>.

0073In the method 100, an anti-interception application is first installed on a device to be secured 102. A secured device is typically a mobile device such as cellular phone, a smart phone, or a tablet computer; but can be a digital desk phone that is either connected to a packet-switched or circuit switched network. Where the device is connected to a circuit-switched network (e.g. a PSTN), the device will include, for example a POTS telephone connected to the PSTN through a modem apparatus.

0074The secured device, with the installed anti-interception application, encrypts voice or text data into an encrypted signal 104 and transmits the encrypted signal over a secured line 106. The encryption can be performed according to SRTP over TLS/SSL protocolThe secured line can be wired or wireless, such as a secured WiFi connection.

0075The transmitted encrypted signal remains encrypted, until received by an encrypted access node 108. The encrypted access node decrypts the encrypted signal 110 and sends a decrypted signal to a termination gateway.

0076The termination gateway receives the decrypted signal 112 and conditionally converts the decrypted signal 114. That is, if the secured (sending) device is connected to a PSTN network, the termination gateway converts the decrypted signal from a PSTN protocol to a packet- switched protocol for each unsecured (receiving) device connected to a packet-switched network.

0077If the secured device is connected to a packet-switched network, the termination gateway converts the decrypted signal from a packet-switched protocol to a PSTN protocol for each non-secured device that is connected to a PSTN network.

0078The termination gateway retransmits the decrypted, conditionally converted signal 116. The retransmitted signal is received by one or more non-secured devices over a clear line 118. Like the secured device, each of the non-secured (receiving) devices can a mobile device or digital desk phone. Furthermore, as indicated, the receiving device can be connected via either a packet-switched network or PSTN. Therefore, a user speaking or texting from a secured device can have the ability to communicate with any phone in the world- not necessarily a protected phone-while the protected phone remains secure from interception of signals it transmits.

0079Reference is now made to <figref idref="f0002">FIG. 2</figref>, illustrating a method 150 for preventing a third-party interception of a voice or text signal received by one or more secured devices, originating from a non-secured device.

0080In the method 150, an anti-interception application is first installed on one or more devices to be secured 152, which, as described in method 100 can be mobile device or a digital desk phone, and on a packet-switched or circuit-switched network.

0081A non-secured device transmits an unencrypted signal over a clear line 154. A termination gateway receives the unencrypted signal 156 and conditionally converts the unencrypted signal 158. That is, if the non-secured (sending) device is connected to a PSTN network, the termination gateway converts the unencrypted signal from a PSTN protocol to a packet- switched protocol for each secured (receiving) device connected to a packet-switched network.

0082If the non-secured device is connected to a packet-switched network, the termination gateway converts the unencrypted signal from a packet-switched protocol to a PSTN protocol for each secured device that is connected to a PSTN network.

0083The termination gateway retransmits the unencrypted, conditionally converted signal 160. The retransmitted signal is received and encrypted by an encrypted access node 162.

0084The secured device receives the encrypted signal 164 and with the anti-interception application decrypts the encrypted signal 166.

0085Both the secured devices and non-secured device can each be a mobile device or a digital desk phone, which can be connected to a packet switched or PSTN network. Therefore, a user listening or receiving text from a secured device can have the ability to communicate with any phone in the world- not necessarily a protected phone- while the protected phone remains secure from interception of signals it receives.

0086(In both methods 100 and 150, the decrypted or unencrypted signal is usually not modified by the termination gateway if the sending and receiving devices are both on a packet switched network or both on a PSTN network.)

0087Methods 100 and 150 may be combined, providing bidirectional protection from third-party signal interception of a secured device. The combined anti-interception application contains the features of both the anti-interception application of method 100 and of method 150.

0088Reference is now made to <figref idref="f0003">FIG. 3</figref>, illustrating a method 200 for protecting a secured device connected to one or more networks from access via hacking.

0089In the method 200, an anti-hacking application is installed on the secured device 201. The anti- hacking application effects steps for securing the secured device from hacking attacks.

0090A timestamping module receives system calls and network calls of the secured device 202. The timestamped system calls and network calls are received by a correlation module that packages the timestamped system and network calls into an input vector 206. Additionally, the correlation module receives lists of permissions (e.g., from a permissions database) for applications on the secured device 208. The correlation module computes parameters of the system calls and network calls 210. These parameters can include, but are not limited to, a difference in time values of the timestamp of a system call and said network call; correspondence of a system call or a network call with a privilege pertaining to an application making the system call or network call; a validity of a certificate attached to a network call; or any combination thereof. The correlation engine further packages the parameters into the input vector 212.

0091A neural network receives input vector 214 and determines, based on learned behavior, whether system and network calls are valid and therefore approved, or whether they are suspected as being part of hacking activity 216.

0092The approved and suspected system/network calls are fed to two output streams: an appoved output and a suspected output 218.

0093Suspected outputs are received by a mitigation rules engine 220. The mitigation rules engine determines an appropriate mitigating action , such as disconnecting from one of the networks, invalidating a transmission session, destroying the access keys and/or deleting the system cache; notifying the user by raising an unauthorized access alert; automatically activating a three factor authentication stage; downgrading accessibility and functionality of files to readonly; accessing said network through a VPN; or any combination thereof.

0094Methods 100, 150, and 200 may be combined in any combination, with installed software appropriately integrated according to the which methods are to be combined. For example, a complete method will protect a secured device from interception of both incoming and outgoing voice and text as well as from hacking.

0095Reference is made now to <figref idref="f0004">FIG. 4</figref> which illustrates, according to an embodiment of the present invention, an example of a computerized system for implementing the invention 300. The systems and methods described herein can be implemented in software or hardware or any combination thereof. The systems and methods described herein can be implemented using one or more computing devices which may or may not be physically or logically separate from each other. Additionally, various aspects of the methods described herein may be combined or merged into other functions.

0096In some embodiments, the illustrated system elements could be combined into a single hardware device or separated into multiple hardware devices. If multiple hardware devices are used, the hardware devices could be physically located proximate to or remotely from each other.

0097The methods can be implemented in a computer program product accessible from a computer- usable or computer-readable storage medium that provides program code for use by or in connection with a computer or any instruction execution system. A computer-usable or computer-readable storage medium can be any apparatus that can contain or store the program for use by or in connection with the computer or instruction execution system, apparatus, or device.

0098A data processing system suitable for storing and/or executing the corresponding program code can include at least one processor coupled directly or indirectly to computerized data storage devices such as memory elements. Input/output (I/O) devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the system. Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. To provide for interaction with a user, the features can be implemented on a computer with a display device, such as an LCD (liquid crystal display), touch-screen; or touch-pad, virtual display, or another type of monitor for displaying information to the user, and a keyboard and an input device, such as a mouse or trackball by which the user can provide input to the computer.

0099A computer program can be a set of instructions that can be used, directly or indirectly, in a computer. The systems and methods described herein can be implemented using programming languages such as C, C++, Assembly, C#^™, JAVA^™, Flash^™ ActionScript, Visual Basic^™, JavaScript^™, PHP, Python, XML, HTML, etc. or a combination of programming languages, including compiled or interpreted languages, and can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. The software can include, but is not limited to, firmware, resident software, microcode, etc. Protocols such as TCP/UDP/ICMP HTTP DNS/SOAP may be used in implementing interfaces between programming modules. The components and functionality described herein may be implemented on any desktop operating system executing in a virtualized or non-virtualized environment, using any programming language suitable for software development, including, but not limited to, different versions of Microsoft Windows^™, Apple^™ Mac^™, iOS^™, Google^™ Android^™, Unix^™X- Windows^™, Windows Mobile^™, Windows Phone^™, Linux^™, etc.

0100The processing system can be in communication with a computerized data storage system. The data storage system can include a non-relational or relational data store, such as a MySQL^™ or other relational database. Other physical and logical database types could be used. The data store may be a database server, such as Microsoft SQL Server^™, Oracle^™, IBM DB2^™, SQLITE^™, or any other database software, relational or otherwise. The data store may store the information identifying syntactical tags and any information required to operate on syntactical tags. In some embodiments, the processing system may use object-oriented programming and may store data in objects. In these embodiments, the processing system may use an object-relational mapper (ORM) to store the data objects in a relational database. The systems and methods described herein can be implemented using any number of physical data models. In one example embodiment, an RDBMS can be used. In those embodiments, tables in the RDBMS can include columns that represent coordinates. In the case of environment tracking systems, data representing user events, virtual elements, etc. can be stored in tables in the RDBMS. The tables can have pre-defined relationships between them. The tables can also have adjuncts associated with the coordinates.

0101Suitable processors for the execution of a program of instructions include, but are not limited to, general and special purpose microprocessors, and the sole processor or one of multiple processors or cores, of any kind of computer. A processor may receive and store instructions and data from a computerized data storage device such as a read-only memory, a random access memory, both, or any combination of the data storage devices described herein. A processor may include any processing circuitry or control circuitry operative to control the operations and performance of an electronic device.

0102The processor may also include, or be operatively coupled to communicate with, one or more data storage devices for storing data. Such data storage devices can include, as non-limiting examples, magnetic disks (including internal hard disks and removable disks), magneto-optical disks, optical disks, read-only memory, random access memory, and/or flash storage. Storage devices suitable for tangibly embodying computer program instructions and data can also include all forms of non-volatile memory, including, for example, semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, ASICs (application-specific integrated circuits).

0103The systems, modules, and methods described herein can be implemented using any combination of software or hardware elements. The systems, modules, and methods described herein can be implemented using one or more virtual machines operating alone or in combination with each other. Any applicable virtualization solution can be used for encapsulating a physical computing machine platform into a virtual machine that is executed under the control of virtualization software running on a hardware computing platform or host. The virtual machine can have both virtual system hardware and guest operating system software.

0104The systems and methods described herein can be implemented in a computer system that includes a back-end component, such as a data server, or that includes a middleware component, such as an application server or an Internet server, or that includes a front-end component, such as a client computer having a graphical user interface or an Internet browser, or any combination of them. The components of the system can be connected by any form or medium of digital data communication such as a communication network. Examples of communication networks include, e.g., Bluetooth, Wi-Fi, GSM, CDMA, 2g, 3g, UMTS, LTE, WiMAX, ZigBee and alike, a LAN, a WAN, and the computers and networks that form the Internet.

0105One or more embodiments of the invention may be practiced with other computer system configurations, including hand-held devices, microprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, etc. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a network.

0106Embodiments within the scope of the present disclosure also include physical and other computer-readable media for carrying or storing computer-executable instructions and/or data structures. In particular, one or more of the processes described herein may be implemented at least in part as instructions embodied in a non-transitory computer-readable medium and executable by one or more computing devices (e.g., any of the media content access devices described herein). In general, a processor (e.g., a microprocessor) receives instructions, from a non-transitory computer-readable medium, (e.g., a memory, etc.), and executes those instructions, thereby performing one or more processes, including one or more of the processes described herein.

0107Computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer system. Computer-readable media that store computer-executable instructions are non-transitory computer-readable storage media (devices). Computer-readable media that carry computer-executable instructions are transmission media. Thus, by way of example, and not limitation, embodiments of the disclosure can comprise at least two distinctly different kinds of computer-readable media: non-transitory computer-readable storage media (devices) and transmission media.

0108Non-transitory computer-readable storage media (devices) includes RAM, ROM, EEPROM, CD-ROM, solid state drives ("SSDs") (e.g., based on RAM), Flash memory, phase-change memory ("PCM"), other types of memory, other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer.

0109A "network" is defined as one or more data links that enable the transport of electronic data between computer systems and/or modules and/or other electronic devices. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or a combination of hardwired or wireless) to a computer, the computer properly views the connection as a transmission medium. Transmissions media can include a network and/or data links which can be used to carry desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer. Combinations of the above should also be included within the scope of computer-readable media.

0110Further, upon reaching various computer system components, program code means in the form of computer-executable instructions or data structures can be transferred automatically from transmission media to non-transitory computer-readable storage media (devices) (or vice versa). For example, computer-executable instructions or data structures received over a network or data link can be buffered in RAM within a network interface module (e.g., a "NIC"), and then eventually transferred to computer system RAM and/or to less volatile computer storage media (devices) at a computer system. Thus, it should be understood that non-transitory computer-readable storage media (devices) could be included in computer system components that also (or even primarily) utilize transmission media.

0111Computer-executable instructions comprise, for example, instructions and data which, when executed at a processor, cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. In some embodiments, computer-executable instructions are executed on a general-purpose computer to turn the general-purpose computer into a special purpose computer implementing elements of the disclosure. The computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, or even source code. Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the described features or acts described above. Rather, the described features and acts are disclosed as example forms of implementing the claims.

0112Those skilled in the art will appreciate that the disclosure may be practiced in network computing environments with many types of computer system configurations, including, personal computers, desktop computers, laptop computers, message processors, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile telephones, PDAs, tablets, pagers, watches, routers, switches, and the like. The disclosure may also be practiced in distributed system environments where local and remote computer systems, which are linked (either by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) through a network, both perform tasks. In a distributed system environment, program modules may be located in both local and remote memory storage devices.

0113Reference is now made to <figref idref="f0005">FIG. 5</figref>, illustrating a combined system 10 for preventing signal interception and hacking. The system 10 comprises a signal interception prevention module 14 and a hacking prevention module 18. The system further comprises software loaded on the memory of a secured device 12. The two modules are described herein as separate systems. The system 10 provides protection to the secured device from interception of incoming and/or outgoing voice/text communication with one or more unsecured devices 16, as well as protection from hacking over a network 20.

0114Reference is now made to <figref idref="f0006">FIG 6</figref>, illustrating an operating environment and elements of a system 30 for preventing a third-party interception of a voice or text signal transmitted from a secure a device 32a-c and addressed to one or more non-secured devices 36a-c, and/or system 31 for preventing a third-party interception of a voice or text signal received by one or more secure devices 32a-c and originating from a non-secured device 36a-c, according to some embodiments of the present invention. In both systems, secured and non-secured devices are connected to a phone system and can be any of a mobile device 32a, 36a, such as a cellular phone, smart phone, or tablet computer, connected to a cellular cloud 44; an IP telephone 32b, 36b connected to the phone system thorough an IP cloud 46; or a POTS phone with a modem apparatus 32c, 36c connected to the phone system through a PSTN cloud 48.

0115In system 30, an anti-interception application is installed on a secured device 32a-c. The secured device 32a-c transmits voice and text signals (e.g., data packets) addressed to one or more non-secured devices 36a-c: the application encrypts the and the encrypted signal is transmitted user over an encrypted access line 34, which can be wired or wireless. An encrypted access node 38 receives and decrypts the encrypted signal. A termination gateway 40 is receives the decrypted signal.

0116The termination gateway 40 is conditionally converts the decrypted signal, as follows: if the secured device [32c] is connected to a PSTN network and one of the non-secured devices [36a-b] is connected to a packet-switched network, termination gateway 40 converts the decrypted signal from a PSTN protocol to a packet-switched protocol; if the secured device [32a-b] is connected to a packet-switched network, the non-secured device [36c] is connected to a PSTN network, to convert said signal from a packet-switched protocol to a PSTN protocol; the termination gateway 40 retransmits the decrypted, conditionally converted signal. The retransmitted signal is received by one or more non-secured devices [36a-c] are configured to receive said retransmitted signal a over a clear access line [42].

0117Reference is now made to <figref idref="f0009">FIG. 10</figref>, which is a schematic illustration of an example of the neural network 600 used by the detection engine. Inputs in that scheme refer to system call and network calls, the output creates the "normal working curve" of the device; The application is configured to receive access privileges upon initial scanning of the at least one communication device wherein the network is configured to operate under conditions wherein the inputs are the system calls data, the networks calls data 602, whether the privileges of all applications are installed data, and time stamp data, transferred via hidden intermediate states 604 and wherein the outputs are "good" or "not good" 606, deterministic and/or with a reference value to state the level of correlation, whether definite and/or in scale.

0118In the description of embodiments, reference is made to the accompanying drawings that form a part hereof, which show by way of illustration specific embodiments of the claimed subject matter. It is to be understood that other embodiments may be used and that changes or alterations, such as structural changes, may be made. Such embodiments, changes or alterations are not necessarily departures from the scope with respect to the intended claimed subject matter. While the steps herein may be presented in a certain order, in some cases the ordering may be changed so that certain inputs are provided at different times or in a different order without changing the function of the systems and methods described. The disclosed procedures could also be executed in different orders. Additionally, various computations that are herein need not be performed in the order disclosed, and other embodiments using alternative orderings of the computations could be readily implemented. In addition to being reordered, the computations could also be decomposed into sub-computations with the same results.