Nortonlifelock Inc.

Symantec Corporation

Gen Digital Inc.

Sharad Subhash Mhaske

Shrikant Pawar

Anand Darak

Anuradha Joshi

Arif Mohammed Shaikh

Lei Gu

Nikhil Nishikant Joshi

The disclosed computer-implemented method for authenticating application points of entry to prevent unauthorized use of locked mobile applications may include (i) identifying one or more mobile applications having an access restriction and a group of application entry points associated with at least one mobile application function, (ii) intercepting a series of device inputs from a user for accessing the application entry points to bypass the access restriction for the mobile applications, (iii) requesting authentication credentials to bypass the access restriction from the application entry points, (iv) determining that the requested authentication credentials are invalid, and (v) performing a security action that protects against potentially malicious activity associated with unauthorized access to the mobile applications upon determining that the requested authentication credentials are invalid. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for authenticating application points of entry to prevent unauthorized use of locked mobile applications

The disclosed computer-implemented method for proactive call spam/scam protection may include intercepting network traffic by the at least one processor employing a network extension feature of an operating system of a computing device. The method may additionally include capturing, by the at least one processor employing the network extension feature, a phone number in the network traffic. The method may also include comparing, by the at least one processor employing the network extension feature, the phone number to a plurality of entries in a spam/scam repository. The method may further include performing, by the at least one processor, a security action in response to the comparison. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for proactive call spam/scam protection using network extensions

The disclosed computer-implemented method for increasing cybersecurity protection may include (i) receiving, at a subscription-management computing device, an alert indication that indicates (A) a cybersecurity status score on a protected computing device is lower than a threshold value and (B) the protected computing device is associated with an expired subscription to a cybersecurity service and (ii) performing, responsive to receiving the alert indication, a security action comprising sending, from the subscription-management computing device to a server, a transfer instruction directing the server to transfer, to the protected computing device, at least a portion of a duration of a valid subscription to the cybersecurity service. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for increasing cybersecurity protection

Routing server communications through a nearby mobile device. In some embodiments, the method may include establishing a direct communication channel between the first mobile device and the second mobile device, determining which of the first mobile device and the second mobile device is currently a more efficient mobile device that is able to communicate with a server device more efficiently, sending a first server query from the less efficient mobile device to the more efficient mobile device over the direct communication channel, forwarding the first server query from the more efficient mobile device to the server device over the Internet, receiving a first server response at the more efficient mobile device from the server device over the Internet, and forwarding the first server response from the more efficient mobile device to the less efficient mobile device over the direct communication channel.

Routing server communications through a nearby mobile device

Employing beacon messages to restart an application on a mobile device. In some embodiments, a method may include subscribing, at the secondary mobile device, to a beacon publisher of the primary mobile device. The method may also include determining, based on historical location data, that the primary mobile device is likely within range of the secondary mobile device for beacon communication therebetween. The method may further include activating, at the primary mobile device, the beacon publisher. The method may also include publishing, at the primary mobile device, a beacon message configured to cause a secondary mobile application on the secondary mobile device to restart. The method may further include receiving, at the secondary mobile device, the beacon message. The method may also include, in response to receiving the beacon message, restarting, at the secondary mobile device, the secondary mobile application of the secondary mobile device.

Employing beacon messages to restart an application on a mobile device

The disclosed computer-implemented method for detecting and preventing auto-click attacks may include (1) detecting, by the computing device, a click input, (2) detecting, by the computing device, a finger in proximity to the computing device, (3) analyzing, by the computing device, at least one event associated with the finger, (4) determining, by the computing device, that the click input is an auto-click based on the analysis of the at least one event associated with the finger, and (5) performing a security action in response to determining that the click input is an auto-click. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods to detect and prevent auto-click attacks

The disclosed computer-implemented method for detecting unauthorized use of an application may include (1) receiving, by the computing device, fingerprint data associated with a fingerprint, where the fingerprint data is received from the touchscreen, when a user interface of the application is displayed on the touchscreen, and in an absence of displaying a request for fingerprint data on the touchscreen, (2) comparing the received fingerprint data to a whitelist of authorized fingerprint data to determine a presence of a match, where the authorized fingerprint data indicates at least one fingerprint of at least one user that is authorized to access the application and (3) performing, when the received fingerprint data does not match the whitelist of authorized fingerprint data, a security action. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting unauthorized use of an application

The disclosed computer-implemented method for enforcing age-based application constraints may include (1) receiving a selection of age-based use constraints to be associated with one or more applications installed on the computing device, (2) associating the age-based use constraints with the applications, (3) determining that a user attempting to access the applications does not meet the age-based use constraints, and (4) performing a security action that restricts user access to the applications when the user does not meet the age-based use constraints. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for enforcing age-based application constraints

The disclosed computer-implemented method for recovering an infected endpoint may include receiving an acoustic signal having an embedded command for executing a security application at the infected endpoint, decoding the acoustic signal to obtain the embedded command, and executing the embedded command to start a security application at the infected endpoint, where the security application is operable to mitigate the infected endpoint. Various other methods, systems and computer-readable media are also disclosed.

Systems and methods for recovering an infected endpoint

The disclosed computer-implemented method for system recovery from a system user interface process malfunction may include (i) determining that a system user interface (UI) process is executing on the computing device, (ii) determining that a message indicating a malfunction of the system UI process is displayed on the computing device, (iii) identifying a mobile application that was executing on the computing device at a time of the malfunction of the system UI process, and (iv) in response to identifying the mobile application that was executing at the time of the malfunction of the system UI process, performing a security action for recovery from the malfunction of the system UI process. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for system recovery from a system user interface process malfunction

Methods and systems are provided for preventing the installation of malicious applications using system-level messages. One example method generally includes intercepting a request sent via an operating system of the computing device; determining the request is to access an application in a remote application repository; obtaining information associated with the application from the request; transmitting, over a network, the information to a security server; and receiving, over the network, a security recommendation for the application from the security server.

Preventing application installation using system-level messages

The disclosed computer-implemented method for controlling access may include (i) installing on a personal mobile device a mobile device application that enforces an authorization security policy for protected premises, (ii) checking, by the mobile device application and in response to installing the mobile device application, whether the personal mobile device satisfies a condition of the authorization security policy, (iii) granting authorization for the personal mobile device to function as an access card based on a result of checking whether the personal mobile device satisfies the condition of the authorization security policy, and (iv) enforcing an additional access security policy on the personal mobile device after granting authorization for the personal mobile device to function as the access card. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for controlling access

A method for preventing malware is described. The method may include identifying a malicious application running on a first computing device, determining that the malicious application is installed on a second computing device based on the identifying, and performing a single operation including uninstalling the malicious application from the first computing device and the second computing device.

Using a common account to block malware on multiple devices

The disclosed computer-implemented method for obscuring user location may include (i) detecting a motion of a user mobile device through a motion sensor of the user mobile device, (ii) checking whether the motion of the user mobile device satisfies a specified threshold that defines a threshold level of motion, (iii) determining that the motion of the user mobile device satisfies the specified threshold that defines the threshold level of motion, and (iv) protecting a user of the user mobile device by obscuring, in response to determining that the motion of the user mobile device satisfies the specified threshold, an actual location of the user mobile device by outputting information indicating a decoy location of the user mobile device that deviates from the actual location of the user mobile device. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Ahmednagar, India

Sharad Subhash Mhaske