After the fact protection of data in remote personal and wireless devices

• US 20030065934A1
• Filed: 09/28/2001
• Published: 04/03/2003
• Est. Priority Date: 09/28/2001
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Novoa, Manuel, Angelo, Michael F., Olarig, Sompong P.
• Application Number:
  US09/965,960
• Publication Number:
  US 20030065934A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 8/245 from a network towards a terminal
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A security system is provided which permits a user or owner of a portable electronic device to report the device missing to a security station. In response, the security station wirelessly transmits a security message or command to the portable electronic device which, in turn, responds by causing a “destructive” security action to occur. The destructive action may include erasing memory in the portable device, disabling certain functions (e.g., transmitting data, receiving data, accessing memory, etc.) or other types of actions such as reporting location information to the security station. Various security mechanisms can be implemented as well to minimize the risk that an unauthorized entity will be able to broadcast security messages to portable devices.

Claims

1. A method for securing a portable electronic device, comprising:

(a) generating a security message;

(b) transmitting said security message to said portable electronic device;

(c) performing a destructive action on said portable electronic device in response to said security message.

2. The method of claim 1 wherein said destructive action includes erasing memory.

3. The method of claim 1 wherein said destructive action includes destroying a portion of said portable electronic device.

4. The method of claim 1 wherein said destructive action prevents said portable electronic device from transmitting or releasing information.

5. The method of claim 1 wherein (a) includes digitally signing said security message.

6. The method of claim 5 further including the portable electronic device verifying the digital signature.

7. The method of claim 5 using an encryption key to digitally sign the security message.

8. The method of claim 7 wherein said encryption key is stored in an encrypted form before being used to digitally sign the security message.

9. The method of claim 6 wherein a person or entity is authorized to cause (b) to happen and only that person or entity is capable of causing said encrypted key to be decrypted so as to be used to digitally sign the security message.

10. The method of claim 1 wherein (b) occurs after a request has been received to perform the destructive action.

11. The method of claim 10 wherein a person or entity is authorized to cause (b) to happen and (b) occurs after said requesting person or entity is verified.

12. The method of claim 1 further including encrypting the security message and said portable device decrypts the encrypted security message.

13. The method of claim 1 further including digitally signing said security message and including a unique value that changes each time (a) is performed.

14. The method of claim 13 further including receiving said digitally signed security message and authenticating the message using said unique value.

15. The method of claim 13 wherein said unique value includes a time stamp.

16. The method of claim 13 wherein said unique value includes a random number.

17. The method of claim 13 wherein said unique value includes a non-repeating sequence number.

18. The method of claim 1 further including permitting the destructive action to be aborted once the security message is received by said portable electronic device.

19. The method of claim 18 wherein permitting the destructive action to be aborted includes providing the portable electronic device with an abort key that is verified by the portable electronic device.

20. The method of claim 1 further including permitting a specified number of tasks to be performed by the portable electronic device before (c) is performed.

21. The method of claim 1 further including permitting tasks to be performed by said portable electronic device for a specified time period before (c) is performed.

22. The method of claim 1 further including permitting a specified number of tasks to be performed during a specified period of time and performing (c) after either said specified number of tasks have been performed or the specified time period has expired.

23. A portable electronic device, comprising:

a CPU;

a memory device coupled to said CPU;

a decryption key stored in said memory device;

an input/output (“

I/O”

) module coupled to said CPU which receives messages from an external security station;

wherein said CPU receives security messages from said security station via said I/O module and, in response, performs a destructive action.

24. The portable electronic device of claim 23 wherein said destructive action includes erasing said memory device.

25. The portable electronic device of claim 23 wherein said destructive action prevents said portable electronic device from transmitting information.

26. The portable electronic device of claim 23, wherein said security messages received at said I/O module include a digital signature and said CPU verifies the digital signature.

27. The portable electronic device of claim 26 wherein said CPU uses said decryption key to verify the digital signature.

28. The portable electronic device of claim 23 wherein said CPU verifies a unique value included in said security message, said unique value capable of being different each time the portable electronic device receives a security message.

29. The portable electronic device of claim 28 wherein said CPU authenticates the security message using said unique value.

30. The portable electronic device of claim 28 wherein said unique value includes a time stamp.

31. The portable electronic device of claim 28 wherein said unique value includes a random number.

32. The method of claim 28 wherein said unique value includes a non-repeating sequence number.

33. The portable electronic device of claim 23 wherein said CPU permits the destructive action to be aborted once the security message is received by said portable electronic device.

34. The portable electronic device of claim 33 wherein said CPU permits entry of an abort key to cause the destructive action to be aborted.

35. The portable electronic device of claim 23 wherein said CPU permits a specified number of tasks to be performed by the portable electronic device before performing said destructive action.

36. The portable electronic device of claim 23 wherein said CPU permits tasks to be performed for a specified time period before said destructive action is performed.

37. The portable electronic device of claim 23 wherein said CPU permits a specified number of tasks to be performed for a specified time period and, after either the specified number of tasks have been performed or the specified time period has elapsed, said CPU performs said destructive action.

38. The portable electronic device of claim 23 wherein said decryption key cannot be overwritten.

39. The portable electronic device of claim 23 wherein said decryption key cannot be copied.

40. A security station through which a user of a portable electronic device can initiate a security response associated with the portable electronic device, comprising:

a registry of user information accessible by said CPU and including an identifier value associated with the portable electronic device; and

a communication port to facilitate communication with the portable electronic device;

wherein said CPU generates a security message which is transmitted through the communication port to the portable electronic device to cause the portable electronic device to perform a destructive security action.

41. The security station of claim 40 wherein said CPU digitally signs said security message with a key associated with the user.

42. The security station of claim 41 wherein said CPU encrypts said security message with said key.

43. The security station of claim 40 wherein said CPU encrypts said security message with a key associated with the user.

44. The security station of claim 40 wherein said security message causes said portable electronic device to erase its data storage.

45. The security station of claim 40 wherein said security message causes said portable electronic device to cease transmitting data.

46. The security station of claim 40 wherein said security message causes said portable electronic device to preclude access to any stored in the portable electronic device.

47. The security station of claim 40 wherein said security message causes said portable electronic device to report location information to the security station.

48. The security station of claim 40 wherein said security message permits the portable electronic device to perform a specified number of tasks after which the portable electronic device performs s aid destructive action.

49. The security station of claim 40 wherein said security message permits the portable electronic device to perform tasks for a specified amount of time after which the portable electronic device performs said destructive action.

50. The security station of claim 40 wherein said security message permits the portable electronic device to perform a specified number of tasks for a specified amount of time, and after either the specified number of tasks have been performed or the specified amount of time has expired, the portable electronic device performs said destructive action.

51. The security station of claim 40 wherein the security message can be aborted by the portable electronic device.