Security screening of electronic devices by device-reported data

• US 20050198513A1
• Filed: 03/04/2004
• Published: 09/08/2005
• Est. Priority Date: 03/04/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Spinac, Clifford Jay, Rodriguez, Herman, Smith, Newton James Jr.
• Granted Patent: US 7,574,608 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method, system, and program for security screening of electronic devices by device-reported data are provided. A device scanner system at a security checkpoint queries a powered on electronic device for device-reported data via a network connection. The device-reported data may include the operational status of at least one component of the electronic device, a configuration of the electronic device, and a current ownership of the electronic device. Responsive to receiving the device-reported data, the device scanner system retrieves expected data for the electronic device. Then, the device scanner system assigns a security level to the electronic device indicating whether the device-reported data matches the expected data, such that the electronic device is screened based on data reported by the powered on electronic device.

Claims

1. A method for security screening of electronic devices, comprising:

querying a powered on electronic device for device-reported data at a security checkpoint;

responsive to receiving said device-reported data, retrieving expected data for said electronic device; and

assigning a security level to said electronic device indicating whether said device-reported data matches said expected data, such that said electronic device is screened based on data reported by said electronic device.

2. The method according to claim 1 for security screening of electronic devices wherein querying a powered on electronic device further comprises:

querying said powered on electronic device for device-reported data comprising at least one from among an operational status of at least one component of said electronic device, a configuration of said electronic device, and a current ownership status of said electronic device.

3. The method according to claim 1 for security screening of electronic devices wherein retrieving expected data for said electronic device further comprises:

querying an expected-data server via a network for said expected data based on a device identifier for said electronic device.

4. The method according to claim 1 for security screening of electronic devices further comprising:

detecting a device identifier from a radio frequency transmitter affixed to said electronic device; and

retrieving said expected data based on said identifier.

5. The method according to claim 1 for security screening of electronic devices further comprising:

detecting an identity of an entity associated with said electronic device; and

adjusting said security level to indicate whether said identity of said entity matches said device-reported data.

6. The method according to claim 1 for security screening of electronic devices further comprising:

controlling output of said security level via an output interface.

7. A system for security screening of electronic devices, comprising:

means for querying a powered on electronic device for device-reported data at a security checkpoint;

means, responsive to receiving said device-reported data, for retrieving expected data for said electronic device; and

means for assigning a security level to said electronic device indicating whether said device-reported data matches said expected data.

8. The system according to claim 7 for security screening of electronic devices wherein said means for querying a powered on electronic device further comprises:

means for querying said powered on electronic device for device-reported data comprising at least one from among an operational status of at least one component of said electronic device, a configuration of said electronic device, and a current ownership status of said electronic device.

9. The system according to claim 7 for security screening of electronic devices wherein said means for retrieving expected data for said electronic device further comprises:

means for querying an expected-data server via a network for said expected data based on a device identifier for said electronic device.

10. The system according to claim 7 for security screening of electronic devices further comprising:

a radio frequency identifier reader for detecting a device identifier from a radio frequency transmitter affixed to said electronic device; and

means for retrieving said expected data based on said identifier.

11. The system according to claim 7 for security screening of electronic devices further comprising:

an identity scanner for scanning an identity of an entity associated with said electronic device; and

means for adjusting said security level to indicate whether said identity of said entity matches said device-reported data.

12. The system according to claim 7 for security screening of electronic devices further comprising:

a display controller for controlling output of said security level via an output interface;

.

13. A computer program product stored on a computer operable medium for security screening of electronic devices, comprising:

means for querying a powered on electronic device for device-reported data at a security checkpoint;

means, responsive to receiving said device-reported data, for retrieving expected data for said electronic device; and

means for assigning a security level to said electronic device indicating whether said device-reported data matches said expected data.

14. The computer program product according to claim 13 for security screening of electronic devices wherein said means for querying a powered on electronic device further comprise:

means for querying said powered on electronic device for device-reported data comprising at least one from among an operational status of at least one component of said electronic device, a configuration of said electronic device, and a current ownership status of said electronic device.

15. The computer-program product according to claim 13 for security screening of electronic devices wherein said means for retrieving expected data for said electronic device further comprise:

means for querying an expected-data server via a network for said expected data based on a device identifier for said electronic device.

16. The computer program product according to claim 13 for security screening of electronic devices further comprising:

means for detecting a device identifier from a radio frequency transmitter affixed to said electronic device; and

means for retrieving said expected data based on said identifier.

17. The computer program product according to claim 13 for security screening of electronic devices further comprising:

means for detecting an identity of an entity associated with said electronic device; and

means for adjusting said security level to indicate whether said identity of said entity matches said device reported data.

18. The computer program product according to claim 13 for security screening of electronic devices further comprising:

means for controlling output of said security level via an output interface.

19. A method for enabling security checks of an electronic device comprising:

capturing device-reported data within said electronic device comprising at least one from among operational data, configuration data, and ownership data for said electronic device; and

responsive to receiving a request for said device-reported data via network connection with a security checkpoint system, transmitting said device-reported data to said security checkpoint system, wherein said security checkpoint system is enabled to determined a security level of said electronic device by comparing said device-reported data with expected data for said electronic device.

20. The method according to claim 19 for enabling security checks further comprising requiring authentication of said security checkpoint system before transmission of said device reported data.

21. A system for enabling security checks of an electronic device comprising:

a device security application residing on an electronic device for capturing device-reported data within said electronic device, said device-reported data comprising at least one from among operational data, configuration data, and ownership data for an electronic device; and

wherein, responsive to receiving a request for said device-reported data via a network connection, said device security application enables transmission of said device-reported data to a security checkpoint system enabled to determine a security level of said electronic device by comparing said device-reported data with expected data for said electronic device.

22. The system according to claim 21 for enabling security checks further wherein said device security application requires authentication of said security checkpoint system before enabling transmission of said device-reported data.

23. A computer program product residing on a computer readable medium for enabling security checks of an electronic device comprising:

means for capturing device-reported data within an electronic device comprising at least one from among operational data, configuration data, and ownership data for an electronic device; and

means, responsive to receiving a request for said device-reported data via a network connection, for controlling transmission of said device-reported data via said network connection.

24. The computer program product according to claim 23 for enabling security checks further comprising

means for requiring authentication of a security checkpoint system requesting said device-reported data before controlling transmission of said device-reported data.