Special PC mode entered upon detection of undesired state

• US 20060107329A1
• Filed: 06/14/2005
• Published: 05/18/2006
• Est. Priority Date: 11/15/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hall, Martin, Phillips, Thomas, Xu, Zhangwei, Frank, Alexander, Steeb, Curt A., Temple, Nicholas, Duffus, James S., Venkatachalam, Rajagopal, Ahdout, Isaac P.
• Granted Patent: US 8,176,564 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/87 by means of encapsulation, e.g. for integrated circuits

Abstract

A system and method for monitoring a computer, particularly a pay-per-use computer, uses an isolated computing environment or supervisor. The isolated computing environment boots prior to any boot device associated with an operating system, runs concurrently with the operating system and monitors and measures the computer in operation. Once the isolated computing environment determines the computer is not in compliance with the required policies, the isolated computing environment may either impose an impediment to use such as slowing clock speed or completely disable the operating system. The user may have to return the computer to a service provider to restore it from the offending condition and reset the computer to an operational state.

Claims

1. A computer adapted for operation in a normal mode and an alternate mode comprising:

a memory;

a processor coupled to the memory;

a first boot device having precedence over any other boot device, the first boot device remaining active concurrently with the any other boot device, the first boot device comprising;

a memory for storing data in a tamper-resistant manner, the data comprising at least one of configuration data, cryptographic data, status data, or executable program data;

a circuit providing monotonically increasing time readings;

a data input/output circuit; and

a program execution environment, coupled to the clock and the data input/output circuit, for executing at least one of a monitoring program or a measurement program stored in the memory;

wherein the first boot device determines when the computer is operating in compliance with a criterion.

2. The computer of claim 1, wherein the any other boot device comprises an operating system boot device, the operating system boot device associated with the normal mode.

3. The computer of claim 1, further comprising sanctioning program code associated with the alternate mode that is activated when the computer is not operating in compliance with the criterion.

4. The computer of claim 3, wherein the alternate mode of operation comprises stopping the operating system boot device.

5. The computer of claim 3, wherein the alternate mode of operation comprises at least one of reducing a function of the computer or sending a warning corresponding to operating in compliance with the criterion.

6. The computer of claim 1, wherein the first boot device is initialized when the computer is powered up and the first boot device is guaranteed execution cycles during the operation of the computer.

7. The computer of claim 1, wherein the alternate mode further comprises a user interface for restoring compliance with the criterion.

8. The computer of claim 1, wherein the first boot device receives a policy via the input/output circuit, the policy corresponding to the criterion for determining compliance.

9. The computer of claim 8, wherein the first boot device authenticates the policy.

10. The computer of claim 1, wherein measurement data is used in calculating a score corresponding to compliance with the criterion and the alternate mode is invoked when the score reaches a threshold value.

11. The computer of claim 10, wherein the measurement data comprises at least one of an operating system heartbeat, a verification of designated files, verification of a system clock, a current operating mode, a frequency of writes to the memory, or a time since last provisioning cycle.

12. The computer of claim 1, wherein the first boot device further comprises a cryptographic service.

13. A supervisor for monitoring compliance with a policy on a computer comprising:

a secure memory;

a clock providing monotonically increasing time measurements;

an input/output circuit; and

a processing capability separate from a processor used to host an operating system of the computer, the processing capability coupled to the secure memory, the clock and the input/output circuit, the processing capability for evaluating data corresponding to compliance with the policy received via the input/output circuit in view of information from the secure memory and the clock.

14. The supervisor of claim 13, further comprising an enforcement circuit responsive to the processing capability for hindering operation of the computer when the computer is not in compliance with the policy.

15. The supervisor of claim 14, wherein the policy corresponds to a valid hardware configuration of the computer and the enforcement circuit limits hardware functions to the valid hardware configuration.

16. A method of determining non-compliance to a policy on a computer comprising:

associating non-compliance to the policy with at least one criterion measurable on the computer;

instantiating a supervisor prior to activating an operating system;

monitoring data, at the supervisor, corresponding to the at least one criterion on the computer; and

determining when the computer is in a non-compliant state by evaluating the data.

17. The method of claim 16, further comprising:

imposing a sanction on the computer when a score based on the data corresponding to the at least one criterion reaches a threshold value, whereby the imposing the sanction further comprises deactivating at least a portion of the operating system.

18. The method of claim 16, wherein the at least one criterion comprises at least one of a duration of a computing session, a time between provisioning packet purchases, or a total time of operation of the computer compared to total provisioning packet purchases.

19. The method of claim 16, wherein the data corresponding to the at least one criterion comprises at least one of an operating system heartbeat, a verification of designated files, verification of a system clock, a current operating mode, a frequency of writes to the memory, or a time since last provisioning cycle.

20. The method of claim 16, further comprising:

providing the supervisor with a program execution environment autonomous from the operating system.