Method and system for tracking a data processing system within a communications network

• US 20070136580A1
• Filed: 12/12/2005
• Published: 06/14/2007
• Est. Priority Date: 12/12/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Girouard, Janice, Ratliff, Emily, Anand, Vaijayanthimala
• Application Number:
  US11/301,108
• Publication Number:
  US 20070136580A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A method and system for tracking a data processing system within a communications network are provided. According to one embodiment, a method is provided comprising receiving identity data from a data processing system via a communications network, where the data processing system comprises a security processing element associated with a secure storage element and the identity data specifies a portion of a security processing element endorsement key stored within the secure storage element. The described method embodiment further comprises identifying the data processing system utilizing the identity data and causing corresponding recovery data to be stored in response to an identification of the data processing system, where the recovery data comprises an associated network connection address.

Claims

1. A method comprising:

receiving identity data from a data processing system via a communications network, wherein

said data processing system comprises a security processing element, and

said identity data comprises data which specifies a portion of a security processing element endorsement key stored within secure storage associated with said security processing element;

identifying said data processing system utilizing said data which specifies said portion of said security processing element endorsement key; and

causing recovery data corresponding to said data processing system to be stored in response to an identification of said data processing system, wherein

said recovery data comprises a network connection address associated with said data processing system.

2. The method of claim 1, wherein

said method is performed utilizing a first system recovery communications network element,

said first system recovery communications network element is associated with a public key infrastructure key pair comprising a public global recovery key and a private global recovery key,

said security processing element comprises a trusted platform module,

said security processing element endorsement key comprises a public key infrastructure key pair comprising a public trusted platform module endorsement key and a private trusted platform module endorsement key,

said identity data comprises data which specifies said public trusted platform module endorsement key and is encrypted utilizing said public global recovery key, and

identifying said data processing system comprises decrypting said identity data utilizing said private global recovery key.

3. The method of claim 2, wherein said identity data comprises an identity data record further comprising

first data which specifies a local recovery key and is encrypted utilizing said public global recovery key, and

second data which specifies said public trusted platform module endorsement key and is encrypted utilizing said local recovery key.

4. The method of claim 2, wherein

said recovery data comprises an Internet Protocol address associated with said data processing system, and

said method further comprises determining a physical location of said data processing system within said communications network utilizing said Internet Protocol address.

5. The method of claim 4, wherein

said method further comprises receiving a loss notification indicating said data processing system has been separated from an associated user, and

determining said physical location of said data processing system is performed in response to a receipt of said loss notification.

6. The method of claim 4, wherein determining said physical location of said data processing system comprises

identifying a sub-network of said communications network including said data processing system utilizing said Internet Protocol address,

activating a second system recovery communications network element within said sub-network, and

processing communications network traffic received at said second system recovery communications network element utilizing said identity data in response to an activation of said second system recovery communications network element.

7. The method of claim 2, wherein

receiving identity data comprises receiving a plurality of identity data messages on a periodic basis,

said method further comprises

detecting a cessation of transmission of said plurality of identity data messages, and

causing a warning message to be issued to a user in response a detection of said cessation.

8. A system comprising:

means for receiving identity data from a data processing system via a communications network, wherein

said data processing system comprises a security processing element, and

said identity data comprises data which specifies a portion of a security processing element endorsement key stored within secure storage associated with said security processing element;

means for identifying said data processing system utilizing said data which specifies said portion of said security processing element endorsement key; and

means for causing recovery data corresponding to said data processing system to be stored in response to an identification of said data processing system, wherein

said recovery data comprises a network connection address associated with said data processing system.

9. The system of claim 8, wherein

said system comprises a first system recovery communications network element,

said first system recovery communications network element is associated with a public key infrastructure key pair comprising a public global recovery key and a private global recovery key,

said security processing element comprises a trusted platform module,

said security processing element endorsement key comprises a public key infrastructure key pair comprising a public trusted platform module endorsement key and a private trusted platform module endorsement key,

said identity data comprises data which specifies said public trusted platform module endorsement key and is encrypted utilizing said public global recovery key, and

said means for identifying said data processing system comprises means for decrypting said identity data utilizing said private global recovery key.

10. The system of claim 9, wherein said identity data comprises an identity data record further comprising

first data which specifies a local recovery key and is encrypted utilizing said public global recovery key, and

second data which specifies said public trusted platform module endorsement key and is encrypted utilizing said local recovery key.

11. The system of claim 9, wherein

said recovery data comprises an Internet Protocol address associated with said data processing system, and

said system further comprises means for determining a physical location of said data processing system within said communications network utilizing said Internet Protocol address.

12. The data processing system of claim 11, wherein

said data processing system further comprises means for receiving a loss notification indicating said data processing system has been separated from an associated user, and

said means for determining comprises means for determining said physical location of said data processing system in response to a receipt of said loss notification.

13. The data processing system of claim 12, wherein said means for determining further comprises

means for identifying a sub-network of said communications network including said data processing system utilizing said Internet Protocol address,

means for activating a second system recovery communications network element within said sub-network, and

means for processing communications network traffic received at said second system recovery communications network element utilizing said identity data in response to an activation of said second system recovery communications network element.

14. The data processing system of claim 8, wherein

said means for receiving comprises means for receiving a plurality of identity data messages on a periodic basis,

said data processing system further comprises

means for detecting a cessation of transmission of said plurality of identity data messages, and

means for causing a warning message to be issued to a user in response a detection of said cessation.

15. A machine-readable medium having a plurality of instructions executable by a machine embodied therein, wherein said plurality of instructions when executed cause said machine to perform a method comprising:

receiving identity data from a data processing system via a communications network, wherein

said data processing system comprises a security processing element, and

said identity data comprises data which specifies a portion of a security processing element endorsement key stored within secure storage associated with said security processing element;

identifying said data processing system utilizing said data which specifies said portion of said security processing element endorsement key; and

causing recovery data corresponding to said data processing system to be stored in response to an identification of said data processing system, wherein

said recovery data comprises a network connection address associated with said data processing system.

16. The machine-readable medium of claim 15, wherein

said machine comprises a first system recovery communications network element,

said first system recovery communications network element is associated with a public key infrastructure key pair comprising a public global recovery key and a private global recovery key,

said security processing element comprises a trusted platform module,

said security processing element endorsement key comprises a public key infrastructure key pair comprising a public trusted platform module endorsement key and a private trusted platform module endorsement key,

said identity data comprises data which specifies said public trusted platform module endorsement key and is encrypted utilizing said public global recovery key, and

identifying said data processing system comprises decrypting said identity data utilizing said private global recovery key.

17. The machine-readable medium of claim 16, wherein said identity data comprises an identity data record further comprising

first data which specifies a local recovery key and is encrypted utilizing said public global recovery key, and

second data which specifies said public trusted platform module endorsement key and is encrypted utilizing said local recovery key.

18. The machine-readable medium of claim 16, wherein

said recovery data comprises an Internet Protocol address associated with said data processing system, and

said method further comprises determining a physical location of said data processing system within said communications network utilizing said Internet Protocol address.

19. The machine-readable medium of claim 18, wherein

said method further comprises receiving a loss notification indicating said data processing system has been separated from an associated user, and

determining said physical location of said data processing system is performed in response to a receipt of said loss notification.

20. The machine-readable medium of claim 18, wherein determining said physical location of said data processing system comprises

identifying a sub-network of said communications network including said data processing system utilizing said Internet Protocol address,

activating a second system recovery communications network element within said sub-network, and

processing communications network traffic received at said second system recovery communications network element utilizing said identity data in response to an activation of said second system recovery communications network element.