Computer Compliance Enforcement

• US 20080148036A1
• Filed: 12/18/2006
• Published: 06/19/2008
• Est. Priority Date: 12/18/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Carpenter, Todd L., Westerinen, William J., Schmidt, Shon, Drake, Stephen Richard, Frank, Alexander
• Granted Patent: US 7,844,808 B2
• Time in Patent Office: Days
• US Class Current: 713/2
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/70 Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A security module for a pay-per-use computer supplies an appropriate BIOS for a given mode of operation. A power manager in the security module powers only essential circuits until the BIOS is operational to help prevent substitution of a non-authorized BIOS. The security module also includes a capability to monitor and restrict data lines on a bus between a main computer processor and computer system memory. When the computer is operating in a restricted use mode, data lines may be restricted to allow only minimal access to the computer system memory. Bus transactions may be monitored to ensure that only valid transactions are occurring and are within the designated memory space.

Claims

1. A module disposed in a metered-use computer for enforcing operation of the metered-use computer in a restricted use mode, the module comprising:

a processor;

a memory coupled to the processor storing executable code and settings;

a bus supervisor coupled to the processor and attached to a system bus coupling a computer processor and a computer memory, the bus supervisor operable to enable traffic on the system bus responsive to a first signal from the processor;

a cryptographic function available to the processor; and

a power control circuit that delays starting a portion of the metered-use computer responsive to a second signal from the processor.

2. The module of claim 1, wherein the cryptographic function is a smart chip.

3. The module of claim 1, wherein the cryptographic function is software executing on the processor.

4. The module of claim 1, wherein the system bus is a packet-oriented high speed data bus.

5. The module of claim 1, wherein the bus supervisor comprises a boot mode register.

6. The module of claim 1, wherein the bus supervisor default behavior is to disable traffic on the system bus until receipt of the first signal.

7. The module of claim 1, wherein the bus supervisor is further operable to monitor traffic on the system bus for unauthorized data traffic during restricted use operation.

8. The module of claim 1, wherein the processor periodically resets the system bus to restricted memory size during restricted use operation.

9. A method of operating a computer in a restricted mode comprising:

starting a boot cycle in the computer;

powering a first circuit that controls a power signal for an interface device;

selecting a BIOS from a set of BIOSs stored at the first circuit, according to a setting saved prior to the boot cycle;

executing the selected BIOS;

enabling a bus switch responsive to a signal generated by the selected BIOS to allow traffic on a set of data paths associated with a system bus after the BIOS operation is stable;

verifying a status of the selected BIOS at the first circuit; and

sending a power signal to the interface device.

10. The method of claim 9, further comprising verifying the memory available to a processor of the computer.

11. The method of claim 9, further comprising executing a restricted mode application of the BIOS when the setting saved prior to the current boot cycle is indicative of restricted operation.

12. The method of claim 11, wherein executing the restricted mode application at the BIOS when the setting saved prior to the current boot cycle is indicative of restricted operation comprises executing the restricted mode application to display a prompt and enable user input to enter an unlock code when the setting saved prior to the current boot cycle is indicative of restricted operation.

13. The method of claim 9, wherein the first circuit comprises the processor of the computer, a local processor, and the bus switch.

14. The method of claim 9, wherein enabling a bus switch responsive to a signal comprises enabling the bus switch to allow traffic on a full set of the data paths allowing access to a full system memory when using an unrestricted BIOS and enabling the bus switch to allow traffic on a limited set of data paths allowing access to less than one percent of the full system memory when using a restricted operation BIOS.

15. A computer adapted for metered operation having a metered mode and a restricted mode of operation comprising:

a processor;

a system memory;

a set of data lines forming a bus coupling the processor to the system memory;

a set of intermediary circuits coupling the processor to system devices and peripherals; and

a security module having a data connection to the processor and power management connections to the set of intermediary circuits, the security module comprising;

a specialized processor;

a local memory; and

a bus monitor adapted to selectively disable the bus and further adapted to monitor data traffic on the bus for unauthorized instruction usage.

16. The computer of claim 15, further comprising a power activation switch coupled to the security module and the security module further comprising a power manager responsive to a signal from the power activation switch for authorizing power to at least the security module and the processor before authorizing power to the set of intermediary circuits.

17. The computer of claim 15, wherein the security module further comprises a cryptographic function.

18. The computer of claim 17, wherein the cryptographic function is one of a smart chip and an executable code implementing a cryptographic function.

19. The computer of claim 15, wherein the local memory comprises executable code for a first BIOS used to boot the computer in the metered mode and a second BIOS used to boot the computer in the restricted mode.

20. The computer of claim 19, wherein the local memory further comprises executable code as a part of the second BIOS that, when executed, causes the bus monitor to disable individual data lines of the set of data lines.