Theft-deterrence method and apparatus for processor based devices

• US 20090089887A1
• Filed: 09/28/2007
• Published: 04/02/2009
• Est. Priority Date: 09/28/2007
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Prakash, Gyan, Chhabra, Jasmeet, Aissi, Selim
• Granted Patent: US 8,298,295 B2
• Time in Patent Office: Days
• US Class Current: 726/35
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss

Abstract

A manageability engine of a processor based device and a host theft-deterrence agent of the processor based device, jointly implement a theft-deterrence protocol with a theft-deterrence service, remotely disposed from the processor based device, to deter theft of the processor based device. The host theft-deterrence agent is configured to operate in a processor operated application execution environment of the processor based device, and the manageability engine is configured to operate outside the application execution environment.

Claims

1. An article of manufacture comprising:

computer readable storage medium;

a plurality of programming instructions stored in the storage medium, the programming instructions configured to configure a manageability engine of a processor based device and to provide a host theft-deterrence agent to the processor based device, to deter theft of the processor based device, the manageability engine and the host theft-deterrence agent being configured to cooperate with each other and a theft-deterrence server, remotely disposed from the client device, to implement a theft-deterrence protocol, the host theft-deterrence agent being configured to operate in a processor operated application execution environment of the processor based device, and the manageability engine being configured to operate outside the application execution environment.

2. The article of claim 1, wherein the programming instructions are configured to configure the manageability engine to periodically obtain a theft status of the processor based device from the remotely disposed theft-deterrence server.

3. The article of claim 2, wherein the programming instructions are configured to configure the manageability engine to periodically obtain a heart beat message comprising the theft status of the processor based device from the remotely disposed theft-deterrence server.

4. The article of claim 3, wherein the programming instructions are configured to configure the manageability engine to periodically send a heart beat request message to the remotely disposed theft-deterrence server, to periodically obtain the heart beat message.

5. The article of claim 4, wherein each heart beat request message comprises at least a selected one of:

the theft status currently held by the manageability engine,

a current first timer value, at expiration of which, the manageability engine is to send the heart beat request message;

or

a current second timer value, at expiration of which, the manageability engine is to enforce a theft-deterrence policy on the processor based device.

6. The article of claim 5, wherein each heart beat request message further comprises at least a selected one of:

a current platform disable priority value,

a current encrypted data disable priority value, or

a current theft-deterrence server rendezvous priority value.

7. The article of claim 1, wherein the programming instructions are further configured to program the manageability engine to send the host theft-deterrence agent an alert on expiration of a timer value or when the theft status denotes stolen status.

8. The article of claim 1, wherein the programming instruction are further configured to program the manageability engine to invoke a boot process to reboot the processor based device, and to provide the boot process with a lock down instruction to abort boot up of the processor based device to lock down the processor based device.

9. The article of claim 8, wherein the programming instruction are further configured to program the manageability engine to allow the boot process to provide an appropriate secret to unlock the processor based device.

10. A system comprising:

a processor;

a wire line based networking interface coupled to the processor to couple the system to a network; and

a theft-deterrence service to be operated by the processor to deter theft of each of one or more remotely disposed processor based devices by jointly implementing a theft-deterrence protocol with a manageability engine of each of the processor based device, via the networking interface and a host theft-deterrence agent of the processor based device, the host theft-deterrence agent of each processor based device being configured to operate in a processor operated application execution environment of the processor based device, and the manageability engine being configured to operate outside the application execution environment of the processor based device.

11. The system of claim 10, wherein the theft-deterrence service is configured to provide the manageability engine of each processor based device with a theft status of the processor based device in response to a request of the processor based device, the manageability engine of each processor based device being configured to periodically obtain the theft status of the processor based device from the theft-deterrence service.

12. The system of claim 11, wherein the theft-deterrence service is configured to provide the manageability engine of each processor based device with a heart beat message comprising the theft status of the processor based device in response to a request of the processor based device, the manageability engine of each processor based device being configured to periodically obtain the heart beast message from the theft-deterrence service.

13. The system of claim 12, wherein each heart beat message comprises at least a selected one of:

the theft status of the processor based device,

an update to a first timer value, at expiration of which, the manageability engine of the processor based device is to request for the heart beat message;

or

an update to a second timer value, at expiration of which, the manageability engine of the processor based device is to enforce a theft-deterrence policy on the processor based device.

14. The system of claim 13, wherein each heart beat request message further comprises at least a selected one of:

an update to a platform disable priority value,

an update to an encrypted data disable priority value, or

an update to a theft-deterrence server rendezvous priority value.

15. The system of claim 10, wherein the theft-deterrence service is further configured to accept subscription and register each of the one or more processor based device for joint implementation of the theft-deterrence protocol to deter theft of the processor based devices.

16. The system of claim 15, further comprising a disk storage coupled to the processor, and a database stored in the disk storage to store subscription information of the one or more processor based devices.

17. A method comprising:

a manageability engine of a processor based device determining whether a theft status of the processor based device is stolen, on expiration of a timer value;

the manageability engine, on determining that the theft status of the processor based device is stolen, alerting a host theft-deterrence agent of the processor device, the host theft-deterrence agent being operated in a processor operated application execution environment of the processor based device, and the manageability engine being operated outside the application execution environment;

the host theft-deterrence agent, on receipt of the alert, causing the processor based device to be re-booted;

a boot process of the processor based device, on booting the processor based device, obtaining the theft status from the manageability engine, and in response, conditionally abort the boot process to enforce a theft-deterrence policy on the processor based device.

18. The method of claim 17, wherein the boot process aborts the boot process to lock down the processor based device if a user of the processor based device is unable to provide an unlock secret acceptable to the manageability engine.

19. The method of claim 18, further comprising the boot process soliciting the unlock secret from the user, providing an inputted unlock secret to the manageability engine, and receiving an indication from the manageability engine indicating whether the provided unlock secret is acceptable to the manageability or not.

20. The method of claim 17 further comprising the host theft agent assisting the manageability engine to periodically obtain updates to the theft status and the time value from a remotely disposed theft-deterrence service.