Method and Apparatus for Detecting Unauthorized Access to a Computing Device and Securely Communicating Information about such Unauthorized Access

• US 20090228698A1
• Filed: 03/07/2008
• Published: 09/10/2009
• Est. Priority Date: 03/07/2008
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Hofmann, Richard Gerard, Shirlen, Martyn Ryan
• Granted Patent: US 8,850,568 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method and apparatus for detecting attacks against a computing device are described. Such attacks may be detected by the device and reported to a requesting entity in a manner that makes it difficult for an attacker to know that the attack has been detected. Several exemplary embodiments comprising different client/server and client/network type systems are presented.

Claims

1. A method of detecting attacks on a computing device and securely communicating information about such attacks, comprising:

a. detecting an attack on the computing device;

b. determining the type of attack;

c. forming a response key based on the type of attack detected and the identity of the computing device;

d. accepting a request from a requesting entity;

e. combining at least a portion of the request with at least a portion of the response key to form a transformed key; and

f. providing the transformed key to the requesting entity.

2. The method of claim 1, wherein the response key is formed by selecting one of a plurality of programmed hardware keys.

3. The method of claim 1, wherein the response key is formed by combining information about any attacks with a programmed hardware key.

4. The method of claim 1, wherein at least a portion of the request is a non-deterministic value.

5. The method of claim 1, wherein forming the transformed key includes mathematically transforming a combination of at least the portion of the request and at least the portion of the response key.

6. The method of claim 5, wherein the mathematical transformation method is a one-way hash function.

7. A computing device configured to detect and securely report information concerning attacks against the computing device, comprising:

a. a storage element configured to store a programmed hardware key;

b. an attack detection circuit adapted to detect attacks against the computing device;

c. a key formation circuit adapted to form a response key based on the Programmed hardware key and an input from the attack detection circuit;

d. an interface circuit adapted to receive a request from a requesting entity;

e. a transformation circuit adapted to generate a transformed key from at least a portion of the response key and at least a portion of the request received at the interface circuit; and

f. a circuit adapted to provide the transformed key to the requesting entity.

8. The computing device of claim 7, wherein the storage element is a non-volatile storage element.

9. The computing device of claim 7, wherein the storage element is a volatile storage element.

10. The computing device of claim 7, wherein the key formation circuit selects one of a plurality of programmed hardware keys to form the response key.

11. The computing device of claim 7, wherein the key formation circuit combines information about any attacks with a programmed hardware key to form the response key.

12. The computing device of claim 7, wherein at least a portion of the request is a non-deterministic value.

13. The computing device of claim 7, wherein the transformation circuit mathematically transforms a combination of at least a portion of the random value from the requesting entity and at least a portion of the response key to form the transformed key.

14. The computing device of claim 13, wherein the mathematical transformation method is a one-way hash function.

15. The computing device of claim 7, wherein the computing device is a wireless cellular phone.

16. A computing device configured to detect and securely report information concerning attacks against the computing device, comprising:

a. storage means configured to store a programmed hardware key;

b. attack detection means adapted to detect attacks against the computing device;

c. a key formation means adapted to form a response key based on the programmed hardware key and an input from the attack detection means;

d. an interface means adapted to receive a request from a requesting entity;

e. a transformation means adapted to generate a transformed key from at least a portion of the response key and at least a portion of the request received at the interface means; and

f. a transmission means adapted to provide the transformed key to the requesting entity.

17. A method of securely receiving information about attacks on computing device at a requesting entity, comprising:

a. forming a request at the requesting entity;

b. providing the request to the computing device;

c. receiving a response from the computing device based on at least a portion of the request, the identity of the computing device and any attack detected; and

d. determining from the response the identity of the computing device and the type of any attack detected.

18. The method of claim 17, wherein at least a portion of the request is formed in a non-deterministic manner.

19. The method of claim 17, further comprising taking action if the requesting entity determines that the computing device has been attacked.

20. A requesting entity adapted to securely receive information about attacks on a computing device, comprising:

a. a request formation circuit adapted to form a request;

b. a circuit adapted to provide the request to the computing device;

c. a receiver circuit adapted to receive from the computing device a response based on at least a portion of the request, the identity of the computing device and any attack detected; and

d. a comparison circuit adapted to compare the response from the computing device to a plurality of expected responses and determine the identity of the computing device and the type of any attack detected.

21. The requesting entity of claim 20, wherein the request is formed in a non-deterministic manner.

22. The requesting entity of claim 20, wherein the requesting entity is a wireless cellular network.

23. A requesting entity adapted to securely receive information about attacks on a computing device, comprising:

a. means for forming a request;

b. means for providing the request to the computing device;

c. means for receiving from the computing device a response based on at least a portion of the request, the identity of the computing device and any attack detected; and

d. means for comparing the response from the computing device to a plurality of expected responses and determining the identity of the computing device and the type of any attack detected.

24. The requesting entity of claim 23, wherein the means for forming a request is a software program contained in a computer-readable medium.

25. The requesting entity of claim 23, wherein the requesting entity is a wireless cellular network.