SECURE AND PRIVATE LOCATION

• US 20120159172A1
• Filed: 12/21/2010
• Published: 06/21/2012
• Est. Priority Date: 12/21/2010
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Saxena, Paritosh, Diamant, Nimrod, Gordon, David, Getz, Benny
• Granted Patent: US 8,893,295 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04W 12/08 Access security

Abstract

Systems and methods of restricting access to mobile platform location information may involve receiving, via a link, location information for a mobile platform at a processor of the mobile platform, and preventing unauthorized access to the location information by an operating system associated with the mobile platform.

Claims

1. A method comprising:

receiving, via a link, location information for a platform at a processor of the platform; and

preventing unauthorized access to the location information by an operating system associated with the platform.

2. The method of claim 1, wherein the location information is received via a dedicated bus.

3. The method of claim 1, wherein the location information is received via a shared bus and the method further includes:

exchanging one or more keys with a source of the location information over the shared bus associated with the platform;

authenticating a signature of the source of the location information based on the one or more keys; and

decrypting the location information based on the one or more keys.

4. The method of claim 1, wherein the method includes:

prompting a user of the platform for authorization to permit direct operating system access to the location information; and

activating a switch disposed between a source of the location information and a port to the platform if the authorization is received.

5. The method of claim 1, further including:

receiving a request for the location information from a service provider external to the platform;

authenticating the request;

encrypting the location information based on one or more keys associated with the service provider;

signing the encrypted location information;

prompting a user of the platform for authorization to release the encrypted and signed location information; and

releasing the encrypted and signed location information to the platform if the authorization is received.

6. The method of claim 1, further including:

activating a global positioning system (GPS) sensor of the platform if the platform is in an inactive state based on a predetermined schedule;

requesting the location information from the GPS sensor if the GPS sensor is activated; and

storing the location information and an associated timestamp to a non-volatile memory that is accessible by the processor.

7. The method of claim 1, wherein the location information includes an access point basic service set identifier (BSSID) and preventing the unauthorized access includes scrambling the BSSID.

8. An apparatus comprising:

logic to,

receive, via a link, location information for a platform at a processor of the platform, and

prevent unauthorized access to the location information by an operating system associated with the platform.

9. The apparatus of claim 8, wherein the location information is to be received via a dedicated bus.

10. The apparatus of claim 8, wherein the location information is to be received via a shared bus and the logic is to,

exchange one or more keys with a source of the location information over the shared bus associated with the platform,

authenticate a signature of the source of the location information based on the one or more keys, and

decrypt the location information based on the one or more keys.

11. The apparatus of claim 8, further including a switch disposed between a source of the location information and a port to the platform, wherein the logic is to,

prompt a user of the platform for authorization to permit direct operating system access to the location information, and

activate the switch if the authorization is received.

12. The apparatus of claim 8, wherein the logic is to,

receive a request for the location information from a service provider external to the platform,

authenticate the request,

encrypt the location information based on one or more keys associated with the service provider,

sign the encrypted location information,

prompt a user of the platform for authorization to release the encrypted and signed location information, and

release the encrypted and signed location information to the platform if the authorization is received.

13. The apparatus of claim 8, wherein the logic is to,

activate a global positioning system (GPS) sensor of the platform if the platform is in an inactive state based on a predetermined schedule,

request the location information from the GPS sensor if the GPS sensor is activated, and

store the location information and an associated timestamp to a non-volatile memory that is accessible by the processor.

14. The apparatus of claim 13, wherein the logic is to,

receive a first request for the location information from a service provider external to the platform,

authenticate the first request,

report to the service provider that current location information is unavailable,

receive a second request for time stamped location information from the service provider,

authenticate the second request,

encrypt the location information from the GPS sensor and the associated timestamp,

sign the encrypted location information and associated timestamp, and

send the encrypted and signed location information and associated timestamp to the service provider.

15. The apparatus of claim 8, wherein the location information is to include an access point basic service set identifier (BSSID) and the logic is to scramble the BSSID.

21. The platform of claim 15, further including a non-volatile memory that is accessible by the secondary processor, wherein the logic is to,

activate the GPS sensor if the platform is in an inactive state based on a predetermined schedule,

request the location information from the GPS sensor if the GPS sensor is activated, and

store the location information and an associated timestamp to the non-volatile memory.

16. A platform comprising:

a wireless data module to receive an access point identifier;

a global positioning system (GPS) sensor;

a primary processor;

a link coupled to the GPS sensor; and

a secondary processor coupled to the link, the secondary processor including logic to,

receive, via the link, a GPS location for the platform from the GPS sensor, wherein the GPS location and the access point identifier are to define location information, and

prevent unauthorized access to the location information by an operating system associated with the primary processor.

17. The platform of claim 16, wherein the link includes a dedicated bus.

18. The platform of claim 16, wherein the link includes a shared bus and the logic is to,

exchange one or more keys with the GPS sensor over the shared bus associated with the platform;

authenticate a signature of the source of the GPS location based on the one or more keys; and

decrypt the GPS location based on the one or more keys.

19. The platform of claim 16, further including a switch disposed between the GPS sensor and the primary processor, wherein the logic is to,

prompt a user of the platform for authorization to permit direct operating system access to the GPS location, and

activate the switch if the authorization is received.

20. The platform of claim 16, wherein the logic is to,

receive a request for the location information from a service provider external to the platform, and

authenticate the request,

encrypt the location information based on one or more keys associated with the service provider,

sign the encrypted location information,

prompt a user of the platform for authorization to release the encrypted and signed location information, and

release the encrypted and signed location information to the platform if the authorization is received.