ALWAYS-AVAILABLE EMBEDDED THEFT REACTION SUBSYSTEM

• US 20140208447A1
• Filed: 12/22/2011
• Published: 07/24/2014
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Berger, Michael
• Granted Patent: US 9,454,678 B2
• Time in Patent Office: Days
• US Class Current: 726/35
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A platform protected by a system, the platform including a power source, is described. The system in one embodiment comprises a risk behavior logic to detect a potential problem, a core logic component to provide logic to analyze the potential problem and to trigger a security action logic to perform a security action, when the potential problem indicates a theft suspicion, and the security action logic to utilize a kill pill to disable the platform, when the platform has set a high security status authorizing use of a self-kill pill or the platform sends an alert and receives a remote instruction to utilize a remote kill pill.

Claims

1. A platform protected by an always-available theft protection system, the system comprising:

a risk behavior logic to detect a potential problem;

a core logic component to provide logic to analyze the potential problem and to trigger a security action logic to perform a security action, when the potential problem indicates a theft suspicion;

the security action logic to utilize a kill pill to disable the platform, when the platform has set a high security status authorizing use of a self-kill pill or the platform sends an alert and receives a remote instruction to utilize a remote kill pill.

2. The system of claim 1, wherein the self-kill pill is used when an attempt to send an alert is not successful.

3. The system of claim 1, wherein the self-kill pill is used when after a time no response is received to the alert.

4. The system of claim 1, further comprising:

a disarming logic to disarm the system, upon receiving a disarming command indicating that there was no theft.

5. The system of claim 1, wherein disabling the platform comprises erasing data on the platform.

6. The system of claim 1, wherein disabling the platform comprises bricking the platform to render it permanently unusable.

7. The system of claim 1, wherein the core logic and the security action logic operate in low power states as well.

8. A platform protected by a system, the platform including a power source, the system including:

a risk behavior logic to detect a potential problem;

a core logic component to provide logic to analyze the potential problem and to trigger a security action logic to perform a security action, when the potential problem indicates a theft suspicion;

a kill pill to disable the platform, in response to the theft suspicion, the kill pill comprising one of;

a self-kill pill or a remote kill pill authorized by an instruction.

9. The platform of claim 8, further comprising:

the security action logic to send an alert in response to the theft suspicious, requesting instructions for the remote kill pill.

10. The system of claim 8, wherein the self-kill pill is used when an attempt to send an alert is not successful.

11. The system of claim 8, wherein the self-kill pill is used when after a time no response is received to the alert.

12. The system of claim 8, further comprising:

a disarming logic to disarm the system, upon receiving a disarming command indicating that there was no theft, the disarming logic, when received in time, to stop the kill pill.

13. The system of claim 8, wherein disabling the platform comprises erasing data on the platform.

14. The system of claim 8, wherein disabling the platform comprises bricking the platform to render it permanently unusable.

15. The system of claim 8, wherein the core logic and the security action logic operate in low power states as well.

16. A method of protecting a platform from theft comprising:

detecting a potential problem;

determining that the potential problem is an indication of a theft;

triggering a security action, in response to the theft, the security action including a kill pill to disable the platform, the kill pill comprising a self-kill pill and a remote kill pill, such that the platform is disabled whether or not the platform can contact a remote server to activate the remote kill pill.

17. The method of claim 16, wherein the self-kill pill is activated when:

data on the platform is indicated as highly sensitive, an attempt to send an alert to the remote server is unsuccessful, or no response is received to the alert sent to the remote server.

18. The method of claim 16, wherein disabling the platform comprises one of:

deleting data on the platform and bricking the platform to render it unusable.