ALWAYS-AVAILABLE EMBEDDED THEFT REACTION SUBSYSTEM

• US 20140223586A1
• Filed: 12/22/2011
• Published: 08/07/2014
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Berger, Michael, Segal, Mark, Horovitz, Dan
• Granted Patent: US 9,569,642 B2
• Time in Patent Office: Days
• US Class Current: 726/35
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A system comprising a platform protected by an always-on always-available security system is described. In one embodiment, the system includes a risk behavior logic to detect a potential problem, a core logic component to provide logic to analyze the potential problem and to move the platform to a suspecting mode when the potential problem indicates a theft suspicion, and the security action logic, to send periodic alerts to a security server when the platform is in the suspecting mode, the alert including movement related data, such that the security server can take an action to protect the platform.

Claims

1. A system comprising a platform protected by an always-on always-available security system, including:

a risk behavior logic to detect a potential problem;

a core logic component to provide logic to analyze the potential problem and to move the platform to a suspecting mode when the potential problem indicates a theft suspicion;

the security action logic, to send periodic alerts to a security server when the platform is in the suspecting mode, the alert including movement related data, such that the security server can take an action to protect the platform.

2. The system of claim 1, wherein the movement related data comprises received signal strength indicators (RSSI) for a plurality of wireless access points and associated wireless access point identifiers (BSSIDs), the security server using the movement related data to determine a movement of the platform.

3. The system of claim 1, wherein the movement related data comprises information collected from an on-board accelerometer, the security server using the movement related data to determine a movement of the platform.

4. The system of claim 1, further comprising:

a disarming logic to send a notification to the security server when the system exits the suspecting mode.

5. The system of claim 1, further comprising:

an arming logic to send a notification to the security server when the system enters the armed mode, including information about data protection policy.

6. The system of claim 4, wherein the security server takes action when the periodic notices from the security action logic are no longer received, and the notification of disarming was not received.

7. The system of claim 1, wherein the security server takes action when the movement related data indicates suspicious movement, such as movement toward an exit.

8. The system of claim 7, wherein the action includes one or more of:

notifying guards, notifying the user, locking gates or doors, changing a search policy on exit.

9. The system of claim 1, further comprising:

a disarming logic to enable an override of the suspecting mode, without providing a disarming command, the disarming logic to notify the security server of the override.

10. The system of claim 1, wherein the security action logic further sends a system ID of the platform to the security server.

11. The system of claim 4, wherein the disarming logic further sends a system ID of the platform to the security server.

12. The system of claim 1, wherein the arming logic further sends a system ID of the platform to the security server.

13. A security server to monitor security for a platform including an always-on always-available security system, the security server comprising:

a monitor to receive periodic alerts from a platform, when the platform is in a suspecting mode;

a movement/location evaluator to utilize movement/location data from the platform to determine a current location of the platform and whether the platform movement/location indicates a theft;

a timer to time the alerts, and to determine that a break in receiving the periodic alerts indicates a theft; and

an exit control system to control exits when the movement/location evaluator or the timer indicates the theft.

14. The security server of claim 13, further comprising:

the monitor to receive a disarming signal, the monitor to disable the movement/location evaluator and the timer, when the disarming signal is received.

15. The security system of claim 13, further comprising:

the monitor to receive an override signal, the monitor to engage the exit control system, when the override signal is not followed by a disarming signal.

16. The security system of claim 13, wherein the exit control system locks unattended exits and alerts guards at attended exits.

17. The security system of claim 13, wherein the movement/location data comprises wireless access point data (RSSI and BSSID) for a plurality of wireless access points, the system further comprising a wireless AP database to translate the wireless access point data to a physical location.

18. The security system of claim 13, further comprising:

a platform ID database to map an identity of the platform to an appropriate user.

19. The security system of claim 18, further comprising:

an alert logic to send an alert to the appropriate user.

20. The security system of claim 13, further comprising:

an alert log including a log of each arming, disarming, and suspecting message for the platform, and a data protection policy of the platform, such that if the platform is stolen, the alert log may be used to determine whether data on the platform is protected.