Method and apparatus to monitor and locate an electronic device using a secured intelligent agent via a global network

• US 6,300,863 B1
• Filed: 03/24/1998
• Issued: 10/09/2001
• Est. Priority Date: 11/15/1994
• Status: Expired due to Term

• Current Assignee: Absolute Software Corporation
• Original Assignee: Absolute Software Corporation
• Inventors: Livingston, Peter Michael Bruce, Cotichini, Christian, Cain, Fraser, Ashworth, David G., Solymar, Gabor
• Primary Examiner(s): Zimmerman, Brian
• Assistant Examiner(s): Dalencourt, Yves
• Application Number:
  US09/047,030
• Time in Patent Office: 1,295 Days
• Field of Search: 340/825.34, 340/426, 340/539, 340/10.42, 714/45, 709/200, 709/217, 709/219, 342/457
• US Class Current: 340/5.8
• CPC Class Codes: G06F 11/006 Identification G06F11/2289 takes precedence
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

A system for locating and monitoring electronic devices utilizing a security system that is secretly and transparently embedded within the software, firmware, or hardware of a computer. This security system initiates the client computer to periodically and conditionally call a host system to provide unique identifying indicia and location information. In one embodiment, the security system calls the host through a public switched telephone network (PSTN) and transmits the indicia in encoded form. In an alternative embodiment, which may be incorporated concurrently with the PSTN application, the security system calls the host system through the Internet and provides the host with indicia encoded within the DNS query sent. The host system is able to identify the calling computer from the indicia and is able to physically locate the computer through either caller identification or by referencing the Internet links which were used to connect the calling computer with the host system.

Claims

1. A method for tracing an electronic device having an agent initiating communication and providing identifying indicia to a host system, said electronic device connectable to said host system through a global network, said method comprising the steps of:

automatically providing said host system with said identifying indicia through said global network for determining the identity of said electronic device; and

providing said host system with one or more global network communication links used to enable transmission between said electronic device and said host system, said transmission via said communication links used for determining the location of said electronic device.

2. The method of claim 1 wherein said global network includes Internet.

3. The method of claim 1 wherein said electronic device is further connected to said host system through a telephone network, and said method further comprising the steps of:

providing said identifying indicia to said host system through said telephone network; and

determining the location of said electronic device by tracing the source of said identifying indicia within said telephone network.

4. The method of claim 1 wherein said electronic device is further connected to said host system through a cablevision network, and said method further comprising the steps of:

providing said identifying indicia to said host system through said cablevision network; and

determining the location of said electronic device by tracing the source of said identifying indicia within said cablevision network.

5. The method of claim 1 wherein said electronic device is further connected to said host system through a wireless radio frequency network, and said method further comprising the steps of

providing said identifying indicia to said host system through said wireless radio frequency network;

and

determining the location of said electronic device by tracing the source of said identifying indicia within said wireless radio frequency network.

6. The method of claim 1 wherein said electronic device is further connected to said host system through a wireless microwave network, and said method further comprising the steps of:

providing said identifying indicia to said host system through said wireless microwave network; and

determining the location of said electronic device by tracing the source of said identifying indicia within said wireless microwave network.

7. The method of claim 3 wherein said step of providing said host system with said identifying indicia through said global network, and said step of providing said identifying indicia to said host system through said telephone network occur at predetermined intervals.

8. The method of claim 7 wherein said electronic device is lost or stolen and said method further including the step of tracing lost or stolen electronic devices.

9. The method of claim 2 wherein said step of providing said host system with said one or more of the Internet communication links i accomplished using a traceroute routine.

10. The method of claim 1 wherein said step of providing said host system with said identifying indicia is accomplished by sending a data packet including address information relating to the source of the global network transmission.

11. The method of claim 2 wherein said step of providing said host system with said identifying indicia is accomplished by sending a domain name service query with said identifying indicia encoded therein.

12. The method of claim 2 further including the step of providing a list of lost or stolen electronic devices to said host system and comparing said list of lost or stolen electronic devices with said identifying indicia to determine if said electronic device is lost or stolen.

13. The method of claim 12 wherein said host system sends a signal through said Internet to said electronic device if it is determined to be lost or stolen indicating that said lost or stolen electronic device should initiate a traceroute routine.

14. The method of claim 12 wherein said host system sends a signal through said Internet to said electronic device if it has been determined to be lost or stolen indicating that said electronic device should initiate a call to said host system via said telephone network.

15. The method of claim 11 wherein said identifying indicia is encoded within said domain name service query according to a predetermined scheme.

16. The method of claim 15 wherein said host system decodes said identifying indicia to determine the identity of said electronic device.

17. The method of claim 1 wherein said electronic device is a computer having a hard drive.

18. The method of claim 17 further including the step of providing said agent with deflection means to enable said agent to resist disablement attempts and evade detection.

19. The method of claim 18 wherein said deflection means deflects read and write attempts to the location where said agent is disposed.

20. The method of claim 1 wherein said step of evading detection is accomplished by providing an agent which is operable without interfering with the normal operation of said electronic device.

21. The method of claim 17 wherein said step of loading said agent within said computer is accomplished by loading said agent within the boot sector of said hard drive.

22. The method of claim 17 wherein said step of loading said agent within said computer is accomplished by loading said agent within the partition sector of said hard drive.

23. The method of claim 17 wherein said step of loading said agent within said computer is accomplished by loading said agent within an operating system file on said hard drive.

24. The method of claim 23 wherein said operating system is MS-DOS and said operating system file is IO.SYS.

25. The method of claim 23 wherein said operating system is PC-DOS and said operating system file is IBMBIO.COM.

26. The method of claim 17 wherein said step of loading said agent within said computer is accomplished by loading said agent on the ROM BIOS.

27. The method of claim 17 wherein said agent is a terminated and stay resident program.

28. The method of claim 17 wherein said agent is a virtual device driver program.

29. The method of claim 17 wherein said agent is an application program.

30. The method of claim 17 wherein said agent is a file filter program.

31. The method of claim 1 wherein said agent provides said identifying indicia automatically and without user intervention.

32. The method of claim 31 wherein said step of providing said host system with said identifying indicia occurs without causing audible or visible signals to be emitted from said electronic device.

33. The method of claim 2 wherein the communication link between said electronic device and said host system is provided through a link to a private network connection to the Internet.

34. The method of claim 2 wherein the communication link between said electronic device and said host system is provided through a telephone line connected to an Internet provider.

35. The method of claim 1 further comprising the step of assigning said identifying indicia to said agent wherein said identifying indicia comprises a unique electronic serial number, said electronic serial number for enabling the determination of the identity of said electronic device associated with said agent.

36. The method of claim 1 further comprising the step of loading said agent within said electronic device for with said host system such that said agent evades detection.

41. The method of claim 36 wherein said global network is the Internet and said step of providing said identifying indicia is accomplished by encoding a domain name service query to include said identifying indicia.

43. The method of claim 1 wherein the Agent is encoded in one or more forms, including software, firmware and hardware.

44. The method of claim 43 wherein the Agent is encoded in one or more device components in the electronic device, including internal non-volatile memory device, communication device, processor, digital signal processor, integrated circuit and hardware circuit.

45. The method of claim 44 wherein the internal non-volatile memory device includes one of ROM BIOS, ROM, EPROM, EEPROM and Flash ROM.

46. The method of claim 44 wherein the communication device is a modem.

47. The method of claim 46 wherein the Agent establishes communication with the host system by using a command function which initializes the communication and a call management function which interfaces with the host system.

48. The method of claim 44 wherein the Agent establishes communication with the host system independent of normal operations of the electronic device.

53. The method of claim 44 wherein a first component of the Agent is provided in a first device component and a second component of the Agent is provided in a second device component.

54. The method of claim 53 wherein the first component of the Agent includes a secure protocol component of the Agent which communicates with the electronic device'"'"'s operating system.

55. The method of claim 54 wherein the Agent immediately establishes the communication link with the host system to transmit the identifying indicia of the electronic device if the secure protocol component fails to establish communication with the operating system.

56. The method of claim 53 wherein the second device component includes a hard disk drive.

37. A method for monitoring an electronic device connectable to a host system through a global network, said electronic device having an agent, said agent providing identifying indicia for determining the identity of said electronic device, said method comprising the steps of:

loading said agent within said device such that said agent evades detection; and

automatically providing said host system with said identifying indicia through said network without causing audible or visual signals to be emitted from said electronic device.

38. The method of claim 37 wherein said electronic device is further connected to said host system through a telephone network, and said method further includes the step of providing said identifying indicia to said host system through said telephone network.

39. The method of claim 37 wherein said step of providing said identifying indicia occurs automatically and without human intervention.

40. The method of claim 38 wherein said step of providing said host system with said identifying indicia through said global network, and said step of providing said identifying indicia to said host system through said telephone network occur at predetermined intervals.

42. The method of claim 7 or 40 wherein said step of providing said host system with said identifying indicia through said global network, and said step of providing said identifying indicia to said host system through said telephone network occur simultaneously.

49. The method of claim 42 wherein the Agent is activated independent of normal system operations of the electronic device.

50. The method of claim 42 wherein the Agent is activated prior to normal system operations of the electronic device.

51. The method of claim 49 wherein the Agent is activated by loading into an internal volatile memory and running the Agent prior to activating normal system operations of the electronic device.

52. The method of claim 50 further comprising the steps of:

checking whether the Agent is also found on a hard disk within the electronic device; and

copying the Agent to the hard disk prior to loading and running the Agent.

57. An apparatus within an electronic device including an agent for initiating communication with a host monitoring system and providing identifying indicia to a host monitoring system, said electronic device connectable to said host monitoring system through a global network, said apparatus comprising:

means for automatically providing said host monitoring system with said identifying indicia through said global network for determining the identity of said electronic device;

means for providing said host monitoring system with one or more global network communication links used to enable transmission between said electronic device and said host monitoring system; and

means for assisting the host monitoring system to determine the location of said electronic device by tracing said communication links.

58. The apparatus of claim 57 wherein said electronic device is further connected to said host monitoring system through a cablevision network, and said apparatus further includes means for providing said identifying indicia to said host monitoring system through said cablevision network, and means for determining the location of said electronic device by tracing the source of said identifying indicia within said cablevision network.

59. The apparatus of claim 57 wherein said electronic device is further connected to said host monitoring system through a wireless radio frequency network, and said apparatus further includes mean, for providing said identifying indicia to said host monitoring system through said wireless radio frequency network, and means for determining the location of said electronic device by tracing the source of said identifying indicia within said wireless radio frequency network.

60. The apparatus of claim 57 wherein said electronic device is further connected to said host monitoring system through a wireless microwave network, and said apparatus further includes means for providing said identifying indicia to said host monitoring system through said wireless microwave network, and means for determining the location of said electronic device by tracing the source of said identifying indicia within said wireless microwave network.

61. The apparatus of claim 57 wherein said electronic device is a computer having a hard drive.

62. The apparatus of claim 57 wherein said agent evades detection by operating without interfering with the normal operation of said electronic device.

63. The apparatus of claim 57 wherein said means for providing said host monitoring system with said identifying indicia operates automatically and without user intervention.

64. The apparatus of claim 62 wherein said means for providing said host monitoring system with said identifying indicia for said electronic device occurs without causing audible or visible signals to be emitted from said electronic device.

65. The apparatus of claim 57 wherein said global network is the Internet.

66. The apparatus of claim 65 wherein said agent is provided with deflection means for evading detection and resisting disablement.

67. The apparatus of claim 66 wherein said deflection means deflect read and write attempts to the location on said hard drive where said agent is disposed.

68. The apparatus of claim 65 wherein said identifying indicia is encoded within a domain name service query.

69. The apparatus of claim 68 wherein said host monitoring system includes means for decoding said identifying indicia to determine the identity of said electronic device.

70. The apparatus of claim 65 wherein said means for providing said host monitoring system with said one or more global network communication links is accomplished using a traceroute routine.

71. The apparatus of claim 65 wherein said Internet connection between said electronic device and said host monitoring system is provided through a link to a private network connection to the Internet.

72. The apparatus of claim 69 wherein said link to a private network connection to the Internet is a wireless link.

73. The apparatus of claim 65 wherein said Internet connection between said electronic device and said host monitoring system is provided through a telephone line connected to an Internet provider.

74. The apparatus of claim 65 further including means for assigning said identifying indicia to said agent wherein said identifying indicia comprises a unique electronic serial number, said electronic serial number for enabling the determination of the identity of said electronic device associated with said agent.

75. The apparatus of claim 57 wherein said electronic device is further connected to said host monitoring system through a telephone network, and said apparatus further includes means for providing said identifying indicia to said host monitoring system through said telephone network, and means for determining the location of said electronic device by tracing the source of said identifying indicia within said telephone network.

76. The apparatus of claim 75 wherein said means for providing said host monitoring system with said identifying indicia through said global network, and said means for providing said identifying indicia to said host monitoring system through said telephone network operate at predetermined intervals.

77. The apparatus of claim 75 wherein said electronic device is lost or stolen.

78. The apparatus of claim 75 further including means for providing a list of lost or stolen electronic devices to said host monitoring system and means for comparing said list of lost or stolen electronic devices with said identifying indicia to determine if said electronic device is lost or stolen.

79. The apparatus of claim 78 wherein said host monitoring system includes means for sending a signal through the Internet to said electronic device if it is determined to be lost or stolen, indicating that said lost or stolen electronic device should initiate said traceroute routine.

80. The apparatus of claim 78 wherein said host monitoring system includes means for sending a signal through the Internet to said electronic device if it is determined to be lost or stolen indicating that said lost or stolen electronic device should initiate a call to said host monitoring system through said telephone network.

81. The apparatus of claim 57 wherein the Agent is encoded in one or more forms, including software, firmware and hardware.

82. The apparatus of claim 81 wherein the Agent is encoded in one or more device components in the electronic device, including internal non-volatile memory device, communication device, processor, digital signal processor, integrated circuit and hardware circuit.

83. The apparatus of claim 82 wherein the internal non-volatile memory device includes one of ROM BIOS, ROM, EPROM, EEPROM and Flash ROM.

84. The apparatus of claim 83 wherein the communication device is a modem.

85. The apparatus of claim 84 wherein the Agent comprises a command function which initializes communication with the host system and a call management function which interfaces with the host system.

86. The apparatus of claim 82 wherein the Agent is configured to establish communication with the host system independent of normal operations of the electronic device.

87. The apparatus of claim 83 wherein the Agent is configured to be activated independent of normal system operations of the electronic device.

88. The apparatus of claim 87 wherein the Agent is configured to be activated prior to normal system operations of the electronic device.

89. The apparatus of claim 87 wherein the Agent is configured to be loaded into an internal volatile memory and executed prior to activating normal system operations of the electronic device.

90. The apparatus of claim 88 wherein the Agent is further configured to check whether the Agent is also found on a hard disk within the electronic device and copying the Agent to the hard disk prior to loading and running the Agent.

91. The apparatus of claim 82 wherein a first component of the Agent is provided in a first device component and a second component of the Agent is provided in a second device component.

92. The apparatus of claim 91 wherein the first component of the Agent includes a secure protocol component of the Agent which communicates with the electronic device'"'"'s operating system.

93. The apparatus of claim 92 wherein. the Agent is configured to immediately establish the communication link with the host system to transmit the identifying indicia of the electronic device if the secure protocol component fails to establish communication with the operating system.

94. The apparatus of claim 91 wherein the second internal memory device is a hard disk drive.