System and method for binding a subscription-based computing system to an internet service provider

• US 7,984,497 B2
• Filed: 04/04/2007
• Issued: 07/19/2011
• Est. Priority Date: 04/04/2007
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Carpenter, Todd, Sebesta, David J., Westerinen, William J., Schmidt, Shon
• Primary Examiner(s): Simitoski; Michael J
• Assistant Examiner(s): Jackson; Jenise E
• Application Number:
  US11/696,356
• Publication Number:
  US 20080250129A1
• Time in Patent Office: 1,567 Days
• Field of Search: 726/16, 726/34, 726/29, 713/171, 713/1
• US Class Current: 726/16
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A system for binding a subscription-based computer to an internet service provider (ISP) may include a binding module and a security module residing on the computer. The binding module may identify and authenticate configuration data from peripheral devices that attempt to connect to the computer, encrypt any requests for data from the computer to the ISP, and decrypt responses from the ISP. If the binding module is able to authenticate the configuration data and the response to the request for data from the ISP, then the security module may allow the communication between the computer and the ISP. However, if either the configuration cycle or the response cannot be properly verified, then the security module may degrade operation of the computer.

Claims

1. A method for binding a subscription-based computer to an internet service provider (ISP) comprising:

communicating configuration data from a peripheral device to the subscription-based computer;

determining if a source of the configuration data is authentic;

communicating an encrypted packet from the subscription-based computer to a remote computer of the ISP if the source of the configuration data is authentic, the encrypted packet uniquely identifying the subscription-based computer;

authenticating the encrypted packet at the remote computer;

communicating a heartbeat packet from the remote computer to the subscription-based computer;

authenticating the heartbeat packet at the subscription-based computer; and

maintaining communication between the ISP and the subscription-based computer if the heartbeat packet is authentic.

2. The method of claim 1, wherein the heartbeat packet includes an encrypted ping message from the ISP to the subscription-based computer.

3. The method of claim 1, further comprising communicating the heartbeat packet from the remote computer to the subscription-based computer at a random time interval.

4. The method of claim 1, further comprising degrading the operation of the subscription-based computer if either the source is not authentic, the encrypted packet is not authentic, the encrypted heartbeat packet is not authentic, or the communication between the ISP and the subscription-based computer is disrupted.

5. The method of claim 4, further comprising degrading operation of the subscription-based computer if the configuration data does not belong to a NIC of the subscription-based computer.

6. The method of claim 1, further comprising detecting the configuration data at a Southbridge of the subscription-based computer.

7. A system for binding a subscription-based computer to a service provider comprising:

a binding module residing on the computer including a non-transitory computer-readable medium having computer executable instructions comprising;

a detection module for identifying configuration data from a peripheral device of the computer;

a validation module for authenticating the configuration data; and

a security module residing on the computer, in communication with the binding module, and including a non-transitory computer-readable medium having computer executable instructions comprising a network module for degrading operation of the computer if the validation module does not authenticate the configuration data;

a heartbeat module including a non-transitory computer-readable medium having computer executable instructions comprising;

a heartbeat transmission module for transmitting an encrypted ping message; and

a heartbeat validation module for receiving and verifying the encrypted ping message;

wherein the network module does not degrade operation of the computer if the validation module authenticates the configuration data and a response to a request for data from the subscription-based computer to a remote computer, and the heartbeat validation module receives and verifies the encrypted ping message; and

wherein the heartbeat transmission module resides at the remote computer, and the heartbeat validation module resides at the subscription-based computer.

8. The system of claim 7, wherein the binding module resides on a Southbridge of the computer.

9. The system of claim 7, wherein the binding module further comprises a cryptographic module for encrypting the request for data from the subscription-based computer to the remote computer and for decrypting a response to the request for data from the remote computer;

wherein the validation module authenticates the configuration data and the response to the request for data from the remote computer; and

wherein the network module degrades the operation of the computer if the validation module does not authenticate the configuration data or the response to the request for data from the remote computer.

10. The system of claim 7, wherein the security module further comprises computer executable instructions comprising:

a provisioning module for accessing, decrementing, and storing subscription data during operation of the subscription-based computer;

wherein the subscription data includes a number of subscription units.

11. The system of claim 7, wherein the cryptographic module includes a secure memory storing an encryption key.

12. The system of claim 9, wherein the network module further comprises computer executable instructions for degrading the operation of the computer if a time between sending the request for data from the remote computer and receiving the response is above threshold.

13. The system of claim 7, wherein the binding module resides on a PCI bus of the computer.

14. The system of claim 7, wherein the peripheral device includes at least one of a USB device, a 1394 device, a NIC, a hard drive, a network device, or a flash device.

15. A system including a binding module in communication with a security module of a subscription-based computer, the binding module including a detection module and a cryptographic module, at least one of the binding module and the security module including a memory and a processor physically configured to execute computer executable code for:

accessing, decrementing, and storing a number of subscription units in the memory during operation of the computer;

communicating configuration data from a peripheral device to the computer;

detecting the configuration data at the computer;

authenticating a source of the configuration data;

passing the configuration data to a processor of the computer if the source of the configuration data is authentic;

discarding the configuration data if the source of the configuration data is not authentic

communicating an encrypted packet from the computer to a remote computer of the ISP if the source of the configuration data is authentic, the encrypted packet uniquely identifying the computer;

authenticating the encrypted packet at the remote computer;

communicating an encrypted ping message from the remote computer to the computer at a random time interval;

authenticating the encrypted ping message at the computer;

maintaining communication between the ISP and the computer if the heartbeat packet is authentic.

16. The system of claim 15, wherein the peripheral device is a NIC of the computer.

17. The system of claim 15, further comprising degrading the operation of the computer if either the encrypted packet is not authentic or the encrypted ping message packet is not authentic.