Persistent security system and method

• US 8,065,509 B2
• Filed: 09/26/2006
• Issued: 11/22/2011
• Est. Priority Date: 09/26/2006
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Ali, Valiuddin Y, Wang, Lan
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): GUIRGUIS, MICHAEL M
• Application Number:
  US11/527,272
• Publication Number:
  US 20080077800A1
• Time in Patent Office: 1,883 Days
• Field of Search: 713 1- 2, 713/187, 719313-317, 726 34- 35, 726/28
• US Class Current: 713/2
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

A persistent security system comprises a computing system comprising an operating system (OS), a basic input/output system (BIOS) and a hard disk drive (HDD), the OS configured to initiate a call to the BIOS to cause the BIOS to write an instance of a security routine to the HDD.

Claims

1. A persistent security system, comprising:

a computing system comprising an operating system (OS), a basic input/output system (BIOS) and a hard disk drive (HDD), wherein upon each booting of the computing system, including after a boot sequence by the BIOS and transfer of control of the computing system to the OS, and after decryption of the HDD by the OS, presence of an instance of a security routine on the HDD is verified, wherein the OS is configured to initiate a call to the BIOS to cause the BIOS to write an instance of the security routine to the HDD if an instance of the security routine is absent from the HDD.

2. The system of claim 1, wherein the boot sequence is executed in response to one of a power-on event and a wake event of the computing system.

3. The system of claim 1, wherein the OS is configured to determine whether an instance of the security routine resides on the HDD.

4. The system of claim 1, wherein the BIOS is configured to determine whether an instance of the security routine resides on the HDD.

5. The system of claim 1, wherein the instance of the security routine is written to the HDD in an encrypted format.

6. The system of claim 1, wherein an instance of the security routine resides in the BIOS.

7. The system of claim 1, wherein the OS is configured to obtain a key for decrypting data residing on the HDD.

14. The system of claim 1, wherein decryption of the HDD comprises validation of a security credential provided by a user and acquisition of a decryption key for the HDD.

15. The system of claim 1, wherein after the instance of the security routine is written to the HDD, the BIOS returns control of the computing system to the OS, and the OS executes the instance of the security routine.

16. The system of claim 1, wherein the security routine comprises an asset protection security routine configured to communicate with a security service via a communication network and facilitate one of tracking and recovery of the computing system if the computing system is one of lost and stolen.

8. A persistent security method, comprising:

during each boot operation of a computing system, determining whether an instance of a security routine resides on a hard disk drive (HDD) of the computing system; and

initiating a call from an operating system (OS) to a basic input/output system (BIOS) of the computing system to cause the BIOS to write an instance of the security routine to the HDD if an instance of the security routine is absent from the HDD,

wherein initiating the call to the BIOS and writing an instance of the security routine to the HDD is performed after a boot sequence by the BIOS, after transfer of control of the computing system to the OS, and after decryption of the HDD.

9. The method of claim 8, further comprising determining by the OS whether the instance of the security routine resides on the HDD.

10. The method of claim 8, further comprising determining by the BIOS whether the instance of the security routine resides on the HDD.

11. The method of claim 8, further comprising writing the instance of the security routine to the HDD in an encrypted format.

12. The method of claim 8, further comprising retrieving an instance of the security routine from the BIOS for writing to the HDD.

13. The method of claim 8, further comprising obtaining a key for decrypting data residing on the HDD.

17. The method of claim 8, wherein the boot sequence is executed in response to one of a power-on event and a wake event of the computing system.

18. The method of claim 8, wherein decryption of the HDD comprises validation of a security credential provided by a user and acquisition of a decryption key for the HDD.

19. The method of claim 8, further comprising after writing the instance of the security routine to the HDD, returning control of the computing system to the OS and executing the instance of the security routine.

20. The method of claim 19, wherein executing the instance of the security routine comprises interfacing with a remote security service via a communication network to facilitate one of tracking and recovery of the computing system if the computing system is one of lost and stolen.