Master-slave security devices

• US 8,151,118 B2
• Filed: 01/29/2007
• Issued: 04/03/2012
• Est. Priority Date: 01/29/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Foster, David James, Schmidt, Shon, Sebesta, David Jaroslav, Steeb, Curt Andrew, Westerinen, William J., Xu, Zhangwei, Carpenter, Todd L.
• Primary Examiner(s): Popham, Jeffrey D
• Assistant Examiner(s): Mangialaschi, Tracy
• Application Number:
  US11/668,446
• Publication Number:
  US 20080183305A1
• Time in Patent Office: 1,891 Days
• Field of Search: 713/189, 726/35, 726/36
• US Class Current: 713/189
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

A computer or other electronic device requiring physical integrity of its components, for example, a pay-per-use computer may use a master security device in communication with a plurality of slave security devices, known as security beans. Each security bean may be given a cryptographic key or keys for use in authenticating communication with the master security device. Each security bean may be coupled to an associated component and may have the ability to disable that associated component. In one embodiment, security bean has an analog switch that may be configured to block or attenuate a critical signal used by the associated component. The security bean may start up in the disable mode and respond to a verified signal from the master security device to enable its corresponding component.

Claims

1. A device for use in enforcing security in a system the device comprising:

a timeout timer configured to be reset in response to receipt of a signal from a master device that is separate from the device;

a processor, that at least in part, determines when an event has occurred, the event comprising an expiration of time at the timeout timer that occurs unless the device receives the signal from the master device that causes the timeout timer to reset;

a cryptographic function coupled to the processor for authenticating communications with the master device;

a switch coupled to the processor and responsive to a signal from the processor related to the event that blocks a “

power OK”

signal external to a corollary device, wherein blocking the “

power OK”

signal prevents the corollary device from beginning its power up sequence, and wherein the corollary device is coupled to and physically separate from the device; and

a port coupled to the processor for communication with the master device, wherein the port is coupled to a communication channel dedicated to communication between the master device and one or more other devices, each of the other devices being substantially identical to the device and including a respective switch configured to block a “

power OK”

signal to a different, respective corollary device that is coupled to and physically separate from the other device.

2. The device of claim 1, wherein the corollary device is a bus and the switch is an analog switch that couples a load to the bus.

3. The device of claim 1, further comprising a memory for storing a cryptographic secret.

4. The device of claim 1, wherein the processor is operable to receive a ping from the master device and respond with an encrypted acknowledgement of the ping.

5. The device of claim 1, wherein the port communicates over one of a dedicated wired bus and wireless network.

6. The device of claim 1, wherein the port communicates over a bus associated with data traffic for the corollary device.

7. A method of binding components in a system, the method comprising:

disposing a plurality of slave devices in the system, each slave device being coupled to and physically separate from a respective component of the system and including a respective switch capable of rendering inoperable the respective component of the system;

disposing a master device in the system wherein the master device sends a request message to each of the plurality of slave devices over a bus dedicated solely to communication between the master device and each of the plurality of slave devices;

determining a total of acknowledge messages received from the slave devices that are responsive to the request message;

sending a disable signal from the master device to each of the plurality of slave devices over the bus when the total of acknowledge messages responsive to the request message fails to meet a threshold level for acknowledgement messages; and

at each of the plurality of slave devices, using the respective switch to impair operation of the respective component coupled to the slave device in response to receipt of the disable signal, the respective switch preventing the respective component from beginning its power up sequence by blocking a “

power OK”

signal.

8. The method of claim 7, wherein determining at the slave device when an event has occurred comprises determining at the slave device that the event has occurred wherein the event is a timeout of a watchdog timer when a timer reset signal from the master device is absent during a predetermined timeout period.

9. The method of claim 7, further comprising sending an acknowledgement from the slave device to the master device responsive to a request from the master device.

10. The method of claim 9, further comprising sending a cryptographically verifiable acknowledgement from the slave device to the master device responsive to a cryptographically verified request from the master device.

11. The method of claim 7, wherein the threshold level requires an acknowledge message responsive to the request message from less than all of the slave devices, wherein the disable signal is not sent from the master device to each of the plurality of slave devices if the total of acknowledge messages meets or exceeds the threshold level.

12. A system for securing an electronic device having a plurality of components, the system comprising:

at least three slave devices operable to disable one or more respective components, the slave devices comprising;

a first slave device operable to interrupt a power OK signal to a processor of the electronic device, wherein the power OK signal comprises a digital signal to the processor that indicates the processor should remain non-operational until the signal is active;

a second slave device operable to interrupt communications between a keyboard and an I/O interface module of the electronic device; and

a third slave device operable to connect a load to a system bus that alters transmission characteristics of the system bus to render the system bus inoperable; and

a security master in communication with each of the first, second, and third slave devices, wherein each of the one or more slave devices disables its respective components when communication between the security master and the slave devices fails to reach a predetermined threshold, wherein the predetermined threshold is indicative of successful communication two from the security master to less than all of the slave devices such that the slave devices do not disable their respective components when communication between the security master and the slave devices is at or exceeds the predetermined threshold.

13. The system of claim 12, wherein each of the slave devices comprises a timeout timer that disables its respective one of the plurality of components unless reset by an acceptable threshold of communication during a timeout period.

14. The system of claim 12, wherein each of the slave devices responds to a poll from the security master and is responsive to a disable message from the security master when a threshold number of the slave devices fail to respond to the poll.

15. The system of claim 12, further comprising a fourth slave device with only power connections and no functional connections to any of the plurality of components to act as a decoy.