Special PC mode entered upon detection of undesired state

• US 8,176,564 B2
• Filed: 06/14/2005
• Issued: 05/08/2012
• Est. Priority Date: 11/15/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Frank, Alexander, Steeb, Curt A., Ahdout, Isaac P., Duffus, James S., Hall, Martin, Temple, Nicholas, Venkatachalam, Rajagopal, Phillips, Thomas, Xu, Zhangwei
• Primary Examiner(s): Popham, Jeffrey D
• Application Number:
  US11/152,214
• Publication Number:
  US 20060107329A1
• Time in Patent Office: 2,520 Days
• Field of Search: 726/27
• US Class Current: 726/27
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/87 by means of encapsulation, e.g. for integrated circuits

Abstract

A system and method for monitoring a computer, particularly a pay-per-use computer, uses an isolated computing environment or supervisor. The isolated computing environment boots prior to any boot device associated with an operating system, runs concurrently with the operating system and monitors and measures the computer in operation. Once the isolated computing environment determines the computer is not in compliance with the required policies, the isolated computing environment may either impose an impediment to use such as slowing clock speed or completely disable the operating system. The user may have to return the computer to a service provider to restore it from the offending condition and reset the computer to an operational state.

Claims

1. A computing device, comprising:

a first memory device storing an operating system of the computing device;

a tamper resistant memory device that is separate from the first memory device, the tamper resistant memory device storing a supervisory program;

a processor coupled to both the first memory device and the tamper resistant memory device;

when a user turns on the computing device, the supervisory program being booted up and readied for operation prior to a time when the operating system of the computing device starts running, the supervisory program having precedence over and operating independently of at least one other boot device in the computing device;

when the computing device is powered up and ready for use by the user on a pay per use or pay as you go basis, the supervisory program generating an initial compliance score that is representative of the computing device'"'"'s compliance with a plurality of policies that indicate the operating system is metering usage of the computing device on the pay per use or the pay as you go basis;

while the computing device is being used on the pay per use or the pay as you go basis, the supervisory program;

receiving data that is representative of a then current operational state of the computing device,

calculating an updated compliance score, and

when the updated compliance score is less than a first threshold, invoking a first sanction mode that limits the ability of the computing device to be used on the pay per use or the pay as you go basis until the user takes corrective action that raises the value of the updated compliance score above the first threshold; and

the supervisory program, during an interval of time for which the user has fully paid for use of the computing device, causing the computing device to enter a non-operational state when, during the interval of time, the supervisory program determines that the updated compliance score falls below a second threshold that is lower than the first threshold,

wherein the operating system stored on the first memory device and the supervisory program stored on the tamper resistant memory device that is separate from the first memory device both execute on the processor concurrently, the supervisory program having guaranteed access to computing cycles on the processor while the processor is also executing the operating system that meters the usage of the computing device.

2. The computing device of claim 1, wherein the computing device comprises a personal computer.

3. The computing device of claim 1, the received data comprising an operating system heartbeat indicating that the operating system is metering the usage of the computing device.

4. The computing device of claim 1, wherein the received data indicates whether the computing device is operating in the first sanction mode.

5. The computing device of claim 1, wherein the received data comprises a time since a last provisioning cycle was executed.

6. A method implemented by a supervisory program on a computing device comprising a processor, the method comprising:

booting the supervisory program on the computing device independently from an operating system that also boots on the computing device;

generating an initial compliance score that is representative of compliance by the computing device with one or more policies that indicate the operating system is metering usage of the computing device;

receiving data that indicates whether the operating system is metering the usage of the computing device;

calculating an updated compliance score based on the received data;

in an instance where the updated compliance score is outside of a first threshold but not a second threshold that is different than the first threshold, invoking a first sanction mode that limits the ability of the computing device to be used on a pay per use or pay as you go basis until a user takes corrective action that changes the value of the updated compliance score to be within the first threshold;

in an instance where the compliance score is outside both the first threshold and the second threshold, causing the computing device to enter a non-operational state,

wherein the operating system is stored in a first memory device and the supervisory program is stored in a tamper resistant memory device that is separate from the first memory device; and

the operating system and the supervisory program both execute concurrently on the processor of the computing device, the supervisory program having guaranteed access to computing cycles on the processor while the processor is also executing the operating system.

7. The method according to claim 6, the second threshold being lower than the first threshold.

8. The method according to claim 6, the received data comprising a heartbeat indicating that the operating system is metering the usage of the computing device.

9. The method according to claim 8, the heartbeat being received at a regular interval.

10. The method according to claim 8, the heartbeat being received from a provisioning module that is supported by the operating system.

11. The method according to claim 10, the heartbeat comprising a digital signature of binary executable code of the provisioning module.

12. The method according to claim 6, the first sanction mode reducing a processor speed of the processor of the computing device.

13. The method according to claim 6, the first sanction mode limiting a display resolution of the computing device.

14. The method according to claim 6, the supervisory program booting before the operating system.

15. The method of claim 6, wherein the updated compliance score is further based on a comparison of a soft clock under control of the operating system to a secure clock time from a tamper resistant time base.

16. One or more computer-readable storage devices comprising executable instructions that perform the method of claim 6.

17. A method comprising:

generating an initial compliance score that is representative of compliance by a computing device with one or more policies that indicate an operating system of the computing device is metering usage of the computing device;

receiving data that indicates whether the operating system is metering the usage of the computing device;

calculating an updated compliance score based on the received data;

in an instance where the updated compliance score reaches a first threshold but not a second threshold that is different than the first threshold, invoking a first sanction mode that limits the ability of the computing device to be used on a pay per use or pay as you go basis until a user takes corrective action that changes the value of the updated compliance score;

in an instance where the compliance score reaches the second threshold, causing the computing device to enter a non-operational state,

wherein the operating system is stored on a first memory device and the generating, the receiving, the calculating, the invoking, and the causing are performed by a program that is stored in a tamper resistant memory device that is separate from the first memory device, and

the operating system and the program both execute concurrently on a processor of the computing device, the program having guaranteed access to computing cycles on the processor while the processor is also executing the operating system.

18. The method according to claim 17, the non-operational state being entered by disabling the operating system.

19. The method according to claim 17, wherein the first sanction mode comprises slowing a clock speed of the processor.

20. One or more computer-readable storage devices comprising executable instructions that perform the method of claim 17.