Method, apparatus and system for remote management of mobile devices

• US 8,321,916 B2
• Filed: 12/19/2008
• Issued: 11/27/2012
• Est. Priority Date: 12/19/2008
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Aissi, Selim, Chhabra, Jasmeet, Prakash, Gyan
• Primary Examiner(s): Poltorak, Peter
• Application Number:
  US12/317,222
• Publication Number:
  US 20100162368A1
• Time in Patent Office: 1,439 Days
• Field of Search: None
• US Class Current: 726/5
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

An apparatus and system for enabling users to remotely manage their devices. Specifically, in one embodiment, in the event of a theft of a device or other such occurrence, a user may send a command to the device to execute a specified command. The command may include actions such as locking the device, shutting down the device, disabling logon'"'"'s to the device and other such actions that may secure the device and the data on the device from unauthorized access. Upon receipt of an authorized unlock credential, the device may once again be made accessible.

Claims

1. A method, comprising:

continuously monitoring, with a theft deterrence agent powered by a first battery included in a device while the device in a power-off state, for messages including at least one command specifying an action to secure the device, wherein the first battery is different than a second battery configured to power on the device;

receiving, in the theft deterrence agent on the device a message directly from a user of the device, via a secure network connection, the message including the at least one command specifying the action to secure the device;

authenticating the message against a secure embedded processor via a secure protocol;

executing the at least one command in the message; and

sending an acknowledgement upon completion of executing the at least one command in the message,

wherein the theft deterrence agent is powered by the second battery when the device is in a power-on state provided by the second battery.

2. The method according to claim 1 further comprising:

requesting approval from the user of the device to execute the at least one command in the message prior to executing the at least one command in the message; and

receiving the approval to execute the at least one command in the message.

3. The method according to claim 1 wherein the action specified by the at least one command comprises a system lockdown.

4. The method according to claim 3 further comprising:

transmitting the system lockdown message from the theft deterrence agent to a system lockdown agent;

storing device state information in a non-volatile random access memory if the system lockdown agent is missing access to the first battery on the device; and

sending a system reset signal to a system reset line on the device to shutdown the device.

5. The method according to claim 4 further comprising receiving an authorized unlock credential to disable the system lockdown and restore the state information on the device.

6. The method according to claim 5 wherein disabling the system lockdown further comprises:

authenticating the unlock credential against a previously provisioned unlock credential on the device, wherein the previously provisioned unlock credential is stored in the secure embedded processor.

7. An apparatus, comprising:

a secure embedded processor; and

a theft deterrence agent coupled to the secure embedded processor and powered by a first battery included in the apparatus while the apparatus in a power-off state, for messages including at least one command specifying an action to secure the apparatus, wherein the first battery is different than a second battery configured to power on the apparatus, and the theft deterrence agent is powered by the second battery when the device is in a power-on state provided by the second battery,

wherein the theft deterrence agent is capable of;

receiving a message directly from a user of the apparatus, via a secure network connection, the message including the at least one command specifying the action to secure the apparatus;

authenticating the message against the secure embedded processor via a secure protocol; and

executing the at least one command in the message and sending an acknowledgement to the user upon completion of executing the at least one command in the message.

8. The apparatus according to claim 7 wherein:

the theft deterrence agent is further capable of requesting approval from the user of the apparatus to execute the at least one command in the message prior to executing the at least one command in the message,

the theft deterrence agent additionally capable of receiving the approval to execute the at least one command in the message.

9. The apparatus according to claim 7 wherein the theft deterrence agent is capable of executing a system lockdown command in the message to lockdown the apparatus.

10. The apparatus according to claim 9 further comprising:

a system lockdown agent coupled to the embedded processor,

the system lockdown agent capable of receiving the system lockdown message from the theft deterrence agent;

the system lockdown agent further capable of storing apparatus state information in a non-volatile random access memory if the system lockdown agent is missing access to the first battery on the apparatus,

the system lockdown agent additionally capable of sending a system reset signal to a system reset line on the apparatus to shutdown the apparatus.

11. The apparatus according to claim 10 wherein the system lockdown agent is further capable of receiving an authorized unlock credential to disable the system lockdown and restore the state information on the apparatus.

12. The apparatus according to claim 11 wherein the system lockdown agent is further capable of disabling the system lockdown by:

authenticating the unlock credential against a previously provisioned unlock credential on the apparatus, wherein the previously provisioned unlock credential is stored in the secure embedded processor.

13. A non-transitory machine accessible medium having stored thereon instructions that, when executed by a machine, cause the machine to:

continuously monitor, with a theft deterrence agent powered by a first battery included in a device while the device in a power-off state, for messages including at least one command specifying an action to secure the device, the first battery being different than a second battery configured to power on the device, the theft deterrence agent being powered by the second battery when the device is in a power-on state provided by the second battery, wherein the device is associated with the machine;

receive in the theft deterrence agent on the device a message directly from a user of the machine, via a secure network connection, the message including the at least one command specifying the action to secure the device;

authenticate the message against a secure embedded processor via a secure protocol;

execute the at least one command in the message; and

send an acknowledgement upon completion of executing the at least one command in the message.

14. The machine accessible medium according to claim 13 wherein the instructions, when executed by the machine, further cause the machine to:

request approval from the user of the machine to execute the at least one command in the message prior to executing the at least one command in the message; and

receive approval to execute the at least one command in the message.

15. The machine accessible medium according to claim 14 wherein the instructions, when executed by the machine, further cause the machine to execute a system lockdown command in the message.

16. The machine accessible medium according to claim 15 wherein the instructions, when executed by the machine, further cause the machine to:

transmit the system lockdown message from the theft deterrence agent to a system lockdown agent;

store device state information in a non-volatile random access memory if the system lockdown agent is missing access to the first battery on the device; and

send a system reset signal to a system reset line on the device to shutdown the machine.

17. The machine accessible medium according to claim 16 wherein the instructions, when executed by the machine, further cause the machine to receive an authorized unlock credential to disable the system lockdown and restore the state information on the machine.

18. The machine accessible medium according to claim 13 wherein the instructions, when executed by the machine, further cause the machine to disable the system lockdown by:

authenticating the unlock credential against a previously provisioned unlock credential on the device, wherein the previously provisioned unlock credential is stored in the secure embedded processor.