System and method for binding a subscription-based computing system to an internet service

• US 8,533,801 B2
• Filed: 06/14/2011
• Issued: 09/10/2013
• Est. Priority Date: 04/04/2007
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Carpenter, Todd, Schmidt, Shon, Sebesta, David J., Westerinen, William J.
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): SCHMIDT, KARI L
• Application Number:
  US13/159,886
• Publication Number:
  US 20110271335A1
• Time in Patent Office: 819 Days
• Field of Search: 726/16, 726/34, 726 1- 4, 726/6, 726/7, 726/13, 726/17, 726/21, 726/26, 726/39, 713/171, 713/1, 713/153, 713/155, 713/160, 713/161, 713/193, 713/194, 380/277, 380/278
• US Class Current: 726/7
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A system for binding a subscription-based computer to an internet service provider (ISP) may include a binding module and a security module residing on the computer. The binding module may identify and authenticate configuration data from peripheral devices that attempt to connect to the computer, encrypt any requests for data from the computer to the ISP, and decrypt responses from the ISP. If the binding module is able to authenticate the configuration data and the response to the request for data from the ISP, then the security module may allow the communication between the computer and the ISP. However, if either the configuration cycle or the response cannot be properly verified, then the security module may degrade operation of the computer.

Claims

1. A method for binding a subscription-based computer to an internet service provider (ISP) comprising:

receiving configuration data from a peripheral device at the subscription-based computer;

determining if a source of the configuration data is authentic;

communicating an encrypted packet from the subscription-based computer to a remote computer of the ISP if the source of the configuration data is authentic, the encrypted packet uniquely identifying the subscription-based computer;

receiving a heartbeat packet from the remote computer at the subscription-based computer, if the encrypted packet is authenticated at the remote computer;

authenticating the heartbeat packet at the subscription-based computer; and

controlling the subscription-based computer to maintain communication with the ISP if the heartbeat packet is authentic.

2. The method of claim 1 wherein the heartbeat packet includes an encrypted ping message from the ISP to the subscription-based computer.

3. The method of claim 1 wherein receiving the heartbeat packet comprises:

receiving the heartbeat packet from the remote computer at a random time interval.

4. The method of claim 1 wherein controlling the subscription-based computer comprises:

degrading operation of the subscription-based computer if the source of the configuration data is not authentic.

5. The method of claim 4 wherein controlling the subscription-based computer comprises:

degrading the operation of the subscription-based computer if the heartbeat packet is not authentic.

6. The method of claim 5 wherein controlling the subscription-based computer comprises:

degrading the operation of the subscription-based computer if the encrypted packet is not authentic.

7. The method of claim 6 wherein controlling the subscription-based computer comprises:

degrading the operation of the subscription-based computer if communication between the ISP and the subscription-based computer is disrupted.

8. The method of claim 7 wherein controlling the subscription-based computer comprises:

degrading the operation of the subscription-based computer if the configuration data does not belong to a network interface controller of the subscription-based computer.

9. A system for binding a subscription-based computer to a service provider, the system comprising:

a processor of the subscription-based computer;

a binding module residing on the subscription-based computer including computer storage media having computer executable instructions comprising;

a detection module identifying configuration data received from a peripheral device of the subscription-based computer;

a validation module authenticating the configuration data; and

a security module residing on the subscription-based computer, in communication with the binding module, including computer storage media, having computer executable instructions comprising a network module that degrades operation of the subscription-based computer if the validation module does not authenticate the configuration data;

a heartbeat module residing on the subscription-based computer including computer storage media having computer executable instructions comprising a heartbeat validation module that receives and verifies an encrypted ping message received from a remote computer using the processor of the subscription-based computer, wherein the network module does not degrade the operation of the subscription-based computer if the validation module authenticates the configuration data and a response to a request for data, sent from the subscription-based computer to the remote computer, and if the heartbeat validation module receives and verifies the encrypted ping message.

10. The system of claim 9 wherein the binding module resides on a Southbridge of the computer.

11. The system of claim 9 wherein the binding module comprises a cryptographic module encrypting the request for data sent from the computer to the remote computer and decrypting the response to the request for data.

12. The system of claim 11 wherein the validation module authenticates the response to the request for data, and wherein the network module degrades operation of the computer if the validation module does not authenticate the configuration data or the response to the request for data.

13. The system of claim 11 wherein the cryptographic module includes a secure memory storing an encryption key.

14. The system of claim 9 wherein the security module further comprises:

a provisioning module that accesses, decrements and stores subscription data, including a number of subscription units, during operation of the computer.

15. The system of claim 9 wherein the network module degrades the operation of the computer if a time between sending the request for data and receiving the response is above a threshold.

16. The system of claim 9 wherein the binding module resides on a peripheral component interconnect (PCI) bus of the computer.

17. A system including a binding module that communicates with a security module of a subscription-based computer, the binding module including a detection module and a cryptographic module, at least one of the binding module and the security module including a memory and a processor physically configured to execute computer executable code for:

accessing, decrementing and storing a number of subscription units in the memory during operation of the subscription-based computer;

receiving, at the subscription-based computer, configuration data from a peripheral device;

authenticating a source of the configuration data;

passing the configuration data to a processor of the subscription-based computer if the source of the configuration data is authentic;

discarding the configuration data if the source of the configuration data is not authentic;

sending an encrypted packet from the subscription-based computer to a remote computer of an independent service provider (ISP) if the source of the configuration data is authentic, the encrypted packet uniquely identifying the subscription-based computer;

receiving an encrypted ping message from the remote computer at a random time interval;

authenticating the encrypted ping message at the computer; and

controlling the subscription-based computer to maintain communication between the ISP and the subscription-based computer if the encrypted ping message is authentic.

18. The system of claim 17 and further comprising:

controlling the subscription-based computer to degrade operation of the subscription-based computer if the encrypted packet is not authentic.

19. The system of claim 17 and further comprising:

controlling the subscription-based computer to degrade operation of the subscription-based computer if the encrypted ping message is not authentic.