Hardware access and monitoring control

• US 8,819,858 B2
• Filed: 12/19/2012
• Issued: 08/26/2014
• Est. Priority Date: 06/03/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Mandava, Srikanth
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US13/720,730
• Publication Number:
  US 20130111569A1
• Time in Patent Office: 615 Days
• Field of Search: 726/3, 726/4, 726 17- 20, 726 34- 36, 710/8, 710 15- 17
• US Class Current: 726/34
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Various embodiments described and illustrated here include one or more of systems, methods, software, and data structures that may be used to implement policies for hardware access and monitoring control in concert with a premises security system that controls ingress and egress of a facility. One embodiment includes identifying when certain devices are removed or decoupled from a computer and preventing one or more users of that computer from leaving a facility within which the computer is located.

Claims

1. A non-transitory computer-readable medium, with instructions thereon that are executable by a computer to:

maintain a list of devices coupled to a computer;

when the computer is attached to a power source, but regardless of whether the computer is in a powered on state, determine if each device in the list is communicatively coupled to the computer; and

upon determining a device in the list is not physically coupled to the computer, send a notice over a network via a network interface device of the computer to a premises security system that the device is not communicatively coupled to the computer, the premises security system controlling ingress and egress from a premises within which the computer is located, wherein the notice includes data identifying one or more users of the computer, the notice to cause the premises security system to prevent egress from the premises of at least the one or more users of the computer.

2. The non-transitory computer-readable medium of claim 1, wherein the device is a data storage device and the notice includes data identifying the data storage device.

3. The non-transitory computer-readable medium of claim 1, wherein the maintaining, determining and sending are performed by an out-of-band controller of the computer, the out-of-band controller is configured to operate when the computer is attached to the power source even when the computer is turned off.

4. The non-transitory computer-readable medium of claim 1, wherein the list of devices coupled to the computer includes at least one Peripheral Component Interface (“

PCI”

) device.

5. The non-transitory computer-readable medium of claim 1, wherein the list of devices coupled to the computer includes at least one Universal Serial Bus (“

USB”

) device.

6. The non-transitory computer-readable medium of claim 1, with further instructions stored thereon that are further executable by the computer to:

receive an interrupt from a Basic Input-Output System (“

BIOS”

) of the computer indicating a hot-pluggable device has been connected to or removed from the computer;

obtain device identifying data of the hot-pluggable device;

compare the device identifying data to permissions data of authorized devices to determine what permissions are allowed with regard to the hot-pluggable device; and

implement the determined permissions.

7. The non-transitory computer-readable medium of claim 6, wherein a violation of an implemented permission triggers a sending of a second notice over the network via the network interface device of the computer to the premises security system, the second notice including data identifying the permission violation.

8. A method comprising:

maintaining, in a memory of a computer, a list of devices coupled to the computer;

when the computer is attached to a power source, but regardless of whether the computer is in a powered on state, determining if each device in the list is communicatively coupled to the computer, the determining including a controller of the computer requesting and receiving property data from devices coupled to the computer and the controller of the computer comparing the received property data with the list of devices coupled to the computer; and

upon the controller determining a device in the list is not physically coupled to the computer, sending a notice over a network via a network interface device of the computer to a premises security system that the device is not communicatively coupled to the computer, the premises security system controlling ingress and egress from a premises within which the computer is located, wherein the notice includes data identifying one or more users of the computer, the notice to cause the premises security system to prevent egress from the premises of at least the one or more users of the computer.

9. The method of claim 8, wherein the device is a data storage device and the notice includes data identifying the data storage device.

10. The method of claim 8, wherein the method is performed by an out-of-band controller of the computer when the computer is turned off.

11. The method of claim 8, wherein the list of devices coupled to the computer includes at least one Peripheral Component Interface (“

PCI”

) device.

12. The method of claim 8, wherein the list of devices coupled to the computer includes at least one Universal Serial Bus (“

USB”

) device.

13. The method of claim 8, further comprising:

receiving an interrupt from a Basic Input-Output System (“

BIOS”

) of the computer indicating a hot-pluggable device has been connected to or removed from the computer;

obtaining device identifying data of the hot-pluggable device;

comparing the device identifying data to permissions data of authorized devices to determine what permissions are allowed with regard to the hot-pluggable device; and

implementing the determined permissions.

14. The method of claim 13, wherein a violation of an implemented permission triggers a sending of a second notice over the network via the network interface device of the computer to the premises security system, the second notice including data identifying the permission violation.

15. A system comprising:

a bus;

a network interface device coupled to the bus;

a device coupled to the system;

a processor coupled to the bus and including an out-of-band controller, wherein the out-of-band controller is configured to operate when the system is attached to the power source even when the system is turned off to;

identify the device has been decoupled from the system;

access a stored list of devices coupled to the system, the stored list including permissions data with regard to at least one device indicating the at least one device is not to be decoupled from the system;

compare property data of the device decoupled from the system to the stored list of devices coupled to the system;

upon determining the device decoupled from the system is one of the at least one devices that is not to be decoupled from the system, send a notice over a network via the network interface device to a premises security system indicating the device has been decoupled from the system, the premises security system controlling ingress and egress from a premises within which the system is located, wherein the notice includes data identifying one or more users of the system, the notice to cause the premises security system to prevent egress from the premises of at least the one or more users of the system.

16. The system of claim 15, wherein the device is a data storage device and the notice includes data identifying the data storage device.

17. The system of claim 15, wherein the list of devices coupled to the computer includes at least one of a Peripheral Component Interface (“

PCI”

) device and a Universal Serial Bus (“

USB”

) device.