Security module having a secondary agent in coordination with a host agent

• US 9,197,651 B2
• Filed: 10/27/2014
• Issued: 11/24/2015
• Est. Priority Date: 01/16/2007
• Status: Active Grant

• Current Assignee: Absolute Software Corporation
• Original Assignee: Absolute Software Corporation
• Inventors: Gordon, William Doyle
• Primary Examiner(s): SCHMIDT, KARI L
• Application Number:
  US14/525,170
• Publication Number:
  US 20150046980A1
• Time in Patent Office: 393 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G08B 13/1418 Removal detected by failure in electrical connection between the appliance and a control centre, home control panel or a power supply
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

The invention is directed to a security module deployed in a host device, which provides a secondary agent that operates in coordination with the host agent in the host device, but operates independent of the host operating system of the host device to independently access an existing communication network interface in the host device or a separate dedicated network interface, if available. In one aspect, the present invention enables robust theft recovery and asset tracking services. The system comprises a monitoring center; one or more monitored devices; a security module in the monitored devices; and one or more active communications networks. Monitored devices may be stand alone devices, such as computers (e.g., portable or desktop computers), or a device or a subsystem included in a system. A monitored device comprises a security module, a host agent and software to support the host agent that runs in the monitored device'"'"'s OS.

Claims

1. A method of tracking a device comprising:

running a host agent within a host operating system in the device, said host agent accessing at least one network;

running a secondary agent in the device wherein said secondary agent accesses said at least one network independently of the host operating system; and

connecting, to said at least one network, a monitoring center configured to communicate with the host agent and the secondary agent;

wherein the secondary agent and the host agent interface to coordinate with each other to;

determine which is to access said at least one network to communicate attributes of one or both of the device and host operating system to the monitoring center, and

communicate said attributes to the monitoring center by the host agent in preference to the secondary agent.

2. The method of claim 1, wherein said host agent and said secondary agent access the at least one network via at least one network interface in the device.

3. The method of claim 2, wherein:

said at least one network comprises first and second networks;

said at least one network interface comprises a host network interface that is accessible by both the host agent and the secondary agent to access said first network; and

said at least one network interface comprises a secondary network interface to which the secondary agent has dedicated access to communicate with the monitoring center via the second network.

4. The method of claim 3, wherein the secondary agent and the monitoring center communicate said attributes to the monitoring center via the secondary network interface if the host network interface becomes unavailable.

5. The method of claim 1, comprising:

running the host agent on a processor in the device, and

running the secondary agent in a virtual environment on the processor.

6. The method of claim 1., comprising:

running the host agent on a processor in the device; and

independently powering the secondary agent so that it can function independently of the processor.

7. The method of claim 6, further comprising the secondary agent booting or resuming operation of the host operating system.

8. The method of claim 7, comprising the secondary agent:

contacting the monitoring center;

receiving instruction from the monitoring center to resume operation of the host operating system; and

requesting the host agent to contact the monitoring center.

9. The method of claim 1, comprising the host agent and the secondary agent coordinating access to said at least one network in a manner to minimize network charges.

10. The method as in claim 9, wherein:

said at least one network interface comprises multiple network interfaces; and

the host agent and secondary agent minimize network charges by selecting use of lower cost networks.

11. The method of claim 1, comprising the secondary agent accessing said at least one network when the host agent is not functional to access said at least one network.

12. The method as in claim 1, comprising reinstalling the host agent when the host operating system detects the secondary agent present in the device.

13. The method as in claim 12, comprising:

the host agent providing one or more device tracking and management services; and

storing licenses associated with the services in a persistent storage location in the device.

14. The method as in claim 1, wherein said at least one network comprises a cellular network.

15. The method as in claim 14, comprising the monitoring center requesting, by transmitting an Short Message Service (SMS) message to the cellular network, the host agent or the secondary agent to contact the monitoring center.

16. The method as in claim 14, comprising the host agent or the secondary agent contacting the monitoring center via the cellular network by sending a further Short Message Service (SMS) via a cellular modem associated with a number, wherein the monitoring center can determine the number from source information contained in the further SMS message.

17. The method as in claim 1 comprising, in response to an event requiring communication between the device and the monitoring center, the step of provisioning a subscription of the device to the at least one network to enable communications of the device to the monitoring center via said at least one network.

18. The method as in claim 1, wherein said, at least, one network interface comprises at least two network interfaces, of which one is used exclusively for communicating with the monitoring center.

20. The method of claim 1 comprising:

automatically installing the host agent and the secondary agent upon installation of the operating system;

detecting, by the host agent, an absence from the device of a license for a service provided by the host agent; and

the host agent and secondary agent automatically uninstalling themselves.

19. The method of claim wherein the secondary agent communicates with the monitoring center if the secondary agent is not pinged by the host agent during a predetermined period of time.