Always-available embedded theft reaction subsystem

• US 9,454,678 B2
• Filed: 12/22/2011
• Issued: 09/27/2016
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Berger, Michael
• Primary Examiner(s): Revak, Christopher
• Application Number:
  US13/993,051
• Publication Number:
  US 20140208447A1
• Time in Patent Office: 1,741 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

A platform protected by a system, the platform including a power source, is described. The system in one embodiment comprises a risk behavior logic to detect a potential problem, a core logic component to provide logic to analyze the potential problem and to trigger a security action logic to perform a security action, when the potential problem indicates a theft suspicion, and the security action logic to utilize a kill pill to disable the platform, when the platform has set a high security status authorizing use of a self-kill pill or the platform sends an alert and receives a remote instruction to utilize a remote kill pill.

Claims

1. A system comprising:

an arming mechanism to automatically arm the system in response to an automatic arming policy, the automatic arming policy being selected from among multiple arming policies, including location, time of day, disconnection from a network, loss of Bluetooth proximity, loss of user via camera, closing of the lid, device idleness, and a timer;

a risk behavior logic to detect a potential problem by analyzing interface data received from interfaces;

a core logic component to analyze the potential problem and to trigger a security action logic to perform a security action when the system is armed and the potential problem indicates a theft suspicion;

the security action logic to utilize one of a self-kill pill and a remote kill pill to disable the system by deleting data, wherein the security action logic to send a notification of the theft suspicion to an owner of the system and to an external security service and to;

initialize a self-kill pill when no response to the notification is received within a specified period of time;

initialize a remote kill pill received from the external security service; and

resume normal functionality when a response is received from the owner.

2. The system of claim 1, further comprising:

a disarming logic to disarm the system, upon receiving a disarming command indicating that there was no theft.

3. The system of claim 1, wherein the core logic and the security action logic to operate in low power states.

4. The system of claim 1, wherein the automatic arming policy comprises at least one of loss of Bluetooth proximity, loss of user via camera, closing of the lid, device movement, device idleness, location, and time of day.

5. The system of claim 1, wherein the automatic arming policy comprises at least one of loss of Bluetooth proximity, loss of user via camera, closing of the lid, device movement, device idleness, location, and time of day.

6. The system of claim 1, further comprising an automatic disarming mechanism to automatically disarm the system in response to an automatic disarming policy.

7. The system of claim 6, wherein the automatic disarming policy comprises at least one of Bluetooth proximity detected, User ID via camera, presence of known network connection, private area communication detected, and geographic location.

8. The system of claim 1 wherein the interfaces comprise at least one of a Bluetooth sensor, a motion sensor, a GPS receiver, and manual arming mechanisms.

9. The system of claim 8, wherein the system further comprises a user-carried device and a platform.

10. The system of claim 9 wherein the interfaces comprise a user-carried device GPS receiver, a user-carried device motion sensor, and a user-carried device motion sensor, and a platform device GPS receiver, a platform motion sensor, and a platform motion sensor.

11. The system of claim 10, wherein the risk behavior logic to detect the potential problem if the user-carried device is in motion, the platform is in motion, and the user-carried device is not within a range of proximity of the platform.

12. A system comprising:

an arming mechanism to automatically arm the system in response to an automatic arming policy, the automatic arming policy being selected from among multiple arming policies, including location, time of day, disconnection from a network, loss of Bluetooth proximity, loss of user via camera, closing of the lid, device idleness, and a timer;

a risk behavior logic to detect a potential problem by analyzing interface data received from interfaces;

a core logic component to analyze the potential problem and to trigger a security action logic to perform a security action when the potential problem indicates a theft suspicion and the system is armed;

storage to store a self-kill pill which when executed is to disable the system; and

security action logic to utilize one of the self-kill pill and a remote kill pill to disable the system by deleting data, wherein the security action logic to send a notification of the theft suspicion to an owner of the system and to an external security service and to;

initialize a self-kill pill when no response to the notification is received within a specified period of time;

initialize a remote kill pill received from the external security service; and

resume normal functionality when a response is received from the owner.

13. The system of claim 12, further comprising:

a disarming logic to disarm the system, upon receiving a disarming command indicating that there was no theft, the disarming logic, when received in time, to stop the kill pill.

14. The system of claim 12, wherein the core logic and the security action logic operate in low power states.

15. A method comprising:

automatically arming the system in response to an automatic arming policy, the automatic arming policy being selected from among multiple arming policies, including location, time of day, disconnection from a network, loss of Bluetooth proximity, loss of user via camera, closing of the lid, device idleness, and a timer;

detecting a potential problem by analyzing interface data received from interfaces;

determining that the potential problem is an indication of a theft; and

triggering a security action, in response to the indication of a theft and the system being armed, the security action including sending a notification of the theft suspicion to an owner of the system and to an external security service and executing a kill pill to disable the system by deleting data, wherein a self-kill pill is executed when no response to the notification is received within a specified period of time, and a remote kill pill is executed when received from the external security service is executed.

16. The method of claim 15, wherein the automatic arming policy comprises at least one of loss of Bluetooth proximity, loss of user via camera, closing of the lid, device movement, device idleness, location, and time of day.

17. The method of claim 15, further comprising an automatic disarming mechanism to automatically disarm the system in response to an automatic disarming policy.

18. The method of claim 17, wherein the automatic disarming policy comprises at least one of Bluetooth proximity detected, User ID via camera, presence of known network connection, private area communication detected, and geographic location.

19. The method of claim 15 wherein the interfaces comprise at least one of a Bluetooth sensor, a motion sensor, and a GPS receiver.

20. The method of claim 19, wherein the system further comprises a user-carried device and a platform.