Always-available embedded theft reaction subsystem

• US 9,734,359 B2
• Filed: 12/22/2011
• Issued: 08/15/2017
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Berger, Michael
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Little, Vance
• Application Number:
  US13/992,705
• Publication Number:
  US 20140230057A1
• Time in Patent Office: 2,063 Days
• Field of Search: 726 23, 726 34, 726 35, 726 36
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2139 Recurrent verification
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent
• CPC Class Codes: Y02D 30/70 in wireless communication networks

Abstract

A system to provide an always-on embedded anti-theft protection for a platform is described. The system comprises in one embodiment, a storage including encryption to protect data, a risk behavior logic to detect a potential problem when the data is not encrypted, a core logic component to provide logic to analyze the potential problem and to trigger a security action logic to perform the security action, when the potential problem indicates a theft suspicion, and the security action logic, to cause the platform to attempt a transition to a reduced power state when triggered by the core logic component, the transition causing the data to be encrypted.

Claims

1. A system to provide anti-theft protection for a platform, the system comprising:

a storage device to store data of the platform;

full disk encryption logic to encrypt the data of the storage device;

a risk behavior logic to use interface data to detect a potential problem when the data is not encrypted, the interface data comprising at least one of wireless interface data and global positioning system (GPS) data;

a core logic component to analyze the potential problem and to trigger a security action when the detected potential problem indicates a theft suspicion based on movement of the platform detected from the interface data; and

security action logic to cause the platform to attempt a transition to a first reduced power state when triggered by the core logic component in response to a triggered security action, the transition causing the data to be encrypted, wherein the security action logic is to detect when the transition to the first reduced power state is unsuccessful within a period, and force the system into an OFF state.

2. The system of claim 1, wherein when the platform is in a second reduced power state, at which the data is not encrypted, the security action logic to transition the platform to an ON state prior to the transition to first the reduced power state at which the data is encrypted.

3. The system of claim 1, wherein the first reduced power state comprises an S4 hibernation state, and a second reduced power state in which the data is not encrypted comprises a standby or “

connected standby”

state.

4. The system of claim 1, further comprising:

a disarming logic to cause the data to be decrypted, when an authorized user credential is received.

5. The system of claim 4, wherein the authorized user credential comprises one or more of:

a biometric, a connection to a linked device, a key combination, and a password.

6. The system of claim 1, wherein a connection between the core logic component and an interface to receive data indicating the potential problem is secured.

7. The system of claim 6, wherein the connection is secured by one or more of:

encrypted connection, authentication connection, and dedicated connection.

8. The system of claim 1, further comprising a proximity logic to use the wireless interface to monitor the platform'"'"'s proximity to a controlled exit point.

9. The system of claim 1, further comprising a proximity logic to use the wireless interface to monitor proximity of the platform to a paired device, wherein a loss of proximity to the paired device to cause the triggered security action.

10. The system of claim 9, wherein the risk behavior logic further to use at least one of the wireless interface data, the motion sensor data, and the global positioning system data to detect motion of the platform relative to the paired device.

11. A system to provide anti-theft protection for a platform, the system comprising:

a power transition logic to transition the platform between a plurality of power levels;

a risk behavior logic to use interface data to detect a potential problem, the interface data comprising at least one of wireless interface data and global positioning system (GPS) data;

a storage device to store data on the platform;

full disk encryption logic to encrypt the data of the storage device; and

a security action logic to cause the power transition logic to transition the platform to a hibernation state upon the detection of the potential problem, the hibernation state to require a disarming command prior to providing access to the platform, and the transition to the hibernation state to encrypt the data on the platform, wherein the security action logic is to detect when the transition to the hibernation state is unsuccessful within a period and force the system into an OFF state.

12. The system of claim 11, further comprising:

a risk behavior logic to monitor for a theft indication, the risk behavior logic to trigger the security action logic, when the theft indication is detected.

13. The system of claim 12, further comprising:

an interface to detect the theft indication.

14. The system of claim 11, further comprising:

an interface to receive the disarming command, the disarming command proving presence of an authorized user.

15. The system of claim 14, further comprising:

the power transition logic to transition the platform to an ON state, upon receiving the disarming command.

16. The system of claim 11, further comprising:

interface to monitor for the disarming command in the hibernation state.

17. The system of claim 11, further comprising:

risk behavior logic to monitor for risk behaviors while the platform is in the hibernation state.