Wireless detection and/or containment of compromised electronic devices in multiple power states

• US 20070005987A1
• Filed: 06/30/2005
• Published: 01/04/2007
• Est. Priority Date: 06/30/2005
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Durham, David, Larson, Dylan, Durham, Lenitra
• Application Number:
  US11/173,986
• Publication Number:
  US 20070005987A1
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Architectures and techniques that allow an electronic platform having a Radio Frequency Identification (RFID) tag to transmit platform security status information regardless of the power state of the platform. The RFID tag contains both an external passive RF interface as well as an internal bus interface that may allow components of the host platform to communicate with the RFID tag. The embedded processing agent may provide the ability to detect that a system has come under attack and cause suspicious traffic to be blocked.

Claims

1. A method comprising:

determining a security status of an electronic device; and

transmitting the security status to an external device using a transmitter configured to operate according to a power-scavenging protocol.

2. The method of claim 1 wherein the power-scavenging transmitter comprises a radio frequency identification (RFID) transceiver.

3. The method of claim 2 further comprising storing the security status in a memory associated with the RFID transceiver via a secure interface.

4. The method of claim 3 further comprising verification of the security status received by the RFID transceiver.

5. The method of claim 2 further comprising:

receiving instructions from a remote RFID portal via the RFID transceiver; and

conveying the instructions to an embedded processing agent coupled with the RFID transceiver.

6. The method of claim 5 further comprising verification of the security status received by the RFID transceiver.

7. The method of claim 1 further comprising selectively limiting access to network resources based, at least in part, on the security status transmitted to the external device.

8. The method of claim 7 wherein the external device comprises a radio frequency identification (RFID) reader and selectively limiting access to network resources comprises:

determining a security violation based, at least in part, on the security status transmitted to the RFID reader;

restricting access to one or more network resources based, at least in part, on the security violation; and

determining one or more remediation actions to be taken based, at least in part, on the security violation.

9. The method of claim 8 wherein restricting access to one or more network resources comprises one or more network routing devices restricting access to one or more network accesses based, at least in part, on the security violation.

10. The method of claim 8 wherein restricting access to one or more network resources comprises one or more filters on the electronic device restricting access to one or more network accesses based, at least in part, on the security violation.

11. The method of claim 8 wherein a security violation comprises one or more of:

detection of malware on the electronic device, lack of current security patch installation, bootup of the electronic device from an unauthorized source, access to unauthorized network resources.

12. The method of claim 1 wherein further comprising taking local remediation actions with components of the electronic device based, at least in part, on the security status.

13. The method of claim 12 wherein the local remediation actions comprise one or more of:

disabling a hard drive, disabling a floppy disk drive, disabling one or more buses, locking removable media, forcing the device to a sleep or other low power state, forcing the device to reboot in a safe or firmware mode.

14. An apparatus comprising:

one or more components interconnected to provide functionality to an electronic device, wherein at least one of the components is configured to detect and report a security violation within the electronic device;

a network interface coupled with at least one of the components to provide access to remote network devices;

a embedded processing agent coupled with one or more of the components to receive the report of the security violation; and

a transmitter coupled with the embedded processing agent to transmit information corresponding to the security violation using a power-scavenging wireless communication protocol.

15. The apparatus of claim 14 wherein the transmitter comprises a radio frequency identification (RFID) transmitter.

16. The apparatus of claim 14 wherein the network interface comprises a filter that is configurable to limit access to remote devices via the network interface based, at least in part, on the security violation.

17. The apparatus of claim 14 wherein the connection between the embedded processing agent and the transmitter comprises a secure connection.

18. The apparatus of claim 14 wherein the embedded processing agent causes local remediation actions to be taken in response to the security violation.

19. The apparatus of claim 18 wherein the local remediation actions comprise one or more of:

disabling a hard drive, disabling a floppy disk drive, disabling one or more buses, locking removable media, forcing the device to a sleep or other low power state, forcing the device to reboot in a safe or firmware mode.

20. A system comprising:

one or more components interconnected to provide functionality to an electronic device, wherein at least one of the components is configured to detect and report a security violation within the electronic device;

a network interface coupled with at least one of the components to provide access to remote network devices;

an Ethernet cable coupled with the network interface;

a embedded processing agent coupled with one or more of the components to receive the report of the security violation; and

a transmitter coupled with the embedded processing agent to transmit information corresponding to the security violation using a power-scavenging wireless communication protocol.

21. The system of claim 20 wherein the transmitter comprises a radio frequency identification (RFID) transmitter.

22. The system of claim 20 wherein the network interface comprises a filter that is configurable to limit access to remote devices via the network interface based, at least in part, on the security violation.

23. The system of claim 20 wherein the connection between the embedded processing agent and the transmitter comprises a secure connection.

24. The system of claim 20 wherein the embedded processing agent causes local remediation actions to be taken in response to the security violation.

25. The system of claim 20 wherein the local remediation actions comprise one or more of:

disabling a hard drive, disabling a floppy disk drive, disabling one or more buses, locking removable media, forcing the device to a sleep or other low power state, forcing the device to reboot in a safe or firmware mode.

26. An article comprising a computer-readable medium having stored thereon instructions that, when executed, cause one or more processors to:

determine a security status of an electronic device; and

transmit the security status to an external device using a transmitter configured to operate according to a power-scavenging protocol.

27. The article of claim 26 wherein the power-scavenging transmitter comprises a radio frequency identification (RFID) transceiver.

28. The article of claim 27 further comprising instructions that, when executed, cause the one or more processors to store the security status in a memory associated with the RFID transceiver via a secure interface.

29. The article of claim 28 further comprising instructions that, when executed, cause the one or more processors to verify the security status received by the RFID transceiver.

30. The article of claim 27 further comprising instructions that, when executed, cause the one or more processors to:

receive instructions from a remote RFID portal via the RFID transceiver; and

convey the instructions to an embedded processing agent coupled with the RFID transceiver.

31. The article of claim 30 further comprising instructions that, when executed, cause the one or more processors to verify the security status received by the RFID transceiver.

32. The article of claim 26 further comprising instructions that, when executed, cause the one or more processors to selectively limit access to network resources based, at least in part, on the security status transmitted to the external device.

33. The article of claim 32 wherein the external device comprises a radio frequency identification (RFID) reader and the instructions that cause the one or more processors to selectively limit access to network resources comprise instructions that, when executed, cause the one or more processors to:

determine a security violation based, at least in part, on the security status transmitted to the RFID reader;

restrict access to one or more network resources based, at least in part, on the security violation; and

determine one or more remediation actions to be taken based, at least in part, on the security violation.

34. The article of claim 33 wherein the instructions that cause the one or more processors to restrict access to one or more network resources comprise instructions that, when executed, cause one or more network routing devices to restrict access to one or more network accesses based, at least in part, on the security violation.

35. The article of claim 33 wherein the instructions that cause the one or more processors to restrict access to one or more network resources comprise instructions that cause one or more filters on the electronic device to restrict access to one or more network accesses based, at least in part, on the security violation.

36. The article of claim 33 wherein a security violation comprises one or more of:

detection of malware on the electronic device, lack of current security patch installation, bootup of the electronic device from an unauthorized source, access to unauthorized network resources.

37. The article of claim 26 further comprising instructions that, when executed, cause the one or more processors to take local remediation actions with components of the electronic device based, at least in part, on the security status.

38. The article of claim 37 wherein the local remediation actions comprise one or more of:

disabling a hard drive, disabling a floppy disk drive, disabling one or more buses, locking removable media, forcing the device to a sleep or other low power state, forcing the device to reboot in a safe or firmware mode.