Security module and method within an information handling system

• US 8,863,268 B2
• Filed: 10/29/2008
• Issued: 10/14/2014
• Est. Priority Date: 10/29/2008
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Stedman, Roy W., Sultenfuss, Andrew T., Loadman, David
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US12/260,519
• Publication Number:
  US 20100107238A1
• Time in Patent Office: 2,176 Days
• Field of Search: 726/13
• US Class Current: 726/13
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 : Location-based management or tracking services

Abstract

A security module and method within an information handling system are disclosed. In a particular form, a processing module can include a local processor configurable to initiate access to resources of a host processing system. The processing module can also include a security module configured to enable use of the resources of the host processing system using a security metric. According to an aspect, the security module can be further configured to detect the security metric, and enable access to a resource of the host processing system in response to the security metric. The security module can further be configured to disable access to another resource of the host processing system in response to the security metric.

Claims

1. A processing module comprising:

a local processor device configurable to initiate access to resources of a host processing system; and

a security module configured to enable use of the resources of the host processing system using a security metric, wherein the security module is further configured to;

detect the security metric;

detect a global location of the host processing system and compare the global location to a list of valid global locations;

enable and disable access to a hardware resource of the host processing system not only in response to the security metric but also based on whether the host processing system is in a low-power operating state or a run operating state, wherein the enabling access to the hardware resource when the host processing system is in the low-powered operating state comprises leaving the host processing system in the low-powered operating state if the host processing system entered the low-powered operating state prior to a disabling of access to hardware resource initiated by a signal from the processing module.

2. The processing module of claim 1, further comprising the security module operable to:

enable use of the hardware resource during low-powered operating state of the host processing system in response to validating the security metric; and

enable use of a plurality of hardware resources of the host processing system during a run operating state of the host processing system in response to validating the security metric.

3. The processing module of claim 2, further comprising:

a wireless communication module configured to receive wireless data from a network location;

an interface configured to receive data received by the host processing system; and

wherein the security module is configured to;

detect a global network location of the received wireless data and the received data;

compare the global network location of the received wireless data to a list of valid global network locations;

disable use of the received wireless data in response to an invalid global network location;

compare the global network location of the received data to the list of valid global network locations; and

disable use of the received data in response to an invalid network location.

4. The processing module of claim 1, further comprising a location identifier module operably coupled to the security module, wherein the location identifier module is configured to:

detect a global location of the host processing system; and

enable the hardware resources of the host processing system in response to validating the global location.

5. The processing module of claim 1, further comprising a wireless communication module accessible to a remote system manager configured to initiate enabling and disabling use of the host processing system using the security metric.

6. The processing module of claim 5, further comprising:

a housing storing the security module, the local processor, and the wireless communication module; and

an interface between the housing and the host processing system configured to be removeably coupled to a host interface of the host processing system wherein the processing module is external to the host processing system.

7. The processing module of claim 1, wherein the hardware resource comprises a communication module of host processing system.

8. The processing module of claim 1, wherein the hardware resource comprises a keyboard of the host processing system.

9. The processing module of claim 1, wherein the security metric is biometric.

10. A method comprising:

detecting, by a processing module including a local processor device, an operating state of an information handling system to be one of a low-powered operating state and a run operating state;

detecting a global location of the information handling system;

comparing the global location to a list of valid global locations; and

altering an operating state of a hardware resource of the information handling system not only in response to the comparison but also the operating state of the information handling system wherein, when the information handling system is in the low-powered operating state prior to a disabling of access to hardware resources by the processing module, the altering the operating state of the hardware resource comprises leaving the information handling system in the low-powered operating state.

11. The method of claim 10, further comprising:

detecting the current operating state of the information handling system as a low-powered operating state; and

enabling the hardware resource of the information handling system based on a valid global location of the information handling system.

12. The method of claim 10, further comprising:

detecting a global network location of the information handling system;

detecting a security access level of the global network location;

comparing the global network location to a list of valid global network locations;

enabling the hardware resource in response to determining the global network location is a valid global network location; and

disabling the hardware resource in response to determining the global network location is an invalid global network location.

13. The method of claim 10, further comprising:

detecting the information handling system in a run operating mode;

detecting a global network location of the information handling system;

detecting an invalid global network location; and

disabling use of the information handling system in response to detecting the invalid global network location.

14. The method of claim 10, further comprising:

receiving data using a communication module of a host processing system of the information handling system;

routing the data to the processing module;

detecting whether the data is communicated from a valid global network location; and

disabling use of the data upon detecting the global network location is invalid.

15. The method of claim 10, further comprising:

receiving data using a communication module of a host processing system of the information handling system;

routing the data to the processing module;

detecting whether the data is communicated from a valid global network location; and

enabling use of the data upon detecting the global network location is valid.

16. The method of claim 10, further comprising:

receiving a user credential at the information processing system;

outputting the user credential from a processing module coupled to the information handling system to a network data center;

receiving validation of the user credential from the network data center at the processing module; and

enabling use of the information handling system using the processing module in response to validating the user credential.

17. The method of claim 10, wherein the information handling system contains a processor other than the local processor.

18. An information handling system comprising:

a host processing system including resources operable to be enabled and disabled by a processing module; and

a host interface configured to;

couple the processing module to the host processing system; and

detect a global location of the host processing system and compare the global location to a list of valid global locations;

receive a signal, by a local processor device, from the processing module to initiate enabling and disabling hardware resources of the host processing system not only in response to a security metric value detected by a security module of the processing module but also based on whether the information handling system is in low-powered operating state or a run operating state, wherein the enabling access to the hardware resource when the information handling system is in the low-powered operating state comprises leaving the information handling system in the low-powered operating state if the information handling system entered the low-powered operating state prior to a disabling of access to hardware resources initiated by a signal from the processing module.

19. The information handling system of claim 18, wherein the processing module includes:

a memory configured to be updated by the processing module to store updated encryption keys communicated from a network data center;

wherein the memory is further configured to store a user access log including user activity information; and

wherein the memory is further configured to store a list of valid global network locations.

20. The information handling system of claim 19, further comprising:

the processing module configured to analyze network data packets received by a wireless communication module or a wireline communication module of the host processing system;

the security module further configured to validate a global network location of the network data packets;

the processing module further configured to filter invalid network data packets from the network data packets of the network data packets; and

the processing module further configured to enable use of non-filtered valid network data packets of the network data packets.