Client controlled lock for electronic devices

• US 8,984,653 B2
• Filed: 04/03/2008
• Issued: 03/17/2015
• Est. Priority Date: 04/03/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: John, Mark St., Holladay, Martin, Carpenter, Todd, Duffus, James, Lopez-Barquilla, Ricardo
• Primary Examiner(s): To, Baotran N
• Application Number:
  US12/061,670
• Publication Number:
  US 20090254995A1
• Time in Patent Office: 2,539 Days
• Field of Search: 726/27, 726/26, 713/194
• US Class Current: 726/27
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss

Abstract

An electronic device can be locked and secured by activating a hardware locking mechanism on the device. The locking mechanism is controlled by a locking policy that is defined and implemented from the client side. If the locking mechanism is activated, then the device operates in a limited mode of operation instead of in a normal mode of operation. The locking mechanism can be deactivated, placing the device into the normal mode of operation, when a specified condition is satisfied.

Claims

1. A method for securing an electronic device, said method comprising:

activating a locking mechanism on said device according to a locking policy that defines first and second conditions, wherein when said locking mechanism is activated, then said device operates in a limited mode of operation providing reduced device functionality compared to a normal mode of operation;

determining that the first condition is satisfied and, in response, deactivating said locking mechanism while the device is operating in the limited mode of operation and placing said device into an intermediate mode of operation that is between said limited mode of operation and said normal mode of operation in terms of available device functionality; and

determining that the second condition is satisfied while the device is in the intermediate mode of operation and, in response, placing the device into said normal mode of operation.

2. The method of claim 1 wherein the locking mechanism determines the second condition that must be satisfied to place the device into the normal mode of operation based on a manner in which the locking mechanism was activated to place the device in the limited mode of operation.

3. The method of claim 1 wherein activating the locking mechanism comprises activating said locking mechanism in response to at least one of:

manual action by a user;

or

a time-based condition that is satisfied.

4. The method of claim 1 wherein activating the locking mechanism comprises activating said locking mechanism if′

connectivity between said device and another device is lost for a period of time prescribed in the locking policy.

5. The method of claim 1 wherein activating the locking mechanism comprises activating said locking mechanism if said device does not receive an expected message from another device.

6. The method of claim 1 wherein operating the device in a limited mode of operation comprises booting said device using reduced-function BIOS (basic input/output system) code, and wherein placing the device into said normal mode of operation comprises booting said device using full-function BIOS code.

7. The method of claim 1, wherein, when in the intermediate mode of operation, the device communicates with another device that is external to the device, and wherein the second condition is determined to be satisfied based on the communication with the other device.

8. The method of claim 1 wherein said activating said locking mechanism comprises causing a component of said device to operate with reduced functionality even if the component is removed from said device.

9. An electronic device comprising:

a locking mechanism activated based on a locking policy controlled by a client-side authority of the device, the locking mechanism comprising a normal boot instruction path that provides a normal mode of operation when the locking mechanism is deactivated and a reduced-function boot instruction path that provides a limited mode of operation, that has reduced device functionality relative to the normal mode of operation, when the locking mechanism is activated;

a locking agent coupled to said locking mechanism, said locking agent configured to;

implement said locking policy to activate said locking mechanism to place the device in the limited mode of operation;

determine a deactivation condition based on activation of said locking mechanism, the deactivation condition comprising one or more requirements for deactivating said locking mechanism, wherein the locking agent is configured to vary the deactivation condition based on a manner in which the locking mechanism was activated to place the device in the limited mode of operation; and

deactivate said locking mechanism when the deactivation condition is satisfied; and

one or more computer processors, being a functional part of the electronic device, and activated by the locking agent to facilitate implementing the locking policy to activate the locking mechanism.

10. The electronic device of claim 9, wherein the reduced-function boot instruction path resides in a secure execution environment.

11. The electronic device of claim 10, wherein the normal boot instruction path is separate from the reduced-function boot instruction path and resides outside the secure execution environment.

12. The electronic device of claim 10, wherein the secure execution environment includes a mode selector that maintains an indication of one of the normal boot instruction path and the reduced-function boot instruction path to be selected on a next boot of the device.

13. The electronic device of claim 9, wherein the locking mechanism is deactivated upon receipt of an input at the electronic device.

14. The electronic device of claim 13, wherein the input comprises at least one of:

an authorized signal received from another device and a user input provided through a user input device.

15. A computer system comprising:

a processor;

memory coupled to said processor;

a locking policy that is controlled by a client-side authority of the computer system;

a hardware-implemented locking mechanism coupled to said memory and configured to;

place the computer system into an unlocked state in which the computer system operates in a first mode of operation having first computing functionality, based on a mode selector controlled by the locking policy; and

place the computer system into a locked state in which the computer system operates in a second mode of operation having second computing functionality that is reduced relative to the first computing functionality of the first mode of operation, based on the mode selector controlled by the locking policy, the locking mechanism and mode selector residing within a secure execution environment of the computer system; and

a tampering detection mechanism configured to detect an unauthorized attempt to circumvent at least one of the locking policy and the locking mechanism.

16. The computer system of claim 15 wherein said locked state is selected when a time-based condition is satisfied.

17. The computer system of claim 15 wherein said locked state is selected if connectivity between said computer system and another device is lost.

18. The computer system of claim 15, wherein the locking policy is encrypted in a secure memory.

19. The computer system of claim 15, wherein the tampering detection mechanism is configured to facilitate prevention of the computer system from being placed into the unlocked state or the locked state in an unauthorized manner.

20. The computer system of claim 15, wherein the tampering detection mechanism is configured to determine if at least one of:

an attempt is being made to modify operation of BIOS (basic input/output system) code; and

a frequency of a controlling clock is altered.