Abstract:
A method and system are disclosed for placing a computer in a safe and secure lock down state from a remote location using a remote command device such as a cellular telephone. The method and system includes optional security provisions before restarting the computer.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    The present invention generally relates to locking-down a digital data processor remotely via a handheld communication device. 
         [0003]    2. Description of the Related Art 
         [0004]    Users of computers normally lock-down their computers to a safe and secure state at the conclusion of their workday or if they plan to be away from the computer for a period of time. Sometimes a computer user may unexpectedly find it inconvenient or impossible to return to the computer to perform the lock-down procedure when described. Alternatively, if the computer were stolen, it would be impossible to place it in a safe and secure lock-down state that would prevent the compromise of stored data and software. 
       SUMMARY OF THE INVENTION 
       [0005]    It is observed, by the inventors, that it would be desirable to have a means for remotely placing the computer into a safe and secure state in situations where the user finds it difficult, inconvenient or impossible to physically access the computer. 
         [0006]    Embodiments herein described include a method comprising: receiving at a network client system, having an a unique number associated with the client system, by way of a telephone network, a remotely transmitted data packet comprising a free text potion; determining if the free text potion of the remotely transmitted data packet includes the unique number associated with the client system, and locking-down the network client system if the data packet comprises the unique number associated with the client system. 
         [0007]    Embodiments also include apparatus comprising: an electronic memory which stores data and executable software code; a network interface component which detects the remotely transmitted data packet, and has a communications network interface; a processor, operatively connected to the network interface component, which has an a unique number associated with the processor, and which executes the executable software code, determines if a remotely transmitted data packet has been received, and lock-down the processor if the remotely transmitted data packet includes the unique number associated with the processor. 
         [0008]    Further embodiments include a computer-usable medium having computer readable instructions stored thereon for execution by a processor to perform comprising: receiving at a network client system, having an a unique number associated with the client system, by way of a telephone network, a remotely transmitted data packet comprising a free text potion; determining if the free text portion of the remotely transmitted data packet includes the unique number associated with the client system; and locking-down the network client system if the data packet comprises the unique number associated with the client system. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0009]    Embodiments are illustrated by the drawings wherein: 
           [0010]      FIG. 1  is a simplified schematic presentation of the computer, a cellular telephone used as a remote command device and the interconnection facilities. 
           [0011]      FIG. 2  is a conceptual flow chart of the sequence of operations for accomplishing remote computer shut down. 
       
    
    
     DETAILED DESCRIPTION 
       [0012]    Referring to  FIG. 1 , a simplified example of conventional personal computer architecture  100  is schematically presented. The architecture comprises a central processing unit (CPU)  10 , a system memory  20 , and a network interface card  30 , interconnected by a system bus  40 . The network interface card  30  connects with the external network  50  of other network nodes such as a local area network (LAN) or wide area network (WAN). In another embodiment, the network interface card  30  may, in addition, connect to a telephone modem  60  for directly accessing the public telephone system  90  The interface with the public telephone system  90  can, thereby, provide connectivity between any cellular, wireless or wired telephone device  70  and the computer&#39;s network interface card  30 . Similarly, this connectivity may be indirectly provided by way of the computer network  50  if the network has a portal  80  with the public telephone system  90 . 
         [0013]    The computer  100  will typically be in one of four states at the time remote lock-down is desired designated as S0 (operating system running), S3 (suspend), S4 (hibernate), or S5 (off). It is assumed that the user is uncertain of the current state. Sending the remote lock-down command should thus take the appropriate action regardless of the initial computer state. With respect to system security, Power On Password (POP) protection is typically employed while Privilege Access Password or Admin Password and Hard Disk Password (HDP), although available are seldom utilized. 
         [0014]    The system to enable remote lock-down of the computer is comprised of the target computer  100  including a network interface card  30 , a remote command device  70  such as a cellular telephone, a network or other communications means to provide remote connectivity between the computer&#39;s network interface card and the remote command device. Additionally, the computer includes algorithmic processes or programs stored in the computers memory to implement the necessary action. 
         [0015]    As shown in  FIG. 2 , a communications connection is established  190  between the computer  100  and the remote command device  70 . The NIC address retrieval algorithm  200  is run and obtains the address of the network interface card. As a next step, the remote lock-down message formatting algorithm  210  is run. A message is prepared, in accordance with a pre-determined format including a prescribed preamble, the address of the computer&#39;s network interface card, and additional data to specify the desired command action and, optionally, a security password. One example of an acceptable message format is the Magic Packet. The Magic Packet is a broadcast frame having a configuration comprising a defined constant followed by sixteen repetitions of the target computers network interface card address possibly followed by a four or six byte password. A common application of Magic Packet technology is the remote commanding of computer states. 
         [0016]    Having prepared the message, a communications link is established with the remote command device and the message is uploaded  220  to a memory in the command device. The communications link may be hardwired to the remote command device or may alternatively be wirelessly dialed up using public telephone system access. At the conclusion of the upload process, the communication link may be terminated  230 . 
         [0017]    In an embodiment, the remote computer lock-down process commences when the computer  100  is accessed  300  by the remote command device  70 . A communications link connection is made and the previously stored formatted message is transmitted  310  from the remote command device to the computer, thus initiating computer lock down  320 . If the computer is in the S3 (suspend) state, the computer is awakened and immediately commanded to transition to the S4 (hibernate) state. The Magic Packet technology may be utilized to perform the awakening from the S3 state. If in the S0 (operating system running) state, the computer is commanded to transition into the S4 (hibernate) state. If the computer is already either in the S4 (hibernate) or S5 (off) state, the message is ignored and the current security policy is continued. The final step of the process is termination  330  of the remote command device connection. 
         [0018]    In a further embodiment, the remote computer lock-down system may be further may be enhanced to provide greater functionality. Additional command message data may be included to execution of additional security algorithmic processes. In this embodiment, the computer&#39;s BIOS further participates in the lock-down process. As an example, when the command message is received, a bit (WOLBit) could be set indicating message receipt. During subsequent POST (pre-operation system test), the BIOS would query the WOLBit and, if set, would enforce an additional security policy (AdminBit). This could enable a requirement that the admin password be entered to unlock the computer system. Specifically, the BIOS must include software to select if the admin password will be required to do a successful boot after the lock-down command message has been received. In addition the BIOS must provide for an additional bit (WLOBit) to keep track of the message received event, software to enable WLAN wake from the S5 (off state, and software to clear the WLAN bit after a successful boot. Application software must also be included to set the WLOBit when the message is received. 
         [0019]    In accordance with this embodiment, if the computer is initially in the S3 (suspend) state, the receipt of the command message causes the system to transition to the S0 (operating system running) followed by the setting of the WOLBit and then, finally, transitioning to the S4 (hibernate) state. If the computer is initially in the S0 (operating system running) state, the WLOBit would be set followed by transition to the S4 (hibernate) state. 
         [0020]    In a further extension of the embodiment, additional BIOS setup features will be added which, for example, allows the remote setting of the HDPW (hard file password) when the (WOLBit) is set, if no password is already set. In accordance with this embodiment, the hardfile password (HDP) and the (WOLBit) are checked. If (HDP) is not set and (WOLBit) is set then the (AdminBit) is checked. If the (AdminBit) is set then the hardfile password, HDPW, is set to the Admin password (PAP). Alternatively, if the (AdminBit) is not set then the hardfile password, HDPW, is set to the User password (POP). Once the appropriate password has been successfully entered, the software clears the WOLBit and allows the user/administrator to clear the HDPW. A logic constraint is provided where, if the hardfile password (HDPW) is set, the HDPWBit cannot be set. Any attempt to do so will result in the generation of a warning message. 
       Statement Regarding Preferred Embodiments 
       [0021]    While the invention has been described with respect to preferred embodiments, those skilled in the art will readily appreciate that various changes and/or modifications can be made to the invention without departing from the spirit or scope of the invention as defined by the appended claims. All documents cited herein are incorporated by reference herein where appropriate for teachings of additional or alternative details, features and/or technical background.