English:
[0001] When an owner of a computer allows another person to use the computer, such as an employer providing a computer for use by an employee, the computer owner may wish to restrict the use of certain ports and/or devices. For example, an employer may wish to restrict the ability of employees to copy data from the computer device. Some operating systems provide methods of disabling ports and/or devices; however, experienced users may defeat the software operating system security protocols and enable the ports and peripheral devices.
[0002] FIGURE 1 is a block diagram of an electronic device comprising a tamper-resistant control for an electronic device; and
[0004] FIGURE 1 is a block diagram of an electronic device 10 comprising a tamper-resistant control system 12. Electronic device 10 may comprise any type of electronic device such as, but not limited to, a desktop computer, portable notebook computer, convertible portable computer, tablet computer, workstation or server.
[0005] In the embodiment illustrated in FIGURE 1, electronic device 10 comprises a central processing unit (CPU) 14, firmware 16, a memory 18 and component device 20. In FIGURE 1 , firmware 16 is coupled to CPU 14, memory 18 and component device(s) 20. Firmware 16 is configured to provide boot-up functionality for electronic device 10. For example, in some embodiments, firmware 16 executes initial power-on instructions such as configuring CPU 14 and causing CPU 14 to begin executing instructions at a predetermined time. Firmware 16 may comprise a basic input/output system (BIOS) 22; however it should be understood that firmware 16 may comprise other systems or devices for providing boot-up functionality. In the embodiment illustrated in FIGURE 1 , BIOS 16 comprises a security module 24 to limit access to BIOS 22 solely to users having a password. Security module 24 may comprise hardware, software, or a combination of hardware and software, and is used to verify or authenticate the identity of a user attempting to access BIOS 22. Memory 18 may comprise volatile memory, non-volatile memory and permanent storage. In FIGURE 1 , memory 18 comprises an operating system (OS) 26 that may be loaded and/or otherwise executed by CPU 14. Embodiments of system 12 enable a setting to be applied or set via firmware 16 for component device(s) 20 to indicate component device(s) 20 as either being enabled (e.g., able to be used and/or otherwise accessed for use thereof by OS 26) or disabled (e.g., disabled and/or otherwise unavailable to OS 26 so that OS 26 cannot readily access and/or interact with component device(s) 20). In operation, tamper-resistant configuration control system 12 is configured to disable and lock one or more ports 28 on component device(s) 20 via a command issued from BIOS 22 prior to loading OS 26.
[0006] In the embodiment illustrated in FIGURE 1 , component device(s) component device 20. Memory registers 34 comprise information stored by microprocessor 32 associated with various preset and/or operating parameters of component device(s) 20. In the embodiment illustrated in FIGURE 1 , memory registers 34 comprise at least an enable/disable register 36 and a locking state register 38. In FIGURE 1 , enable/disable register 36 comprises an enable/disable flag 40 stored in non-volatile memory thereof. Enable/disable flag 40 is used to indicate a setting for component device(s) 20 as either being enabled for use or disabled for non-use. For example, enable/disable flag 40 is used to indicate whether port 28 on a particular component device 20 is enabled for use or disabled for non-use. Thus, in some embodiments, if enable/disable flag 40 is set to "YES," the setting for device 20 comprises an enabled setting to enable use of device 20. Correspondingly, if enable/disable flag 40 is set to "NO," the setting for device 20 comprises a disabled setting to otherwise disable device 20 to prevent use thereof. It should be understood that flag 40 may be otherwise set for indicating the enabled or disabled state of device 20.
[0008] During booting of electronic device 10 (e.g., in response to a power-on event or wake event from a hibernation, sleep or other type of reduced-power mode), BIOS 22 determines whether enable/disable flag 40 is set to "YES," thereby indicating an enabled or disabled status setting for one or more component devices 20. During manufacturing or building of electronic device 10, enable/disable register 36 is set to an "enabled" state until, for example, an IT administrator or another person changes setting 36 to a disabled state via BIOS 22. Accordingly, in response to BIOS 22 determining that register 36 has been changed to "disabled", BIOS 22 issues a disable command to the particular component device 20 (e.g., setting a disable register in volatile memory), and a lock command to lock the state of registers 36 and 38 before BIOS 22 transfers control of electronic device 10 to OS 26. Thus, embodiments of system 12 lock the state of registers 36 and 38 (e.g., write-protects registers 36 and 38) before transferring control of electronic device 10 to OS 26 to prevent unauthorized tampering with electronic device 10. Thus, in the event a user resets electronic device 10 (e.g., by initiating a hard reset), BIOS 22 will reconfigure the particular component device 20 (e.g., reset a disable register in volatile memory) and issue a lock command to lock the state of registers 36 and 38 before BIOS 22 transfers control of electronic device 10 to OS 26.
[0010] FIGURE 2 is a flow diagram illustrating an embodiment of a tamper-resistant configuration control method. In FIGURE 2, the method begins at block 200, wherein BIOS 22 executes a boot routine (e.g., in response to a power-on or wake event). At block 202, BIOS 22 reads enable/disable register 36 to determine the configuration set-up for component device 20 (e.g., whether component device 20 is set as enabled or disabled). At decision block 204, BIOS 22 determines whether enable/disable flag 40 indicates if the state of register 36 is enabled. If enable/disable flag 40 indicates that the state of register 36 is enabled, BIOS 22 sends a command to microprocessor 32 to enable port 28 of device 20 or otherwise report to OS 26 the availability of device 20, as indicated at block 206. The method proceeds to block 218 wherein BIOS 22 issues a command to lock registers 36 and 38. The method continues to block 208 wherein BIOS 22 completes any remaining functions associated with the boot routine. At block 210, BIOS loads operating system 26.
[0011] If at decision block 204 BIOS 22 determines that enable/disable flag 40 indicates the state of register 36 is disabled, BIOS 22 sends a command to microprocessor 32 to disable device 20 for non-use, as indicated at block 212. The method proceeds to block 218 where BIOS 22 issues a command to lock memory registers 36 and 38 (e.g., issues command to lock/write-protect registers 36 and 38). The method proceeds to block 208, wherein BIOS 22 completes any remaining functions associated with the boot routine. At block 210, BIOS loads operating system 26.
[0012] Embodiments of system 12 may be implemented in software and can be adapted to run on different platforms and operating systems. In particular, functions implemented by system 12, for example, may be provided by an ordered listing of executable instructions that can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. In the context of this document, a "computer- readable medium" can be any means that can contain, store, communicate, propagate or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example, but is not limited to, an electronic, magnetic, optical, electro-magnetic, infrared, or semiconductor system, apparatus, device, or propagation medium.

中文:
[0001]当计算机的拥有者允许其他人使用该计算机(例如雇主提供计算机以供雇员使用)时,该计算机的拥有者可能希望限制某些端口和/或设备的使用。例如,雇主可能希望限制雇员从计算机设备拷贝数据的能力。某些操作系统提供禁用端口和/或设备的方法;然而,有经验的用户会使软件操作系统安全协议失效并且启用所述端口和外围设备。
[0002]图1是包括电子设备的防篡改(tamper-resistant)控制的电子设备的框图;以及
[0004]图1是包括防篡改控制系统12的电子设备10的框图。电子设备10可以包括任何类型的电子设备,例如但不限于桌上型计算机、便携式笔记本计算机、可变换的(convertible)便携式计算机、平板计算机、工作站或服务器。
[0005]在图1所图示的实施例中,电子设备10包括中央处理单元(CPU)14、固件16、存储器18和部件设备20。在图1中,固件16耦合到CPU14、存储器18和(一个或多个)部件设备20。固件16被配置成为电子设备10提供引导(boot-up)功能性。例如,在一些实施例中,固件16执行初始通电指令,例如配置CPU 14以及使得CPU 14在预定的时间开始执行指令。固件16可以包括基本输入/输出系统(BIOS)22;然而,应该理解,固件16可以包括用于提供引导功能性的其它系统或设备。在图1所图示的实施例中,BIOS 16包括安全模块24,以将对BIOS 22的访问限制到仅具有密码的用户。安全模块24可以包括硬件、软件或硬件和软件的组合,并且被用来验证或认证尝试访问BIOS 22的用户的身份。存储器18可以包括易失性存储器、非易失性存储器和永久存储装置。在图1中,存储器18包括可以被CPU 14加载和/或以其它方式执行的操作系统(OS)26。系统12的实施例使得能够经由固件16为(一个或多个)部件设备20应用或设定设置,以将(一个或多个)部件设备20指示为被启用(例如能够由OS 26使用和/或为了其的使用而以其它方式访问)或被禁用(例如对OS 26禁用和/或以其它方式对OS 26不可用,以使得OS 26不能容易地访问(一个或多个)部件设备20和/或与(一个或多个)部件设备20交互)。在操作中,防篡改配置控制系统12被配置成在加载OS 26之前经由从BIOS 22发布的命令来禁用和锁定(一个或多个)部件设备20上的一个或多个端口28。
[0006]在图1所图示的实施例中,(一个或多个)部件设备20包括任何类型的设备,例如但不限于多外围部件互连(PCI)设备、通用串行总线(USB)设备、调制解调器、麦克风、数字视频盘(DVD)驱动器或任何其它类型的设备。在图1所图示的实施例中,(一个或多个)部件设备20包括微处理器32、一个或多个存储器寄存器(memory register)34、以及用于促进与特定部件设备20外部的设备的通信接合的(一个或多个)设备端口28。存储器寄存器34包括由微处理器32存储的信息,该信息与(一个或多个)部件设备20的各种预置和/或操作参数相关联。在图1所图示的实施例中,存储器寄存器34至少包括启用/禁用寄存器36和锁定状态寄存器38。在图1中,启用/禁用寄存器36包括存储在其非易失性存储器中的启用/禁用标志40。启用/禁用标志40被用来指示(一个或多个)部件设备20的设置或者是被启用以供使用或者是被禁用而不能使用。例如,启用/禁用标志40被用来指示在特定部件设备20上的端口28是被启用以供使用还是被禁用而不能使用。因此,在一些实施例中,如果启用/禁用标志40被设置为“是”,则设备20的设置包括启用设置,以启用对设备20的使用。相应地,如果启用/禁用标志40被设置为“否”,则设备20的设置包括禁用设置以另外禁用设备20,从而防止对其的使用。应该理解,标志40可以以其它方式设置,以指示设备20的启用或禁用状态。
[0008]在电子设备10的引导(boot)期间(例如响应于通电事件,或从休眠、睡眠(sleep)或其他类型省电模式的唤醒事件),BIOS 22确定启用/禁用标志40是否被设置为“是”,由此指示一个或多个部件设备20的启用或禁用状况设置。在电子设备10的制造或建造期间,启用/禁用寄存器36被设置为“启用”状态,直到例如IT管理员或另一个人经由BIOS 22将设置36变成禁用状态。因此,响应于BIOS 22确定寄存器36已被改变成“禁用的”,BIOS 22对该特定部件设备20发布禁用命令(例如设置易失性存储器中的禁用寄存器),并且发布锁定命令以在BIOS 22将对电子设备10的控制转移给OS 26之前锁定寄存器36和38的状态。因此,系统12的实施例在将对电子设备10的控制转移给OS 26之前锁定寄存器36和38的状态(例如对寄存器36和38进行写保护)以防止对电子设备10的未授权篡改。因此,在用户(例如通过启动硬重置)重置电子设备10的情况下,BIOS 22将重新配置该特定部件设备20(例如重置易失性存储器中的禁用寄存器)并且发布锁定命令以在BIOS 22将对电子设备10的控制转移给OS 26之前锁定寄存器36和38的状态。
[0010]图2是图示防篡改配置控制方法的实施例的流程图。在图2中,该方法在框200处开始,其中BIOS 22(例如响应于通电或唤醒事件)执行引导例程。在框202处,BIOS 22读取启用/禁用寄存器36以确定部件设备20的配置设置(例如部件设备20被设置为启用的还是禁用的)。在判定框204中,BIOS 22确定启用/禁用标志40是否指示寄存器36的状态是否是启用的。如果启用/禁用标志40指示寄存器36的状态是启用的,则BIOS 22向微处理器32发送命令以启用设备20的端口28或者以其它方式向OS 26报告设备20的可用性,如框206所指示的那样。该方法进行到框218,其中BIOS 22发布命令以锁定寄存器36和38。该方法继续进行到框208,其中BIOS 22完成与引导例程相关联的任何剩余功能。在框210处,BIOS加载操作系统26。
[0011]如果在判定框204处,BIOS 22确定启用/禁用标志40指示寄存器36的状态是禁用的,则BIOS 22发送命令到微处理器32以禁用设备20而使其不能使用,如框212所指示的那样。该方法进行到框218,在框218BIOS 22发布命令以锁定存储器寄存器36和38(例如发布命令以锁定/写保护寄存器36和38)。该方法进行到框208,其中BIOS 22完成与引导例程相关联的任何剩余功能。在框210处,BIOS加载操作系统26。
[0012]系统12的实施例可以以软件实施,并且可以被适配成在不同的平台和操作系统上运行。特别地,由系统12实施的功能例如可以由可执行指令的有序列表提供,该可执行指令可以被包括在任何计算机可读介质中以供指令执行系统、装置或设备(例如基于计算机的系统、包含处理器的系统或其它可以从该指令执行系统、装置或设备取出指令并执行这些指令的系统)使用或结合所述指令执行系统、装置或设备进行使用。在本文献的上下文中,“计算机可读介质”可以是可以包含、存储、传送、传播或传输程序以供指令执行系统、装置或设备使用或结合所述指令执行系统、装置或设备使用的任何装置。所述计算机可读介质可以是例如但不限于电子的、磁的、光的、电磁的、红外的或半导体的系统、装置、设备或传播介质。