Operating system independent architecture for subscription computing

A system for managing a subscription-based computer independent of an operating system of the computer may include a security module that accesses, decrements, and stores subscription data during operation of the subscription-based computer. Additionally, the system may include a network module in communication with the security module and comprising a network stack, a web server, and a user interface in an operating system independent format. A web browser of the computer may request the user interface from the network stack. The interface may be populated with the subscription data, and a network driver may retrieve the populated user interface from the network module. The populated interface may then be sent to the web server to be served back to the requesting web browser.

BACKGROUND

This Background is intended to provide the basic context of this patent application and is not intended to describe a specific problem to be solved.

Pay-as-you-go or pay-per-use and subscription business models have been used in many areas of commerce, from cellular telephones to commercial launderettes. In developing a pay-as-you go business, a provider, for example, a cellular telephone provider, offers the use of hardware (a cellular telephone) at a lower-than-market cost in exchange for a commitment to remain a subscriber to their network. In this specific example, the customer receives a cellular phone for little or no money in exchange for signing a contract to become a subscriber for a given period of time. Over the course of the contract, the service provider recovers the cost of the hardware by charging the consumer for using the cellular phone.

The pay-as-you-go business model is predicated on the concept that the hardware provided has little or no value, or use, if disconnected from the service provider. To illustrate, should the subscriber mentioned above cease to pay his or her bill, the service provider deactivates their account, and while the cellular telephone may power up, calls cannot be made because the service provider will not allow them. The deactivated phone has no “salvage” value, because the phone will not work elsewhere and the component parts are not easily salvaged nor do they have a significant street value. When the account is brought current, the service provider will reconnect the device to network and allow the subscriber to make calls.

This model works well when the service provider, or other entity taking the financial risk of providing subsidized hardware, has tight control on the use of the hardware and when the device has little salvage value. This business model does not work well when the hardware has substantial uses outside the service provider's span of control. Thus, a typical personal computer does not meet these criteria since a personal computer may have substantial uses beyond an original intent and the components of a personal computer, e.g. a display or disk drive, may have a significant salvage value.

In a typical pay-as-you-go computing system, a user purchases a code that is redeemable for a number of computing hours at a specially-equipped electronic device. The user may add time to an existing account balance by purchasing additional codes and entering them through a user interface executing on the device operating system (OS). To ensure security of the user's time balance and securely track consumed time, the OS network stack performs all network traffic, for example, establishing a connection with a provisioning server which replenishes the device with purchased time. The dependency of the system on the device's OS requires that all provisioning applications be written for a specific OS.

SUMMARY

A system for managing a subscription-based computer independent of an operating system of the computer may include a security module that accesses, decrements, and stores subscription data during operation of the subscription-based computer. Additionally, the system may include a network module in communication with the security module and comprising a network stack, a web server, and a user interface in an operating system independent format. A web browser of the computer may request the user interface from the network stack. The interface may be populated with the subscription data, and a network driver may retrieve the populated user interface from the network module. The populated interface may then be sent to the web server to be served back to the requesting web browser.

SPECIFICATION

Much of the inventive functionality and many of the inventive principles are best implemented with or in software programs or instructions and integrated circuits (ICs) such as application specific ICs. It is expected that one of ordinary skill, notwithstanding possibly significant effort and many design choices motivated by, for example, available time, current technology, and economic considerations, when guided by the concepts and principles disclosed herein will be readily capable of generating such software instructions and programs and ICs with minimal experimentation. Therefore, in the interest of brevity and minimization of any risk of obscuring the present invention's principles and concepts, further discussion of such software and ICs, if any, will be limited to the essentials with respect to the preferred embodiments.

Many prior-art high-value computers, personal digital assistants, organizers, and the like, are not suitable for secure subscription use without modification. The ability to enforce a contract requires a service provider, i.e., an “ISP” or other enforcement entity, to be able to affect a device's operation even though the device may not be connected to the service provider, e.g. connected to the Internet. A first stage of enforcement may include a simple pop up or other graphical interface warning, indicating the terms of the contract are nearing a critical point. A second stage of enforcement, for example, after pay-per-use minutes have expired or a subscription period has lapsed, may be to present a system modal user interface for adding value and restoring service. A provider's ultimate leverage for enforcing the terms of a subscription or pay-as-you go agreement is to disable the device. Such a dramatic step may be appropriate when it appears that the user has made a deliberate attempt to subvert the metering or other security systems active in the device.

Uses for the ability to place an electronic device into a limited function mode may extend beyond subscription and pay-per-use applications. For example, techniques for capacity consumption could be used for licensing enforcement of an operating system or individual applications.

FIG. 1illustrates a logical view of a computing device in the form of a computer110that may be used in a pay-per-use or subscription mode. For the sake of illustration, the computer110is used to illustrate the principles of the instant disclosure. However, such principles apply equally to other electronic devices, including, but not limited to, cellular telephones, personal digital assistants, media players, appliances, gaming systems, entertainment systems, set top boxes, and automotive dashboard electronics, to name a few. With reference toFIG. 1, an exemplary system for implementing the claimed method and apparatus includes a general purpose computing device in the form of a computer110. Components shown in dashed outline are not technically part of the computer110, but are used to illustrate the exemplary embodiment ofFIG. 1. Components of computer110may include, but are not limited to, a processor112, a system memory114, a memory/graphics interface116, also known as a Northbridge chip, and an I/O interface118, also known as a Southbridge chip. The memory114and a graphics processor120may be coupled to the memory/graphics interface116. A monitor122or other graphic output device may be coupled to the graphics processor120.

A series of system busses may couple various system components including a high speed system bus124between the processor112, the memory/graphics interface116and the I/O interface118, a front-side bus126between the memory/graphics interface116and the system memory114, and an advanced graphics processing (AGP) bus128between the memory/graphics interface116and the graphics processor120. The system bus124may be any of several types of bus structures including, by way of example, and not limitation, an Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus and Enhanced ISA (EISA) bus. As system architectures evolve, other bus architectures and chip sets may be used but often generally follow this pattern. For example, companies such as Intel and AMD support the Intel Hub Architecture (IHA) and the Hypertransport architecture, respectively.

The system memory114includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM)130and random access memory (RAM)132. The system ROM130may contain permanent system data134, such as identifying and manufacturing information. In some embodiments, a basic input/output system (BIOS) may also be stored in system ROM130. RAM132typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processor112. By way of example, and not limitation,FIG. 1illustrates operating system136, application programs138, other program modules140, and program data142.

The I/O interface118may couple the system bus124with a number of other busses144,146, and148that join a variety of internal and external devices to the computer110. A serial peripheral interface (SPI) bus144may connect to a basic input/output system (BIOS) memory150containing basic routines to help transfer information between elements within computer110. For example, the BIOS may execute during start-up.

A super input/output chip152may be used to connect to a number of ‘legacy’ peripherals, such as floppy disk154, keyboard/mouse156, and printer158. In one embodiment, the super I/O chip152is connected to the I/O interface118with a low pin count (LPC) bus146. The super I/O chip is widely available in the commercial marketplace.

In one embodiment, bus148may be a Peripheral Component Interconnect (PCI) bus, or a variation thereof, may be used to connect higher speed peripherals to the I/O interface118. A PCI bus may also be known as a Mezzanine bus. Variations of the PCI bus include the Peripheral Component Interconnect-Express (PCI-E) and the Peripheral Component Interconnect Extended (PCI-X) busses, the former having a serial interface and the latter being a backward compatible parallel interface. In other embodiments, bus148may be an advanced technology attachment (ATA) bus, in the form of a serial ATA bus (SATA) or parallel ATA (PATA).

The computer110may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,FIG. 1nonvolatile magnetic media. Removable media, such as a universal serial bus (USB) memory162or CD/DVD drive164may be connected to the PCI bus148directly or through an interface166. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like.

The drives and their associated computer storage media discussed above and illustrated inFIG. 1, provide storage of computer readable instructions, data structures, program modules and other data for the computer110. InFIG. 1, for example, hard disk drive160is illustrated as storing operating system168, application pro grams170, other program modules172, and program data174. Note that these components can either be the same as or different from operating system136, application programs138other program modules140, and program data142. Operating system168, application programs170, other program modules172, and program data174are given different numbers here to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer110through input devices such as a mouse/keyboard156or other input device combination. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit112through one of the I/O interface busses, such as the SPI144, the LPC146, or the PCI148, but other busses may be used. In some embodiments, other devices may be coupled to parallel ports, infrared interfaces, game ports, and the like (not depicted), via the super I/O chip152.

The computer110may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer178via a network interface controller (NIC)180. The remote computer178may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer110. The logical connection depicted inFIG. 1may include a local area network (LAN), a wide area network (WAN), or both, but may also include other networks. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.

In some embodiments, the network interface may use a modem (not depicted) when a broadband connection is not available or is not used. It will be appreciated that the network connection shown is exemplary and other means of establishing a communications link between the computers may be used.

The computer110may also include a security module (SM)182. The SM182may be enabled to perform security monitoring, pay-per-use and subscription usage management, and policy enforcement related to terms and conditions associated with paid use. The SM182may be particularly suited to securely enabling a computer110in a subsidized purchase business model. The SM182may be a set of virtualized containers executing on the processor112or real containers such as an embedded processor or controller. In one embodiment, the SM182is connected to I/O Interface118on the SPI bus144. In another embodiment, the SM182may be embodied in the processing unit112, as a standalone component, or in a hybrid, such as a multi-chip module. A clock184may be incorporated into the SM182to help ensure tamper resistance. To allow user management of local time setting, including daylight savings or movement between time zones, the clock184may maintain its time in a coordinated universal time (UTC) format and user time may be calculated using a user-settable offset. The SM182may also include a cryptographic function (not depicted).

Additionally, the SM may include firmware or other form of secure memory186. The secure memory186may include routines or applications that may facilitate the secure operation of the computer110through the security module182. Additionally, the secure memory186may include any other data that may be securely accessed, stored, or modified without unauthorized tampering. In one embodiment, the secure memory186includes a lower provisioning module (LPM) that manages the allocation of the usage time and policy enforcement. The LPM of the secure memory186may act as a secure execution environment of the SM182and may account for a user's prepaid access time or subscription information. Additionally, the LPM may be described by U.S. patent application Ser. No. 10/988,907, and U.S. patent application Ser. No. 11/612,433 the entire disclosure of which is hereby incorporated by reference.

The secure memory186may also include a cryptographic core that may act as an authentication device for all communication between the SM182and other devices. For example, the cryptographic core of the execution unit225may provide a processing and encryption subsystem of the security module182that reaches a suitable Common Criteria Evaluation Assurance Level to ensure that the computer110and any communication with the SM182may not be compromised.

The memory186may also include storage for system-critical items such as a BIOS for a computer or other electronic device in which the SM182is operating. The secure memory186may also include memory dedicated to the operation of the SM182itself, such as storage, for example, for storing metering code to access and decrement subscription data. The secure memory186may also act as a repository for subscription or pay-per-use data such as data representing an amount of access time. With the LPM, the access time data may be decremented during computer110use. Further, an application for use in providing functionality during limited operation modes, such as a “hardware limited mode,” (HLM) may also be stored in the secure memory186. To support a limited operation mode, a second BIOS, and optionally, an alternate copy of the second BIOS, may also be stored in the secure memory186. The second BIOS may be used for booting the computer or other electronic device incorporating the SM182. The second BIOS may be activated as a secure boot environment to replace the standard BIOS150to enforce a subscription or other security policy. Furthermore, the SM182may also have an ability to force a system reset at any time which may ensure that pay per use or subscription terms are met, as well as provide a clean environment to start with either a normal or a restricted operation BIOS.

The SM182may also include a network module188in communication with the LPM. The network module188may include a network stack that may control all network traffic to the OS136,168through the SM182. For example, the network module188may be implemented in a 32-bit RISC Microcontroller. One example of a suitable microcontroller may be the LPC2378 microcontroller manufactured by NXP Semiconductors of Eindhoven, The Netherlands. Additionally, the network module188may include a web server within the SM182that may host a number of interfaces that allow secure management of a subscription-based computing system. In one embodiment, the network module188includes a number of user interfaces as web pages in a standard publishing format that are served to the user through the SM182. The standard publishing format may be Hypertext Markup Language or any similar format. The network module182may also include a cryptographic module or function that may encrypt all communications between an internet service provider (ISP) and the computer100using a secret key stored in the secure memory186. In another embodiment, the network module188manages a network stack and provides packet filtering and redirection within a subscription-based or pay-per-use computing system. The network module may be in communication with or act as a substitute for the LPM and/or an upper provisioning module (UPM) as described in U.S. patent application Ser. No. 10/988,907, and U.S. patent application Ser. No. 11/612,433.

With reference toFIG. 2, the network module188may be in communication with the SM182. In one embodiment, the network module includes a UPM in the form of a number of web pages in an OS independent format205, a memory210, a network stack and driver215, and a web server220. In one embodiment, the UPM205is a series of web pages that allow a user to add access time and perform other subscription account administrative functions. The UPM205may be hosted inside the web server220and may invoke the LPM, as previously discussed, to retrieve information to be presented on the web sites that are served by the web server220to a web browser executing on the OS. In a further embodiment, the web sites invoke the LPM to retrieve a current time balance and provide packets to provision access time from the SM182to the computer110. The network stack and driver215may make a network port available to the OS during operation of the computer110. In one embodiment, the network stack and driver215determines if incoming requests are destined for the web server220based on an internet protocol (IP) address and a port of the incoming packet. For example, if the incoming packet is for the web server220, then the network stack and driver215may forward the packet to the web server220unencrypted. However, if the incoming packet is destined for another location, i.e., a remote computer178, then the network stack and driver215may encrypt the packet and send it to its destination. In one embodiment, the network stack and driver215may provide a processing and encryption subsystem of the module188that reaches a suitable Common Criteria Evaluation Assurance Level to ensure that the module188and any communication between the computer110and an outside device178may not be compromised. In a further embodiment, the network stack and driver215manages all communication from the computer110to a system that manages user subscription information, as further discussed in relation toFIG. 3.

Other embodiments may include an activation fuse189. The fuse189may be any type of device or firmware that may be selectively activated from an inactive state to enable communication between the I/O Interface118and the SM182. When deactivated, i.e., when the fuse189does not maintain a connection between the SM182and the I/O Interface118, the computer110may not operate as a subscription-based computing device, but rather, as a normal PC. However, when activated, i.e., when the fuse189maintains a connection between the SM182and the I/O Interface118, the computer may operate as a subscription-based computing device. In one embodiment, the fuse189, once activated to enable communication between the SM182and other components and devices, may not be deactivated. For example, the computer110may be manufactured initially to operate as a normal, non-subscription-based PC and may later be activated by an underwriter or subscriber to operate as a subscription-based PC. Therefore, while the fuse is activated and upon boot-up, connection, or disconnection of the device188, firmware of the SM182(i.e., the previously-described local provisioning module of the secure memory186) may seek subscription or usage time stored in the metered computing device188.

FIG. 3is a simplified and exemplary block diagram of a system300supporting pay-per-use and subscription usage of a computer or other electronic device. A provisioning server302may serve as a trusted endpoint for provisioning requests from one or more electronic devices participating in the pay-per-use business ecosystem. One electronic device304may be similar to computer110ofFIG. 1including the SM182and network module188. Other electronic devices306may perform substantially the same as the exemplary device304. Communication between the provisioning server302and the electronic device304may be accomplished through a network308to a network module188of the computer110and that may include landline, wireless, or broadband networks, or other networks known in the art.

An accounting server310may be linked to the provisioning server302and may maintain account data corresponding to the electronic device304. Account data may also be stored at the SM182. The accounting server310may also serve as a clearinghouse for financial transactions related to the electronic device304, such as, replenishing or adding value to a pay-per-use account maintained on the accounting server310. In one embodiment, the electronic device304, communicating through the network module188, establishes a connection with a vendor312that communicates with the accounting server310. In another embodiment, the device304establishes a connection directly with the accounting server310through the module188. During use, an LPM within the SM182of the device304may decrement access data stored in the secure memory186. The access data may be any value, access time for operating any secure OS or application of the electronic device304,306, or any other data that may be recorded at the accounting server310and stored at the SM182for use with a computer110. In a further embodiment, the user may purchase a generic amount of time that may be used for any OS, application, or any other activity at a secure electronic device304. Of course, many other types of data, access time, and subscription information may be purchased and stored at the SM182or an accounting server310.

FIG. 4is a simplified and exemplary block diagram of a method400for implementing an operating system independent architecture for secure, pay-as you-go or subscription-based computing. At block405, a user desiring to operate a computer110with a security module182including the network module188may initiate network communications with the computer110. In one embodiment, the user initiates a web browser executing on the OS136,168of the computer110.

At block410, the user may give instructions to the browser to access the web server220hosted by the network module188. In one embodiment, the user enters a network address of the network module188residing on the computer110.

At block415, the network stack and driver215may determine if the incoming communication from the web browser is destined for the web server220or to an external computer178. If the request is for an external computer or other network device, at block420, the network stack and driver215may encrypt the request before sending it out to a remote computer178. In one embodiment, the network stack and driver215encrypts outgoing requests using a secret key stored in the secure memory186. In another embodiment, a cryptographic module of the SM182may encrypt all outgoing requests. For example, the network stack and driver215may encrypt the message at the network or packet processing layer of network communication using Internet Protocol Security (IPSec) that may be initialized by a secret key of the SM182or stored in the memory210. In a further embodiment, a user's access to anything outside the computer110, i.e., any internet use, will only be accepted at an ISP that is able to decrypt the encrypted message. For example, any ISP not having the key or other cryptographic information used at block420may not communicate with the originating computer110. Encrypting communications from the network module188to any outside entity may result in the computer110being “tightly coupled” to only those ISPs that are able to decrypt the messages.

If, at block415, the request is for the web server220, it may be forwarded with or without encryption. At block425, the web server220may retrieve one of the web pages205to display subscription or other information to the user. As previously described, the user interface web pages205may function as the Upper Provisioning Module disclosed by U.S. patent application Ser. No. 10/988,907, and U.S. patent application Ser. No. 11/612,433. In one embodiment, the web pages205retrieve subscription and other data from the LPM and the system300for display to the user. For example, the web pages may invoke the LPM to display a current account balance or provide a provisioning packet from the server302.

At block430, using the web pages205served to the user in block415, the user may manage the metering of their machine or other subscription functions. In one embodiment, because the network module188serves a user interface205in a universal format, i.e., HTML, metering and provisioning of access time to a computer110in a subscription or pay-as-you-go system is not dependent on the underlying OS. Thus, a network module188may allow a user to manage a subscription-based computing system110independently from the OS136,168.

Many modifications and variations may be made in the techniques and structures described and illustrated herein without departing from the spirit and scope of the present invention. Accordingly, it should be understood that the methods and apparatus described herein are illustrative only and are not limiting upon the scope of the invention