Secure access management of devices

Systems and methods may provide implementing one or more device locking procedures to block access to a device. In one example, the method may include receiving an indication that a user is no longer present, initiating a timing mechanism to set a period to issue a first device lock instruction to lock a peripheral device, relaying timing information from the timing mechanism to a controller module associated with the peripheral device; and locking the peripheral device upon expiration of the period.

BACKGROUND

1. Technical Field

Embodiments generally relate to device security. More particularly, embodiments relate to implementing one or more device locking procedures to block access to a device.

Typically, when a user leaves a vicinity of a device (e.g., a desktop computer), the user may not be able to monitor others who may have access to the device. In some cases, the device may use a device lock mechanism that initiates after a predetermined period of user inactivity. This approach may require the user (or an administrator), however, to predict the period of user inactivity that best balances security concerns and usability. Moreover, if the security of the device has been compromised (e.g., by malware), the device may be prevented from implementing a device lock altogether.

DETAILED DESCRIPTION

FIG. 1is a block diagram of an example of a first system10implementing multiple device locking procedures to block access to a device. The illustrated system10includes a first peripheral device20, a second peripheral device30, and a user device40.

The first peripheral device20and the second peripheral device30may be auxiliary devices configured to work with the user device40. In this example, the first peripheral device20may be a keyboard, and the second peripheral device30may be a display device.

The user device40may be any programmable machine that may carry out a sequence of logical operations. Examples of the user device40may include a notebook computer, desktop computer, personal digital assistant (PDA), media player, a mobile Internet device (MID), any smart device such as a smart phone, smart tablet, or the like. In this example, the user device40may be a desktop computer. The user device40may include an operating system (OS)41and a management module43.

The OS41may be a collection of software that manages computer hardware resources and provides common services for computer programs on the user device40. The OS41may include a security module driver42. The security module driver42may also be configured to issue one or more instructions to implement a device lock on the first peripheral device20and the first second peripheral device30.

The management module43may be configured to, among other things, manage access rights of the first peripheral device20and the second peripheral device30. For example, the management module43may be configured to implement a device lock on the first peripheral device20and the second peripheral device30in order to block their access to the user device40.

So, in this example, if a user of the user device40leaves its vicinity, the OS41may be configured to implement a first timer to monitor a predetermined period of user inactivity. If the period expires, the security module driver42may be configured to issue a device lock instruction on the first peripheral device20and the first second peripheral device30.

In addition, in this example, if the user leaves, the management module43may be configured to detect that the user is no longer present. Upon detecting such an event, the management module43may implement a timer and monitor whether access to the first peripheral device20and the second peripheral device30has been blocked (e.g., by the security module driver42). If, after a period set by the timer expires, access to the first peripheral device20and the second peripheral device30has not been blocked, the management module43may be configured to step in and implement a device lock on these devices. So, for example, if security of the OS41has been compromised by malware that may render the security module driver42unable to implement a device lock, the management module43may be configured to step in and implement the device lock to prevent unauthorized access to the user device40.

FIG. 2is a block diagram of an example of a second system1000that implements multiple device locking procedures to block access to a device. The illustrated system1000includes an OS100, a first subscriber controller module200, a second subscriber controller module300, and a management module400. As will be discussed in greater detail, the OS100, the first subscriber controller module200, the second subscriber controller module300, and the management module400may be configured to manage the access of peripheral devices, such as a keyboard201and a display device301.

The OS100may be a collection of software that manages computer hardware resources and provides common services for computer programs on a user device. The OS100may include a security module driver101. In one example, the security module driver101of the OS100may be configured to issue an instruction to implement a device lock on the keyboard201and the display device301after a predetermined period of user inactivity.

The first subscriber controller module200and the second subscriber controller module300may interface with the keyboard201and the display device301respectively. Among other things, the first subscriber controller module200and the second subscriber controller module300may receive an instruction and implement a device lock on the keyboard201and the display device301.

So, for example, after the expiration of a predetermined period of user inactivity, the first subscriber controller module200and the second subscriber controller module300may receive device lock instructions from the security module driver101to lock the keyboard201and the display device301. In the case of the keyboard201, the device lock may include precluding the keyboard201from receiving further input. In the case of the display device301, the device lock may include locking access to the display screen, and displaying a lock screen.

The management module400may be configured to manage security and subscribers of a user device, such as the user device40(FIG. 1). The management module400may include a security module401to manage security of the user device, and a subscriber module405to manage subscribers of the user device. The security module401may include an authentication module402, a user presence module403, and a subscription management module404.

The authentication module402may be configured to receive user-related information to authenticate a user80. So, in this example, the authentication module402may be configured to receive a security code from the user80via an input device (e.g., a keypad), and compare it to a valid, known security code. In another example, the authentication module may utilize a smart card affiliated with the user80to conduct key exchange process. In still another example, the authentication module may utilize a biometric authentication process. The relationship of the input devices and the authentication module402may be secure, in that they may be configured to be resistant to attacks from malware.

The user presence module403may be configured to monitor the presence of the user80. In one example, the user presence module403may utilize a proximity sensor90(e.g., an ultrasonic sensor, an infrared sensor, etc.) to detect whether the user80is present. The relationship of the proximity sensor90and the user presence module403may be secure, in that they may be configured to be resistant to attacks from malware.

The subscription management module404may be configured to manage subscribers of the management module400. A subscriber may include an entity (e.g., a component, a device, etc.) that may rely on operational instructions from the subscription management module404. In this example, the subscribers may include the keyboard201and the display device301.

The subscriber module405may be configured to receive management information from the subscription management module404, monitor access to the keyboard201and the display device301, and issue instructions relating to access rights of the keyboard201and the display device301.

So, as will be discussed in greater detail, the subscriber module405may receive information regarding the presence of the user80from the user presence module403. If the user presence module403determines that the user80is not present (i.e., via the proximity sensor90), the subscriber module405may set a timer. The first subscriber controller module200and the second subscriber controller module300may be configured to receive the timer information.

If the timer expires, and an instruction from the security module driver101has not resulted in a device lock of the keyboard201and the display301(e.g., after a predetermined period of inactivity), the subscriber module405may be configured communicate directly with the first subscriber module200and the second subscriber module300to implement a device lock on the keyboard201and the display device301respectively.

The arrangement and numbering of blocks depicted inFIG. 2is not intended to imply an order of operations to the exclusion of other possibilities. Those of skill in the art will appreciate that the foregoing systems and methods are susceptible of various modifications and alterations. For example, in another embodiment, a security module driver may communicate with a management module to implement a device lock. In such a case, a timer associated with a subscriber module of the management module may be reset upon the device lock.

FIG. 3is a flowchart of an example of a method of implementing multiple device locking procedures to block access to a device. In this example, a management module, such as the management module400(FIG. 2), may authenticate a user, and allow the user access to system resources, such as the keyboard201(FIG. 2) and the display device301(FIG. 2). In addition, upon detecting that the user may no longer be present, the management module may be configured to communicate with an OS, such as the OS100(FIG. 2), a first subscriber module, such as the first subscriber module200(FIG. 2), and a second subscriber module, such as the second subscriber module300(FIG. 2), to manage access rights of the system resources.

The method might be implemented as a set of logic instructions stored in a machine- or computer-readable storage medium such as, for example, random access memory (RAM), read only memory (ROM), programmable ROM (PROM), firmware, flash memory, etc., in configurable logic such as programmable logic arrays (PLAs), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), in fixed-functionality logic hardware using circuit technology such as application specific integrated circuit (ASIC), complementary metal oxide semiconductor (CMOS) or transistor-transistor logic (TTL) technology, or any combination thereof. For example, computer program code to carry out operations shown in the method may be written in any combination of one or more programming languages, including an object oriented programming language such as, for example, Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages.

At processing block3000, an authentication module, such as the authentication module402(FIG. 2), may authenticate the user utilizing a security code. At processing block3010, a security module, such as the security module401(FIG. 2), may issue a notification to a security module driver, such as the security module driver101(FIG. 2), that the user has been authenticated. The security module may be part of an OS, such as the OS100(FIG. 2). At processing block3020, the security module driver may grant the user access to the keyboard and the display device.

At processing block3030, a proximity module, such as the proximity module403(FIG. 2), may monitor the user's presence. The proximity module may continuously communicate user presence information to a subscriber module, such as the subscriber module405(FIG. 2). The subscriber module may, in turn, relay the user presence information to the first subscriber controller module and the second subscriber controller module.

At processing block3040, the proximity module may detect that the user is no longer present.

At processing block3050, upon detecting that the user may no longer be present, the subscriber module may set a timer. The timing information of the timer may be relayed to the first subscriber controller module and the second subscriber controller module. At processing block3060, the process may continue based on whether the security module driver locks access to the keyboard and the display device before the expiration of the timer.

At processing block3070, after a predetermined period of user inactivity, the subscriber module may send a lock notification to the security module driver of the OS. The security module may, in turn, issue an instruction to the first subscriber controller module and the second subscriber controller module to lock the keyboard and the display device respectively. Upon receiving the instruction, the first subscriber controller module may block keyboard input. Similarly, upon the receiving the instruction, the second subscriber controller module may lock the display device, and display a lock screen on the display device. In another example, the device locking process may further include flushing buffer content (e.g., display buffers), and to transitioning the system to a low-power state.

However if, at processing block3080, the security module fails to lock the keyboard and the display device before upon expiration of the timer, the first subscriber controller module and the second subscriber controller module may recognize the expiration of the timer via the information relayed from the subscriber module. At this point, at processing block3090, the first subscriber controller module may implement a device lock on the keyboard (i.e., may block keyboard input), and the second subscriber controller module may implement a lock on the display device (i.e., may lock the display device, and display a lock screen on the display device). In another example, the device locking process may further include flushing buffer content (e.g., display buffers), and to transitioning the system to a low-power state. At processing block3100, the system may wait for the user authentication (i.e., similar to processing block3000).

Embodiments may therefore provide for an apparatus including a security module deriver, an authentication module, a user presence module, and a subscription module. The security module driver may issue a first device lock instruction to lock a peripheral device after a predetermined period of user inactivity. The authentication module may verify an identity of a user, and the user presence module to monitor the user's presence. The subscription module may receive an indication that the user is no longer present and initiate a timing mechanism to set a period to issue a second device lock instruction to lock the peripheral device. In addition, the subscription module may relay timing information from the timing mechanism to a controller module associated with the peripheral device, wherein the controller module is to automatically implement a device lock on the peripheral device upon expiration of the period.

In one example, the authentication module is to verify the identity of the user via one or more of a security code, a key exchange process, and biometric authentication.

In another example, the user presence module is to utilize user presence data received via a secure connection from one or more of a sensor and a device associated with the user.

In one example, the peripheral device is one of a keyboard and a display device.

In still another example, the controller module is to flush a data buffer of content.

Another embodiment may provide for at least one computer readable storage medium comprising a set of instructions which, if executed by a processor, cause a computer to receive an indication that a user is no longer present, initiate a timing mechanism to set a period to issue a first device lock instruction to lock a peripheral device, and relay timing information from the timing mechanism to a controller module associated with the peripheral device.

In one example, the set of instructions cause a computer to implement a device lock on the peripheral device upon expiration of the period.

In another example, the set of instructions cause a computer to issue a second device lock instruction to lock a peripheral device after a predetermined period of user inactivity.

In one example, the set of instructions cause a computer to verify an identity of the user.

In still another example, verifying the identity of the user is to utilize one or more of a security code, a key exchange process, and biometric authentication.

In yet another example, the set of instructions cause a computer to monitor the user's presence.

In one example, user presence data received via a secure connection from one or more of a sensor and a device associated with the user is to be used to monitor the user's presence.

In another example, the set of instructions cause a computer to flush a data buffer of content.

Still another embodiment may provide for an apparatus comprising a subscription module including first logic to receive an indication that a user is no longer present and second logic to initiate a timing mechanism to set a period to issue a first device lock instruction to lock a peripheral device. The subscription module may also include third logic to relay timing information from the timing mechanism to a controller module associated with the peripheral device, wherein the controller module is to automatically implement a device lock on the peripheral device upon expiration of the period.

In one example, the apparatus includes a security module driver to issue a second device lock instruction to lock a peripheral device after a predetermined period of user inactivity.

In another example, the apparatus includes an authentication module to verify an identity of the user.

In one example, the authentication module is to verify the identity of the user via one or more of a security code, a key exchange process, and biometric authentication.

In still another example, the apparatus includes a user presence module to monitor the user's presence.

In another example, the user presence module is to utilize user presence data received via a secure connection from one or more of a sensor and a device associated with the user.

In another example, the peripheral device is one of a keyboard and a display device.

In still another example, the controller module is to flush a data buffer of content.

Yet another embodiment may provide for a method comprising receiving an indication that a user is no longer present and initiating a timing mechanism to set a period to issue a first device lock instruction to lock a peripheral device. The method may also provide for relaying timing information from the timing mechanism to a controller module associated with the peripheral device and locking the peripheral device upon expiration of the period.

In one example, the method includes locking the peripheral device after a predetermined period of user inactivity.

In another example, the method includes verifying an identity of the user.

In still another example, the method includes verifying the identity of the user is via one or more of a security code verification process, a key exchange process, and biometric authentication.

In one example, the method includes monitoring the user's presence.

In still another example, the method includes monitoring the user's presence includes utilizing user presence data received via a secure connection from one or more of a sensor and a device associated with the user.

In yet another example, the peripheral device is one of a keyboard and a display device.

In still another example, the method includes flushing a data buffer of content.

Techniques described herein may therefore provide for cleaning sensitive information in graphics display buffers, as well as preventing unauthenticated users from providing input except for authentication challenges/responses. Moreover, screen locking control can correspond to an interval when the user is in close proximity of the platform. Additionally, presence-based auto lock actions may be applied in the context of an authenticated/authorized user. Indeed, chipset secure elements may have trusted path connectivity with the sensors, authentication devices, USB (Universal Serial Bus), locking mechanisms and integrated graphics engines resulting in a platform that is highly resistant to malicious tampering by host malware and where authorized users can maintain control of the platform.