System and method to lock electronic device

A method to lock an electronic device comprising an operating system comprises placing the electronic device in a disable state in which the processor is blocked from accessing the operating system, receiving a first unlock password from a remote source during a power-up operation of the electronic device, and placing the electronic device in a temporary unlock state which allows the processor to boot the operating system for a predetermined period of time when the first unlock password matches a password stored in the electronic device. Other embodiments may be described.

RELATED APPLICATIONS

BACKGROUND

The subject matter described herein relates generally to the field of electronic devices and more particularly to a system and method to lock one or more electronic devices.

Some electronic devices may be susceptible to data loss and/or theft of the electronic device. By way of example, electronic devices such as personal computers are susceptible to theft during shipping and even during the retail display process. Accordingly techniques to safeguard an electronic device in the event that it is stolen or is subject to an unauthorized access by a user may find utility.

DETAILED DESCRIPTION

Described herein are exemplary systems and methods to lock electronic devices. In the following description, numerous specific details are set forth to provide a thorough understanding of various embodiments. However, it will be understood by those skilled in the art that the various embodiments may be practiced without the specific details. In other instances, well-known methods, procedures, components, and circuits have not been illustrated or described in detail so as not to obscure the particular embodiments.

FIG. 1is a schematic illustration of an exemplary system100which may be locked in accordance with some embodiments. In one embodiment, system100includes an electronic device108and one or more accompanying input/output devices including a display102having a screen104, one or more speakers106, a keyboard110, one or more other I/O device(s)112, and a mouse114. The other I/O device(s)112may include a touch screen, a voice-activated input device, a track ball, and any other device that allows the system100to receive input from a user.

In various embodiments, the electronic device108may be embodied as a personal computer, a laptop computer, a personal digital assistant, a mobile telephone, an entertainment device, or another computing device. The electronic device108includes system hardware120and memory130, which may be implemented as random access memory and/or read-only memory. A file store180may be communicatively coupled to computing device108. File store180may be internal to computing device108such as, e.g., one or more hard drives, CD-ROM drives, DVD-ROM drives, or other types of storage devices. File store180may also be external to computer108such as, e.g., one or more external hard drives, network attached storage, or a separate storage network.

System hardware120may include one or more processors122, at least two graphics processors124, network interfaces126, and bus structures128. In one embodiment, processor122may be embodied as an Intel® Core2 Duo® processor available from Intel Corporation, Santa Clara, Calif., USA. As used herein, the term “processor” means any type of computational element, such as but not limited to, a microprocessor, a microcontroller, a complex instruction set computing (CISC) microprocessor, a reduced instruction set (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or any other type of processor or processing circuit.

In some embodiments one of the processors122in system hardware120may comprise a low-power embedded processor, referred to herein as a manageability engine (ME). The manageability engine122may be implemented as an independent integrated circuit or may be a dedicated portion of a larger processor122.

Graphics processor(s)124may function as adjunct processor that manages graphics and/or video operations. Graphics processor(s)124may be integrated onto the motherboard of computing system100or may be coupled via an expansion slot on the motherboard.

In one embodiment, network interface126could be a wired interface such as an Ethernet interface (see, e.g., Institute of Electrical and Electronics Engineers/IEEE 802.3-2002) or a wireless interface such as an IEEE 802.11a, b or g-compliant interface (see, e.g., IEEE Standard for IT-Telecommunications and information exchange between systems LAN/MAN—Part II: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications Amendment 4: Further Higher Data Rate Extension in the 2.4 GHz Band, 802.11G-2003). Another example of a wireless interface would be a general packet radio service (GPRS) interface (see, e.g., Guidelines on GPRS Handset Requirements, Global System for Mobile Communications/GSM Association, Ver. 3.0.1, December 2002).

Memory130may include an operating system140for managing operations of computing device108. In one embodiment, operating system140includes a hardware interface module154that provides an interface to system hardware120. In addition, operating system140may include a file system150that manages files used in the operation of computing device108and a process control subsystem152that manages processes executing on computing device108.

Operating system140may include (or manage) one or more communication interfaces that may operate in conjunction with system hardware120to transceive data packets and/or data streams from a remote source. Operating system140may further include a system call interface module142that provides an interface between the operating system140and one or more application modules resident in memory130. Operating system140may be embodied as a UNIX operating system or any derivative thereof (e.g., Linux, Solaris, etc.) or as a Windows® brand operating system, or other operating systems.

In one embodiment, memory130includes a platform disable (PD) firmware module162and a platform disable (PD) host module164which cooperate to manage access to the electronic device108, i.e., to lock the electronic device108. In one embodiment, the platform disable module162may be reduced to firmware stored on a memory module of the electronic device108, and the platform disable host module164may be embodied as logic instructions stored in the computer readable memory module130of the system100. In various embodiments the platform disable module162and the platform disable host module164may be reduced to firmware which may be stored with a basic input/output system (BIOS) for the system100, or to hardwired logic circuitry, e.g., an integrated circuit (IC). Additional details about the operations implemented by modules162and164are described below.

FIG. 2is a schematic illustration of an exemplary networking environment in which a system may be adapted to lock an electronic device in accordance with some embodiments. Networking environment200may comprise a one or more electronic devices108a,108b,108c, (referred to generally by108) connected to one or more servers212a,212b, (referred to generally by212) by a communication network220.

Electronic devices108may be implemented as computing devices such as, e.g., a networked computer, a laptop computer, a desktop computer, an electronic device as described with reference to the electronic device108inFIG. 1. Applications running on electronic devices108may initiate service requests to resources provided by servers212via communication network(s)220. The communication network(s)220may be implemented as a Personal Area Network (PAN), Local Area Network (LAN), Metropolitan Area Network (MAN) or a Wide Area Network (WAN) or the like. Furthermore, communication network220may comprise one or more sub-networks. By way of example, and not by limitation, communication network220may comprise one or more wireless access points (WAPs) that establish a wireless network, which is coupled to a LAN or directly to a backbone network such as the Internet. Additionally, the communication network220may include a variety of input/output transports such as, but not limited to; wired USB or serial links, Wireless 802.11x link, wireless USB, Blue-tooth, infra red link or the like.

In some embodiments one or more of the servers212is adapted to function as an unlock server212a, and one or more of the servers212is adapted to function as a permit server212b. Collectively, the servers212a,212bcooperate to allow a user to permanently unlock an electronic device108. Operations for locking an electronic device108are described with reference toFIG. 3andFIG. 4.

Referring first toFIG. 3, in some embodiments an electronic device108may be loaded with a firmware image that manages locking the electronic device during the manufacturing and/or assembly process. Thus, at operation310a firmware image is generated. At operation315the firmware image is loaded onto the electronic device108. In some embodiments the firmware image may include a hardcoded temporary password for the temporary unlock operation. At operation320a unique platform identifier is recorded in a memory module coupled to the firmware.

In some embodiments the firmware image comprises a public key associated with one or more permit servers212, and a shared security algorithm to manage communication between the electronic device108and the one or more permit servers212. In some embodiments the shared security algorithm generates an unlock password as one component of a password unlock message (PUM) using one or more of the unique identifiers associated with the electronic device recorded in operation320. By way of example and not limitation the unique identifiers may comprise a platform ID, an Ethernet MAC address, or a serial number associated with a circuit board on the electronic device108. The particular identifier is not critical.

In some embodiments the firmware image also comprises a state variable which may be set to a disable state. The firmware image may also comprise a permanent unlock policy (PUP) and a unique disable permit for the platform, and a temporary unlock password. These parameters may be stored in a memory module, e.g., a non-volatile memory module, on the electronic device108.

At operation325the electronic device108is placed into a disable state. When the electronic device is in the disable state the processor(s)122are blocked from accessing the operating system140of the electronic device. By way of example and not limitation, this may be accomplished by a BIOS module that does not boot the system if disk encrypting is used, e.g., by hiding the disk decryption keys till system is unlocked.

The electronic device may be shipped in the disable state. Referring toFIG. 4, when a user activates the electronic device the device's basic input/output system (BIOS) is activated (operation410). At operation415a temporary password is received. In some embodiments the BIOS invokes an application to present a user interface on a display102a user may enter a temporary password in the user interface. In alternate embodiments a temporary password may be supplied to a user on an electronic, magnetic, or optical device which is shipped with the electronic device108or may be shipped separately. By way of example, in some embodiments a temporary password may be stored on a memory device such as a universal serial bus (USB) memory device or on an optical disk or the like. The password may be input into the system by coupling the memory device to the electronic device108.

At operation420it is determined whether the temporary password received in operation415is correct. In some embodiments the temporary password received in operation415is compared to the temporary password which was loaded with the firmware in operation315. If, at operation420, the temporary password received in operation415does not match the temporary password loaded with the firmware in operation315, then control passes to operation440and the electronic device remains in a disabled state.

By contrast, if at operation420the temporary password is correct, then control passes to operation425and the electronic device transitions from a disabled state to a temporary unlock state (seeFIG. 5). In the temporary unlock state the electronic device108is unlocked for a predetermined period of time, such that the processor122can boot the operating system. The predetermined period of time may be established by a manufacturer or assembly and may be loaded into the firmware in operation315. In operation, the electronic device108may monitor the amount of time which elapses during the temporary unlock period. At the end of the temporary unlock period the electronic system returns to a disabled state (seeFIG. 5). During the temporary unlock period the electronic device108may be fully functional or may be only partially functional.

When the electronic device is in a temporary unlock state a procedure may be implemented to transition the device into a permanent unlock state. In some embodiments the procedure may be self-initiated by the electronic device108. In some embodiments a user of the electronic device may have to initiate the procedure, e.g., by invoking a permanent unlock routine that utilizes the services of the platform disable modules162,164.

The flowchart inFIG. 4depicts an embodiment in which the electronic device108automatically implements a routine to permanently unlock the electronic device108. Thus, at operation425a permanent unlock password is received. In some embodiments the platform disable modules162,164cooperate with an unlock server212aand a permit server212bto obtain a permanent unlock password for the electronic device108.

Referring toFIG. 6, in one embodiment the platform disable module164queries the platform disable firmware module162to retrieve the current platform state and a predetermined information set, e.g., a nonce. In response to the query the platform disable firmware module162returns the state value and the nonce. The platform disable module164then transmits nonce and state information to an unlock server212a. In some embodiments the unlock server212amaybe maintained by the manufacturer or distributor of the electronic device, or of one or more components of the electronic device. By way of example, in some embodiments the unlock server212amay be maintained by the manufacturer of the processor(s)122in the electronic device.

The unlock server212apasses the predetermined information set and state information from the electronic device108to a permit server212band requests a platform unlock message (PUM) for the electronic device108. In some embodiments the permit server212bmaybe maintained by the manufacturer or distributor of the electronic device, or of one or more components of the electronic device. By way of example, in some embodiments the permit server212bmay be maintained by the manufacturer of the processor(s)122in the electronic device. In response to the request for a platform unlock message (PUM) the permit server212bgenerates a platform unlock message, which is transmitted back to the unlock server212a.

In some embodiments the permit server212bgenerates a platform unlock message, e.g., by writing the nonce and state information onto a predefined message structure and encrypting the message using permit server's RSA private key.

The unlock server212apasses the encrypted platform unlock message (PUM) back to the platform disable module164, which in turn forwards the encrypted platform unlock message (PUM) to the platform disable firmware162. Referring back toFIG. 4, at operation435the platform disable firmware module162verifies the permanent password. In one embodiment the permanent password is verified e.g., by decrypting the message using permit server's RSA public key and then matching state and nonce info.

If, at operation435the password returned with the platform unlock message (PUM) is not verified then control passes to operation440and the electronic device108is placed into a disable state (seeFIG. 5).

By contrast, if at operation435the password returned with the platform unlock message (PUM) is verified then control passes to operation445and the electronic device is placed in a permanent unlock state (seeFIG. 5). Thus, the operations425-445define a routine by which the electronic device108may be permanently enabled.

As described above, in some embodiments the electronic device may be embodied as a computer system.FIG. 7is a schematic illustration of a computer system700in accordance with some embodiments. The computer system700includes a computing device702and a power adapter704(e.g., to supply electrical power to the computing device702). The computing device702may be any suitable computing device such as a laptop (or notebook) computer, a personal digital assistant, a desktop computing device (e.g., a workstation or a desktop computer), a rack-mounted computing device, and the like.

Electrical power may be provided to various components of the computing device702(e.g., through a computing device power supply706) from one or more of the following sources: one or more battery packs, an alternating current (AC) outlet (e.g., through a transformer and/or adaptor such as a power adapter704), automotive power supplies, airplane power supplies, and the like. In some embodiments, the power adapter704may transform the power supply source output (e.g., the AC outlet voltage of about 110 VAC to 240 VAC) to a direct current (DC) voltage ranging between about 7 VDC to 12.6 VDC. Accordingly, the power adapter704may be an AC/DC adapter.

The computing device702may also include one or more central processing unit(s) (CPUs)708. In some embodiments, the CPU708may be one or more processors in the Pentium® family of processors including the Pentium® II processor family, Pentium® III processors, Pentium® IV, or CORE2 Duo processors available from Intel® Corporation of Santa Clara, Calif. Alternatively, other CPUs may be used, such as Intel's Itanium®, XEON™, and Celeron® processors. Also, one or more processors from other manufactures, may be utilized. Moreover, the processors may have a single or multi core design.

A chipset712may be coupled to, or integrated with, CPU708. The chipset712may include a memory control hub (MCH)714. The MCH714may include a memory controller716that is coupled to a main system memory718. The main system memory718stores data and sequences of instructions that are executed by the CPU708, or any other device included in the system700. In some embodiments, the main system memory718includes random access memory (RAM); however, the main system memory718may be implemented using other memory types such as dynamic RAM (DRAM), synchronous DRAM (SDRAM), and the like. Additional devices may also be coupled to the bus710, such as multiple CPUs and/or multiple system memories.

The MCH714may also include a graphics interface720coupled to a graphics accelerator722. In some embodiments, the graphics interface720is coupled to the graphics accelerator722via an accelerated graphics port (AGP). In some embodiments, a display (such as a flat panel display)740may be coupled to the graphics interface720through, for example, a signal converter that translates a digital representation of an image stored in a storage device such as video memory or system memory into display signals that are interpreted and displayed by the display. The display740signals produced by the display device may pass through various control devices before being interpreted by and subsequently displayed on the display.

A hub interface724couples the MCH714to an platform control hub (PCH)726. The PCH726provides an interface to input/output (I/O) devices coupled to the computer system700. The PCH726may be coupled to a peripheral component interconnect (PCI) bus. Hence, the PCH726includes a PCI bridge728that provides an interface to a PCI bus730. The PCI bridge728provides a data path between the CPU708and peripheral devices. Additionally, other types of I/O interconnect topologies may be utilized such as the PCI Express™ architecture, available through Intel® Corporation of Santa Clara, Calif.

The PCI bus730may be coupled to an audio device732and one or more disk drive(s)734. Other devices may be coupled to the PCI bus730. In addition, the CPU708and the MCH714may be combined to form a single chip. Furthermore, the graphics accelerator722may be included within the MCH714in other embodiments.

Additionally, other peripherals coupled to the PCH726may include, in various embodiments, integrated drive electronics (IDE) or small computer system interface (SCSI) hard drive(s), universal serial bus (USB) port(s), a keyboard, a mouse, parallel port(s), serial port(s), floppy disk drive(s), digital output support (e.g., digital video interface (DVI)), and the like. Hence, the computing device702may include volatile and/or nonvolatile memory.

The terms “logic instructions” as referred to herein relates to expressions which may be understood by one or more machines for performing one or more logical operations. For example, logic instructions may comprise instructions which are interpretable by a processor compiler for executing one or more operations on one or more data objects. However, this is merely an example of machine-readable instructions and embodiments are not limited in this respect.

The terms “computer readable medium” as referred to herein relates to media capable of maintaining expressions which are perceivable by one or more machines. For example, a computer readable medium may comprise one or more storage devices for storing computer readable instructions or data. Such storage devices may comprise storage media such as, for example, optical, magnetic or semiconductor storage media. However, this merely an example of a computer readable medium and embodiments are not limited in this respect.

The term “logic” as referred to herein relates to structure for performing one or more logical operations. For example, logic may comprise circuitry which provides one or more output signals based upon one or more input signals. Such circuitry may comprise a finite state machine which receives a digital input and provides a digital output, or circuitry which provides one or more analog output signals in response to one or more analog input signals. Such circuitry may be provided in an application specific integrated circuit (ASIC) or field programmable gate array (FPGA). Also, logic may comprise machine-readable instructions stored in a memory in combination with processing circuitry to execute such machine-readable instructions. However, these are merely examples of structures which may provide logic and embodiments are not limited in this respect.

Some of the methods described herein may be embodied as logic instructions on a computer-readable medium. When executed on a processor, the logic instructions cause a processor to be programmed as a special-purpose machine that implements the described methods. The processor, when configured by the logic instructions to execute the methods described herein, constitutes structure for performing the described methods. Alternatively, the methods described herein may be reduced to logic on, e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC) or the like.

In the description and claims, the terms coupled and connected, along with their derivatives, may be used. In particular embodiments, connected may be used to indicate that two or more elements are in direct physical or electrical contact with each other. Coupled may mean that two or more elements are in direct physical or electrical contact. However, coupled may also mean that two or more elements may not be in direct contact with each other, but yet may still cooperate or interact with each other.

Reference in the specification to “one embodiment” or “some embodiments” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least an implementation. The appearances of the phrase “in one embodiment” in various places in the specification may or may not be all referring to the same embodiment.