Theft-deterrence method and apparatus for processor based devices

A manageability engine of a processor based device and a host theft-deterrence agent of the processor based device, jointly implement a theft-deterrence protocol with a theft-deterrence service, remotely disposed from the processor based device, to deter theft of the processor based device. The host theft-deterrence agent is configured to operate in a processor operated application execution environment of the processor based device, and the manageability engine is configured to operate outside the application execution environment.

TECHNICAL FIELD

Embodiments of the present invention relate to the field of data processing, in particular, to methods and apparatuses for deterring theft of processor based devices.

BACKGROUND

With the advance of personal computing, making available computing power that was once reserved for main frame computing to ever increasing number of computing users, unfortunately, the theft of processor based devices, from desktops to mobile devices, has also increased. Prior art methods to deter or prevent theft have included physically securing the processor based devices to larger stationery objects to prevent the processor based devices from being stolen. For recovery, prior art also included services for recovering stolen devices via law enforcement agencies.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

Illustrative embodiments of the present invention include, but are not limited to, methods and apparatuses for deterring theft of processor based devices.

FIG. 1illustrates an overview of various embodiments of the present invention. As illustrated, each processor based device102(also referred interchangeably as client device) is provided with a theft-deterrence enabled manageability engine112and host theft-deterrence agent114. In particular, manageability engine112and host theft-deterrence agent114are configured to jointly implement a theft-deterrence protocol with a theft-deterrence service122, remotely disposed from client device102, to deter theft of the client device102. Theft-deterrence service122may be implemented on one or more remotely disposed servers106. Client devices102may be coupled to server(s)106via one or more networks104.

As will be described in more detail below, the theft-deterrence protocol includes manageability engine112periodically requesting a heartbeat message134, including the current theft status of the client device102, from the theft-deterrence service122. And manageability engine112enforces one or more theft-deterrence policies on the client device102, based at least in part on the theft status obtained from theft-deterrence service122. Host theft-deterrence agent114is configured to assist manageability engine112, including e.g. determining whether network104is accessible and/or obtaining from a user a secret to unlock client device102, in the event client device102is locked down.

In various embodiments, the theft-deterrence policy may comprise locking a client device (102). In other embodiments, the theft-deterrence policy may alternatively or additionally comprise partially disabling the client device (102), shredding or deleting data from the client device (102), notify an owner of the client device (102), and/or notify a technical support group supporting the client device (102)

For the illustrated embodiments, host theft-deterrence agent114is configured to operate in a processor operated application execution environment of the client device102, whereas manageability engine112is configured to operate outside the application execution environment. Client device102may have one or more processor operated application execution environments, virtual or otherwise.

Further, client device102may be any one of a number of processor based devices, including but are not limited to desktop computing devices, portable computing devices (laptops as well as handhelds), set-top boxes, and game consoles. Handhelds may include, but are not limited to, personal digital assistants, digital cameras, media players, and mobile phones. Server106may be any number of servers, including but are not limited to blade servers. Networks104may include one or more private and/or public, wire line based and/or wireless, local and/or wide area networks.

Additionally, for the illustrated embodiments, each client device102may include a basic input/output system (BIOS)103configured to cooperate with manageability engine112in implementing the theft-deterrence policies on client device102, including but not limited to locking down the client device102or recovering the unlocking key from the device102, when the theft status of the client device102is stolen.

In various embodiments, each client device102may further include a browser104, whereas theft-deterrence service122may further include a subscription function132to facilitate the client devices102in subscribing with theft-deterrence service122or canceling that service. Theft-deterrence service122may be a pay or a free service, or combination thereof. For the embodiments, server(s)106hosting the theft-deterrence service122may include one or more databases124to store the subscribers and/or subscription related information. The databases124may be stored in one or more persistent storage, such as disk storage.

These and other aspects of the various embodiments, including the various elements and the manner the elements cooperate with each other to deter theft of the client devices102, will be described in further details in turn below.

Referring now toFIG. 2, wherein selected operations of selected components for obtaining/providing the theft status of a client device are illustrated. As shown, during operation, for the embodiments, manageability engine112awaits for the expiration of a request timer (RT) value,202. On expiration of the RT value, manageability engine112determines whether client device102has access to the network,204. For the embodiments, manageability engine112makes the network availability determination by checking with host theft-deterrence agent114, which performs the actual availability checking,206, and reports back to manageability engine112,208.

If access to network104is determined to be available, manageability engine112establishes a network connection to theft-deterrence service122,210. The network connection may be a secure (TLS) connection. Therefore, manageability engine112and theft-deterrence service122may mutually authenticate each other,212.

Upon authentication, manageability engine112may request for a heartbeat message from theft-deterrence service122,214. In various embodiments, each heartbeat request message216may include:

identification of the client device

the theft status currently held by manageability engine112,

a current RT timer value (at expiration of which, manageability engine112is to send the heart beat request message),

a current enforcement timer (DT) value (at expiration of which, manageability engine112is to enforce a theft-deterrence policy on client device102),

a current platform disable priority value,

a current encrypted data disable priority value, or

a current theft-deterrence server rendezvous priority value.

In alternate embodiment, each heartbeat request message may include more or less data.

Continue to refer toFIG. 2, on receipt of the heartbeat request message, theft-deterrence service122logs the connection and request data,218. In response, theft-deterrence service122sends the requested heartbeat message to manageability engine112,220. In various embodiments, each heartbeat message222may include:

identification of the client device

the theft status of the client device,

an update to the RT value,

an update to the DT value,

an update to the platform disable priority value,

an update to the encrypted data disable priority value,

an update to a theft-deterrence server rendezvous priority value.

Similarly, in alternate embodiment, each heartbeat message may include more or less data, consistent with the heartbeat request message. The message may be transmitted between manageability engine112and theft-deterrence service122in any one of a number of formats, in accordance with any one of a number of messaging protocols.

Thereafter, manageability engine112may apply the data contained in the heartbeat message, and may report the success or failure in applying the data,224. Theft-deterrence service122may log the report in its database,226.

Referring now toFIG. 3, wherein selected operations of selected components for enforcing theft-deterrence policy or policies on a client device are illustrated. As shown, during operation, either on obtaining a stolen theft status from theft-deterrence service122,302and306, or on expiration of the DT value,304, manageability engine112alerts host theft-deterrence agent114,308. Thereafter, manageability engine112causes the client device to reboot,310.

For the embodiments, BIOS113is responsible for rebooting client device102. Further, BIOS113is configured to obtain a system lock down status from manageability engine112,312. If the theft status is stolen, manageability engine112returns system lock down equals True to BIOS113,314. If the theft status is not stolen, manageability engine112returns system lock down equals False to BIOS113.

On receipt of system lock down equals False, BIOS113would continue to complete the boot process,316. However, on receipt of system lock down equals True, BIOS113would request a user of client device102to provide an unlock secret,318. On receipt, BIOS113provides the inputted unlock secret to manageability engine112,320.

If the provided unlock secret is incorrect or the time allowed for its provision has expired, the client device102would remain locked (unable to boot). However, if the provided unlock secret is correct, manageability engine112notifies BIOS113,324. On receipt of the notification, BIOS113continues with the boot process,326.

The unlock secret may be provisioned to manageability engine112in any one of a number of manners, including but not limited having the user provide to manageability engine112directly, or indirectly via theft-deterrence service122(with the user or an administrator (on behalf of the user) providing the info to theft-deterrence service122during initial service set up).

In various embodiments, a locked client device102may also become unlock through the receipt of an updated not stolen theft status from theft-deterrence service122,328.

As described earlier, in various embodiments, the theft-deterrence service may be a paid service, and in others, a free service. Regardless, in various embodiments, manageability engine112may register with theft-deterrence service122to subscribe to the service.FIG. 4illustrates selected operations of selected components for renewing subscription of the theft-deterrence service. As illustrated, for the embodiments, on expiration of a subscription timer,402, manageability engine112notifies host theft-deterrence agent114,404.

On receipt of the notification, host theft-deterrence agent114notifies the user,406. For the embodiments, client device102includes browser115. For these embodiments, user may use browser115to connect to theft-deterrence service122. In various embodiments, theft-deterrence service122may be implemented to require or not require browser115to have a special plug-in to be able to connect to theft-deterrence service122to renew a user's theft-deterrence service subscription. Regardless, once connected, theft-deterrence service122may facilitate user in renewing the subscription. The renewal process may be implemented in any one of a number of manners, requiring or not requiring authentication of the user, and/or payment for the subscriptions.

Upon renewal, the plug-in of browser115may notify manageability engine112via the host theft-deterrence agent,412and414, to immediately resume the request for heartbeat messages,416and418. Alternatively, the request for heartbeat messages,416and418may simply resume in due course.

As described earlier, on receipt of a new heartbeat message420, manageability engine112applies the data contained in the heartbeat message420,422, and reports the success or failure of the application to theft-deterrence service122,426. If the obtaining and application is immediately performed as part of the subscription renewal process, manageability engine112may also notify the user of successful renewal,424, via the host theft-deterrence agent.

FIG. 5illustrates an example computer system suitable for use as a client device or a server to practice various embodiments of the present invention. As shown, computing system500includes a number of processors or processor cores502, and system memory504. For the purpose of this application, including the claims, the terms “processor” and “processor cores” may be considered synonymous, unless the context clearly requires otherwise. When use as a client device102, computer system500may further include chipset503. Additionally, computing system500includes mass storage devices506(such as diskette, hard drive, compact disc read only memory (CDROM) and so forth), input/output devices508(such as display, keyboard, cursor control and so forth) and communication interfaces510(such as network interface cards, modems and so forth). The elements are coupled to each other via system bus512, which represents one or more buses. In the case of multiple buses, they are bridged by one or more bus bridges (not shown).

Each of these elements performs its conventional functions known in the art. In particular, chipset503may be employed to practice all or some of the described aspects of manageability engine112(shown as521). System memory504and mass storage506may be employed to store a working copy and a permanent copy of the programming instructions implementing, in whole or in part, the various other components, such as host theft-deterrence agent114or theft-deterrence service122(herein commonly denoted as522), depending on whether computer system500is used as a client device102or as server106. The various components may be implemented by assembler instructions supported by processor(s)502or high-level languages, such as C, that can be compiled into such instructions.

The permanent copy of the programming instructions may be placed into permanent storage506in the factory, or in the field, through, for example, a distribution medium (not shown), such as a compact disc (CD), or through communication interface510(from a distribution server (not shown)). That is, one or more distribution media having an implementation of the agent program may be employed to distribute the agent and program various computing devices.

The constitution of these elements502-512are known, and accordingly will not be further described.

Therefore, it is manifestly intended that the embodiments of the present invention be limited only by the claims and the equivalents thereof.