Patent ID: 12210664

DETAILED DESCRIPTION

An intrusion detection system with a non-repeating element may provide intrusion detection functionality with reduced likelihood of manipulation by a malicious user, better intrusion detection, and/or detection of events when there is no active power. The non-repeating element may provide mechanical detection and/or electrical detection using analog and/or digital values, such as by reading an analog value from an electro-mechanical switch. In some embodiments, the non-repeating resistive element may produce a new value for comparison with a previous value, in which the system may detect a mismatch between the new value and the previous value to determine the occurrence of an intrusion event. For example, when a secure boundary of the IHS is removed, the non-repeating resistive element, alone or in combination with another element, may indicate that the secure boundary has been removed.

A general purpose input/output (GPIO) pin may be used to determine the value of the non-repeating element. For example, when the non-repeating element is a resistive element and is coupled to a processor (e.g., a CPU or EC) through the GPIO, the processor may record a value of a characteristic of the non-repeating element for storage in non-volatile memory (NVM) for comparison. A future determination of the characteristic of the non-repeating element may be compared with the previous value stored in NVM to determine whether the intrusion event has occurred. Measuring the non-repeating value of the characteristic of the non-repeating element in the intrusion detection circuit may reduce the likelihood of system manipulation. For example, the use of a non-binary element in the intrusion detection circuit may increase the difficulty for a malicious user to manipulate the non-repeating element in order to hide a breach of the secure boundary. With the non-repeating element, the previous value and the new value of the characteristic of the non-repeating element may be determined and recorded as an analog or digital signal by the IHS. The values may be used to determine when a secure boundary such as a chassis or cover has been breached.

The flow chart inFIG.1illustrates a flow chart of a method100according to some embodiments of the disclosure. Method100may start with the IHS determining an initial analog/digital GPIO value for a characteristic of a non-repeating element at step102. When a user opens the secure boundary such as a cover of the IHS at step104, the IHS may determine a different initial analog/digital GPIO value at step106. For example, the IHS may determine a first value of the first characteristic of the non-repeating element and then retrieve another value of the same characteristic. The first value may be recorded after the recording of the second value and may be compared to a second value, a previous value. The IHS may then compare and register a difference between the first value and the second value at step108. Based on the comparison, the IHS may determine that the secure boundary was opened or intruded upon at step110. An event associated with the determination of block110may be executed based on reaching step110. For example, the determination may be transmitted as an event to an operating system, recorded into RAM or scratchpad, logged in a BIOS event log, and/or stored in a non-volatile memory (NVM). As another example, certain functionality may be permanently or temporarily restricted in response to the intrusion detection. For example, access to certain memory components (e.g., a memory storing sensitive data or an encryption key) and/or certain processing components (e.g., a random number generator, an encryption/decryption circuit, a communications circuit, etc.). As a further example, the information handling system may transmit to a central IT system that the event occurred, through either or both of a primary or a secondary network connection through direct access (e.g., bypassing the operating system) or through a notification sent to the OS.

If the case was not opened as described in step112, the IHS may read the initial analog/digital GPIO value from step102as an identical value or approximately equal (within a threshold amount) as a previous value at step114. When the values do not differ, the IHS may register no change at step116and determine that there was no intrusion event at step118. An event associated with the determination of block110may be executed on reaching step118. For example, the determination may be transmitted as an event to an operating system, recorded into RAM or scratchpad, logged in a BIOS event log, and/or stored in a non-volatile memory (NVM).

One example of a non-repeating element for which a characteristic value is determined as part of method100is shown inFIG.2.FIG.2illustrates a variable resistance unit200of a non-repeating element202and a GPIO208. The non-repeating element200may include a variable resistive element202that may include a resistive material such as a metallic material shaped as a semi-circle. The semi-circle resistive element202may provide a contact surface for a rotating wiper204to connect the resistance material. For example, the wiper204may contact the resistance material at various degrees of rotation as shown by the arrow inFIG.2. The non-repeating element200with the wiper204may produce varying values such as a resistance value for the variable resistive element202. For example, different values of a resistance characteristic for the unit200may be obtained as the wiper204rotates to different points on the resistance resistive element202between a pin1206A to a pin3206C. The wiper204that may be coupled to a pin2206B of the GPIO208and a characteristic value determined by measuring between pin2206B and one or more of pin1206A and pin3206C. The GPIO208may convert an analog value to a digital value based on the position of the wiper204in contact with the resistance element202. The mechanical action of the wiper204may produce an electrical reading on the GPIO208with one or more pins that may be stored in non-volatile memory of the IHS for retrieval and analysis when the system is powered on. After the IHS determines the resistance value from the GPIO208, an embedded controller, processor, or the like may compare the current resistance value with a previous resistance value similar to steps108and116. In some embodiments, the GPIO208may have one or more pins for coupling with the non-repeating element202.

In certain embodiments, the IHS may determine and retrieve one or more resistances values of a non-repeating element such as the variable resistive element202. For example, the IHS may retrieve a voltage value as shown in the flow chart ofFIG.3for method300. Based on the mechanical rotation of a component such as the wiper204in contact with the non-repeating element202, the method300may include one or more readings of from the GPIO208. For example, the IHS may determine that an initial value of the non-repeating element may be 3.01V at step302. The non-repeating element may be coupled to a secure boundary of the IHS being monitored to determine an intrusion event when a limit of the non-repeating element is activated. When the secure boundary such as a cover of the IHS is opened, the mechanical rotation of the component may change the resistance value of the non-repeating element at steps304,308,312, and316. For example, the IHS may determine that the current value of the non-repeating element may be 4.11V at step306. In some embodiments, the IHS may determine the that difference between the current value and the previous value met the limit of the non-repeating element, and the IHS may indicate that the intrusion event occurred. In some cases, the intrusion detection system may detect one or more intrusions events. The IHS may determine the difference of the resistance values between steps302,306,310,314,318, and/or320. For example, the IHS may determine that the 4.91V at step310is the previous value when compared to the current value of 2.81V at step318and that the intrusion event occurred between these two example values. In another embodiment, the resistance value may continue to change after step310because the component such as the wiper204may rotate to the end of the resistance material at step314. When the wiper204rotates pass the end of the resistance material at step314, the resistance values may be reset at step316. For example, the wiper204may rotate 360 degrees from the pin1206A and reset the resistance values.

FIG.4illustrates an example of method400in a flow chart where the GPIO pins1through4may be activated. In some embodiments, the IHS may determine that a GPIO pin is activated in order to determine whether an intrusion event occurred. The GPIO may be coupled to active power through an active rail of the IHS and may be coupled to the non-repeating element for intrusion detection. In some embodiments, the GPIO may operate with no power because the GPIO pins may be activated without power. At step402, the GPIO pin1may be activated and the IHS may store the initial status. When the non-repeating element produces a new value, the GPIO pin2may be activated at step406because of a switch activation at step404. For example, the switch activation at step404may include the wiper204rotating from pin1206A to pin3206C. The IHS may store the current status and determine whether there is a difference between the statuses at steps402and406. Based on the status differences between the two pins, the IHS may determine that the limit for the non-repeating element has been met and the intrusion event occurred. At steps408,412, and416, the activation of the switch for the GPIO may be triggered and produce a different status at GPIO pin3at step410and GPIO pin4at step414. In some embodiments, the IHS may read the one or more GPIO pin statuses to determine whether the intrusion event has occurred. In certain embodiments, the GPIO pin statues may be reset at step418, and GPIO pin4may be compared with GPIO pin2depending on the switch activation and reset at step418.

FIG.3andFIG.4are methods illustrating potential non-repeating values determined from a non-repeating element according to different embodiments. InFIG.3, a method300of operation for determining values from a non-repeating element is shown for a rotating wiper according to some embodiments of the disclosure. A first determination at block302may produce a first value, such as 3.01 Volts, which corresponds to a first value of a resistance characteristic of the non-repeating element. At block304, the non-repeating element is activated to rotate the rotating wiper, which selects a new value for the resistance characteristic. At block306, a second determination may produce a second value, such as 4.11 Volts. At block308, the non-repeating element is activated again. At block310, a third determination may produce a third value, such as 4.91 Volts. At block312, the non-repeating element is activated again. The end of the circular resistive element may be reached at block314, and the rotating wiper is reset at block316at the beginning of the circular resistive element. At block318, a fourth determination may produce a fourth value, such as 2.81 Volts. The process may continue as the side of the chassis is removed or other aspects of the secure boundary are breached. Each activation of the non-repeating element at blocks304,308,312,320produces a new value of the characteristic (e.g., resistance) that is different from the previous value. That is, each subsequent value has a low probability of being the same value as the previous value.

InFIG.4, a method of operation for determination values from another non-repeating element is shown according to some embodiments of the disclosure. For example, the non-repeating element may be a series of elements with a switch that rotates from each element to the next element when the non-repeating element is triggered. A method400of operation begins at block402with a first determination producing a first value, such an output of (1,1,1,0) from four GPIO pins. At block404the switch is activated, and at block406a second determination produces a second value, such as an output of (1,1,0,0) from the four GPIO pins. At block408the switch is activated, and at block410a third determination produces a third value, such as an output of (1,0,0,0) from the four GPIO pins. At block412the switch is activated, and at block414a fourth determination produces a fourth value, such as an output of (0,0,0,0) from the four GPIO pins. Each of the values may be progressed through, for example, by the switch blowing a subsequent fuse in a series of fuses or toggling a switch in a series of switches, in which the switches and/or fuses couple the GPIO pins in series between a first terminal and a second terminal (which are coupled to a positive power supply and a negative power supply when determining the value of the non-repeating element). The non-repeating element may be configured such that the values repeat every four activations, such that the method400returns418back to the first value at block402. The non-repeating element may alternatively be configured such that the element does not return to the first value after progressing through the available value states. In one example embodiment of such a non-repeating element, the non-repeating element may have four output pins and a contact inside the non-repeating element upon activating will reconfigure to contact the next of the output pins of the sequence of pins to a supply voltage. A determination of a value for a characteristic (e.g., voltage) may be made by reading each of the output pins of the non-repeating element to determine which of the output pins is connected to a supply voltage.

An embedded controller (EC), processor (CPU), or the like may determine and/or retrieve the non-repeating values from the non-repeating element, such as determined from GPIO terminals, and compare the non-repeating values for analysis to determine whether an intrusion event occurred. The method500as shown inFIG.5illustrates an example flow chart of the intrusion detection system according to some embodiments. In some embodiments, the IHS may include a non-repeating element with access through a GPIO. The IHS may further include a memory, and a processor coupled to memory, wherein the processor is configured to perform the method500. At block502, the IHS may determine a first value for a first characteristic of the non-repeating element. For example, the IHS may determine a voltage value corresponding to a resistance characteristic of a resistive element, a non-binary value corresponding to a non-binary characteristic of a non-binary element, and/or an activation status for a GPIO pin. The non-repeating element may be coupled to a secure boundary of the IHS such that the non-repeating element is triggered when the secure boundary is breached, such as by the removal of a side or panel of the IHS. The IHS may determine and/or retrieve a second value for the first characteristic of the non-repeating element at block504. The second value may be a previous value compared to the first value. For example, the second value may be retrieved from a non-volatile memory (NVM) coupled to the processor. In certain embodiments, the IHS may determine the first value and second value by reading a current value from the GPIO coupled to the non-repeating element. At block506, the IHS may determine whether an intrusion event occurred by comparing the first value of the first characteristic of the non-repeating element with the second value of the first characteristic of the non-repeating element. When comparing the values, the IHS may indicate that the secure boundary was breached based on one or more criteria, such as the first value being equal to the second value or the first value being within a threshold amount of the second value. For example, the IHS may determine that a cover of the IHS was removed after determining a difference between the initial value and the current value.

In some embodiments, the IHS may determine whether the intrusion event occurred when there is no power supplied to the non-repeating element. For example, the non-repeating element may be activated by a security breach without being powered by a battery. In another embodiment, the non-repeating element may be a non-binary element or a fuse. For example, the intrusion detection system may determine that the fuse has been blown. In certain embodiments, the BIOS may include code for performing the method500and the central processing unit (CPU) may execute the method500when executing the BIOS. In some embodiments, an intrusion may be detected even when the intrusion occurs while the IHS has no power. For example, the method500may be executed after the IHS is turned on after power was off at the IHS. With the second value stored in NVM, the previous value for the characteristic of the non-repeating element may be retained despite a power disconnection. With the non-repeating element comprising a mechanical component not reliant on power for measuring changes in the IHS, such as a force applied to the chassis, the non-repeating element may detect the intrusion despite a power disconnection. Upon powering on of the IHS after the power disconnection, the method500may be executed to determine if an intrusion was detected during the power disconnection. For example, the method500may include determining a position of the rotating wiper204relative to a variable resistive element202, where the position of the rotating wiper204is rotated by an amount proportional to a force applied to a contact point of the secure boundary. The method500may further include determining the intrusion event for a cover or chassis of the IHS, where the cover or chassis is the secure boundary.

FIGS.6A-6Dillustrate an electro-mechanical switch600that may be implemented in the intrusion detection system of an IHS620according to some embodiments. For example, the electro-mechanical switch600may be attached to a motherboard (other printed circuit board or other component) of the IHS620and may include the variable resistance unit200fromFIG.2. As shown inFIG.6A, the electro-mechanical switch600may include a housing608, a cover602, and a plunger610. The housing608may have one or more alignment pin(s)612on the bottom surface for the switch600to electrically couple to the IHS620. Additionally, the switch600may include a contact terminal612for a GPIO.FIG.6Bdepicts the internal structure of the housing608that may include a rotating wiper616, the plunger610, and a spring614. In some embodiments, the spring614may be supplemented with or replaced by another device that receives an applied force, such as a magnet arrangement with the same polar fields that can be pressed closer together by an external force. The distal end of the plunger610may be coupled to the proximal end of the spring614, and the plunger610and the spring614may be located inside the housing608. The plunger610may be mechanically coupled to the chassis of the IHS620such that removing a side or panel of the chassis of the IHS620or otherwise accessing a secure space of the IHS may activate the plunger610causing the rotating wiper616to move an amount proportional to a force applied to the plunger610.

InFIG.6C, the plunger610coupled to the spring614may be compressed into the housing608when the secure boundary is in place. For example, a cover618for the IHS may be the secure boundary of the IHS and may depress the plunger610partially into the housing608. The alignment pin(s)606on the bottom of the switch600may be coupled to the IHS620to secure the switch600to the system. The alignment pin(s)606and the contact terminal612may extend away from the bottom of the housing608. For example, the pin(s)606and the contact terminal612may protrude from the bottom of the housing608. The cover602of the switch600seals the top of the housing608where the rotating wiper616, the plunger610, the spring614, and the resistive element622may reside. The rotating wiper616may be configured to rotate in only one direction in response to movement of the plunger610. In other embodiments, the rotating wiper616may be configured to rotate in either direction in response to movement of the plunger610.

The housing608inFIG.6Dmay have an opening624on one side, and the opening624may be configured to receive the plunger610and the spring614coupled together. The housing608may be configured to include the non-repeating element622that may be a variable resistive element as shown inFIG.2. The rotating wiper616may be configured to cover a portion of the resistance element622. The resistance element622may include a variable resistive element made of a conductive (e.g., metallic) material. In some embodiments, the resistance element622may be shaped as a semi-circle or another comparable shape for contact with rotating wiper616. The bottom of the rotating wiper616may include a conductive (e.g., metal) contact for connecting the resistance material of the resistance element622to an input/output unit such as the GPIO.

The resistance element622, the rotating wiper616, and the spring614may be fully enclosed in the housing608. The plunger610may be fully or partially enclosed in the housing608depending on the force applied to the plunger from the secure boundary618. The plunger610coupled to the spring614may define a contact point for the secure boundary618with the switch600as shown inFIG.6C. When the secure boundary618is removed, the plunger610may decompress and rotate the rotating wiper616. For example, the rotating wiper616may be rotated by an amount proportional to a force applied to the plunger610, the contact point of the secure boundary618. As the movement of the plunger610rotates the rotating wiper616, the position of the rotating wiper616relative to the resistance element622may be modified and may produce a new value for a characteristic of the resistance element622. The IHS620may retrieve one or more values for the characteristic of the resistance element622from the GPIO and/or non-volatile memory. Then, the IHS may determine whether the current value is different from a previous value and may determine whether the difference between the two values exceeds a threshold amount. If so, the IHS620may determine that the cover618was removed and the intrusion event occurred.

In certain embodiments, the non-repeating element622with the GPIO may form the electro-mechanical switch600. The GPIO may be coupled to active power through an active rail of the IHS620and may be coupled to the non-repeating element622for intrusion detection. In some embodiments, the non-repeating element622may be a comparable element that produces a measurable value based on one or more characteristics for comparison and detection of the intrusion event.

FIG.7depicts a block diagram of an intrusion detection system700with a non-repeating element702. The non-repeating element702may be coupled to a GPIO704, and the GPIO704may be coupled to a memory706accessible by the IHS. The memory may include non-volatile memory or the like. The measured values may be non-repeating, but the values are recordable because the non-repeating element may be coupled to GPIO704in order to detect and monitor the values for determining the intrusion event. For example, the IHS may retrieve a value for a characteristic of the non-repeating element702and determine that the intrusion event occurred. Additionally, the IHS may display a notification on a user interface that indicates that the intrusion event has occurred after the IHS.

In some embodiments, the non-repeating element may include a variable resistance element as shown inFIG.2andFIG.6D. In another embodiment, the non-repeating element may be a non-binary element where the values may be represented by values other than 0 and 1. In certain embodiments, the non-repeating element may include a fuse. For example, the intrusion detection system may determine that the fuse has been blown and that the limit of the non-repeating element has been met. In another embodiment, the non-repeating element may include a material that may be shaved away. For example, the IHS may measure the thickness of a material, and as the secure boundary is opened and closed, the thickness of the material may decrease. For some embodiments, the intrusion detection system may include a linear surface that could produce varying resistance values similar toFIG.2.

An information handling system (IHS) may include a variety of components to generate, process, display, manipulate, transmit, and receive information. Any of the illustrated components may be coupled to each other by a cable or another component. One example of an information handling system800is shown inFIG.8. IHS800may include one or more central processing units (CPUs)802. In some embodiments, IHS800may be a single-processor system with a single CPU802, while in other embodiments IHS800may be a multi-processor system including two or more CPUs802(e.g., two, four, eight, or any other suitable number). CPU(s)802may include any processor capable of executing program instructions. For example, CPU(s)802may be processors capable of implementing any of a variety of instruction set architectures (ISAs), such as the ×86, POWERPC®, ARM®, SPARC®, or MIPS® ISAs, or any other suitable ISA. In multi-processor systems, each of CPU(s)802may commonly, but not necessarily, implement the same ISA.

CPU(s)802may be coupled to northbridge controller or chipset804via front-side bus806. The front-side bus806may include multiple data links arranged in a set or bus configuration. Northbridge controller804may be configured to coordinate I/O traffic between CPU(s)802and other components. For example, northbridge controller804may be coupled to graphics device(s)808(e.g., one or more video cards or adaptors, etc.) via graphics bus810(e.g., an Accelerated Graphics Port or AGP bus, a Peripheral Component Interconnect or PCI bus, etc.). Northbridge controller804may also be coupled to system memory812via memory bus814. Memory812may be configured to store program instructions and/or data accessible by CPU(s)802. In various embodiments, memory812may be implemented using any suitable memory technology, such as static RAM (SRAM), synchronous dynamic RAM (SDRAM), non-volatile/Flash-type memory, or any other type of memory.

Northbridge controller804may be coupled to southbridge controller or chipset816via internal bus818. Generally, southbridge controller816may be configured to handle various of IHS800's I/O operations, and it may provide interfaces such as, for instance, Universal Serial Bus (USB), audio, serial, parallel, Ethernet, etc., via port(s), pin(s), and/or adapter(s)832over bus834. For example, southbridge controller816may be configured to allow data to be exchanged between IHS800and other devices, such as other IHSs attached to a network. In various embodiments, southbridge controller816may support communication via wired or wireless general data networks, such as any suitable type of Ethernet network, for example: via telecommunications/telephony networks such as analog voice networks or digital fiber communications networks; via storage area networks such as Fiber Channel SANs; or via any other suitable type of network and/or protocol.

Southbridge controller816may also enable connection to one or more keyboards, keypads, touch screens, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or retrieving data. Multiple I/O devices may be present in IHS800. In some embodiments, I/O devices may be separate from IHS800and may interact with IHS800through a wired or wireless connection. As shown, southbridge controller816may be further coupled to one or more PCI devices820(e.g., modems, network cards, sound cards, video cards, etc.) via PCI bus822. The PCI devices820may couple to other information handling systems (such as through network cabling) and electronic devices (such as through audio cabling), in which the coupling is through wires according to embodiments of this disclosure. Southbridge controller816may also be coupled to Basic I/O System (BIOS)824, Super I/O Controller826, and Baseboard Management Controller (BMC)828via Low Pin Count (LPC) bus830.

BIOS824may include non-volatile memory having program instructions stored thereon. The instructions stored on the BIOS824may be usable by CPU(s)802to initialize and test other hardware components and/or to load an Operating System (OS) onto IHS800. For example, BIOS824may also refer to a set of instructions, stored on BIOS824, that are executed by CPU(s)802. As such, BIOS824may include a firmware interface that allows CPU(s)802to load and execute certain firmware, as described in more detail below. In some cases, such firmware may include program code that is compatible with the Unified Extensible Firmware Interface (UEFI) specification, although other types of firmware may be used.

BMC controller828may include non-volatile memory having program instructions stored thereon that are usable by CPU(s)802to enable remote management of IHS800. For example, BMC controller828may enable a user to discover, configure, and manage BMC controller828, setup configuration options, resolve and administer hardware or software problems, etc. Additionally or alternatively, BMC controller828may include one or more firmware volumes, each volume having one or more firmware files used by the BIOS' firmware interface to initialize and test components of IHS800.

In some embodiments, IHS800may be configured to access different types of computer-accessible media separate from memory812. Generally speaking, a computer-accessible medium may include any tangible, non-transitory storage media or memory media such as electronic, magnetic, or optical media—e.g., magnetic disk, a hard drive, a CD/DVD-ROM, a Flash memory, etc. coupled to IHS800via northbridge controller804and/or southbridge controller816. Super I/O Controller826combines interfaces for a variety of lower bandwidth or low data rate devices. Those devices may include, for example, floppy disks, parallel ports, keyboard and mouse, temperature sensor and fan speed monitoring, etc.

In some embodiments, northbridge controller804may be combined with southbridge controller816, and/or be at least partially incorporated into CPU(s)802. In other implementations, one or more of the devices or components shown inFIG.8may be absent, or one or more other components may be added. Accordingly, systems and methods described herein may be implemented or executed with other computer system configurations. In some cases, various elements shown inFIG.8may be mounted on a motherboard, coupled to a PCB, paddleboard or other connector, or protected by a chassis or the like.

The flow chart and sequence flow diagrams ofFIG.1,FIG.3,FIG.4, andFIG.5are generally set forth as a logical flow chart diagram. As such, the depicted order and labeled steps are indicative of aspects of the disclosed method. Other steps and methods may be conceived that are equivalent in function, logic, or effect to one or more steps, or portions thereof, of the illustrated method. Additionally, the format and symbols employed are provided to explain the logical steps of the method and are understood not to limit the scope of the method. Although various arrow types and line types may be employed in the flow chart diagram, they are understood not to limit the scope of the corresponding method. Indeed, some arrows or other connectors may be used to indicate only the logical flow of the method. For instance, an arrow may indicate a waiting or monitoring period of unspecified duration between enumerated steps of the depicted method. Additionally, the order in which a particular method occurs may or may not strictly adhere to the order of the corresponding steps shown.

The operations described above as performed by a controller may be performed by any circuit configured to perform the described operations. Such a circuit may be an integrated circuit (IC) constructed on a semiconductor substrate and include logic circuitry, such as transistors configured as logic gates, and memory circuitry, such as transistors and capacitors configured as dynamic random access memory (DRAM), electronically programmable read-only memory (EPROM), or other memory devices. The logic circuitry may be configured through hard-wire connections or through programming by instructions contained in firmware. Further, the logic circuitry may be configured as a general purpose processor capable of executing instructions contained in software and/or firmware.

If implemented in firmware and/or software, functions described above may be stored as one or more instructions or code on a computer-readable medium. Examples include non-transitory computer-readable media encoded with a data structure and computer-readable media encoded with a computer program. Computer-readable media includes physical computer storage media. A storage medium may be any available medium that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise random access memory (RAM), read-only memory (ROM), electrically-erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. Disk and disc includes compact discs (CD), laser discs, optical discs, digital versatile discs (DVD), floppy disks and Blu-ray discs. Generally, disks reproduce data magnetically, and discs reproduce data optically. Combinations of the above should also be included within the scope of computer-readable media.

In addition to storage on computer readable medium, instructions and/or data may be provided as signals on transmission media included in an information handling system. For example, an information handling system may include an intrusion detection system. The instructions and data are configured to cause one or more processors to implement the functions outlined in the claims.

Although the present disclosure and certain representative advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the disclosure as defined by the appended claims. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, composition of matter, means, methods and steps described in the specification. For example, although the intrusion detection system may include non-repeating element. Other kinds or types of non-repeating elements and/or accompanying components may be used in the invention depending on applications and operations performed. As another example, although processing of certain kinds of values or attributes may be described in example embodiments, other kinds of values or attributes may be processed through the methods and devices described above. As one of ordinary skill in the art will readily appreciate from the present disclosure, processes, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.

For purposes of this disclosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, calculate, determine, classify, process, transmit, receive, retrieve, originate, switch, store, display, communicate, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an information handling system may be a personal computer (e.g., desktop or laptop), tablet computer, mobile device (e.g., personal digital assistant (PDA) or smart phone), server (e.g., blade server or rack server), a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of non-volatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, touchscreen and/or a video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.