Patent Application
20080005783
While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the drawings and detailed description thereto are not intended to limit the invention to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present invention as defined by the appended claims. It is noted that the word “may” is used throughout this application in a permissive sense (i.e., having the potential to, being able to), not a mandatory sense (i.e., must).
Turning now to
It is noted that computer system 10 may include various other components and circuits that have been omitted for simplicity. It is further noted that the components of the computing subsystem are depicted in
In the illustrated embodiment, processor 30 may be illustrative of a microprocessor that implements the x86 architecture. Although in other embodiments, processor 30 may be any type of processor implemented with any type of architecture. In one embodiment, processor 30 may include a memory controller (not shown) to facilitate memory transactions directed to memory 40, for example. In addition, processor 30 may include various interface circuits such as a host interface (not shown) for controlling transactions with I/O unit 50.
I/O unit 50 may be any of a variety of I/O controllers that may include bridging and graphics circuits (not shown) that may be used as interfaces between processor 30 and the various I/O devices and buses to which it is coupled. For example, in one embodiment, I/O unit 50 may be coupled to processor 30 via a HyperTransport™ link 31. In such an embodiment, I/O unit 50 may include one or more HyperTransport™ to peripheral component interconnect (PCI) and/or a HyperTransport™ to universal serial bus (USB) bridges for connection to PCI and USB devices, respectively, for example. In addition, in one embodiment, I/O unit 50 may be coupled to wireless module 70 via a USB, HyperTransport™ or other type of link 57, although other interconnects are contemplated. Further, I/O unit 50 may include and graphics functionality for generation of the various signals used in association with display 60 and LR display 65, for example.
The audio subsystem 20 may include audio functionality including analog-to-digital and digital to-analog circuits for generation of the various signals associated with microphone 79 and speaker 78, for example.
Storage 80 may be a mass storage device. For example, in one embodiment storage 80 may include one or more hard disk drives. In other embodiments, storage 80 may include other types of storage media such as a non-volatile random access memory (RAM) device (e.g., a memory stick, flash drive, etc.), compact disk (CD) drive, digital video disk (DVD) drive, tape drive, floppy drive, and the like.
In one embodiment, display 60 may be a liquid crystal display (LCD) or other type of displays such as may be common to portable laptop and notebook computers. In contrast, LR display 65 may be a display such as the type of display used on a mobile telephone or a personal digital assistant (PDA) for example. In one embodiment, LR display 65 may have a lower resolution than display 60. As will be described in greater detail below, in some modes of operation of portable computer system 10, LR display 65 may be used exclusively, while in other modes, display 60 may be used exclusively, and in still other modes, both displays may used concurrently.
As shown, wireless module 70 is coupled to an antenna 77. Wireless module 70 includes a processing unit 71. Wireless module 70 may include the functionality of a wireless communication device such as a mobile telephone, for example. As such, in one embodiment, processing unit 71 may execute instructions and perform functions, and may include analog, digital, radio frequency (RF) and baseband circuits (not shown) that may function to perform such tasks as RF signal reception and transmission, up-conversion and down-conversion of the RF signals, analog-to-digital conversion, digital-to-analog conversion, digital signal processing of the baseband signals, as well as monitoring and control functions. Accordingly, in various implementations, processing unit 71 may include hardware that includes a separate processor such as an advanced RISC machine (ARM) processor, for example, a digital signal processing unit, and/or one or more hardware accelerators for handling complex algorithms.
Wireless module 70 may communicate with a wireless network, such as a wireless telephone network, for example. The wireless network may conform to any of a variety of communication standards that may be compatible with various technologies such as the second (2G), third (3G) and fourth (4G) generation mobile phone technologies. In addition, the wireless network may be a wireless wide area network implemented using such protocols as WiMax, WiBro, NextNet, and others. More particularly, in various embodiments, wireless module 70 may employ a time-division multiple access (TDMA), a code division multiple access (CDMA) and/or a wideband CDMA (WCDMA) technique to implement standards such as the Global System for Mobile Communications (GSM) standard, the Personal Communications Service (PCS) standard, and the Digital Cellular System (DCS) standard, for example. In addition, many data transfer standards that work cooperatively with the various technology platforms may also be supported. For example, wireless module 70 may also implement the General Packet Radio Service (GPRS) standard, the Enhanced Data for GSM Evolution (EDGE) standard, which may include Enhanced General Packet Radio Service standard (E-GPRS) and Enhanced Circuit Switched Data (ESCD), and the high speed circuit switched data (HSCSD) standard, high speed downlink packet access (HSDPA), high speed uplink packet access (HSUPA), evolution data optimized (EV-DO), among others.
In one embodiment, memory 40 may be a system memory that is used to store instructions and data that may be used by processor 30 as well as other devices (e.g., I/O unit 50). In various embodiments, memory 40 may be implemented using any of a variety of volatile or non-volatile memory devices. For example, memory 40 may be implemented using any number of memory devices in the dynamic RAM family of devices. In one embodiment, memory 40 may be implemented using removable or non-removable memory modules with the memory devices affixed thereto. However, other memory device configurations are possible and contemplated.
As shown, memory 40 includes telephony drivers and application software 45 stored therein. It is noted that telephony drivers and application software 45 may be stored more permanently within storage 80 and during run time, at least portions of the instructions and data being executed by processor 30 may be loaded into memory 40.
Portable computer system 10 may include a computing subsystem and a wireless subsystem. In one embodiment, the computing subsystem may include the components that typically make up a general computing platform. For example, the computing subsystem may include processor 30, memory 40, I/O unit 50, display 60, and so on. The wireless subsystem may include wireless module 70, which includes processing unit 71, LR display 65, and in various embodiments, authentication unit 75, GPU 95, and power management unit 90. As will be described in greater detail below, in one embodiment, portable computer system 10 may operate in various modes. It is contemplated that the system architecture of the computing subsystem may follow a more conventional Personal Computer (PC) architecture that uses a Northbridge and/or Southbridge arrangement. However, this type of architecture is also well-known and is not discussed here for brevity. It is worth mentioning that in such a system, the wireless module 70 may be connected to the Northbridge via any type of interconnect such as a USB or PCI link, for example.
During operation of portable computer system 10, either subsystem may be used alone, or both subsystems may be used together in various combinations. For example, in one mode, portable computer system 10 may operate such that only the wireless module 70 may be in operation while the computing subsystem components may be in a standby or low power state. As such, portable computer system 10 may be operated as a wireless communication device such as a mobile telephone or a personal 10 digital assistant (PDA). In such an embodiment, LR display 65 may be used. In another mode, the wireless subsystem may be turned off or placed in a standby mode and portable computer system 10 may operate simply as a laptop or notebook computer. In still other modes, portable computer system 10 may operate using various combinations of computing and wireless communication functionality. It is noted that while portable computer system 10 is operated in the different modes, one or more components may be powered down or placed in a standby mode or other low power states. As such, portable computer system 10 includes a power management unit 90 that may manage the different modes and power states and any switching therebetween.
Depending upon the application software and drivers that may be installed, portable computer system 10 may function as a laptop computer with a fully integrated wireless communication platform that includes voice and data transfer functionality. In addition, due to the integration of the wireless hardware and the telephony drivers and application software 45 on the portable computing platform, the management of various email, address books, and other files may be seamless to a user. For example, the telephony drivers and application software 45 may include instructions that may be used to configure the wireless module 70. In one implementation, a user may select a driver via the operating system or other mechanism, for example. The driver may configure one or more operational characteristics and/or behaviors of wireless module 70. In addition, the telephony drivers and application software 45 may be used to manage email, address books, phone lists, databases, calendars, and other information traditionally used on a mobile telephone. The application software may also include applications that may be run by processor 30 such as spreadsheet, word processing, games, and the like. Once the user configures the system operation, such operations as managing general IP data traffic, receiving incoming calls, sending outgoing calls, receiving and sending email, and display management may be fully automated from a platform user perspective.
Further, as described in greater detail below, portable computer system 10 may be securely accessed by a remote user having administrative privileges. The remote user may perform various administrative tasks including such tasks as querying the portable computer system 10, determining a current location the portable computer system 10, disabling portable computer system 10, and erasing, wiping, or patterning the mass storage 80 and memory 40 of any data, for example. In various embodiments, these administrative tasks may be performed even if portable computer system 10 is in a low power state or powered off, due to wake up functionality of portable computer system 10.
In addition to the functionality described above, portable computer system 10 may be used in a secure computing environment in which processor 30 may be initialized or re-initialized into a secure execution mode. More particularly, in one embodiment, processor 30 may be a secure execution mode-capable processor. More particularly, processors configured to execute x86 instructions generally include architectural features such as Protected mode, which provides for paged virtual memory and privileged execution modes, and the set of control registers which controls these features. Controlling access to those control registers and page tables may provide additional protection from unauthorized access to program code and data within a computer system. Thus, adding a set of architectural extensions to such processors and corresponding software support may provide this protection. The overall security enhancements to a processor may be referred to as a Secure Execution Mode (SEM). Secure Execution Mode (SEM) is a new operating mode added to a processor that creates a trusted execution environment in which a Security Kernel can run free from external tampering.
Accordingly, a processor capable of operating in SEM may include security hardware which, when enabled by SEM, provides support for SEM operating modes such as a trusted execution (TX) mode of operation, for example. As will be described further below, the trusted execution mode may include, depending on what software is executing and its privilege level, the SEM-capable processor operating in a secure user mode and a secure kernel mode in addition to the normal user mode and normal kernel mode. Thus, portable computer system 10 may be secured when processor 30 is operated in TX mode of operation, for example.
It is noted that embodiments of the trusted execution mode and the architectural extensions and hardware that may be added to an x86 processor are described in greater detail in related U.S. patent application Ser. No. 10/419,121, entitled “INITIALIZATION OF A COMPUTER SYSTEM INCLUDING A SECURE EXECUTION MODE-CAPABLE PROCESSOR,” which is incorporated herein by reference in its entirety.
As described in the aforementioned patent application, to enable operation in the trusted or secure execution mode, a second processing engine may provide cryptographic capabilities for verifying at least a portion of a secure code segment, which maybe referred to as a security kernel (SK), of the OS. In one embodiment, as described above, processing unit 71 may include a second processor that may serve as a security services processor (SSP). As such, the SSP may be provided with a unique number from authentication unit 75. In one embodiment, the unique number may be the private key of an asymmetric cryptography key pair. The private key may be generated from a unique personal identification number, or the telephone number of the mobile unit, for example. The key may be stored within authentication unit 75, which in one embodiment may be a device such as a smart card implemented as a subscriber identity module (SIM) card, for example. In addition, since other secure keys may already be stored in the SIM, a signature of a valid secure loader hash and/or a valid security kernel hash may be stored within authentication unit 75.
As such, during a security initialization, processor 30 may send a hash of a secure loader and/or a hash of the SK to processing unit 71 using a special atomic instruction referred to as the SKINIT instruction. As such, processing unit 71 may obtain the key from authentication unit 75 and then verify the hash by encrypting the hash using the key. The signature created by the encryption may be compared to the signature stored within authentication unit 75.
Once the secure loader and the SK have been verified and the SK has been loaded into memory, the secure loader may cause the SK code to be executed. The SK in turn, may take control of the address translation tables, control registers and the SEM hardware mechanisms within processor 30 and then return to the normal OS which resumes operation where it left off, but with full SEM protections in place. Accordingly, once in the trusted execution environment, portable computer system 110 may be used to download digital content or to run other applications that may require a trusted environment.
In another embodiment, authentication unit 75 may also include processing functionality configured to generate cryptographic key/signature information. For example, in addition to the unique personal identification number described above, a unique cryptographic key may be used as a seed value to generate other keys and signatures. The signatures may be used during authentication sequences between the wireless module 70 and the wireless network. In one implementation, authentication unit 75 may provide the unique key to wireless module 70, which may be used to uniquely identify to the network the identity of the portable computer system 10. As such, processing unit 71 may be configured to generate key and signature information.
In another implementation, since authentication unit 75 may include processing functionality to generate cryptographic key information, the wireless network may present a challenge to wireless module 70 when wireless module 70 establishes a connection to the network, along with randomly generated number. The randomly generated number may be used with the unique cryptographic key to generate a signature. Wireless module 70 may provide the randomly generated number to authentication unit 75, which may generate the signature. The signature may be sent by wireless module 70 to the network. If the network-generated signature matches the signature generated by authentication unit 75, then the network authenticates portable computer system 10 as being a valid user.
In a similar manner, wireless module 70 may establish an authenticated wireless session with a computer network via the wireless network using another set of cryptographic keys. For example, using a similar process, the computer network may challenge wireless module 70 and provide a different randomly generated number. Wireless module 70 may provide the new randomly generated number to authentication unit 75, which may generate another signature. This signature may be sent by wireless module 70 to the computer network. If the network-generated signature matches the new signature generated by authentication unit 75, then the computer network may authenticate portable computer system 10 as being a valid user.
In another embodiment, wireless module 70 may be configured to autonomously (i.e., without processor 30 intervention) receive an incoming message or datagram from a remote user and to authenticate the remote user using keys and/or signatures previously stored within authentication unit 75 or a secure memory area (not shown) of wireless module 70. More particularly, the remote user may be authenticated and granted administrative level privileges. Once authenticated, the administrative level user may perform various tasks. For example, if portable computer system 10 is lost or believed to be stolen or otherwise compromised in some way, the administrative level user may send commands to wireless module 70. For example, the administrative level user may query wireless module 70 to determine an operational status of the portable computer system 10 such as the current location, which processes are currently executing, does the memory/storage disk need to be wiped, among others.
Accordingly in one embodiment, the commands may wake up processor 30 if processor 30 is in a low power state such as stand by. In addition, the commands may interrupt processor 30 unconditionally, thereby halting any current processes. Alternatively, the commands may cause all currently executing processes to have a lower priority than any administrative processes that the commands may cause to be initiated, so that the administrative processes may be less likely to be detected. Further, the commands may cause processor 30 to initiate a memory/disk wiping or erasing procedure, and to notify the administrative level user when the wiping procedure is complete. The commands may additionally cause processor 30 and/or portable computer system 10 to be disabled from further operation.
In one embodiment, GPU 95 may provide coordinate information corresponding to a current geographic location of portable computer system 10 to processing unit 71 and/or to processor 30. For example, in one embodiment, GPU 95 may be configured to receive global positioning system (GPS) coordinate information that may be used to determine longitude, latitude, elevation, and time of day. In some embodiments, the coordinate information may be sent via a GPS satellite network or via a GPS terrestrial network, or a combination. In other embodiments, other types of systems and networks may provide the coordinate information. For example, within a large corporate facility, location beacons or other terrestrial beacons may transmit coordinate information that may be received by GPU 95. Further, cellular tower identification may be used to approximate the geographic location, which in some systems may be within a few hundred meters. Accordingly, in the event portable computer system 10 is lost or believed to be stolen, it may be possible to determine the current location and/or the operational status of portable computer system 10 by sending appropriate commands to wireless module 70.
Once the system settings have been configured, portable computer system 10 may be operated normally, or allowed to go into a low power state, as desired. At some point during operation, a user may launch an application that may request secure execution mode operation. For example, an online banking application, or an application that uses media having digital rights management requirements, and the like may be run. As such, if secure/trusted mode is desired (block 205), the user or the software application may initiate an secure execution mode driver which when executed may launch the initialization of processor 30 into the secure execution mode (block 210). Once processor 30 is in the secure execution mode, processing may continue. However, referring back to block 205, if secure execution mode operation is not desired, operation continues as described below in block 215.
A user may desire to connect to a computer network via a wireless connection offered through a wireless network such as wide area network or a wireless telephone network, for example. The wireless module 70 may be configured to establish a wireless connection to the Internet using an IP protocol, or by via dial-up by calling a telephone number to an ISP, for example (block 215). Once the connection is established, wireless module 70 may be configured to establish a connection to a computer network (block 220). In one embodiment, wireless module 70 may initiate the connection with a request. In response to the request, the computer network may present a security challenge to portable computer system 10 (block 225). For example, the computer network may have a secure gateway server, or router that may provide information such as a random or pseudo-random number, for example, to wireless module 70. The information may also be used by the secure gateway server to generate an authentication key or signature for comparison. Wireless module 70 may provide the information to authentication unit 75.
In one embodiment, authentication unit 75 may use the information to generate an authentication key or signature using any of a variety of encryption techniques (block 230). Authentication unit 75 may provide the signature to wireless module 70, which may, in turn, respond to the security challenge by supplying the authentication key to the computer network (block 235). The computer network server may compare the signature returned by wireless module 70, with the signature that was generated after the challenge was issued. If the signatures match (block 240), secure gateway server or router may determine that portable computer system 10 is an authorized user and allow access to various levels and/or resources of the computer network. However, referring back to block 240, if the signatures do not match, secure gateway server or router may determine that portable computer system 10 is not an authorized user and may deny access to various levels and/or resources of the computer network (block 245). For example, the computer network may terminate the connection. Alternatively, the secure gateway server or router may reroute the connection to a non-secure portion of the computer network, as desired.
Once the system settings have been configured, portable computer system 10 may be operated normally, as desired. As described above, portable computer system 10 may have multiple modes of operation during which processor 30 may be operating normally, or in a low power state such as standby or sleep, for example. In addition, wireless module 70 may also be awake and operating normally, independent of processor 30. Further, both processor 30 and wireless module 70 may be in low power states. It is also contemplated that in one embodiment, with the exception of a small receiving portion of wireless module 70, the entirety of portable computers system 10 may be powered off.
Accordingly, wireless module 70 may receive an incoming communication in the form of a datagram, for example. The source of the datagram may be identified as possibly being sent by an admin-level user. Wireless module 70 may initiate an authentication request to authentication unit 75 by providing to authentication information included in the datagram. Authentication unit 75 may authenticate the identity of user (block 305). For example, the datagram may include one or more passwords or signatures for use by authentication unit 75. In addition to the authentication information, one or more commands associated with queries may also be included in the datagram. As such, once the user is authenticated and has been verified to have administrative privileges, wireless module 70 may initiate executing the commands. For example, the user may request information such as current geographic location of portable computers system 10. In addition, other information such as operational state of processor 30 and other peripherals, current processes being executed on processor 30, and the like may be requested in the query. Thus, wireless module 70 may provide the requested information to the user in response to the query.
In response the administrative user may determine that portable computer system 10 is not lost or stolen and that the information contained therein may be safe. As such, a disk wipe may not be necessary. This may be the case, for example, if portable computer system 10 were determined to be somewhere within the owner's facility. Thus, normal operation of portable computer system 10 may be allowed. However, on the other hand, the administrative user may determine that portable computer system 10 is lost or stolen and/or that the information contained therein may be in a compromising situation depending on a number of factors. As such, the administrative user may determine that a disk wipe may be necessary (block 310). The administrative user may issue various commands to cause the disk wipe operation to commence.
If processor 30 is not in a low power state, in one embodiment, wireless module 70 may issue a high-priority interrupt to processor 30, thereby halting any currently executing process(es) (block 325). In addition, wireless module 70 may cause all other processes executing on processor 30 to be reprioritized to have a lower priority than the interrupting process (block 330). Further, wireless module 70 may issue a disk wipe command sequence to processor 30 (block 335). For example, the disk wipe command sequence may cause all file structure trees to be eliminated and storage 80 (e.g., hard disk storage, other mass storage devices) and in some embodiments, system memory to be patterned with a data pattern that may render the data stored therein to be useless (block 355). Once the disk wipe sequence completes, wireless module 70 may send a completion message to the administrative user (block 360). In one embodiment, wireless module 70 may cause a system shutdown (block 365).
Referring back to block 320, if processor 30 is in a low power state, the administrative user may opt not to force a wake up of processor 30 (block 340). Instead, wireless module 70 may store the disk wipe command until processor 30 is brought out of the low power state (block 345). For example, the wipe disk command may be stored within a register set or other secure storage within wireless module 70. As processor 30 begins the boot/restore sequence, in one embodiment, wireless module 70 may interrupt the boot/restore sequence with a high priority interrupt prior to the memory image being reloaded. In another embodiment, BIOS may query wireless module 70 during reboots and/or suspend-to-RAM reloads for the presence of disk wipe command, and if detected, prior to the memory image being loaded/reloaded, the disk wipe sequence may be performed as described above in conjunction with block 355.
Referring back to block 340, the administrative user may opt to force a wake up of processor 30. As such, wireless module 70 initiates a wake up with a disk wipe prior to reboot/reload (block 370). For example, similar to above, BIOS may detect the pending disk wipe operation. As such, BIOS may allow wireless module to issue the disk wipe commands for the disk wipe sequence to occur. In another embodiment, wireless module 70 may interrupt the boot sequence executing out of BIOS, prior to the system image being loaded/reloaded as described above in block 350. Disk wipe operation may proceed as described in block 355.
In one specific implementation, the entire portable computer system 10 may be powered off. In such implementations, wireless module 70 may initialize more quickly than processor 30 and the other portions of the computing subsystem. As such, wireless module 70 may be configured to autonomously initiate a connection to a specific server such as a security enterprise server, for example, of a particular computer network. The wireless module 70 may query the server to determine if it is safe/advisable to boot up. If the server answers with a yes, wireless module 70 may not interfere with the boot sequence. However, if the answer is no, the server may respond with the disk wipe command. Accordingly, wireless module 70 may interrupt the boot sequence as described above beginning in either blocks 345 or in block 370, for example, as desired.
Referring to
Portable computer system 10 also includes a microphone 78, speakers 79A and 79B, and a keyboard 456, and a touch activated mouse control 415 that are mounted on a top surface of the housing 420. In addition, portable computer system 10 includes an additional display unit (e.g., LR display 65) mounted to the top surface of housing 420. As described above, in one embodiment, display 65 may be a low-resolution display. In various other embodiments, LR display 65 may also be an input device (e.g., touch-activated screen) to facilitate use of a pointing device such as a stylus, for example. As such, LR display 65 may include analog-to-digital conversion circuits to input data from the screen. It is noted that the location and type of LR display 65 are also implementation details. As such, LR display 65 may be located in any desired location, another example of which is shown in
Referring to
Although the embodiments above have been described in considerable detail, numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to embrace all such variations and modifications.
