TW201028883A - Secure platform management device - Google Patents
Secure platform management device Download PDFInfo
- Publication number
- TW201028883A TW201028883A TW98103163A TW98103163A TW201028883A TW 201028883 A TW201028883 A TW 201028883A TW 98103163 A TW98103163 A TW 98103163A TW 98103163 A TW98103163 A TW 98103163A TW 201028883 A TW201028883 A TW 201028883A
- Authority
- TW
- Taiwan
- Prior art keywords
- platform management
- management device
- laptop
- processor
- electronic device
- Prior art date
Links
Landscapes
- Telephone Function (AREA)
Abstract
Description
201028883 六、發明說明: 【發明所屬之技術領域】 本發明大體上是關於電子裝置,且更特定言之是關於一 種平台管理裝置,其提供一相應之佈建電子裝置之安全連 接及控制。 【先前技術】 電子裝置(例如,膝上型電腦、掌上型電腦、個人數位 助理’蜂巢式通信裝置、銷售點售貨機及其他合適裝置以 及其組合)已變為行動工作力中之一種一體式組件。以前 員工受限於在桌上型電腦或其他固定場所工作,而膝上型 電腦及其他行動個人電腦裝置之出現已使行動性電腦操作 成為通例且不是例外。儘管如此,行動性具有其缺點。首 先,丟失及/或失竊的電腦已極大地增加了置於公共區域 之機密資訊量。在過去的若干年中,此資訊丟失之一不幸 的副產品是身份盜竊的增加。 此外,由於使用者報告丟失/失竊電腦事件丨取代及組 態-取代系統以等同於先前電腦之系统;可能必須對許多 方案執行兩次、三次或更多次並採取若干步驟以確保其身 份未被偷m ’例>使用者將事件報告給銀行、信用卡公 司、信用機構及其他相庫紐铋;t , 邗應組織而導致的生產力之巨大減 低’會造成損失生產力時期内之可能的成千上萬美元損 失’公司及個人無法追回該等損失。由於丢失/失竊電腦 之增加事件’業界已盡力減少 之可能風險。 /、此等丢失/失竊電腦相關 I38076.doc 201028883 一種此類的努力是將全球定位系統(GPS)詢答機裝備於 電腦’特別是膝上型電腦’該詢答機週期性地發送一信號 至一監控台,使得可監控或快速判定該電腦之位置。此 外,該電腦可經組態使得若該電腦在一預定時間内未被使 用,則單元將關閉,且在回到一全功能或作用中狀態之前 需要°亥單元之持有者輸入一密碼或提供一些其他的鑑認形 式。201028883 VI. Description of the Invention: TECHNICAL FIELD OF THE INVENTION The present invention generally relates to electronic devices and, more particularly, to a platform management device that provides secure connection and control of a correspondingly disposed electronic device. [Prior Art] Electronic devices (eg, laptops, palmtop computers, personal digital assistants' cellular communication devices, point-of-sale vending machines, and other suitable devices, and combinations thereof) have become an integral part of mobile work. Component. Previously, employees were limited to working on desktop computers or other fixed locations, and the emergence of laptops and other mobile PC devices has made mobile computer operations a general exception and not an exception. Despite this, mobility has its drawbacks. First, lost and/or stolen computers have greatly increased the amount of confidential information placed in public areas. One of the unfortunate by-products of this information loss over the past few years has been the increase in identity theft. In addition, since the user reports a lost/stealed computer event, the replacement and configuration-replacement system is equivalent to the previous computer system; it may be necessary to perform two, three or more times on many scenarios and take several steps to ensure that their identity is not Stolen m 'examples> users report incidents to banks, credit card companies, credit agencies and other collaterals; t, the huge reduction in productivity caused by the organization of the organization will result in a possible loss of productivity during the period Thousands of dollars in losses 'company and individuals can not recover these losses. Due to the increase in lost/stolen computers, the industry has tried to reduce the possible risks. /, Lost/Stolen Computer Related I38076.doc 201028883 One such effort is to equip a Global Positioning System (GPS) interrogator with a computer 'especially a laptop' that periodically sends a signal To a monitoring station, it is possible to monitor or quickly determine the location of the computer. In addition, the computer can be configured such that if the computer is not used for a predetermined period of time, the unit will be turned off and the holder of the unit needs to enter a password or before returning to a full-featured or active state. Provide some other forms of identification.
一忒疋位解決方案相關的一個缺點是其可能需要該電腦 具有一活動網路連接(例如,網際網路卜若丟失/被偷竊的 b疋位於建築物内或一地下結構中,則一網路連接不 了利用且通常不可利用^與❺請決方案相關的—個缺點 是可藉由從基本系統移除或關閉相應計時硬體(例如計數 器)而相當容易地避開防護。或者,該電腦之目前未授權 持有者在沒有經授權制者之允許或認可下,可能已獲得 經授權所有者或該電腦使用者之密碼;藉此而允許對該電 腦的未經授權之存取。 【發明内容】 膝上型電腦)是否可被該膝上型電腦之持有者使用。此 夕卜’該平台管理裝置可提供可證實對使用者有用的其他能 」舉例而言’安全性、身份識別、儲存及定位。舉例而 二=僅允許已持有該管理裝置之—使用者之 =!適埠:將:平台管理裝置插人到-可利用的_ 戍八他。適埠中,其促使所佈建的膝上型電腦被啟用。若 —種平台管理裝置控制一所佈建的電子裝置(例如 138076.doc 201028883 該所插入的平台管理裝置未佈建至膝上型電腦或未相應於 其已插入之膝上型電腦’則該膝上型電腦將仍然為停用; 藉此防止對該膝上型電腦之未經授權存取。在一停用系統 中,該膝上型電腦之韌體防止基本硬體子系統及組件發揮 作用;因此無軟體可執行。 操作。 舉例而S,藉由實體持有(physical p〇ssessi〇n)及指紋或 其他生物特徵識別,可提供對一經授權使用者之識別碼。 在應用巾’該+台管理裝置之使用者或持有者將必須藉由 使其手指碰擦於一生物特徵讀取機上而建立授權。若該指 紋未被識別或是未經授權’則該平台管理裝置不會變成作 用m防止對被佈建有該管理裝置之膝上型電腦進行 ,因為該平台管理裴置包含A disadvantage associated with a digital solution is that it may require the computer to have an active network connection (for example, if the Internet is lost/stealed, it is located in a building or in an underground structure, then a network The disadvantage of using a connection that is not available and often not available is that it can be easily avoided by removing or turning off the corresponding timing hardware (such as a counter) from the base system. Or, the computer The currently unauthorised holder may have obtained the password of the authorized owner or the computer user without the permission or approval of the authorized system; thereby allowing unauthorized access to the computer. SUMMARY OF THE INVENTION Whether a laptop is available to the holder of the laptop. In addition, the platform management device can provide other capabilities that can be verified to be useful to the user, for example, security, identity, storage, and location. For example, two = only the user who has already held the management device =! Appropriate: Insert: the platform management device into - available _ 戍 八. Properly, it prompted the deployment of the laptop to be enabled. If the platform management device controls a built-in electronic device (for example, 138076.doc 201028883, the inserted platform management device is not built to the laptop or does not correspond to the laptop it has inserted) The laptop will remain disabled; thereby preventing unauthorized access to the laptop. In a deactivated system, the laptop's firmware prevents basic hardware subsystems and components from functioning. Function; therefore no software executable. Operation. For example, S, by physical possession (physical p〇ssessi〇n) and fingerprint or other biometric identification, can provide an identification code for an authorized user. The user or holder of the + management device will have to establish authorization by rubbing his finger on a biometric reader. If the fingerprint is not recognized or unauthorized, then the platform management device Will not become a function to prevent the laptop from being deployed with the management device because the platform management device contains
由該平台管理裝置提供儲存, 例如用於儲存資料之快閃記憶體 及恢復系統。視情況言之,若該 於一特定裝置,則該整個驻罢IStorage is provided by the platform management device, such as a flash memory and recovery system for storing data. As the case may be, if it is for a particular device, then the entire station I
膝上型電腦可操作 J38076.doc 201028883 提供雙因素鑑認。 點是可在一遠端位置控制一所佈 本發明所提供之另一 建的膝上型電腦。The laptop is operational J38076.doc 201028883 provides two-factor authentication. The point is that a further laptop provided by the present invention can be controlled at a remote location.
本發明所提供之—特點B ^ •點疋可藉由在一所佈建的膝上型電 腦不受一經授權丰 〜 者持有時,遠端停用此種裝置,而防 止對機密資訊的存取。 【實施方式】The present invention provides a feature that can be used to prevent confidential information by remotely disabling a device when it is not authorized by an authorized laptop. access. [Embodiment]
—在審視結合下列圖式(其中相同數字代表相同元件)而進 盯的本發明之下列詳細描述後,將可更容易地瞭解本發明 之上述及相關優點及特點。 ,現在將參考圖對本發明之—例示性實施例進行描 述圖1疋-網路結構1〇之一示意方塊圖,該網路結構⑺ 經組態以採用及使用根據本發明之平台管理裝置。如所 不’該網路10包含-企業飼服器12、一中間通信設備似 -或多個電子裝置16(例如一膝上型電腦,其可經由一網 路20例如網際網路與該企業伺服器12進行遠端通信卜在 應用中,經由存在於該企業伺服器12與一或多個電子裝置 16之間的相應防火牆18、19 ’ 一或多個電子裝置μ與該企 業伺服器12通信。 ' 可將該企業伺服器12實施為一或多個伺服器,其包含並 傳輸與相應電子裝置16相關之使用政策。擁有該企業伺服 器12之企業的員工或經授權人員可使用該等電子裝置μ之 各個。該等電子裝置16及企業伺服器12之各者包含通信嘹 備’例如一收發器,其允許在該企業伺服器]2與—或多個 138076.doc 201028883 電子裝置16之間的通信。一或多個電子裝置16之結構及功 此性將參考圖2而予以更詳細地描述。 可將該中間通信設備14實施為一或多個伺服器,其容納 一或多個企業之通信、使用政策及資料協定,使得複數個 公司(各公司擁有一或多個企業伺服器12)可經由該等電子 裝置16與其遠端工作力通信。在應用中,一或多個企業伺 服器12與該中間通信設備14之間的資料及其他合適資訊交 換是藉由一通信鏈路15予以提供。可將該通信鏈路15實施 為一有線通信鏈路或一無線通信鏈路。 或多個電子裝置16可為膝上型電腦、桌上型電腦、掌 上型電腦、行動通信裝置(例如,蜂巢式電話)或其他合適 裝置及其組合。一或多個電子裝置16被組態有專門的韌 體,稱為平台管理韌體132(圖2),其係結合一平台管理裝 置200操作以提供對該電子裝置丨6之經授權、安全操作以 及與一相應企業伺服器12之更多的安全通信。在應用十, 一或多個電子裝置16與該企業伺服器12之間的通信可經由 一或多個防火牆18、19予以執行。在一些應用中,不一定 需要該等防火牆18、19。 圖2是一例示性電子裝置16之一示意方塊圖該電子裝 置16經組態以結合本發明之平台管理裝置作業。出於闌釋 性及非限制性之㈣’將該電子裴置16係實施為一膝上型 電腦。然而,一般技術者應瞭解可將該電子裝置16實施為 -桌上型PC、-平板PC' 一掌上㈣、一 PDA、無線通 信裝置(例如,-蜂巢式電話)、列印裝置或其他合適裝置 138076.doc 201028883 或其組合。該膝上型電腦16包含至少一控制器或處理器 102,其經組態以控制該膝上型電腦16之全部操作。 該處理器102可包含一用於執行計算之算術邏輯單元 (ALU)、一或多個用於暫時儲存資料及指令之暫存器及一 . 用於控制該膝上型電腦16之操作之控制器。在一實施例 中,s亥處理器102包含由英特爾公司(Intel c〇rp〇rati〇n)所 製造之x86、PentiumTM&Pentiumpro™之微處理器之任何 馨 一者,或由超微(Advanced Micro Devices)所出售之κ_6微 處理器。該處理器102非限於微處理器,也可採取其他形 式,例如微控制器、數位信號處理器、專用硬體(例如 ASIC)、在一或多個分佈橫越一網路之微處理器上執行之 狀態機或軟體。 由處理器102所執行之功能之一是當平台管理裝置 200(圖3)在膝上型電腦16之傳輸範圍外時促使該膝上型電 腦16之系統韌體13〇停用相應膝上型電腦16。舉例而言, • 此可藉由該處理器1〇2量測傳輸在連接裝置之間的信號強 度而予以兀成。若該信號強度是低於一預定臨限,則該處 理器1G2發送-號至該勒體13(),其促使該勒體停止 • 基本裝置(例如,膝上型筆記本)的運作,以及發送一信號 ' 至音訊裝置115 ’其促使該音訊裝置115產生三個警示使用 者處於超出範圍條件之嗶聲。經由轉換器108將一可比較 信號發送至平台管理裝置扇;藉此促使該平台管理裝置 200之揚聲器215提供一超出範圍警告。 該處理器102是藉由―咖匯流排1G3㈣合至一匯流排 138076.doc 201028883 控制器104。該匯流排控制器1〇4包含一整合於其中之記憶 體控制器107。在一替代實施例中’該記憶體控制器聰 與該匯流排控制器104分開β該記憶體控制器m為由該處 理器102或其他裝置對系統記憶體1〇6(例如,同步動態隨 機存取記憶體)進行存取提供一介面。 該匯流排控制器1〇4是耦合至一系統匯流排U3,例如一 週邊組件互連(PCI)匯流排、工業標準結構(ISA)匯流排、 -無線連接或其他合適之通信媒體。耦合至該系統匯流排 113的疋一收發器108 ; 一顯示控制器丨〗2,其可操作以傳 送資料117用於在一相應顯示裝置118(例如,一監視器或 電腦螢幕)上顯示;一硬碟114; 一音訊裝置115(例如,一 揚聲器);運動偵測器116(例如,一加速計);一可視指示 裝置119(例如,一發光二極體(1^〇)); 一輸入/輸出(ι/〇)控 制器120及一 USB或智慧卡讀卡機埠124。 s亥收發器1 08可為能夠透過一可應用通信網路傳輸及接 收資料及資訊之任何合適裝置。舉例而言’該收發器1〇8 可為一基於USB之通信裝置,或一具備藍芽功能之裝置, 具備藍芽功能之裝置能夠提供接至一藍芽網路的一連接並 且在其上發送與接收資訊。該收發器丨〇8亦可採用或利用 其他資料鏈路連接協定(例如,RFID)。 該硬碟114可為任何合適的非揮發性記憶體,例如,快 閃δ己憶體。該硬碟114保持有系統韌體13〇(例如,BI〇s軟 體)或該膝上型電腦16之其他合適的核心系統軟體。其中 該韌體130負責初始化及組態各種硬體子系統(例如,顯示 138076.doc -10· 201028883 控制器112、運動感測器116、輸入/輸出(I/O)控制器118或 其他合適裝置或存在於該膝上型電腦16内、由該電腦控制 或耦合至該電腦之一系列裝置)’及開始作業系統(〇3)開 機啟動處理程序(boot process)。在該系統韌體13〇内的是 • 平台管理韌體(PMF)程式碼132 ’其係用於與可相關聯於該 膝上型電腦16的一平台管理裝置200(圖3)通信及啟用該裝 置之功能性。以下將更詳細地描述該平台管理裝置之功能 • 性及其基本韌體。 此外,該系統韌體13 0可被健存在一處理器可讀媒體中 或藉由體現於一載波中之一電腦資料信號透過一傳輸媒體 或其他合適通信鏈路予以傳輸。該處理器可讀媒體可包含 可儲存或傳送資訊之任何媒體,例如,一電子電路、一半 導體記憶體裝置、一 ROM、一快閃記憶體、一可擦除可程 式化ROM(EPROM)、一軟式磁片、一CD_R〇M、一光碟、 一光纖媒體、一射頻(RF)鏈路或其他適當媒體。該電腦資 參 料信號可包含可經由一傳輸媒體(例如,電子網路通道、 光纖、空中電磁、RF鏈路或其他合適傳輸媒體)傳播之任 何信號。碼段可經由電腦網路(例如,網際網路' 一内部 網路、LAN、WAN或其他合適網路或其組合)予以下載。 , 舉例而言’可藉由-揚聲器或能夠對使用者提供一可聽 見的警告之其他合適裝置來實施一音訊模組⑴。在應用 中,在-未經授權期間,當移動該膝上型電腦叫,咳立 訊模組115將變為作用中(例如提供一畢聲或其他二 告)’如下文將進行更詳細論述。該音訊模組ιΐ5亦提㈣ 138076.doc •11- 201028883 該膝上型電腦16之操作狀態之一指示。舉例而言,一單一 °畢聲指示停用該膝上型電腦16。兩個嗶聲指示啟用該膝上 型電腦16。舉例而言’若該膝上型電腦起初是處於一睡眠 或休眠狀態’則在該膝上型電腦16接收到一有效指紋或其 他生物特徵值後,可能發生此兩個嗶聲。三個嗶聲指示該 膝上型電腦16是在一相應平台管理裝置之無線範圍外。 一運動感測器116(例如,一加速器)經組態以判定該膝 上型電腦16是在何時被移動。在應用中,當移動該膝上型 電腦16時,該運動感測器116會發送一相應信號至在該處 理器102上運行的韌體。響應於此等信號,該處理器1〇2發 送適用信號至該音訊模組115,其促使該音訊模組提供一 指不該膝上型電腦16被移動之可聽見的信號(例如,嗶 聲)》或者,響應於由該運動感測器116所提供之運動信 號,該處理器1G2發送-適用信號至可視指示裝置ιΐ9(例 如,一LED),其促使該LED 119提供該膝上型電腦w被移 動之一可視警告。 ι/〇控制11118經組態以控制在複數個輸人裝置(例如, 一滑鼠⑵、一㈣、控制桿或其他週邊輸入裝置a]及一 生物辨識感測器123(例如’ 一指紋讀取機),以及一適用輸 出裝置(例如,一印表機(夫顧+ 衣機(禾顯不)))之間的資訊傳送及在該 等輸入裝置與該處理器102之間 一 幻貝。凡傳送。该I/O控制器 118亦經組態以提供資訊及資 寸主忑收發器1 08以與在該膝 上型電腦16遠端之裝置通信。 USB谭124經組態以從一外部裝置a, & 。丨哀置(例如,本發明之平台 -J2· 138076.doc 201028883 管理裝置或-標準USB記憶體裝置)接收一相應usb連接 器。在一實施例中,該USB埠124亦可為一智慧卡讀卡機 璋。 圖3是本發明之平台管理裝置200之一示意方塊圖。出於 ‘ _性及非限制性之目的,該平台管理裝置200可被容納The above and related advantages and features of the present invention will be more readily understood from the following detailed description of the appended claims. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A schematic block diagram of a network structure (1) of the present invention will now be described with reference to the accompanying drawings, which is configured to employ and use the platform management apparatus in accordance with the present invention. If not, the network 10 includes a corporate server 12, an intermediate communication device, or a plurality of electronic devices 16 (e.g., a laptop computer that can be connected to the enterprise via a network 20 such as the Internet The server 12 performs remote communication in the application via a corresponding firewall 18, 19' between the enterprise server 12 and one or more electronic devices 16 and one or more electronic devices μ and the enterprise server 12 Communication. The enterprise server 12 can be implemented as one or more servers that contain and communicate usage policies associated with the respective electronic device 16. The employee or authorized personnel of the enterprise that owns the enterprise server 12 can use the Each of the electronic devices 16 and the enterprise server 12 includes a communication device 'for example, a transceiver that allows the enterprise server 2 and/or a plurality of 138076.doc 201028883 electronic devices. Communication between 16 . The structure and functionality of one or more electronic devices 16 will be described in more detail with reference to Figure 2. The intermediate communication device 14 can be implemented as one or more servers that accommodate one or more Multiple companies Communication, usage policies, and data protocols enable a plurality of companies (each company owning one or more enterprise servers 12) to communicate with their remote working forces via the electronic devices 16. In the application, one or more enterprise servers The data and other suitable information exchanges between the intermediate communication device 14 and the intermediate communication device 14 are provided by a communication link 15. The communication link 15 can be implemented as a wired communication link or a wireless communication link. The electronic device 16 can be a laptop, a desktop computer, a palmtop computer, a mobile communication device (eg, a cellular phone), or other suitable device, and combinations thereof. One or more of the electronic devices 16 are configured with a dedicated The firmware, referred to as platform management firmware 132 (FIG. 2), operates in conjunction with a platform management device 200 to provide authorized, secure operation of the electronic device 6 and more with a corresponding enterprise server 12. Secure communication. In application ten, communication between the one or more electronic devices 16 and the enterprise server 12 can be performed via one or more firewalls 18, 19. In some applications, it is not necessary Such firewalls 18, 19. Figure 2 is a schematic block diagram of an exemplary electronic device 16 that is configured to operate in conjunction with the platform management apparatus of the present invention. For ease of use and without limitation (4) 'The electronic device 16 is implemented as a laptop. However, the average person should understand that the electronic device 16 can be implemented as a desktop PC, a tablet PC', a handheld (four), a PDA, and wireless communication. A device (eg, a cellular phone), a printing device, or other suitable device 138076.doc 201028883, or a combination thereof. The laptop computer 16 includes at least one controller or processor 102 configured to control the lap All operations of the computer 16. The processor 102 can include an arithmetic logic unit (ALU) for performing computations, one or more registers for temporarily storing data and instructions, and a control for controlling the operation of the laptop 16. Device. In one embodiment, the sho processor 102 includes any of the x86, PentiumTM & PentiumproTM microprocessors manufactured by Intel Corporation (Intel c〇rp〇rati〇n), or by Supermicro (Advanced) Κ_6 microprocessor sold by Micro Devices. The processor 102 is not limited to a microprocessor, and may take other forms, such as a microcontroller, a digital signal processor, a dedicated hardware (such as an ASIC), and one or more microprocessors distributed across a network. The state machine or software that is executed. One of the functions performed by the processor 102 is to cause the system firmware 1 of the laptop 16 to disable the corresponding laptop when the platform management device 200 (Fig. 3) is out of range of the laptop 16. Computer 16. For example, • This can be determined by the processor 1〇2 measuring the signal strength transmitted between the connected devices. If the signal strength is below a predetermined threshold, the processor 1G2 sends a - sign to the levitator 13(), which causes the levitator to stop • operation of the base device (eg, a laptop), and transmission A signal 'to the audio device 115' causes the audio device 115 to generate three beeps that alert the user to an out of range condition. A comparable signal is sent to the platform management device fan via converter 108; thereby causing speaker 215 of platform management device 200 to provide an out of range warning. The processor 102 is coupled to a bus 138076.doc 201028883 controller 104 by a "cafe" 1G3 (4). The bus controller 1〇4 includes a memory controller 107 integrated therein. In an alternate embodiment, the memory controller is separated from the bus controller 104. The memory controller m is the system memory 1 〇 6 by the processor 102 or other device (eg, synchronous dynamic randomness). Access memory) provides an interface for access. The bus controller 1〇4 is coupled to a system bus U3, such as a peripheral component interconnect (PCI) bus, an industry standard architecture (ISA) bus, a wireless connection, or other suitable communication medium. A first transceiver 108 coupled to the system bus 113; a display controller </ RTI> operative to transmit data 117 for display on a corresponding display device 118 (e.g., a monitor or computer screen); a hard disk 114; an audio device 115 (eg, a speaker); a motion detector 116 (eg, an accelerometer); a visual indicating device 119 (eg, a light emitting diode (1^〇)); An input/output (ι/〇) controller 120 and a USB or smart card reader 埠124. The s-heavy transceiver 108 can be any suitable device capable of transmitting and receiving data and information through an applicable communication network. For example, 'the transceiver 1 〇 8 can be a USB-based communication device, or a Bluetooth-enabled device, and the Bluetooth-enabled device can provide a connection to and on a Bluetooth network. Send and receive information. The transceiver port 8 can also employ or utilize other data link connection protocols (e.g., RFID). The hard disk 114 can be any suitable non-volatile memory, such as a flash δ memory. The hard disk 114 holds a system firmware 13 (e.g., BI〇s software) or other suitable core system software for the laptop 16. The firmware 130 is responsible for initializing and configuring various hardware subsystems (eg, display 138076.doc -10. 201028883 controller 112, motion sensor 116, input/output (I/O) controller 118, or other suitable The device is either in the laptop computer 16, controlled by the computer or coupled to a series of devices of the computer) and starts the operating system (〇3) to boot the boot process. Within the system firmware 13 is a Platform Management Firmware (PMF) code 132' for communication and activation with a platform management device 200 (Fig. 3) that can be associated with the laptop 16. The functionality of the device. The functionality of the platform management device and its basic firmware will be described in more detail below. In addition, the system firmware 130 can be stored in a processor readable medium or transmitted by a computer data signal embodied in a carrier through a transmission medium or other suitable communication link. The processor readable medium can include any medium that can store or transfer information, such as an electronic circuit, a semiconductor memory device, a ROM, a flash memory, an erasable programmable ROM (EPROM), A flexible magnetic disk, a CD_R〇M, a compact disc, a fiber optic medium, a radio frequency (RF) link, or other suitable medium. The computer information signal can include any signal that can be propagated via a transmission medium (e.g., an electronic network channel, fiber optic, airborne electromagnetic, RF link, or other suitable transmission medium). The code segments can be downloaded via a computer network (e.g., the Internet 'an internal network, LAN, WAN, or other suitable network, or a combination thereof). For example, an audio module (1) can be implemented by a speaker or other suitable device capable of providing an audible warning to the user. In the application, during the unauthorized period, when the laptop is called, the coughing module 115 will become active (for example, providing a second or other second message), as will be discussed in more detail below. . The audio module ιΐ5 is also mentioned (four) 138076.doc • 11- 201028883 One of the operational states of the laptop 16 is indicated. For example, a single tone indicates that the laptop 16 is deactivated. Two beeps indicate that the laptop 16 is enabled. For example, if the laptop is initially in a sleep or hibernation state, the two beeps may occur after the laptop computer 16 receives a valid fingerprint or other biometric value. Three beeps indicate that the laptop 16 is outside the wireless range of a corresponding platform management device. A motion sensor 116 (e.g., an accelerator) is configured to determine when the laptop 16 is being moved. In an application, when the laptop 16 is moved, the motion sensor 116 sends a corresponding signal to the firmware running on the processor 102. In response to the signals, the processor 112 sends a suitable signal to the audio module 115, which causes the audio module to provide an audible signal that the laptop 16 is not being moved (eg, a click) Alternatively, in response to the motion signal provided by the motion sensor 116, the processor 1G2 sends a -apply signal to the visual indication device ι 9 (eg, an LED) that causes the LED 119 to provide the laptop w is moved by one of the visual warnings. The ι/〇 control 11118 is configured to control a plurality of input devices (eg, a mouse (2), a (four), a joystick or other peripheral input device a] and a biometric sensor 123 (eg, a fingerprint read) Pick-up), and information transfer between an applicable output device (eg, a printer (French + machine) and a phantom between the input device and the processor 102 The I/O controller 118 is also configured to provide information and information to the transceiver 108 to communicate with devices at the remote end of the laptop 16. The USB Tan 124 is configured to An external device a, & 丨 置 (for example, the platform of the present invention - J2 138076.doc 201028883 management device or - standard USB memory device) receives a corresponding usb connector. In an embodiment, the USB The device 124 can also be a smart card reader. Figure 3 is a schematic block diagram of the platform management device 200 of the present invention. The platform management device 200 can be accommodated for the purpose of <RTIgt;
. 在一具有一覆蓋區之外殼内,該覆蓋區相當於一標準USB 裝置之覆蓋區.。但是本文所述之容納級件之所有裝置外殼 φ (由本發明預期且是在本發明之精神及範圍内。該平台管 裝置00匕3處理器或控制器202,其經組態以控制該 裝置200之全部操作。 一該處理器200可包含—用於執行計算(例如,信號強度計 算)之ALU、一或多個用於暫時儲存資料及指令之暫存 器,及一用於控制該平台管理裝置2〇〇之操作之控制器。 該處理器202非限於微處理器,但可採取其他形式,例如 微控制器、數位信號處理器、專用硬體(例如,A"。、在 ❹ —或多個分佈橫越—網路之微處理器上執行之狀態機或於 體。 . 1¾處理器202是藉由一裝置匯流排2()3而麵合至—匯流排 控制器204。該匯流排控制器2〇4可包含一含於其中之纪胯 ' 體,該記憶體可操作以提供對裝置記憶體206(例如, 步動態隨機存取記憶體)之存取。 該匯流排控制器204是連接至一裝置匯流排213(例如, - ISA匯流排或其他合適通信媒體)。輕合至該裝置匯 213的是一收發器208、—GPS信號產生器21〇、—揚聲器 138076.doc ,, 201028883 或其他音訊裝置215、一非揮發性記憶體214(例如,一非 揮發性快閃記憶體)、一電源供應器2丨6、—可視指示器 219(例如,一LED)、一1/0控制器22〇、一停用按鈕222、 一 USB連接器224及一無線通信控制器226。 該收發器208可藉由能夠經由一網路偵測、建立及傳輸 並接收資料及其他資訊之任何適當裝置予以實施。舉例而 . 言,該收發器208可為一基於USB之通信裝置,或一具備 . 藍芽功能之裝置,該具備藍芽功能之裝置能夠提供一連接 至一藍芽網路。該收發器208亦可採用或利用其他資料鏈 ❹ 路連接協定(例如,RFID)。 該GPS信號產生器21〇可為能夠經由一網路提供一定位 信號之任何合適詢答機。或者,該Gps信號產生器可 提供其最後的已知位置及一相應膝上型電腦16(圖2)之位置 至一企業伺服器以進行進一步處理及處置。 該音訊裝置215可為任何揚㈣或能夠提供—可聽見的 警告(例如…畢聲)至一使用者之其他合適裝置。當基本平 f ’舉例而言-所佈建之膝上型電腦被移動時;當該平台 ❹ 管理裝置200與該相應佈建的膝上型電腦之間的距離超過 -預定距離時,可提供可聽見的警告;或告知使用者好 。g理裂置200之操作狀態。舉例而言,當該音訊裝置出 · 提供單-。畢聲或其他合適指示信號時,停用該平台管理 裝置200。舉例而言’在從該生物特徵讀取機如成功讀取 指紋後’兩個。畢聲指示啟用該平台管理裝置·。三㈣ 聲指示該平台管理裝置200與該相應膝上型電腦或其他合 338076.doc -14- 201028883 $裝置之間的距離超過1定臨限。舉例而言,當該所佈 =膝上型電腦脫離在該相應平台管理裝置之無線範圍 •’该音訊裝置215會提供三個嗶聲。 非揮發性記憶體214可為任何適當記憶體(例如,一 發性快閃記憶體),其在基 , #丞本裝置低電力或電源關閉狀態 . ㈣保持儲存於其中之内容。在該非揮發性記憶體214内 的疋平台管理物體232,當其藉由該處理器2〇2予以執行 • 時’促使該處理器加提供該平台管理裝置200之功能性。 =口 e理勒體232之-部分是保持在一所佈建的膝上型 电腦之硬碟或其他非揮發性記憶體或其他合適裝置中,使 得組合之勤體模組132、232提供用於本發明之安全佈建及 操作。而且,該勤體232包含所佈建的膝上型電腦之一些 動體132 ’使得當該平台管理裝置細是在傳輸範圍外時防 止操作該所佈建的膝上型電腦。由該物體所提供之功能性 將參考圖4-5予以更詳細描述。 • t源供應器216可為任何合適裝置,其能夠提供至少八 個小時的連接時間及至少七天的待機或非連接時間。此種 .電源供應器之一實例可為鐘離子(Li-ΟΝ)電池或一錄金属 氯化物電池。在一替代實施例中,該電源供應器W可藉 由可再充電電池或類似組件予以實施。 舉例而言’可藉由一發光二極體(LED)或能夠響應於該 平台管理裝置200之一命令或狀態而提供一可視警告之任 何合適裝置來實施可視指示器219。舉例而言,一綠色 LED指示一成功的指紋讀取已發生。一紅色ΕΕ〇指示一失 138076.doc -15- 201028883 敗的指紋讀取已發生。一快閃棕黃色LED指示該平台管理 裝置200處於一低電力狀態。可提出任何數目的額外色彩 指示器以提供該平台管理裝置200之狀態之一指示。 s亥I/O控制器220經組態以控制在複數個輸入裝置(例 如’停用按鈕222及生物特徵讀取機223,以及其他週邊裝 置(未顯示)及/或一相應膝上型電腦)之間的資訊傳送。該 . 停用知:鈕222疋用於控制該相應佈建的膝上型電腦μ是否 · 被停用,以及控制該平台管理裝置2〇〇之操作狀態。舉例 而§,當按下該停用按鈕222時,該相應膝上型電腦16被 0 置於停用狀態。舉例而言,此可藉由該平台管理裝置 2〇〇向該相應膝上型電腦16發送一信號予以完成該信號 包含促使該膝上型電腦16之系統韌體13〇(圖2)防止該等基 本子系統及組件運行之命令;藉此防止任何軟體由該所佈 建的膝上型電腦予以執行。在一替代實施例中,當按下該 停用按鈕222時,該膝上型電腦之系統動體將防止所佈= 的膝上型電腦從一低電力或中斷狀態開機或恢復。當處於 一停用狀態時,在該平台管理裝置2〇〇上之Led 219會閃紅 ❹ 光。 一:旦處於停用狀態,—經授權使用者將具有輸入一關_ 字以重啟所佈建的膝上型電腦16之能力。或者,使用者可 在生物特徵讀取機223上碰擦其指紋以重啟該所佈建的冑 , 上型電腦16。從一限制或停用狀態重啟該所佈建的膝上型 電腦16需要該平台管理裝置·麵合至該所佈建的膝上型 電腦16之該USB或相應埠124(圖2)或是在該所佈建的膝上 138076.doc •16- 201028883 型電腦16之無線範圍内。當該所佈建的膝上型電腦被重啟 時°亥LED 21 9會閃綠光,以及有兩個噪聲由揚聲器215提 供。 該生物特徵讀取機223可為任何合適的指紋讀取機或相 應生物特徵掃描裝置,其為可操作以將有關於使用者之一 • 些生物特徵資訊傳送至該處理器202以便鑑認。在應用 中,該平台管理裝置200是與一個別使用者相關。該使用 φ 者可藉由一密碼或例如其指紋予以鑑認。在應用中,經授 權使用者之指紋設定檔是儲存在該平台管理裝置2〇〇之非 揮發丨生。己隐體214中。當一使用者欲啟動該管理裝置2〇〇 時,其在該生物特徵讀取機223上碰擦其手指之一。將所 操取影像或其他所需生物特徵資料傳送至該處理器逝, 處里器202係錯由比較所擷取的指紋資訊與儲存於該非 揮發性記憶體214中之生物特徵資訊而判定該所擁取的指 〔資訊疋否與經授權使用者相關。若該所擷取的生物特徵 • f訊與所儲存的生物特徵資訊相匹配,則該LED 219會閃 滹光且使用者將能夠使用該平台管理裝置·;藉此允許 u使用者存取及使用該相應佈建的膝上型電腦16。另一方 ’ ® ’右該所擁取的生物特徵資訊與所儲存的生物特徵資訊 配則-亥LED 219會閃紅光,且將拒絕對該平台管理 裝置及該相應佈建的膝上型電腦16之存取。 簡要地參考圖2,在該膝上型電腦16被停用之該等情形 用於移除5玄膝上型電腦16之任何嘗試將促使加速計或 ㈣㈣itm感測移動。當移動發生時,該加速計ιΐ6將 138076.doc -17· 201028883 發送一相應信號例如至該揚聲器1 1 5 ;藉此促使該揚聲器 提供一可聽見的警告例如三個嗶聲警示使用者及在該膝上 型電腦16被移動之周圍區域中的其他人。此外,該加速計 Π6可發送一信號至!^]) 119,促使該LED提供該膝上型電 腦16被移動之一可視警告。 回到圖3,可將無線通信控制器226實施為一藍芽、無線 USB或無線RFID晶片,其能夠偵測並提供一連接至上述資 · 料鏈路中之一者或其組合。以此方式,該平台管理裝置 200可藉由一無線通信媒體連接至一相應佈建的膝上型電 腦。 USB連接器224是用於在該平台管理裝置2〇〇與一相應佈 建的膝上型電腦上之USB埠124(圖2)之間提供一直接連 接。以此方式’該平台管理裝置2〇〇可藉由一實體通信媒 體連接至一相應膝上型電腦。In a housing with a footprint, the footprint corresponds to the coverage area of a standard USB device. However, all of the device housings φ of the housing components described herein are contemplated by the present invention and are within the spirit and scope of the present invention. The platform tube device 00匕3 processor or controller 202 is configured to control the device. The entire operation of 200. The processor 200 can include an ALU for performing calculations (e.g., signal strength calculation), one or more registers for temporarily storing data and instructions, and a control for the platform. The controller of the operation of the management device 2. The processor 202 is not limited to a microprocessor, but may take other forms such as a microcontroller, a digital signal processor, a dedicated hardware (for example, A" Or a plurality of distributed traversing-state machines or entities executing on the microprocessor of the network. The processor 202 is coupled to the bus controller 204 by a device bus 2()3. The bus controller 2〇4 can include a corpus contained therein that is operable to provide access to the device memory 206 (e.g., step DRAM). The device 204 is connected to a device sink Row 213 (eg, - ISA bus or other suitable communication medium). Lightly coupled to the device sink 213 is a transceiver 208, - GPS signal generator 21, - speaker 138076.doc,, 201028883 or other audio device 215, a non-volatile memory 214 (eg, a non-volatile flash memory), a power supply 2丨6, a visual indicator 219 (eg, an LED), a 1/0 controller 22〇 A disable button 222, a USB connector 224, and a wireless communication controller 226. The transceiver 208 can be implemented by any suitable device capable of detecting, establishing, and transmitting and receiving data and other information via a network. For example, the transceiver 208 can be a USB-based communication device, or a Bluetooth-enabled device capable of providing a connection to a Bluetooth network. The 208 may also employ or utilize other data link routing protocols (e.g., RFID). The GPS signal generator 21A may be any suitable interrogator capable of providing a positioning signal via a network. Alternatively, the GPS signal generation Available The last known location and the location of a corresponding laptop 16 (Fig. 2) to an enterprise server for further processing and disposal. The audio device 215 can be any amp (four) or can provide an audible warning (eg ...bi sound) to other suitable devices for a user. When the basic laptop is, for example, the laptop being deployed is moved; when the platform ❹ management device 200 and the correspondingly deployed laptop When the distance between the computers exceeds the predetermined distance, an audible warning may be provided; or the user may be informed that the operation state of the device is 200. For example, when the audio device is provided with a single-. The platform management device 200 is deactivated upon completion of a sound or other suitable indication signal. For example, 'two after reading the fingerprint from the biometric reader, such as successfully. The sound indication indicates that the platform management device is enabled. The three (four) sound indicates that the distance between the platform management device 200 and the corresponding laptop or other device 338076.doc -14 - 201028883 $ device exceeds a threshold. For example, when the computer is out of the wireless range of the corresponding platform management device, the audio device 215 provides three beeps. The non-volatile memory 214 can be any suitable memory (e.g., a flash memory) that is in a low power or power-off state at the base device. (4) The content stored therein is maintained. The 疋 platform management object 232 within the non-volatile memory 214, when executed by the processor 〇2, causes the processor to add functionality to the platform management device 200. The portion of the port 232 is held in a hard disk or other non-volatile memory or other suitable device of a built-in laptop, so that the combined body modules 132, 232 are provided. The security installation and operation of the present invention. Moreover, the body 232 includes some of the moving bodies 132' of the deployed laptop to prevent operation of the deployed laptop when the platform management device is outside the transmission range. The functionality provided by the object will be described in more detail with reference to Figures 4-5. • The t-source provider 216 can be any suitable device capable of providing at least eight hours of connection time and at least seven days of standby or non-connection time. An example of such a power supply may be a clock ion (Li-ΟΝ) battery or a recorded metal chloride battery. In an alternate embodiment, the power supply W can be implemented by a rechargeable battery or similar component. For example, the visual indicator 219 can be implemented by a light emitting diode (LED) or any suitable device capable of providing a visual warning in response to a command or state of the platform management device 200. For example, a green LED indicates that a successful fingerprint reading has occurred. A red ΕΕ〇 indicates a loss 138076.doc -15- 201028883 A failed fingerprint reading has taken place. A flashing brown LED indicates that the platform management device 200 is in a low power state. Any number of additional color indicators can be presented to provide an indication of the status of the platform management device 200. The s-hai I/O controller 220 is configured to control a plurality of input devices (eg, 'deactivate button 222 and biometric reader 223, and other peripheral devices (not shown) and/or a corresponding laptop) ) The transfer of information between. The disable button 222 is used to control whether the correspondingly deployed laptop μ is deactivated and to control the operating state of the platform management device 2 . For example and §, when the disable button 222 is pressed, the corresponding laptop 16 is placed in the disabled state by 0. For example, this may be accomplished by the platform management device 2 transmitting a signal to the corresponding laptop 16 to complete the signal including causing the system firmware 13 of the laptop 16 (FIG. 2) to prevent the Commands such as basic subsystems and component operations; thereby preventing any software from being executed by the built-in laptop. In an alternate embodiment, when the disable button 222 is pressed, the system of the laptop will prevent the laptop from being turned on or resumed from a low power or interrupted state. When in a deactivated state, the Led 219 on the platform management device 2 will flash red. One: Once inactive - the authorized user will have the ability to enter a _ word to restart the deployed laptop 16. Alternatively, the user can rub his fingerprint on the biometric reader 223 to restart the built-in computer 16 . Rebooting the deployed laptop 16 from a restricted or deactivated state requires the platform management device to face the USB or corresponding port 124 (FIG. 2) of the deployed laptop 16 or In the wireless range of the computer 138076.doc •16- 201028883 type computer built in the office. When the built-in laptop is restarted, the LED 21 9 will flash green and two noises will be provided by the speaker 215. The biometric reader 223 can be any suitable fingerprint reader or corresponding biometric scanning device that is operable to communicate information about one of the user's biometrics to the processor 202 for authentication. In the application, the platform management device 200 is associated with a different user. The use of φ can be authenticated by a password or, for example, its fingerprint. In the application, the fingerprint profile of the authorized user is stored in the non-volatile episode of the platform management device. It has been hidden in 214. When a user wants to activate the management device 2, it rubs one of its fingers on the biometric reader 223. Transmitting the captured image or other required biometric data to the processor, and the controller 202 determines that the captured fingerprint information is compared with the biometric information stored in the non-volatile memory 214. The finger that is being used [information is not relevant to authorized users. If the captured biometrics match the stored biometric information, the LED 219 will flash and the user will be able to use the platform management device; thereby allowing the u user to access and Use the correspondingly built laptop 16. The other party ' ® ' right to capture the biometric information and stored biometric information matching - Hai LED 219 will flash red, and will refuse the platform management device and the corresponding built-in laptop 16 access. Referring briefly to Figure 2, any attempt to remove the 5 laptop 16 in the case where the laptop 16 is deactivated will cause the accelerometer or (d) (iv) itm to sense the movement. When the movement occurs, the accelerometer ι ΐ6 sends a corresponding signal to 138076.doc -17· 201028883, for example to the speaker 1 1 5; thereby causing the speaker to provide an audible warning such as three beeps to alert the user and The laptop 16 is moved by others in the surrounding area. In addition, the accelerometer 可6 can send a signal to! ^]) 119, causing the LED to provide a visual warning that the laptop 16 is being moved. Returning to Figure 3, the wireless communication controller 226 can be implemented as a Bluetooth, wireless USB or wireless RFID chip capable of detecting and providing a connection to one of the above-described resource links or a combination thereof. In this manner, the platform management device 200 can be coupled to a correspondingly built laptop computer via a wireless communication medium. USB connector 224 is used to provide a direct connection between the platform management device 2 and a USB port 124 (Fig. 2) on a correspondingly deployed laptop. In this manner, the platform management device 2 can be connected to a corresponding laptop by a physical communication medium.
、,圖1疋—流程圖,其說明當膝上型電腦被佈建以結合玄 平台官理裝置作業時,由該平台管理裝置及相應膝上型, 腦所執行之步驟。佈建是將—平台管理裝置耗合至一相肩 膝上型電腦之程序。該佈建可藉由該平台管理裝置之US] 連=裔與Θ膝上型電腦之_相應刪埠之—直接互連而子 :、或者胃互連可藉由各自裝置之相應收發器 驟乂佑〇:而以無線完成。不管連接機構如何,執行下列步 以佈建兮"m 丄 408 〇 。本方法始於步驟彻且繼續直至步驟 在步驟4〇2中 該平台管理裝置是耦合至一相應未佈建 138076.doc -18· 201028883 系統。此可藉由將平台管理裝置實體連接至該未佈建系統 之咖埠或經由相應收發器無線連接至該未佈建系統予以 兀•成。 在步驟4G4中,對該膝上型電腦是否被佈建至所輕合的 .+台管理裝置作出-個判定。舉例而言,此可藉由詢問使 . 帛者或判定位於該平台管理裝置及相應膝上型電腦兩者中 ^體是否經授權或相關而予以完成。若該膝上型電腦及 • 肖平台管理裝置被佈建,則該程序移至步驟4〇5,其令兮 平台管理裝置提供-安全連接至該膝上型電腦,隨後該膝 上型電腦進行正常操作。若該膝上型電腦未 合的平台管理裝置,則該程序移至步驟4〇6。 ㈣ 在步驟406中’對麵合至該膝上型電腦之特定平台管理 f置是否應被佈建至該膝上型電腦作出一個判定。舉例而 言,此可藉由要求使用者授權該佈建而予以完成。若該佈 建未經授權,則該程序移至步驟4〇7。否則,該程序移至 φ 步驟408。 在步驟407中’該平台管理經组態以充當—標準職裝 , 置(例如,一刪記憶體裝置)。在此情形下,該平台管理 裝置之非揮發性及裝置記憶體是用於標準的使用者儲存。 , ㈣置將不用於對該膝上型電職供任何義或控制。 在步驟408中,該膝上型電腦將一命令序列及相應組熊 參數傳送至該管理裝置;藉此鏗認該裝置並授權其充“亥 膝上型電腦之-控制器。從此點開始,所麵合的平^理 裝置㈣建至相應電腦。此時’產生—組對稱密錄並在該 13S076.doc •19- 201028883 膝上型電腦與該平台管理裝置之間交換以允許安全協定在 該膝上型電腦與該平台管理裝置之間操作。此等密鑰可為 具有一特定寬度之AES密鑰或具有一特定寬度之3DES密 鑰。然而,可使用任何標準的對稱加密演算法。因此,將 僅在藉由該特定平台管理裝置啟動後才啟用該膝上型電 腦。以此方式,現在將需要雙因素鑑認以啟用該膝上型電 腦:與相關的平台管理裝置之互連及由使用者進行的生物 特徵及/或密碼鑪認。接著該佈建程序終止。 藉=使用本發明t所佈建㈣台管理裝置所提供之好處 之一疋畲該膝上型電腦丟失或被偷竊時,該膝上型電腦之Figure 1 is a flow chart illustrating the steps performed by the platform management device and the corresponding laptop, brain when the laptop is deployed to work in conjunction with the platform. Fabrication is the process of consuming the platform management device to a laptop computer. The deployment can be directly interconnected by the US-based management device of the platform management device, and the corresponding interconnection transceivers of the respective devices can be interconnected by the respective devices.乂佑〇: And it is done wirelessly. Regardless of the connection mechanism, perform the following steps to build 兮"m 丄 408 〇 . The method begins with the steps and continues until the step in step 4〇2. The platform management device is coupled to a corresponding un-built 138076.doc -18·201028883 system. This can be done by physically connecting the platform management device to the coffee machine of the un-system or via the corresponding transceiver to the un-system. In step 4G4, a determination is made as to whether or not the laptop is deployed to the light-weighted + station management device. For example, this can be accomplished by interrogating the viewer or determining whether the platform management device and the corresponding laptop are authorized or related. If the laptop and the Xiao platform management device are deployed, the program moves to step 4〇5, which provides the platform management device with a secure connection to the laptop, which then proceeds to the laptop. Normal operation. If the laptop does not have a platform management device, the program moves to step 4-6. (d) In step 406, a specific decision is made as to whether the particular platform management of the laptop should be deployed to the laptop. For example, this can be done by requiring the user to authorize the deployment. If the installation is unauthorized, the program moves to step 4〇7. Otherwise, the program moves to φ step 408. In step 407, the platform management is configured to act as a standard job (e.g., a memory device). In this case, the non-volatile and device memory of the platform management device is for standard user storage. (4) The device will not be used for any meaning or control of the laptop. In step 408, the laptop transmits a command sequence and corresponding set of bear parameters to the management device; thereby recognizing the device and authorizing it to charge the controller of the laptop. From this point on, The integrated planar device (4) is built into the corresponding computer. At this time, the 'generating-group symmetric record is recorded and exchanged between the laptop and the platform management device to allow the security agreement to be in the 13S076.doc •19-201028883 The laptop operates between the platform management device. The keys can be AES keys having a particular width or 3DES keys having a particular width. However, any standard symmetric encryption algorithm can be used. Therefore, the laptop will only be enabled after booting by the particular platform management device. In this way, two-factor authentication will now be required to enable the laptop: interconnection with the associated platform management device And the biometric and/or password recognition by the user. Then the installation procedure is terminated. Borrowing = one of the benefits provided by using the (four) management device of the invention t, the laptop is lost When the theft, the laptop's
經授權使用者將很有可能擁有該平台管理裝置,而小偷 發現者將擁有該膝上型電腦。舉例而言,若經授權所有; 藉由輸入按壓按紐之-適用組合請求,則該管理裝置將; 用使用者之蜂巢式電話之一藍芽連接而經由蜂巢式資料』 SM:傳輸該膝上型電腦之最後的已知位置。舉例而言" 可藉由該平台管理裝置之收發器㈣該使用者蜂巢式電言An authorized user will most likely have the platform management device, and the thief discoverer will own the laptop. For example, if all are authorized; by pressing the button-applicable combination request, the management device will connect with one of the user's cellular phones via the cellular data. SM: transmit the knee The last known location of the laptop. For example, " a transceiver that can be managed by the platform (4) the user's cellular language
,連接至藍芽或其他可連接蜂巢式電話之合適網路而予: 完成。或者’該使用者可將該平台㈣装置插到任何個乂 電腦裝置令及執行—料在料置記憶體内之程式以傳輕 該位置資料至—狀位置(例如,由使用者工作的公司所 操作之—伺服器)。 可藉由该平台管理裝置在—所佈建的膝上型電腦上實施 之另一特點是迫使該膝上型電腦進人—待機 省電模式。此可Μ由紐能路後冰 此了猎由組慼所佈建之膝上型 138076.doc -20· 201028883 用按紐時輸入前述省電狀熊 由該膝上型電願所執行之實 間由該所佈建的電腦及相應 參數。 !將為述所佈建的膝上型電腦與平台管理裝置之間的 通信。該所佈建的膝上型 μ ^ . . 这十台管理裝置之收發器 係使用:❹個賢料鏈路協定(例如,藍芽、刪、rConnect to Bluetooth or other suitable network to connect to the cellular phone: Complete. Or 'the user can plug the platform (4) device into any computer device to execute and execute the program in the material memory to transfer the location data to the location (for example, a company operated by the user) The operation - the server). Another feature that can be implemented by the platform management device on the deployed laptop is to force the laptop into a human-standby mode. This can be seen from the back of the New Energy Road. This is the laptop that was built by the group. 138076.doc -20· 201028883 Enter the aforementioned power-saving bear with the button when the button is executed by the laptop. The computer and corresponding parameters of the office. The communication between the laptop and the platform management device will be described. The built-in laptop μ ^ . . The transceivers of these ten management devices are used: 贤 贤 链路 link agreement (for example, Bluetooth, delete, r
相互通:。且與-企業伺服器通信。在此等協定之一些 該資料鏈料常可料接觸上或在料裝置之範 圍二為可、用。其他協定(例如,藍芽)需要可被執行為、佈建 ,二:的明確配對,以上已參考圖4對其進行了較為詳 腦與該平台管理=時,該所佈建的膝上型電 、σ s理裝置之收發器在該資料鏈路頂部進行一安 全輸$ jt確保輸送獲得較高階協定訊息且在傳輸之前對Intercommunication: And communicate with the - enterprise server. Some of these agreements are often available for contact or for use in the range of materials. Other agreements (eg, Bluetooth) require explicit pairing that can be performed, deployed, and two. The above has been detailed with reference to Figure 4 for the brain and the platform management = when the laptop is built The transceiver of the electrical, σ s device performs a secure input at the top of the data link to ensure that the transport obtains a higher order protocol message and
。在按下停用按紐時,藉 際功能是取決於在佈建程序期 平台管理裝置兩者共用之組態 ’、加在纟接收後’於執行該等較高階協定訊息 密該等加密訊息。 則解 、牛例而。,加密可藉由或利用任何一般用途之對稱演算 法予以執打。密鑰(例如,共用密鑰4〇8(圖4))係在佈建期 間被父換且在交換多個訊息後可予以更新。協定訊人 (但不限於)以下表Α巾所說明之訊息。 〜3 138076.doc -21 - 201028883 <seq> EXCHANGE -KEY <key-width> 〈key data > Seq是命令序列號。提出用於加密之新密 錄。 <seq> KEY-CONFIRMED <key-width> <key-data> 確認先前命令 <seq> DISABLE 停用電子裝置(例如,膝上型~~~ <seq> DISABLE-CONFIRMED 確認先前命令 ~~~ ' <seq> ENABLE 啟用電子裝置(例如,膝上型 <seq> ENABLE-CONFIRMED 確認先前命令 ~~一' <seq> TRANSFER-FIRMWARE <size><firmware bytes> 發送韌體的〈大小 > 位元組 ’ ~~ <seq> TRANSFER-CONFIRMED 確認先前命令 <seq> TRANSFER FAILED 否定先前命令 ------. When the deactivation button is pressed, the debit function is determined by the configuration of the platform management device during the deployment process, and the encryption message is executed after the execution of the higher-order agreement message. . Then the solution, the cow case. Encryption can be performed by or using any general purpose symmetric algorithm. The key (e.g., shared key 4〇8 (Fig. 4)) is changed by the parent during deployment and can be updated after multiple messages are exchanged. The agreement is (but not limited to) the information described in the following table. ~3 138076.doc -21 - 201028883 <seq> EXCHANGE -KEY <key-width> <key data > Seq is the command serial number. Propose a new password for encryption. <seq> KEY-CONFIRMED <key-width><key-data> Confirm previous command <seq> DISABLE to disable the electronic device (for example, laptop ~~~ <seq> DISABLE-CONFIRMED Confirm previous command ~~~ ' <seq> ENABLE Enables the electronic device (for example, laptop <seq> ENABLE-CONFIRMED confirms the previous command ~~一' <seq> TRANSFER-FIRMWARE <size><firmware bytes> <size> bit] '~~ <seq> TRANSFER-CONFIRMED Confirm previous command <seq> TRANSFER FAILED Negative previous command ------
表A 此外,該平台管理裝置支援一全USB協定,且如以上所 論述,可根據該平台管理裝置是否經授權而佈建至—特定 膝上型電腦予以實施為一大容量儲存USB裝置。 出於闡釋性及描述性之目的’已提供本發明之前述詳細 描述。雖然本文已參考隨附圖式描述了本發明之—例示性 實施例,但是應瞭解本發明不受限於所揭示之該(等)精確 實施例,且根據以上教示,可對本發明之各種變換及修 飾。 【圖式簡單說明】 圖1是一網路結構之一示意方塊圖’其中一或多個遠端 電子裝置被組態有本發明之平台管理裝置; 圖2是一電子裝置之一示意方塊圖,該電子裝置經組熊 以結合本發明之平台管理裝置作業; 圖3是本發明之平台管理裝置之一示意方塊圖;及 138076.doc •22· 201028883 圖4是一流程圖,其說明當此種裝置被佈建時,由該平 台管理裝置及一相應電子裝置所執行之步驟。 【主要元件符號說明】In addition, the platform management device supports an all-USB protocol and, as discussed above, can be implemented as a large-capacity storage USB device depending on whether the platform management device is authorized to be deployed to a particular laptop. The foregoing detailed description of the invention has been provided for purposes of illustration and description. Although the present invention has been described with reference to the preferred embodiments of the present invention, it is understood that the invention is not limited by the And modification. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic block diagram of a network structure in which one or more remote electronic devices are configured with the platform management device of the present invention; FIG. 2 is a schematic block diagram of an electronic device. The electronic device is operated by the group bearer in conjunction with the platform management device of the present invention; FIG. 3 is a schematic block diagram of a platform management device of the present invention; and 138076.doc • 22· 201028883 FIG. 4 is a flowchart illustrating The steps performed by the platform management device and a corresponding electronic device when such a device is deployed. [Main component symbol description]
10 網路結構 12 企業伺服器 14 中間通信設備 15 通信鏈路 16 電子裝置 18 防火牆 19 防火牆 20 網路 102 處理器 103 CPU匯流排 104 匯流排控制器 106 系統記憶體 107 記憶體控制器 108 收發器 112 顯示控制器 113 系統匯流排 114 硬碟 115 音訊裝置 116 運動感測器 117 資料 118 顯示裝置 119 可視指示裝置 138076.doc -23- 201028883 120 輸入/輸出(I/O)控制器 121 滑鼠 122 週邊輸入裝置 123 生物辨識感測器 124 USB或智慧卡讀卡機埠 130 系統韌體 132 組合韌體模組 200 平台管理裝置 202 處理器 203 裝置匯流排 204 匯流排控制器 206 裝置記憶體 208 收發器 210 GPS信號產生器 213 裝置匯流排 214 非揮發性記憶體 215 揚聲器/音訊裝置 216 電源供應器 219 可視指示器 220 I/O控制器 222 停用按紐 223 生物特徵讀取機 224 USB連接器 226 無線通信控制器 232 組合韌體模組 138076.doc •24-10 Network structure 12 Enterprise server 14 Intermediate communication device 15 Communication link 16 Electronic device 18 Firewall 19 Firewall 20 Network 102 Processor 103 CPU bus bar 104 Bus controller 106 System memory 107 Memory controller 108 Transceiver 112 Display Controller 113 System Bus 114 Hard Disk 115 Audio Device 116 Motion 117 Data 118 Display Device 119 Visual Indicator Device 138076.doc -23- 201028883 120 Input/Output (I/O) Controller 121 Mouse 122 Peripheral input device 123 Biometric sensor 124 USB or smart card reader 埠 130 System firmware 132 Combined firmware module 200 Platform management device 202 Processor 203 Device bus bar 204 Bus bar controller 206 Device memory 208 Transceiver 210 GPS signal generator 213 device bus 214 non-volatile memory 215 speaker / audio device 216 power supply 219 visual indicator 220 I / O controller 222 disable button 223 biometric reader 224 USB connector 226 Wireless Communication Controller 232 Combined Firmware Module 138076.doc •twenty four-
Claims (1)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW98103163A TW201028883A (en) | 2009-01-23 | 2009-01-23 | Secure platform management device |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW98103163A TW201028883A (en) | 2009-01-23 | 2009-01-23 | Secure platform management device |
Publications (1)
Publication Number | Publication Date |
---|---|
TW201028883A true TW201028883A (en) | 2010-08-01 |
Family
ID=44853834
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
TW98103163A TW201028883A (en) | 2009-01-23 | 2009-01-23 | Secure platform management device |
Country Status (1)
Country | Link |
---|---|
TW (1) | TW201028883A (en) |
Cited By (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TWI506473B (en) * | 2011-12-22 | 2015-11-01 | 英特爾股份有限公司 | Always-available embedded theft reaction subsystem |
TWI512530B (en) * | 2011-12-22 | 2015-12-11 | 英特爾股份有限公司 | Always-available embedded theft reaction subsystem |
US9454678B2 (en) | 2011-12-22 | 2016-09-27 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9507918B2 (en) | 2011-12-22 | 2016-11-29 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9507965B2 (en) | 2011-12-22 | 2016-11-29 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9520048B2 (en) | 2011-12-22 | 2016-12-13 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9558378B2 (en) | 2011-12-22 | 2017-01-31 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9569642B2 (en) | 2011-12-22 | 2017-02-14 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9619671B2 (en) | 2011-12-22 | 2017-04-11 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9734359B2 (en) | 2011-12-22 | 2017-08-15 | Intel Corporation | Always-available embedded theft reaction subsystem |
-
2009
- 2009-01-23 TW TW98103163A patent/TW201028883A/en unknown
Cited By (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TWI506473B (en) * | 2011-12-22 | 2015-11-01 | 英特爾股份有限公司 | Always-available embedded theft reaction subsystem |
TWI512530B (en) * | 2011-12-22 | 2015-12-11 | 英特爾股份有限公司 | Always-available embedded theft reaction subsystem |
US9454678B2 (en) | 2011-12-22 | 2016-09-27 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9507918B2 (en) | 2011-12-22 | 2016-11-29 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9507965B2 (en) | 2011-12-22 | 2016-11-29 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9520048B2 (en) | 2011-12-22 | 2016-12-13 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9552500B2 (en) | 2011-12-22 | 2017-01-24 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9558378B2 (en) | 2011-12-22 | 2017-01-31 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9569642B2 (en) | 2011-12-22 | 2017-02-14 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9619671B2 (en) | 2011-12-22 | 2017-04-11 | Intel Corporation | Always-available embedded theft reaction subsystem |
US9734359B2 (en) | 2011-12-22 | 2017-08-15 | Intel Corporation | Always-available embedded theft reaction subsystem |
TWI610193B (en) * | 2011-12-22 | 2018-01-01 | 英特爾股份有限公司 | Always-available embedded theft reaction subsystem |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
TW201028883A (en) | Secure platform management device | |
JP5154436B2 (en) | Wireless authentication | |
CN208580402U (en) | Store equipment and the station for storing equipment | |
JP5112700B2 (en) | A system for identifying individuals in electronic transactions | |
US9578445B2 (en) | Systems and methods to synchronize data to a mobile device based on a device usage context | |
JP7194847B2 (en) | A method for authenticating the identity of digital keys, terminal devices, and media | |
US8769657B2 (en) | System and method for controlling user's access to protected resources using multi-level authentication | |
JP2008512738A (en) | Portable storage device and method for exchanging data | |
US8307055B2 (en) | Secure platform management device | |
US20140320261A1 (en) | Method for upgrading rfid readers in situ | |
CN105144670A (en) | Wireless networking-enabled personal identification system | |
KR101654778B1 (en) | Hardware-enforced access protection | |
US9471757B2 (en) | Radio frequency identifiers for providing user access to computing resources | |
WO2014016695A2 (en) | Presence-based credential updating | |
JP2007174633A (en) | Computer implementation method for securely acquiring binding key for token device and secure memory device, and system for securely binding token device and secure memory device | |
TW201248409A (en) | Security architecture for using host memory in the design of a secure element | |
CN107077355A (en) | For the mthods, systems and devices initialized to platform | |
KR20140007303A (en) | Pairing digital system for smart security and providing method thereof | |
JP2003288328A (en) | Security device for portable information apparatus and method therefor | |
CN111125664A (en) | Electronic equipment and method for logging in operating system | |
JP5260908B2 (en) | Control device, communication device, control system, control method, and control program | |
JP2006060392A (en) | Unauthorized-use preventive system and identification method for information terminal device | |
KR20110105447A (en) | Wireless security usb storage with fingerprint authorization | |
KR101226918B1 (en) | Pairing digital system and providing method thereof | |
KR101437050B1 (en) | Pairing digital system and providing method thereof |