Isolated computing environment anchored into cpu and motherboard

Description of equivalent WO 2006055425 A2

ISOLATED COMPUTING ENVIRONMENT ANCHORED INTO

CPU AND MOTHERBOARD

[0001] This application is a continuation-in-part of application "Method for pay-as-you-go Computer and Dynamic Differential Pricing," filed December 8, 2004, under attorney docket number 30835/40476, which is a continuation-in- part of application, "Method and Apparatus for Provisioning Software," filed November 15, 2004 under attorney docket number 30835/40399.

BACKGROUND

[0002] Pay-as-you-go or pay-per-use business models have been used in many areas of commerce, from cellular telephones to commercial Laundromats. In developing a pay-as-you go business, a provider, for example, a cellular telephone provider, offers the use of hardware (a cellular telephone) at a lower- than-market cost in exchange for a commitment to remain a subscriber to their network. In this specific example, the customer receives a cellular phone for little or no money in exchange for signing a contract to become a subscriber for a given period of time. Over the course of the contract, the service provider recovers the cost of the hardware by charging the consumer for using the cellular phone.

[0003] The pay-as-you-go business model is predicated on the concept that the hardware provided has little or no value, or use, if disconnected from the service provider. To illustrate, should the subscriber mentioned above cease to pay his or her bill, the service provider deactivates their account, and while the cellular telephone may power up, calls cannot be made or received because the service provider will not allow communication to the cellular telephone. The deactivated phone has no "salvage" value, because the phone will not work elsewhere and the component parts do not have a significant street value. When the account is brought current, the service provider will re-allow use of the device to make calls.

i [0004] This model works well when the service provider, or other entity taking the financing risk, has a tight control on the use of the hardware. The model does not work well when the hardware has substantial uses outside the service provider's span of control, such as that of a computer, where the computer may be useful whether connected to a service provider network or not. Additionally, the open and extensible nature of most computer hardware, for example, personal computers and personal digital assistants allow and encourage modifications to both hardware and software, making it more difficult to retain the level of control needed by a pay-as-you go or similar business model. Therefore there is a need to monitor and correct as well as block and eliminate unauthorized configuration of a computer, including hacked or unauthorized operating systems and software, that could move the computer beyond the service provider's span of control.

SUMMARY

[0005] According to one aspect of the disclosure, an isolated computing environment may provide for securely storing programs and information used to monitor and enforce policies related to configuration and operation of a computer. The isolated computing environment may have a secure memory, for storing or validating verification and enforcement programs, cryptographic keys and other data requiring limited access. The isolated computing environment may further have a clock or timer and a logic circuit responsive to the clock or timer for activating the verification program. When a state of the computer is determined not to be in compliance with terms required under a pay-per-use or other business agreement, the enforcement program may initiate a sanction, to correct or encourage a user to correct the non-compliant state of the computer.

[0006] A method for assembling a computer using an isolated computing environment may include disposing the isolated computing environment on a motherboard of the computer, either directly or indirectly, and may include attaching the isolated computing environment to the motherboard in a manner that irreparably damages the computer if removed. The isolated computing environment may also be tested as part of the assembly process. BRIEF DESCRIPTION OF THE DRAWINGS [0007] Fig. 1 is a simplified and representative block diagram of a computer;

[0008] Fig. 2 is a block diagram of a simplified isolated computing environment; and

[0009] Fig. 3 is a flow chart depicting a method of binding an associated device to a computer.

DETAILED DESCRIPTION OF VARIOUS EMBODIMENTS

[0010] Although the following text sets forth a detailed description of numerous different embodiments, it should be understood that the legal scope of the description is defined by the words of the claims set forth at the end of this disclosure. The detailed description is to be construed as exemplary only and does not describe every possible embodiment since describing every possible embodiment would be impractical, if not impossible. Numerous alternative embodiments could be implemented, using either current technology or technology developed after the filing date of this patent, which would still fall within the scope of the claims.

[0011] It should also be understood that, unless a term is expressly defined in this patent using the sentence "As used herein, the term ' ' is hereby defined to mean..." or a similar sentence, there is no intent to limit the meaning of that term, either expressly or by implication, beyond its plain or ordinary meaning, and such term should not be interpreted to be limited in scope based on any statement made in any section of this patent (other than the language of the claims). To the extent that any term recited in the claims at the end of this patent is referred to in this patent in a manner consistent with a single meaning, that is done for sake of clarity only so as to not confuse the reader, and it is not intended that such claim term by limited, by implication or otherwise, to that single meaning. Finally, unless a claim element is defined by reciting the word "means" and a function without the recital of any structure, it is not intended that the scope of any claim element be interpreted based on the application of 35 U.S.C. § 112, sixth paragraph.

[0012] Much of the inventive functionality and many of the inventive principles are best implemented with or in software programs or instructions and integrated circuits (ICs) such as application specific ICs. It is expected that one of ordinary skill, notwithstanding possibly significant effort and many design choices motivated by, for example, available time, current technology, and economic considerations, when guided by the concepts and principles disclosed herein will be readily capable of generating such software instructions and programs and ICs with minimal experimentation. Therefore, in the interest of brevity and minimization of any risk of obscuring the principles and concepts in accordance to the present invention, further discussion of such software and ICs, if any, will be limited to the essentials with respect to the principles and concepts of the preferred embodiments.

[0013] Many prior art high-value computers, personal digital assistants, organizers and the like may not be suitable for use in a pre-pay or pay-for-use business model without additional security. As discussed above, such equipment may have significant functions apart from those requiring a service provider. For example, a personal computer can be disconnected from a provided Internet service and still be useful for word processing, spreadsheets, etc. In the case where a service provider, for example an Internet service provider or other business entity, underwrites the cost of the personal computer with the expectation of future fees, this "untethered value" creates an opportunity for fraudulent applications and theft. Pre-pay business models, where a user pays in advance for use of a subsidized, high value computing system environment is one example of such a risk for fraud and theft.

[0014] Fig. 1 illustrates a computing device in the form of a computer 110. Components of the computer 110 may include, but are not limited to a processing unit 120, a system memory 130, and a system bus 121 that couples various system components including the system memory to the processing unit 120. The system bus 121 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus also known as Mezzanine bus.

[0015] Computer 110 typically includes a variety of computer readable media. Computer readable media can be any available media that can be accessed by computer 110 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, FLASH memory or other memory technology, CD- ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by computer 110. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media. [0016] The system memory 130 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 131 and random access memory (RAM) 132. A basic input/output system 133 (BIOS), containing the basic routines that help to transfer information between elements within computer 110, such as during start-up, is typically stored in ROM 131. RAM 132 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 120. By way of example, and not limitation, Figure 1 illustrates operating system 134, application programs 135, other program modules 136, and program data 137.

[0017] The computer 110 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only, Figure 1 illustrates a hard disk drive 141 that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive 151 that reads from or writes to a removable, nonvolatile magnetic disk 152, and an optical disk drive 155 that reads from or writes to a removable, nonvolatile optical disk 156 such as a CD ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. The hard disk drive 141 is typically connected to the system bus 121 through a non-removable memory interface such as interface 140, and magnetic disk drive 151 and optical disk drive 155 are typically connected to the system bus 121 by a removable memory interface, such as interface 150.

[0018] The drives and their associated computer storage media discussed above and illustrated in Figure 1, provide storage of computer readable instructions, data structures, program modules and other data for the computer 110. In Figure 1, for example, hard disk drive 141 is illustrated as storing operating system 144, application programs 145, other program modules 146, and program data 147. Note that these components can either be the same as or different from operating system 134, application programs 135, other program modules 136, and program data 137. Operating system 144, application programs 145, other program modules 146, and program data 147 are given different numbers here to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer 20 through input devices such as a keyboard 162 and pointing device 161, commonly referred to as a mouse, trackball or touch pad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit 120 through a user input interface 160 that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). A monitor 191 or other type of display device is also connected to the system bus 121 via an interface, such as a video interface 190. In addition to the monitor, computers may also include other peripheral output devices such as speakers 197 and printer 196, which may be connected through an output peripheral interface 195.

[0019] The computer 110 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 180. The remote computer 180 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer 110, although only a memory storage device 181 has been illustrated in Figure 1. The logical connections depicted in Figure 1 include a local area network (LAN) 171 and a wide area network (WAN) 173, but may also include other networks. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.

[0020] When used in a LAN networking environment, the computer 110 is connected to the LAN 171 through a network interface or adapter 170. When used in a WAN networking environment, the computer 110 typically includes a modem 172 or other means for establishing communications over the WAN 173, such as the Internet. The modem 172, which may be internal or external, may be connected to the system bus 121 via the user input interface 160, or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer 110, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation, Figure 1 illustrates remote application programs 185 as residing on memory device 181.

[0021] The communications connections 170 172 allow the device to communicate with other devices. The communications connections 170 172 are an example of communication media. The communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. A "modulated data signal" may be a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Computer readable media may include both storage media and communication media.

[0022] The isolated computing environment 125, discussed in more detail with respect to Fig. 2 may store and cause execution of programs and data. The isolated computing environment 125 may be deployed and configured to enforce the terms of an agreement between a user of the computer 110 and a service provider with an interest in the computer 110.

[0023] The isolated computing environment 125 may be instantiated in more than one manner. When implemented by one or more discrete components, the isolated computing environment 125 may be disposed on the motherboard (not depicted) of the computer. The motherboard may be any circuit interconnect and component mounting base technology suitable for a given application and may range from a fiberglass material, to molded epoxy resin, mylar, ceramic, etc. When the isolated computing environment 125 is disposed on or in the motherboard, the isolated computing environment 125 may be coated in an epoxy or buried beneath interconnect layers or components. Coating or burying the isolated computing environment 125 may serve to increase the difficulty of removing or tampering with the isolated computing environment 125 itself, associated power and ground connections to the isolated computing environment 125 or data and address connections to the isolated computing environment 125. Ideally, the removal or de-lidding of the isolated computing environment 125 causes permanent damage to the motherboard and/or surrounding components and renders the computer 110 inoperable.

[0024] Another instantiation of the isolated computing environment 125 may be as depicted in Fig. 1, where the isolated computing environment 125 is incorporated in the processing unit 120. Being so disposed in the processing unit may offer advantages of better access to processing unit registers and monitoring of data sequences as well as improved resistance to physical attacks.

[0025] Referring to Fig. 2, a simplified and representative isolated computing environment is discussed and described. The isolated computing environment may be or may be similar to the isolated computing environment 125 introduced above. The isolated computing environment 125 may include a memory 202, a logic circuit 204 and a clock or timer 206, for example, the timer 206 may be used to implement a clock by counting intervals of real time. The memory 202 may include both volatile and non-volatile memory.

[0026] The isolated computing environment 125 may further include a digital signature verification circuit 208. When one-way verification of an external entity is required, for example, verification of a server (not depicted), a random number generator 210 may be a part of the digital signature verification circuit 208. Digital signature technology is well known and hashing, signature verification, symmetric and asymmetric algorithms and their respective keys are not discussed here in detail.

[0027] The blocks of the isolated computing environment 125 may be coupled by a bus 212. The bus 212 may be separate from a system or processing unit bus 214 used for external access. Separate busses may improve security by limiting access to data passed by bus 212. The bus 212 may incorporate security precautions such as balanced data lines to make power attacks on cryptographic keys 216 stored in the memory 202 more difficult.

[0028] The memory 202, may include non-volatile memory that, in addition to storing cryptographic keys 216, may store at least one verification program 218 and at least one enforcement program 220. These programs are discussed in more detail below. Other data 222 may be stored in the memory 202, for example, hash codes and/or other digital signature information associated with known BIOS code or application programs. Other examples of data 222 that may be stored in memory 202 may be compliance data pertaining to the current state of the computer 110 or certificate information for verification of downloaded updates to verification programs 218 or enforcement programs 220. Non-volatile memory in the memory 202 may also allow a trusted, secure, boot process separate from the operating system 144.

[0029] The validation and enforcement programs 218 220 are shown stored in the isolated computing environment 125, but may also be stored externally, with a digital signature or hash of the programs stored in the isolated computing environment 125, for example, in the data section 216 of the memory 202. When monitoring or measuring an application program, the isolated computing environment 125 may validate a hash or digital signature of the application program before or during the program's execution. Since the programs 218 220 and data stored in memory 202 are part of the security associated with the success of the pay-as-you-go, pay-per-use business model, it may be important that the data be protected from unauthorized access and tampering. Unauthorized access of the memory 202 may be limited using either the logic circuit 204 or the digital signature verification circuit 208 or a combination of the two. The access to the memory may be restricted to processes running a known program code, i.e. a program code trusted by the isolated computing environment 125. The program code may be the validation program 218 or the enforcement program 220. However, other programs may be granted access to the memory 202. For example, an application supporting the management of usage credits or balances may use the memory of the isolated computing environment 125. When repair or maintenance is required, access to the memory 202 may be granted to a service process supported on a networked device having proper credentials in order to effect the repair.

[0030] The isolated computing environment 125 may have several functions. One function of the isolated computing environment 125 is to protect itself from unauthorized updates and tampering. Programs and data stored in the isolated computing environment 125 may be injected at the time of manufacture or may be downloaded if correctly signed with the signature authenticated by the isolated computing environment 125 itself. Another function may be to monitor and/or measure the state of the computer 110 to determine if a hack or other unauthorized change in the state of the computer 110 is in process or has occurred. Another aspect of monitoring and measuring may be to support legitimate changes of state of the computer 110 related to functions associated with provisioning resources and hosting secure functions such as an event dispatcher or balance manager. A third function may be to validate current BIOS code and validate updates and extensions to BIOS code. Another function of the isolated computing environment 125 may be to provide a reliable clock or timer both as a source of time for metering programs and expiration dates. The clock or timer may also ensure that the isolated computing environment 125 is routinely granted access to the computer 110 and not "starved" for CPU cycles. Another function may be to enforce sanctions when a non-compliant state is determined in the computer 110.

[0031] To protect from unauthorized updates and tampering the memory 202 may be secured. To accomplish this, the memory 202 may be made accessible only to a specific program, for example, an update routine authenticated by a digital signature under the control of a secure operating mode of the computer 110. The memory 202 may be made inaccessible to any program executed by another execution environment such as the operating system or the kernel. The kernel typically runs when the computer 110 is booting. By way of example, a x86 processors from Intel™ can be operated in several modes, or rings of execution. Ring 0-2 are occupied by the kernel, Ring 3 is occupied by "user mode" processes. A third mode SMM (system management mode) is occupied by the BIOS. The program with access to the secure memory 202 may be run in the SMM because it is out of reach of the kernel, but would require securing the BIOS.

[0032] For security of the isolated computing environment 125, devices other than the isolated computing environment 125 may simply not be able to address the physical memory dedicated to the isolated computing environment memory 202. This is only one way to ensure that only the isolated computing environment can access and alter any of the data associated with the operation of the isolated computing environment memory 202, including programs 218, 220, keys 216 and state/operational data 222. The digital signature verification circuit 208 may be used to verify all requested changes to the memory 202 that come from outside, that is, through the operating system 144. By confirming digital signatures using internally stored keys, trust can be established for data received by an untrusted source, i.e. the operating system 144.

[0033] Another method of securing the memory 202 may be to create another mode of execution, for example, a Mode Z or Ring -1. The memory 202 may be partitioned according to function such that some areas of memory 202 are only accessible by Mode Z, whereas other areas of memory 202 are read-only from Ring 0. There may be case-specific access to designated sections of memory 202, such as read access from Ring 0 to a specific designated range of memory 202. For example, some of the keys 216 may be read-only from Ring 0. Obviously, code associated with the isolated computing environment 125 may have access to all its memory 202, including full read and write access to the keys 216. [0034] The isolated computing environment 125 may be able to access memory used by the operating system for monitoring and sanctioning the operating system 144. Because the isolated computing environment 125 is used to monitor and measure the operating system 144, the isolated computing environment access to the memory should not use operating system function calls or a man-in-middle attack on the isolated computing environment 125 may be mounted. To monitor, measure and sanction the operating system 144, the isolated computing environment 125 may incorporate both memory watchers and instruction pointer watchers that monitor access to certain memory locations and movement of the instruction pointer through designated locations. Access and use of designated memory locations may be an indication that non-compliant programs are operating or that attempts to subvert the computer's security may be underway.

[0035] The isolated computing environment 125 may serve to host functions related to provisioning and activating licensed or pay-per-use resources. Such resources may include some or all of the above, for example, network connections 170 172, hard disk drive 141, or video interface 190. The isolated computing environment 125 may also host a balance manager that maintains an accounting of pay-per-use resources used and available. Because the isolated computing environment 125 may be used to provision, activate and monitor the resources listed above, it may be necessary to program, or inject the isolated computing environment programs, for example, verification and enforcement 218 220, or other initial operational data 222 early in the manufacturing process, perhaps before the assembly of the computer 110. When late stage programming of the isolated computing environment 125 takes place, it may be performed in a secure environment or use transport keys for verification of all initial programming, as is known in the data security arts. This may be particularly important when programming of the isolated computing environment 125 is performed at a point of sale or even after possession by a user. [0036] The verification program 218 may monitor or measure a state of the computer 110. The state of the computer 110 may be used to determine the level of compliance of the computer 110 with a set of policies or pre-determined conditions. The pre-determined conditions may be both positive and negative, that is, the policy or condition may require the presence of certain elements, be they hardware, software, peripherals, etc. or the policy may prohibit the presence of certain other elements. For example, one policy may require the presence of a given version of a system driver, while another policy may prohibit the presence of an alternative boot device. To determine compliance, the verification program 218 may monitor the state of a resource used by the operating system, the state of an application program, the state of a BIOS structure or a BIOS extension. In addition, the verification program 218 may monitor compliance with various policies, for example, usage policies, including usage policies related to contractual terms of a pay-per-use contract. In the event of non-compliance, the verification program 218 may warn the user, for example, using a pop-up message, or may activate the enforcement program 220 to begin sanctions.

[0037] The timer 206 may provide a reliable measure for pay-per-use terms involving periods of time, for example, unlimited use for a month. The timer 206 may also act as a trigger to ensure that the verification and/or enforcement programs 218 220 of the isolated computing environment 125 receive enough processor execution cycles to perform their respective tasks. The trigger function may cause the logic circuit 204 to force execution of the verification program 218. The logic circuit may force an interrupt that causes the processing unit to execute the validation program 218 from the appropriate location.

[0038] When the verification program determines non-compliance, a corrective action may instituted. For example, the enforcement program may cause a non- compliant driver to be overwritten with a driver from a known location. Conversely, when the non-compliant state is not automatically correctable, a sanction may be imposed to encourage the user to bring the system into compliance. Sanctions may be invoked by the logic circuit 204 activating the enforcement program 220. To carry out the enforcement task, the isolated computing environment 125, under the direction of the enforcement program, may disable or otherwise sanction resources under the direct influence or control of the computer 110. The policy may vary according to the state of the computer and may include reducing the processing speed of the computer or reducing the functional operation of the computer, such as booting in "safe mode." Other sanctions may include limiting the amount of random access memory available for processing, limiting the Instruction Set Architecture, i.e. the processor commands available for execution, slowing access to a hard disk 141 or limiting the space accessible on the hard disk drive 141. Additional sanctions may include limiting the display resolution or even causing frequent, periodic resets of the computer 110. The goal of sanctions is that they be recoverable, and more specifically, be recoverable by the user. However, certain policies may exist that call for disabling the computer 110 to the point that qualified service personnel with special equipment are required to restore service. This may be the case when it is determined that repeated hostile attacks have been attempted over a period of time, despite warnings.

[0039] Fig. 3 illustrates a method of assembling a computer 110 having an isolated computing environment 125. Along with other structural elements, a motherboard (not depicted) may be provided 302. The motherboard, as discussed above, may be a standard substrate with wiring traces and landing pads for attaching and connecting circuit components. Bare boards, as well as populated and semi-populated motherboards are readily available in the commercial and retail marketplaces. An isolated computing environment 125 may be disposed 304 on the motherboard. The isolated computing environment 125 may be a discrete component, such as a custom integrated circuit, a combination of components, for example, a multi-chip module (MCM), or fully integrated on the processing unit 120 chip.

[0040] When disposed on the motherboard, the isolated computing environment 125 may be protected 306 from tampering. Tamper-resistant mechanisms are known, but may include potting in epoxy or other coating that is difficult to remove without damage or destruction to the board and surrounding components. Another tamper-resistant mechanism may be to sandwich the isolated computing environment 125 underneath other components. To discourage key theft, metal coatings may be applied to prevent laser probing. As discussed above, the isolated computing environment 125 itself may have separate measures to protect the integrity of its own circuitry and contents.

[0041] Before or after disposing 304 on the motherboard, the isolated computing environment 125 may be initialized with executable code, such as verification and enforcement program code 218 220. The function of the verification and enforcement programs is discussed above. In addition, keys and other data, such as certificates and known hash codes may be downloaded or injected. Injection usually occurs early in the manufacturing process, such as during chip testing. Later downloading may require cryptographic authentication and/or secure channels.

[0042] When assembled, the computer 110 may be tested. To perform a test of isolated computing environment 125 function, one or more of the states of the computer may be altered 310. The alteration may include attaching an unauthorized peripheral, loading/executing unauthorized code, or configuring the computer 110 to operate past an expiration date. Testing 312 the isolated computing environment 125 may be done by determining correct function of the verification program 218 to identify the non-compliant state and that appropriate sanctions are imposed by the enforcement program 220.