Remote computer lockdown

The present invention generally relates to locking-down a digital data processor remotely via a handheld communication device.

Users of computers normally lock-down their computers to a safe and secure state at the conclusion of their workday or if they plan to be away from the computer for a period of time. Sometimes a computer user may unexpectedly find it inconvenient or impossible to return to the computer to perform the lock-down procedure when described. Alternatively, if the computer were stolen, it would be impossible to place it in a safe and secure lock-down state that would prevent the compromise of stored data and software.

It is observed, by the inventors, that it would be desirable to have a means for remotely placing the computer into a safe and secure state in situations where the user finds it difficult, inconvenient or impossible to physically access the computer.

Embodiments herein described include a method comprising: receiving at a network client system, having an a unique number associated with the client system, by way of a telephone network, a remotely transmitted data packet comprising a free text potion; determining if the free text potion of the remotely transmitted data packet includes the unique number associated with the client system; and locking-down the network client system if the data packet comprises the unique number associated with the client system.

Embodiments also include apparatus comprising: an electronic memory which stores data and executable software code; a network interface component which detects the remotely transmitted data packet, and has a communications network interface; a processor, operatively connected to the network interface component, which has an a unique number associated with the processor, and which executes the executable software code, determines if a remotely transmitted data packet has been received, and lock-down the processor if the remotely transmitted data packet includes the unique number associated with the processor.

Further embodiments include a computer-usable medium having computer readable instructions stored thereon for execution by a processor to perform comprising: receiving at a network client system, having an a unique number associated with the client system, by way of a telephone network, a remotely transmitted data packet comprising a free text potion; determining if the free text portion of the remotely transmitted data packet includes the unique number associated with the client system; and locking-down the network client system if the data packet comprises the unique number associated with the client system.

Embodiments are illustrated by the drawings wherein:

FIG. 1 is a simplified schematic presentation of the computer, a cellular telephone used as a remote command device and the interconnection facilities.

FIG. 2 is a conceptual flow chart of the sequence of operations for accomplishing remote computer shut down.

Referring to FIG. 1 , a simplified example of conventional personal computer architecture 100 is schematically presented. The architecture comprises a central processing unit (CPU) 10 , a system memory 20 , and a network interface card 30 , interconnected by a system bus 40 . The network interface card 30 connects with the external network 50 of other network nodes such as a local area network (LAN) or wide area network (WAN). In another embodiment, the network interface card 30 may, in addition, connect to a telephone modem 60 for directly accessing the public telephone system 90 The interface with the public telephone system 90 can, thereby, provide connectivity between any cellular, wireless or wired telephone device 70 and the computer's network interface card 30 . Similarly, this connectivity may be indirectly provided by way of the computer network 50 if the network has a portal 80 with the public telephone system 90 .

The computer 100 will typically be in one of four states at the time remote lock-down is desired designated as S 0 (operating system running), S 3 (suspend), S 4 (hibernate), or S 5 (off). It is assumed that the user is uncertain of the current state. Sending the remote lock-down command should thus take the appropriate action regardless of the initial computer state. With respect to system security, Power On Password (POP) protection is typically employed while Privilege Access Password or Admin Password and Hard Disk Password (HDP), although available are seldom utilized.

The system to enable remote lock-down of the computer is comprised of the target computer 100 including a network interface card 30 , a remote command device 70 such as a cellular telephone, a network or other communications means to provide remote connectivity between the computer's network interface card and the remote command device. Additionally, the computer includes algorithmic processes or programs stored in the computers memory to implement the necessary action.

As shown in FIG. 2 , a communications connection is established 190 between the computer 100 and the remote command device 70 . The NIC address retrieval algorithm 200 is run and obtains the address of the network interface card. As a next step, the remote lock-down message formatting algorithm 210 is run. A message is prepared, in accordance with a pre-determined format including a prescribed preamble, the address of the computer's network interface card, and additional data to specify the desired command action and, optionally, a security password. One example of an acceptable message format is the Magic Packet. The Magic Packet is a broadcast frame having a configuration comprising a defined constant followed by sixteen repetitions of the target computers network interface card address possibly followed by a four or six byte password. A common application of Magic Packet technology is the remote commanding of computer states.

Having prepared the message, a communications link is established with the remote command device and the message is uploaded 220 to a memory in the command device. The communications link may be hardwired to the remote command device or may alternatively be wirelessly dialed up using public telephone system access. At the conclusion of the upload process, the communication link may be terminated 230 .

In an embodiment, the remote computer lock-down process commences when the computer 100 is accessed 300 by the remote command device 70 . A communications link connection is made and the previously stored formatted message is transmitted 310 from the remote command device to the computer, thus initiating computer lock down 320 . If the computer is in the S 3 (suspend) state, the computer is awakened and immediately commanded to transition to the S 4 (hibernate) state. The Magic Packet technology may be utilized to perform the awakening from the S 3 state. If in the S 0 (operating system running) state, the computer is commanded to transition into the S 4 (hibernate) state. If the computer is already either in the S 4 (hibernate) or S 5 (off) state, the message is ignored and the current security policy is continued. The final step of the process is termination 330 of the remote command device connection.

In a further embodiment, the remote computer lock-down system may be further may be enhanced to provide greater functionality. Additional command message data may be included to execution of additional security algorithmic processes. In this embodiment, the computer's BIOS further participates in the lock-down process. As an example, when the command message is received, a bit (WOLBit) could be set indicating message receipt. During subsequent POST (pre-operation system test), the BIOS would query the WOLBit and, if set, would enforce an additional security policy (AdminBit). This could enable a requirement that the admin password be entered to unlock the computer system. Specifically, the BIOS must include software to select if the admin password will be required to do a successful boot after the lock-down command message has been received. In addition the BIOS must provide for an additional bit (WLOBit) to keep track of the message received event, software to enable WLAN wake from the S 5 (off state, and software to clear the WLAN bit after a successful boot. Application software must also be included to set the WLOBit when the message is received.

In accordance with this embodiment, if the computer is initially in the S 3 (suspend) state, the receipt of the command message causes the system to transition to the S 0 (operating system running) followed by the setting of the WOLBit and then, finally, transitioning to the S 4 (hibernate) state. If the computer is initially in the S 0 (operating system running) state, the WLOBit would be set followed by transition to the S 4 (hibernate) state.

In a further extension of the embodiment, additional BIOS setup features will be added which, for example, allows the remote setting of the HDPW (hard file password) when the (WOLBit) is set, if no password is already set. In accordance with this embodiment, the hardfile password (HDP) and the (WOLBit) are checked. If (HDP) is not set and (WOLBit) is set then the (AdminBit) is checked. If the (AdminBit) is set then the hardfile password, HDPW, is set to the Admin password (PAP). Alternatively, if the (AdminBit) is not set then the hardfile password, HDPW, is set to the User password (POP). Once the appropriate password has been successfully entered, the software clears the WOLBit and allows the user/administrator to clear the HDPW. A logic constraint is provided where, if the hardfile password (HDPW) is set, the HDPWBit cannot be set. Any attempt to do so will result in the generation of a warning message.

Statement Regarding Preferred Embodiments

While the invention has been described with respect to preferred embodiments, those skilled in the art will readily appreciate that various changes and/or modifications can be made to the invention without departing from the spirit or scope of the invention as defined by the appended claims. All documents cited herein are incorporated by reference herein where appropriate for teachings of additional or alternative details, features and/or technical background.