# US 12,001,571 B2 · System and device for data protection and method thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,571 B2 - Document ID: US12001571B2 - Status: Granted - Kind: B2 - Application number: 18/052,211 - Filed: 2022-11-03 - Published: 2023-04-13 - Granted: 2024-06-04 - Earliest claimed: 2018-06-28 - Assignees: Taiwan Semiconductor Manufacturing Company, Ltd. - Applicants: Taiwan Semiconductor Manufacturing Company Ltd. - Inventors: Wen-Chang Kuo; Chiang Kao; Kuo Hsiung Chen; Ho-Han Liu; Ti-Yen Yang; Jo-Chan Liu; Chi-Pin Wang; Yao-Hsiung Chang - Web page: https://patentgrep.com/patent/US12001571B2 ## CPC - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/629: {to features or functions of an application} - H04W 48/04: based on user or terminal location or mobility data, e.g. moving direction, speed - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method of operating a user device includes: receiving a command from a user to power on the user device, wherein the user device includes information on a restricted zone associated with the user device; detecting, by a monitoring entity of the user device without involvement of any device external to the user device, whether the user device is located within the restricted zone in response to the user device being powered on and before an operating system of the user device is executed; and granting access of the user to the user device by the monitoring entity in response to detecting the user device as being within the restricted zone. ## Claims ### Claim 1 A method of operating a user device, comprising: receiving a command from a user to power on the user device, wherein the user device includes information on a restricted zone associated with the user device; determining, by a first monitoring entity of the user device, whether the user device is located within the restricted zone through accessing a server located within the restricted zone in response to the user device being powered on and before an operating system of the user device is executed, wherein the server comprises a key server configured to store a key for encrypting or decrypting the user device; and granting access of the user to the user device by the first monitoring entity in response to determining the user device as being within the restricted zone through successfully accessing the server. ### Claim 2 (depends on 1) The method according to claim 1, further comprising limiting access to the user device in response to determining that the user device is outside the restricted zone. ### Claim 3 (depends on 2) The method according to claim 2, wherein the limiting access to the user device comprises locking a display of the user device. ### Claim 4 (depends on 2) The method according to claim 2, wherein the user device comprises a storage device, and the limiting access to the user device comprises encrypting the storage device of the user device. ### Claim 5 (depends on 4) The method according to claim 4, further comprising decrypting the storage device and executing the operating system after determining whether the user device is located within the restricted zone. ### Claim 6 (depends on 5) The method according to claim 5, further comprising accessing the key server and decrypting the storage device using the key received from the key server. ### Claim 7 (depends on 2) The method according to claim 2, wherein the limiting access to the user device comprises either shutting down the user device or causing the user device to enter a hibernation mode. ### Claim 8 (depends on 1) The method according to claim 1, wherein the server further comprises at least one of a predetermined domain controller, a predetermined anti-virus server, a predetermined web server, a predetermined proxy server, a predetermined DNS server, a predetermined DHCP server, a predetermined Email server, a predetermined NTP server, a predetermined printer server, a predetermined operation system patch server, and a predetermined key server. ### Claim 9 (depends on 1) The method according to claim 1, wherein determining whether the user device is located within the restricted zone further comprises detecting a physical location of the user device by a second monitoring entity through receiving at least one of a GPS signal, a Wi-Fi signal, a cellular network signal, an RFID signal, an NFC signal, a Bluetooth signal, an ultrasonic signal and a network address of the user device. ### Claim 10 (depends on 1) The method according to claim 1, wherein determining whether the user device is located within the restricted zone further comprises authenticating a user accessing the user device based on a biometric indicator comprising at least one of voice, iris, fingerprint, finger vein data, palm vein data, and facial data of the user. ### Claim 11 A non-transitory computer readable storage medium, comprising instructions which, when executed by a processor, performs steps of operating a user device, the steps comprising: receiving a command from a user to power on the user device, wherein a storage device of the user device is encrypted in a power-off state; determining, by a first monitoring operation of the user device whether the user device is located within a restricted zone through accessing a server located within the restricted zone in response to the user device being powered on and before an operating system of the user device is executed, wherein the server comprises a key server configured to store a key for encrypting or decrypting the user device; keeping the storage device encrypted, by the user device, in response to determining the user device as being outside the restricted zone through unsuccessfully accessing the server; and performing, by the user device, a second monitoring operation and determining whether a risk condition of the user device as being located within the restricted zone exists. ### Claim 12 (depends on 11) The non-transitory computer readable storage medium according to claim 11, further comprising limiting access to the user device in response to the risk condition being detected. ### Claim 13 (depends on 12) The non-transitory computer readable storage medium according to claim 12, wherein the limiting access to the user device comprises at least one of locking an output device of the user device, encrypting the storage device, demounting the storage device and shutting down power of the storage device. ### Claim 14 (depends on 11) The non-transitory computer readable storage medium according to claim 11, further decrypting the storage device of the user device in response to determining the user device as being within the restricted zone. ### Claim 15 (depends on 14) The non-transitory computer readable storage medium according to claim 14, wherein the decrypting of the storage device of the user device comprises receiving a key associated with the storage device from the key server. ### Claim 16 A user device, comprising: a processor; a storage device coupled to the processor; and a monitoring entity coupled to the processor and the storage device and configured to perform the steps of: determining whether the user device is located within a restricted zone through accessing a server located within the restricted zone in response to the user device being powered on and before an operating system of the user device is executed, wherein the server comprises a key server configured to store a key for encrypting or decrypting the user device; and granting access to the user device for executing the operating system of the user device in response to determining the user device as being within the restricted zone through successfully accessing the server. ### Claim 17 (depends on 16) The user device according to claim 16, wherein the monitoring entity comprises a transceiver configured to provide information on a location of the user device based on at least one of a GPS signal, a Wi-Fi signal, a cellular signal, a RFID signal, a NFC signal, a Bluetooth signal, an ultrasonic signal and an IP address. ### Claim 18 (depends on 17) The user device according to claim 17, wherein the monitoring entity is further configured to perform the step of limiting access of the user device in response to determining the location of the user device as being outside the restricted zone. ### Claim 19 (depends on 18) The user device according to claim 18, further comprising an output device, wherein the monitoring entity is further configured to lock the output device in response to determining the location of the user device as being outside the restricted zone. ### Claim 20 (depends on 18) The user device according to claim 18, further comprising a power supply coupled to the monitoring entity and the storage device, wherein the monitoring entity is configured to shut down the power supply in response to detecting a physical location of the user device as being outside the restricted zone.