# US 2010/0169949 A1 · System and method to provide added security to a platform using locality-based data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2010/0169949 A1 - Document ID: US20100169949A1 - Status: Published application - Kind: A1 - Application number: 12/347,830 - Filed: 2008-12-31 - Published: 2010-07-01 - Earliest claimed: 2008-12-31 - Assignees: Intel Corporation - Inventors: Michael M. Rothman; Vincent Zimmer - Web page: https://patentgrep.com/patent/US20100169949A1 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 9/441: {Multiboot arrangements, i.e. selecting an operating system to be loaded} - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 21/35: communicating wirelessly - G06F 21/575: {Secure boot} - G06F 21/88: Detecting or preventing theft or loss - G06F 9/4408: {Boot device selection} - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some embodiments, the invention involves protecting a platform using locality-based data and, more specifically, to using the locality-based data to ensure that the platform has not been stolen or subject to unauthorized access. In some embodiments, a second level of security, such as a key fob, badge or other source device having an identifying RFID is used for added security. Other embodiments are described and claimed. ## Claims ### Claim 1 A system for protecting a computing platform from unauthorized access, comprising: a host processor coupled to a first wireless communication device to receive location-based information from a positioning device; a firmware service configured to run during boot to verify that the computing platform is authorized for operation, the authorization based at least on location-based information received from the positioning device and pre-defined platform policy; and a runtime service configured to run after boot, the runtime service configured to verify that the computing platform is authorized for operation, the authorization based at least on location-based information received from the positioning device and pre-defined platform policy. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the runtime service executes on a second processor other than the host processor, the second processor coupled to the platform and in communication with the host processor. ### Claim 3 (depends on 1) The system as recited in claim 1, wherein the runtime service executes on the host processor. ### Claim 4 (depends on 1) The system as recited in claim 1, wherein the firmware service is configured to allow normal operation when the platform is within range of a location defined in the platform policy and an identifier associated with the platform is authenticated. ### Claim 5 (depends on 4) The system as recited in claim 4, wherein the firmware service is configured to prohibit the platform from completing the boot when the platform is out of range of the location defined in the platform policy or if the identifier associated with the platform is not authenticated. ### Claim 6 (depends on 1) The system as recited in claim 1, wherein the runtime service is configured to allow normal operation when the platform is within range of a location defined in the platform policy and an identifier associated with the platform is authenticated. ### Claim 7 (depends on 6) The system as recited in claim 6, wherein when the platform is out of range of the location defined in the platform policy or if the identifier associated with the platform not authenticated, the firmware service is configured to perform at least one of lock-up the platform, force the platform to execute a screensaver, or shutdown the platform. ### Claim 8 (depends on 1) The system as recited in claim 1, wherein the platform is configured to send an alert when the platform fails authorization for operation. ### Claim 9 (depends on 8) The system as recited in claim 8, wherein the alert is to be sent by at least one of a network device coupled to the host processor or a network device coupled to a second processor on the platform. ### Claim 10 (depends on 1) The system as recited in claim 1, wherein the authorization is also based on detection that the platforn is within a predefined range of at least one security device. ### Claim 11 (depends on 10) The system as recited in claim 10, wherein the security device comprises a physical device having either a passive or active radio frequency identifier known to the platform policy. ### Claim 12 (depends on 1) The system as recited in claim 1, wherein the location-based information includes an indicator as to whether the platform is within range of an authorized network. ### Claim 13 (depends on 1) The system as recited in claim 1, wherein the positioning device is a global positioning satellite system. ### Claim 14 (depends on 1) The system as recited in claim 1, wherein the positioning device is a local positioning system within range of the platform. ### Claim 15 A method for protecting a computing platform from unauthorized access, comprising: receiving location-based information from a positioning device during both boot and runtime; determining whether the platform is within range of a pre-defined location, based on the received location-based information and a platform policy; transmitting a platform identifier to an ID Authenticator on a network server; receiving one of an authentication confirmation or authentication failure from the ID Authenticator; determining whether the platform is authorized to operate at a current location determined by the received location-based information, authentication confirmation/failure of the platform identifier, and platform policy; when the platform is authorized to operate, allowing normal boot and runtime operation; and when the platform is not authorized to operate, based on platform policy and whether the platform is in boot mode or runtime mode, performing at least one of: prohibiting the platform to boot, locking-up the platform when in runtime, shutting down the platform when in runtime, and sending an alert that identifies failure to authorize the platform to operate normally. ### Claim 16 (depends on 15) The method as recited in claim 15, wherein determining whether the platform is authorized to operate is performed by a firmware service during boot and a system service during runtime. ### Claim 17 (depends on 16) The method as recited in claim 16, wherein the system service at runtime is executed on one of a host processor or a second processor on the platform, wherein the host processor and second processor are coupled to separate network devices capable of independent communication to at least one network device. ### Claim 18 (depends on 15) The method as recited in claim 15, further comprising allowing normal boot operation when the platform is within range of a location defined in the platform policy and the platform ID is confirmed. ### Claim 19 (depends on 18) The method as recited in claim 18, further comprising prohibiting the platform from completing the boot when the platform is out of range of the location defined in the platform policy or if authentication failure from the ID Authenticator is received. ### Claim 20 (depends on 15) The method as recited in claim 15, further comprising allowing normal runtime operation when the platform is within range of a location defined in the platform policy and the platform ID authentication is confirmed. ### Claim 21 (depends on 20) The method recited in claim 20, further comprising performing at least one of locking-up the platform, forcing the platform to execute a screensaver, or shutting down the platform when the platform is out of range of the location defined in the platform policy or when an authentication failure is received from the ID Authenticator. ### Claim 22 (depends on 15) The method as recited in claim 15, further comprising sending an alert to a network device when the platform fails authorization for operation. ### Claim 23 (depends on 15) The method as recited in claim 15, wherein determining whether the platform is authorized to operate at a current location further comprises: detecting proximity of at least one security device, wherein when the at least one security device fails to maintain proximity to the platform, then causing the authorization to be withdrawn or withheld, wherein the platform policy defines thresholds for proximity and authorized security devices. ### Claim 24 (depends on 23) The method as recited in claim 23, wherein the security device comprises a physical device having either passive or active radio frequency identifier known to the platform policy. ### Claim 25 (depends on 15) The method as recited in claim 15, wherein the location-based information includes an indicator as to whether the platform is within range of an authorized network. ### Claim 26 (depends on 15) The method as recited in claim 15, wherein the positioning device is a global positioning satellite system. ### Claim 27 (depends on 15) The method as recited in claim 15, wherein the positioning device is a local positioning system within range of the platform. ### Claim 28 A computer readable medium having instructions stored therein for protecting a computing platform from unauthorized access, the instructions when executed on at least one processor on the platform, cause the platform to: receive location-based information from a positioning device during both boot and runtime; determine whether the platform is within range of a pre-defined location, based on the received location-based information and a platform policy; transmit a platform identifier to an ID Authenticator on a network server; receive one of an authentication confirmation or authentication failure from the ID Authenticator; determine whether the platform is authorized to operate at a current location determined by the received location-based information, authentication confirmation/failure of the platform identifier, and platform policy; when the platform is authorized to operate, allow normal boot and runtime operation; and when the platform is not authorized to operate, based on platform policy and whether the platform is in boot mode or runtime mode, perform at least one of: prohibit the platform to boot, lock-up the platform when in runtime, shutdown the platform when in runtime, and send an alert that identifies failure to authorize the platform to operate normally. ### Claim 29 (depends on 28) The medium as recited in claim 28, wherein determining whether the platform is authorized to operate is performed by a firmware service during boot and a system service during runtime. ### Claim 30 (depends on 29) The medium as recited in claim 29, wherein the system service at runtime is executed on one of a host processor or a second processor on the platform, wherein the host processor and second processor are coupled to separate network devices capable of independent communication to at least one network device. ### Claim 31 (depends on 28) The medium as recited in claim 28, further comprising instructions to allow normal boot operation when the platform is within range of a location defined in the platform policy and the platform ID is confined. ### Claim 32 (depends on 31) The medium as recited in claim 31, further comprising instructions to prohibit the platform from completing the boot when the platform is out of range of the location defined in the platform policy or if authentication failure from the ID Authenticator is received. ### Claim 33 (depends on 28) The medium as recited in claim 28, further comprising instructions to allow normal runtime operation when the platform is within range of a location defined in the platform policy and the platform ID authentication is confirmed. ### Claim 34 (depends on 33) The medium recited in claim 33, further comprising instructions to perform at least one of locking-up the platform, forcing the platform to execute a screensaver, or shutting down the platform when the platform is out of range of the location defined in the platform policy or when an authentication failure is received from the ID Authenticator. ### Claim 35 (depends on 28) The medium as recited in claim 28, further comprising sending an alert to a network device when the platform fails authorization for operation. ### Claim 36 (depends on 28) The medium as recited in claim 28, wherein determining whether the platform is authorized to operate at a current location further comprises instructions to: detect proximity of at least one security device, wherein when the at least one security device fails to maintain proximity to the platform, then cause the authorization to be withdrawn or withheld, wherein the platform policy defines thresholds for proximity and authorized security devices. ### Claim 37 (depends on 36) The medium as recited in claim 36, wherein the security device comprises a physical device having either passive or active radio frequency identifier known to the platform policy. ### Claim 38 (depends on 28) The medium as recited in claim 28, wherein the location-based information includes an indicator as to whether the platform is within range of an authorized network. ### Claim 39 (depends on 28) The method as recited in claim 28, wherein the positioning device is a global positioning satellite system. ### Claim 40 (depends on 28) The medium as recited in claim 28, wherein the positioning device is a local positioning system within range of the platform.