# US 9,520,048 B2 · Always-available embedded theft reaction subsystem > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,520,048 B2 - Document ID: US9520048B2 - Status: Granted - Kind: B2 - Application number: 13/992,480 - Filed: 2011-12-22 - Published: 2014-02-27 - Granted: 2016-12-13 - Earliest claimed: 2011-12-22 - Assignees: Intel Corporation - Applicants: Michael Berger - Inventors: Michael Berger - Web page: https://patentgrep.com/patent/US9520048B2 ## CPC - G08B 25/008: {Alarm setting and unsetting, i.e. arming or disarming of the security system} - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06F 21/88: Detecting or preventing theft or loss - H04W 12/12: Detection or prevention of fraud - H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2105: Dual mode as a secondary aspect - G08B: SIGNALLING SYSTEMS, e.g. PERSONAL CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A system to provide an always-on always-available security system for a platform is described. The system comprises a multi-mode system having a plurality of modes, available whenever the platform has a source of power, the modes comprising an unarmed mode, in which the security system is not protecting the platform, an armed mode, in which the platform is protected, the armed mode reached from the unarmed mode, after an arming command, and a suspecting mode, in which the platform is suspecting theft, the suspecting mode reached from the armed mode, when a risk behavior is detected. The system further enabling the unarmed mode to be reached from the armed mode when a user disarms the platform, and the unarmed mode reached from the armed mode through the suspecting mode when an override command is received. ## Claims ### Claim 1 A system comprising: a hardware platform comprising a processor to execute instructions to transition the system to one of a plurality of modes, wherein the plurality of modes to include: an unarmed mode, in which the system is to not protect the hardware platform; an armed mode, in which the platform is to be protected by the system, the armed mode to be reached from the unarmed mode, after an arming command is received from a user interface; a suspecting mode, in which the platform is suspecting theft, the suspecting mode to be reached from the armed mode, when a risk behavior is detected, wherein the unarmed mode to be reached from the armed mode when a user disarms the platform, and the unarmed mode reached from the armed mode through the suspecting mode when an override command is received, the override command to move the system from the armed mode to the suspecting mode, prior to disarming the system, and the system to perform security actions including performing a full disk encryption of data on the platform when the override command is received to move the system from the armed mode to the suspecting mode. ### Claim 2 (depends on 1) The system of claim 1, further comprising: the unarmed mode to be reached from the suspecting mode when a user disarms the platform, and the unarmed mode to be reached from the suspecting mode when an override command is received. ### Claim 3 (depends on 1) The system of claim 1, wherein the system to provide a soft reaction to the risk behavior, a soft reaction not deleting data on the platform or otherwise preventing use of the platform. ### Claim 4 (depends on 1) The system of claim 1, wherein the security actions further comprise one or more of: sending a message via a network, sounding an alarm, and transitioning the system to another power mode for data protection. ### Claim 5 (depends on 1) The system of claim 1, wherein a time until the movement from the suspecting mode to the unarmed mode is configurable. ### Claim 6 (depends on 1) The system of claim 1, wherein the override utilizes a separate authentication. ### Claim 7 (depends on 1) The system of claim 1, further comprising, in transitioning from the armed mode to the unarmed mode via the override command, to encrypt data on the platform, such that the platform is usable and the data is protected. ### Claim 8 (depends on 1) The system of claim 1, further comprising: a physical switch to receive the override command. ### Claim 9 A hardware platform comprising: a hardware computing device including a core logic component to transition the platform from an unarmed mode to an armed mode upon receipt of a user arming command; a user interface to receive an override command from the user, to transition the system from the armed mode to the unarmed mode through a suspecting mode; the core logic component to transition the platform to the suspecting mode, in response to receiving the override command; a security action logic to perform one or more security actions including performing a full disk encryption of data on the platform in response to being in the suspecting mode; and the core logic to transition the platform from the suspecting mode to the unarmed mode, after the security action logic performs the security actions, in response to receiving the override command. ### Claim 10 (depends on 9) The platform of claim 9, the security actions further comprising one or more of: sending a message via a network, sounding an alarm, and transitioning the system to another power mode for data protection. ### Claim 11 (depends on 9) The platform of claim 9, further comprising: the core logic component to transition the platform from the armed mode to the unarmed mode when receiving a disarming command. ### Claim 12 (depends on 9) The platform of claim 9, wherein a time between movement from the suspecting mode to the unarmed mode is configurable. ### Claim 13 (depends on 9) The platform of claim 9, wherein the override command utilizes a separate authentication. ### Claim 14 (depends on 13) The platform of claim 13, wherein the separate authentication comprises a separate password. ### Claim 15 (depends on 9) The platform of claim 9, wherein the override command permits access to the platform, without access to data on the platform. ### Claim 16 (depends on 9) The platform of claim 9, further comprising: an interface to receive a disarming command from a paired device, the override command used when the paired device is inaccessible. ### Claim 17 A platform comprising: storage including encryption logic to encrypt data; a core logic component of a computing device to transition a security system of the platform between a plurality of modes the modes including: an unarmed mode when the platform is usable; an armed mode, during which a risk behavior logic monitors for a risk behavior; a suspecting mode, reached when the risk behavior logic detects the risk behavior, in the suspecting mode a security action logic to react to the risk behavior and perform a security action including to perform a full disk encryption of data on the platform; and an interface to receive an override command from a user, and to transition from the armed mode to the unarmed mode through the suspecting mode, without use of a disarming command; and the core logic to transition through the suspecting mode, prior to moving the security system to the unarmed mode in response to the override command, so that the security action takes actions in response to receiving the override command. ### Claim 18 (depends on 17) The platform of claim 17, wherein when the security system is moved to the unarmed mode through the override command, the data remains encrypted. ### Claim 19 (depends on 17) The platform of claim 17, wherein when the security system is moved to the unarmed mode through the override command, the security action comprises one or more of: sending a message via a network, sounding an alarm, and transitioning the system to another power mode for data protection. ### Claim 20 A method comprising: transitioning a platform from an unarmed mode to an armed mode through a suspecting mode, the platform comprising a computing device coupled to a user interface, the computing device being selected from a group consisting of a laptop computer, a netbook, a tablet computer, and a mobile device; receiving an override command from the user interface to transition the platform from the armed mode to the unarmed mode through the suspecting mode, when in the armed mode; transitioning the platform to the suspecting mode in response to receiving the override command; performing at least two security actions in response to being in the suspecting mode, wherein one of the at least two security actions includes performing a full disk encryption; and transitioning from the suspecting mode to the unarmed mode after performing the security actions, in response to receiving the override command. ### Claim 21 (depends on 20) The method of claim 20, wherein the security actions are selected from the group consisting of: sending a message via a network, sounding an alarm, and transitioning the system to another power mode for data protection.