WO2001075830A1

WO2001075830A1 - Secured appliance

Info

Publication number: WO2001075830A1
Application number: PCT/GB2001/001359
Authority: WO
Inventors: Jonathan Hopkins; David Caldwell Mcglaughlin; Alexander Charles Croxall Brennan; Richard Charles Blyth; Stephen Michael Reeder
Original assignee: British Telecommunications Public Limited Company
Priority date: 2000-03-31
Filing date: 2001-03-27
Publication date: 2001-10-11
Also published as: AU2001242600A1

Abstract

A secured appliance includes a locational sensor for example a GPS sensor. The appliance also includes communication capability for example a mobile phone. Each time the appliance is activated and also at periodic intervals a call is established from the appliance to a control centre to request functional permissions. If the appliance is being operated in an invalid location or by an unauthorised operator functional permissions may be denied.

Description

SECURED APPLIANCE

The present invention relates to a moveable appliance, and in particular to an appliance incorporating security systems to discourage theft. Homes and workplaces commonly house large numbers of technological appliances, and developments in information and communication technology are tending to increase still further the number and value of the appliances. For example, a domestic living room might now house a digital television, hi fi components, a digital video disc player, a video cassette recorder and a personal computer. All such appliances are vulnerable to theft. Even if premises are secured with burglar alarms, determined thieves may still not be deterred. Furthermore with some appliances, such as laptop computers, it may often be necessary to take the appliance outside the home, further increasing the risk of theft.

According to a first aspect of the present invention there is provided a moveable appliance including a location sensor, and a security controller integrated with the appliance, the security controller being arranged to inhibit at least some of the functions of the appliance when the location of the appliance indicated by data from the location sensor is not an authorised location.

The present invention fundamentally reduces the value of an appliance to a thief by incorporating in the appliance a system that ensures that the appliance ceases to function, or at least has its functionality limited, if the appliance is stolen. This system comprises a location sensor together with a security controller that controls the functioning of the appliance, for example by preventing the appliance powering up. The location sensor detects signals indicating the current location of the appliance and that location is then compared with the authorised location. The authorised location may have been recorded, for example by a retailer using customer details provided at the time of purchase, or by the customer themselves on installing the appliance. For example, the retailer might take the postcode of the customer, translate that postcode into a co-ordinate range by reference to a geographical information systems (GIS) database, and then record the co-ordinate range .

Preferably the apparatus further comprises a communications interface for communicating data via a communications network with a remote operations centre, in use a permission code being transmitted from the remote operations centre to the appliance depending on the location reported by the location sensor and the security controller enabling functions of the appliance in response to the said security permission code.

The previous applications of the present assignee discussed in detail below describe security systems in which permissions are transmitted to the customer location from a remote operations centre by way of an interface unit, connected, for example, to the power supply. This feature of the present invention adapts such an arrangement and achieves further advantages by effectively integrating the interface to the remote operations centre with the appliance. In the context of the present invention, this provides enhanced security by the use of the remote centre, whilst still maintaining the security and ease of use of a system wholly integrated with the appliance.

The location sensor may be responsive to signals transmitted by a mobile cellular communications network. Such signals can be used to identify which cell of the network the appliance is located in, and receivers for this purpose are readily and cheaply available. Alternatively the location sensor may be responsive to a satellite positioning signal such as that provided by the GPS (global positioning system). This provides a more accurate determination of the appliance location. Other types of signal may also be used, for example in other networks divided into different domains, the sensor may detect a signal identifying the domain to which the appliance is connected.

The appliance may be a computer, in which case the security controller is preferably arranged to inhibit access to at least some of the data on the computer when outside an authorised location. This feature of the invention addresses the further problem associated with the theft of computers, that the thief may gain access to sensitive data stored on the computer. The controller may completely disable the computer, or may selectively inhibit access to certain sets of data, for example to a particular folder that then provides a secure store for particularly sensitive data. This latter arrangement is of particular value in the case of a laptop computer which may routinely be used by the owner away from authorised locations, for example on a journey between work and home. The owner can then still make use of the computer on the journey, whilst knowing that data in the secure store will not be compromised if the computer is lost. According to another aspect of the present invention, there is provided a method of operating a moveable appliance including detecting with a location sensor integrated with the appliance the location of the appliance and, with a security controller integrated with the appliance, inhibiting at least some of the functions of the appliance when the location of the appliance indicated by data from the location sensor is not an authorised location.

In published European Patent Applications Nos. 675626 and 960407 the assignee of the present invention has disclosed improved security systems using an interface ("Home Control Centre") between the public switched telephone network (PSTN) and appliances in customer premises whereby such apparatus may be less attractive to thieves since without certain permissions obtained by way of the PSTN from a remote operations centre the appliance will not function.

In further developments of the system of EP960407 disclosed in co-pending

European patent applications Nos. 99302132, 99302133, 99302134 and 99302149 alternative communications methods for both communication within the customer premises and communication between the home control centre and a permission granting arrangement were disclosed.

In yet a further development disclosed in co-pending European Patent

Application no. 99307981 , the customer premises interface was developed to provide an environmental alarm arrangement for simple installation and use in communal premises, for example to provide smoke or fire detection in an apartment block.

A brief introduction to the earlier arrangement and its operation will facilitate understanding of the invention hereinafter disclosed and claimed. However, for a full description of the operation of the basic system the reader should refer to the earlier applications referred to above.

Thus referring to Figure 1 , in one form a control and communications network uses the PSTN 1 to effect communications between a remote operations centre 4 and customer premises 3. It will be appreciated that for simplicity only one remote operations centre is shown although there may be many such centres distributed across the PSTN.

In each customer premises 3, a home control centre 2 provides an interface for communication on the one hand by way of the customer telephone line 7 and the PSTN with the remote operations centre and on the other hand by way of the mains electricity supply 6 of the customers premises 3 with suitably adapted electrical appliances 5.

Although reference in the earlier application was to the two forms of communication mentioned, that is by superimposition of signalling on the supply line 6 and by way of the PSTN, it is noted that other communications arrangements have been proposed by the proprietor of this application including but not limited to use of cellular radio networks, satellite communications and radio and Internet links between the home control centre 2 and the remote operations centre 4. Communication between the home control centre 2 and appliances 5 may be by way of low power radio such as DECT, by way of an Intranet or by way of telephony wiring for example.

Also shown in Figure 1 is a repatriation unit 8 which enables stolen property to be identified by authorised persons for return to the owner. It will be appreciated that other control centres accessible by way of the PSTN may also benefit from the arrangement.

Suppliers of goods and services to consumers may wish to permit usage of features in dependence upon the contractual and payment arrangements made in respect of such usage by a consumer. . A communications and control network in accordance with the invention will now be described by way of example only with reference to the accompanying drawings of which:

Figure 1 is a block schematic diagram of a communications and control network; Figure 2 is a block schematic diagram of the "home control centre" of figure

1 modified to provide additional features of the invention;

Figure 3 is a block schematic diagram of adapted apparatus;

Figure 4 is a flow chart showing the operation of the home control centre of figure 2; Figure 5 is a flow chart showing the operation of relevant circuits of the apparatus of figure 3;

Figure 6 is a block schematic diagram of apparatus in the remote operations centre; Figure 7 is a flow chart showing functionality of the operation of the remote operations centre of Figure 1 ;

Figure 8 shows a flow chart of an information request response in the remote operations centre; Figure 9 shows operation of a capability change section of the operations centre;

Figure 10 shows a further flow chart in relation to a keyed changed request from a control centre to the remote operations centre;

Figure 1 1 shows operation of the processor of the apparatus of Figure 3 in respect of a specific function request; and

Figure 12 is a schematic representation of a geographical control arrangement.

Figure 1 , to which reference has already been made, shows an implementation of a communications and control network of the kind modified by the present invention and as disclosed in European patent application number 960406. A detailed explanation of the arrangement shown in Figure 1 may be had by reference to the previous application in respect of coding of electrical appliances 5 and only a limited description of the functionality of the remote operations centre (ROC) and home control centre (HCC) in respect of the prior art will be given herein. Referring to Figure 2, the HCC 2 of Figure 1 comprises a processor 23, with associated data stores 24, 26. As described hereinafter, the processor has an analogue shift key (ASK) signalling interface 25 for communicating on the mains electricity supply 6. For completeness it is noted that the ASK interface 25 may be replaced by other signalling arrangements communicating by way of the mains electricity supply. In alternative arrangements radio transmission or Intranet or telephony line communication may be used in place of the ASK interface 25 or in addition thereto. Thus, whilst herein communication is described as being on the mains electricity supply to electrical appliances and/or detectors and/or sensors, it should not be taken as limiting the invention to communication by way of the electricity supply.

The processor is also shown as having access to a tone generator modem 22 for communication by way of network termination equipment 20 to telephone lines 7. again, while herein communication is described as being by way of the telephony network and location data is derived from calling line identity (CLI), it should be appreciated that other communications methods and location identification may be used including, but not limited to, used of cellular networks for communication including triangulation between cellular network masts to determine the location identity. Low Earth orbital satellite and/or direct radio communication between the HCC 2 and ROC 4 may also be used while global positioning by satellite (GPS) and/or burnt in identification of the HCC 2 should not be considered to be excluded.

Furthermore, in descriptions hereinafter relating to modified appliances and/or sensors and/or environmental alarms and the like, while a specific form of communication between such devices and the HCC may be specified these should not be taken as excluding other forms of communication.

Referring now to figure 3, in a protected or controlled appliance (e.g. 5 of Figure 1 ), modification of the process control 15 within the appliance (which may be any electrically operable or electro mechanically assisted device) requires the process control to signal to operational circuits of the appliance.

Thus the process control 1 5 has an interface 14 for communicating by way of a communications device, for example a mobile cellular phone connected to a phone connector 1 1 or directly by radio aerial 21 with the HCC 2. The HCC 2 returns control information to the process control 1 5 by way of the phone circuit or radio communication and the interface 14 to permit or deny activation of operational circuits. As discussed in the earlier European patent applications mentioned above, one method of discouraging theft is to have the power supply of the appliance 5 cease to supply power to the operational circuits unless or until the process control 1 5 has received an appropriate code downloaded from a ROC by way of the HCC 2. Thus initially, the device until coded forwards a message to the HCC each time it is activated and requests a coding. Once connected via premises at which a HCC exists then it will receive coding with which it will compare subsequently received codes prior to operation. On first coding it will also receive a "blanking" code which is know only to the coded appliance and to the ROC, the blanking code being transmitted to the HCC only on specific request of a legitimate authority (owner) to enable decoding of the appliance to permit its bona fide transfer to another party.

In the present invention, in addition to receiving operation and blanking codes, the HCC also includes the ability to transfer additional information to the process control 15 this information including identity of "capability sets" and timer information. The capability sets are programmed in to a memory 1 9 and define which functions of the appliance are available for use. For example, in a lap top computer, the facilities available to be used may be held in the capability set along with data access permissions. Thus when a function is requested by use of a keypad, the process control may determine from the capability set in combination with the current location determined by location sensor 13 whether the appropriate function is available. The process control may thus permit or refuse activation of the appropriate function which enables the functionality of the apparatus to be varied from the ROC 4 by way of the home control 2 to the process control 15.

This facility therefore allows apparatus owners to permit or deny access to certain functions by way of a secure route.

A further advantage of the arrangement hereinafter described is that appliances may be coded through the supply chain from manufacturer, to wholesaler, to retailer, to end customer so that theft in transit is more difficult and electronic sales (for example by way of the Internet) can be secured. Thus even if an attempt is made to purchase goods or services using fraudulent means, for example by quoting another person's card account number or by using a stolen credit or debit card, the goods will be of no benefit to the fraudulent user since they will be pre- coded at the point of sale to the specific HCC of the proper card owner. In this way, delivery of goods to a specific address is secured since any theft will leave the thief with an unusable apparatus which is readily traceable to its proper owner and which may reveal its location to proper authorities to facilitate recovery.

Turning now to figure 4, the processor 23 of the HCC 2 of Figure 2 is normally quiescent in a main state 900 until it receives, by way of the communications channel, an "unlock request" message (901 ) from an appliance 5. The message includes the identity of the requesting apparatus by type, manufacturer and electronic serial number. If the requesting apparatus is not in the list of appliances held in the volatile data store 24 then by way of the path 906 to 970 coding is requested from the ROC 4 by way of the PSTN 1 . Various checks are made to ensure that the requesting appliance codes appropriately and that the new equipment is now included in the appliance list. Full details of this part of the operation are disclosed in the earlier published European applications, including a more complete flow chart for those operations involved after the commencement of the Lock Enable Timer at step 910.

Assuming that the requesting apparatus is in the list held in the data store 24 then at step 903 the message type is analysed to determine how the message is to be handled by the HCC. If the message is an environmental alarm (944) then it is handled in a manner described in other co-pending patent applications of the proprietor to ensure that appropriate response to the alarm occurs. This is indicated here for the sake of completeness only.

Similarly, if the message indicates a basic type appliance (that is one coded only for the purposes of permission to operate when re-connected to power after disconnection) then the Signal Group Basic route 945 is followed. Thus at 946 a check is carried out to determine whether in respect of the particular appliance the blanking code is present and, if so, the equipment is ordered to decode itself as disclosed in published European patent application no 960407 which includes a full flow chart in respect of the code blanking activity.

However, if at step 946 the blanking code is not present, this being the more usual status, then the unlock code is recovered from the data store (904) and is transmitted as an unlock response (905) to the communications channel. It should be noted that where a precoded appliance (from an electronic sale record) is first activated its unlock code will already be present in the equipment list of the HCC 2 provided that the equipment is licitly present at its location and that the HCC has either made a connection to the ROC 4 in the period between coding and delivery and connection or has been forced to make such a call by the owner causing a reset of the HCC 2. In the alternative, where the equipment is licitly present at its location, when the HCC receives an unlock request it will follow the path indicated at step 902 and the ROC 4 will recognise the coding request and return the appropriate (already stored) coding for the appliance to operate.

It will be realised that if the ROC receives a coding request from apparatus in an incorrect location it may not return a valid coding and may cause an alert to be provided to appropriate authorities. However, there may be advantages in allowing the apparatus to operate on a temporary basis, for example by returning a coding with a short time decay (hereinafter discussed) so that a fraudulent operator of the appliance may not realise that the authorities are aware of the illicit operation and its location.

Returning once again to step 903, if a signalling group information message is received indicating a request for capability set information more detailed than a simple authorisation code, then at step 947, the processor 23 determines whether there are instructions for the apparatus in the list. If at step 947 instructions exist and locational data in the message is valid then the information message is returned through the interface 25 at step 952 and the HCC resumes its quiescent state.

Now, if at step 947 instructions in respect of the particular apparatus have not previously been received and stored then a call is established through the PSTN to the ROC 4 and an equipment information required message is transmitted (948). The ROC 4 will respond with an equipment information response message (949) and the processor 25 determines whether the message includes information to be stored either in respect of the particular request or additional thereto (950). If not then the received information is passed through the interface to the mains as a transmit information message (952) prior to the quiescent state being resumed.

If the received message from the ROC 4 includes information to be stored then the list held in the data store 24 or 25 is updated (951 ) in accordance with the message and the information responding to the request received is then transmitted as before at step 952.

Considering now the operation of process control 15 of figure 3 and referring also to figure 5, from a quiescent state 50, the process control may be interrupted or triggered as a result of user action or as a result of timer permissions decaying to zero. Considering first the re-connection (or first connection) of power to the apparatus, as indicated at step 51 , the process control causes an Unlock Request Message to be transmitted 52 and commences a cover timer 53 for response from the HCC 2 as previously described with reference to Figure 4. The unlock request message includes locational information from the location sensor 13. Four potential exits from the timer waiting state may be received representing respectively the outputs of the HCC 2 of System Lock Enable (909), Blank Instruction (912), Unlock Response (905) or the internal timer of the appliance expiring with no response being received. The process followed in respect of each of these responses to an Unlock Request (SG Basic) message is fully disclosed in the prior published European Patent Applications mentioned hereinbefore and further description here is not deemed necessary.

Note that messages from the apparatus to the HCC 2 may be by mobile phone or by use of radio transmission. Further, messages may be directed to an ROC or a control centre in other premises (for example work place).

Turning to the other possible exits from the quiescent state 50, the user may force a request to the HCC 2 by activating a reset function either directly or through remote control in order to activate or de-activate a capability in the controlled apparatus. Thus if the user has made arrangements with a supplier to allow additional functionality resetting the system (56) causes an SG Plus message (57) to be transmitted by way of the interface 14 to the mains supply line 6 and thence to the HCC 2. Following transmission of the request message a cover timer is started (58) while awaiting the response from the HCC 2. If, as expected, an information message is received (59) (transmitted as hereinbefore described at 952 of Figure 4) then any additional capability set "Y" may be stored as active in the data store 16 together with an appropriate timer associated therewith (if any) at step 61 .

Alternatively, if the information message received includes a multiple capability set activate and/or deactivate instruction (possibly with respective associated decay timers) then these are stored at as indicated at steps 62 and 63. A further facility which may be provided by the control system of the invention allows for sensors to be provided which may be smart card, smart badge, or passive or biometric sensors so that the presence or absence of a particular card or badge may be used to modify or determine the facilities provided. Thus, as indicated at step 64, if there is a change in the card presence this may cause the process control 1 5 to generate an SG plus message as before following the steps 57 et sequenda.. This enables the particular apparatus to provide certain facilities only when an appropriate card is present. Thus the apparatus may have certain capabilities turned off unless a card indicative of presence of a qualified operator is present such that user access to specific information may be restricted Sensor presence may also be a limited period authorisation such that the timer decays and causes a further SG Plus message to be transmitted as indicated at step 65. On one of the timers decaying to zero in the data store 16 and process control 1 5, the associated capability set "X" is marked as disabled (66) and a message transmitted as before. This will result either in an information message including a renewed time for the capability set or a disable message as appropriate through steps 59 to 63.

Note that if the cover timer started at step 58 expires (67) without an information message being received then the process control assumes that the previous capability set authorisation pattern remains in force minus any capability set (step 68) which for which the respective timer decayed to zero.

In the absence of an information message the process control may set a further timer to force an SG plus message at a subsequent time to attempt an update of the capability sets.

Turning now to figure 1 1 while continuing to refer to figure 3, if a function is requested then the process control reads the current capability set(s) which are active (step 71 ) and determines whether the particular function is controlled (step 72). If the function is an open function ("Always") then as indicated at step 73 the function is implemented and the controlled appliance responds to the function request appropriately. If the function is marked as disabled or inactive ("No") then the function may be disabled (step 74) and a display activated indicating that the function is unavailable.

The third possibility is that the capability set requires that the function requested is authorised on the basis of location each time it is activated. Thus at step 76 an information request message is transmitted to the HCC 2 including location data derived from the location sensor using GPS or sensed by the cellular system using triangulation and a cover timer started (77). On receipt of an information response (78) the process control will store any modification to the capability set authorisation (with a decay timer if present) and will again read the capability set. If the timer set at step 77 expires then the process control may check the number of attempts made (step not shown) and will either return to reading the capability set or will step to reject the request and disable functions.

Note that for any particular function request the number of attempts to check authorisation may be bounded so that only a single request for information is made in respect of the function requested and if not authorised the requested function may be rejected. It will be appreciated that the cover timer started at step 77 must be sufficient in some circumstances to allow for the HCC to effect a modem interchange with the ROC in case there should be a third party authorisation entered through the remote centre. Note also the presence of a "heartbeat timer" which may force application for authorisation at periodic intervals.

Referring now to figure 6, the ROC in its simplest form comprises a computer 30 with associated data storage 31 and communications capabilities represented by telephone lines 37 and modems 33. Location detection represented by CLI detector 32 is also provided, noting that GPS may also be detectable. Much of the functionality of the ROC of figure 6 has been described in the proprietors earlier applications such that only a representative selection of program instances are from the previous operational description are shown in figure 7 to which reference is now also made.

Thus the first process shown (81 1 ) is a response to a HCC 2 requesting an equipment list. The HCC 2 will lose data from the volatile data store 24 (of figure 2) if power is removed for any reason. It is therefore necessary for the ROC to return a complete listing to the HCC to enable apparatus in the controlled premises to function. Thus at step 812 the location identity is recovered (from CLI detector 32/GPS or wired coding from the message) and a comparison made to determine whether the location is valid (line ID Registered 813). An attempt from an unauthorised source (including an invalid combination of identity and wired coding) will result in the termination of the interchange (816) and a record being made of the call (step 817). Appropriate authorities may be notified of the attempt if there has been an indication that the HCC making application has been fraudulently removed from its previous location.

If there is a valid registration of the requesting HCC then the equipment listing and codings appropriate to the premises in which the home control is located will be loaded (step 814) and encompassed in a message for return through the PSTN (81 5).

In the Equipment code required (step 820) process, when a request is received 820 then as previously location data is checked (822,823) before location code and equipment code and blanking codes are determined (824, 825). It should be noted here that where a pre-coded appliance (hereinafter described) causes application for an equipment code and there is an indication of invalid location of the appliance an appropriate action may be taken (steps not shown). Once codings for the requesting appliance have been determined then an equipment code response is transmitted 827 and a timer for confirmation of coding 826 is started. If on expiry of the timer no response has been received then a further attempt to transmit codings may be made and/or a query may be entered against the record of the appliance in the appropriate equipment list. Assuming that an equipment stored confirm message is received (828) then the cover timer is stopped (829) and the process ended.

Turning now to figure 8, where a message from a HCC 2 to the ROC 4 is an information request (70) as before, the location of the calling control centre is checked (71 ,72) and if not valid the request rejected (73) and a record of the attempt made (74).

Assuming validity of the information request message then data for the particular location (capability sets, timers, new apparatus) is recovered (75) from the data store 31 and an information response message encapsulating that data is transmitted (76) back through the PSTN.

In figure 9 there is shown a process whereby a service provider or appliance retailer may register changes against a particular customer location. Thus, the supplier forwards a capability change message which is received at the ROC (step 80) and the identity of the supplier checked (81 ) and validated (82). Assuming that the supplier is appropriately identified the HCC is identified from the message content and a check carried out to ensure that the HCC is registered (84).

If the capability change requested is subject to agreement from the HCC user then a check is made to ensure that the end user has given permission (85) prior to responding to the change request. If the change is simply one requiring a capability set modification then the appropriate information is amended (86) in the data store 31 so that on the next application of the respective HCC for information the amended capabilities are transmitted. A notification message is returned to the supplier at step 87 and the process terminates.

If at step 86 it is necessary to allocate a new item or appliance to the HCC then appropriate codings are generated and stored and these will be notified to the supplier so that the appliance being supplied or sold may be appropriately coded.

If there is any failure of any of the validity or permit checks (82, 84, 85) a non implementation message is transmitted back to the requesting supplier (88) which may include a reason for non implementation and the interchange of information terminates (89). A record of the transaction attempt may be made in an exception log (90).

In a further process available at the ROC 4, referring now to figure 10, where a keyed entry to the HCC 2 is made once the complete change has been identified in the HCC 2 (process not shown) the HCC transmits a keyed change request to the ROC. Such a request maybe in respect of modification of capability sets, time of availability, availability only on sensed presence and the location at which the apparatus may be used whereby user authorities are modified by the user or other authorised persons.

Thus when the ROC receives a keyed change request (1 10) the HCC is identified (1 1 1 ) and the usual identity and validity checks are carried out (1 12, 1 13 1 14). Assuming that the request is valid then the data for the appropriate HCC is recovered (1 15) from the data bank 31 to enable a check to be carried out (1 16) on any required PIN entry or smart card presence prior to modification of the respective data and an information message including the updated information being transmitted (1 1 8).

For the avoidance of doubt it is here noted that the term HCC should not be construed as limiting the application of the invention to domestic premises since the control mechanisms and methods disclosed hereinbefore may be equally applied to non domestic premises with little variation in the implementation.

In particular referring to Figure 1 2, while it is noted usage of mobile electronic apparatus such as lap top computers, portable receivers etc may be controlled by geographic location, it is also possible to limit the usage of machinery having electronic controls in the same way.

Thus, an HCC located in a farm building 120, for example, may be used to restrict usage of farm machinery 121 . Thus, if an attempt is made to start the machine 1 21 a process control may require a mobile phone to be connected to the connector (1 1 of Figure 3) and will establish a call to the HCC to receive permissions. Sensors present in the machine 121 will provide location data and identity of any card or badge present. The HCC may check that the machine is within authorised boundaries 1 22 and that the operator is allowed to use that machine. Thus a request from a machine 123 outside of the authorised boundary 122 will receive no operational permissions, while the machine 1 21 will be authorised to operate subject to sensed smart card presence. The operational permissions may be required to be renewed at periodic intervals. Accordingly, such actions as changed an attached implement may result in a permissions request, the system being adapted to identify the implement(s) attached.

Such an arrangement may also be used for example to control operation of machinery on building sites so that operation is restricted to valid locations and by appropriate authorised persons. In this arrangement the supplier may be able to authorise usage of certain functions while denying use of others.

A suitable GPS receiver is commercially available from Motorola Integrated Electronics Systems as the SL Oncore ™. In this case a suitable micro-controller for implementing the security control is a Motorola M-COR E™ micro-controller.

Claims

1 . A moveable appliance including a location sensor, and a security controller integrated with the appliance, the security controller being arranged to inhibit at least some of the functions of the appliance when the location of the appliance indicated by data from the location sensor is not an authorised location.

2. A moveable appliance according to claim 1 , further comprising a communications interface for communicating data via a communications network with a remote operations centre, in use a permission code being transmitted from the remote operations centre to the appliance depending on the location reported by the location sensor and the security controller enabling functions of the appliance in response to the said security permission code.

3. A moveable appliance according to claim 1 or 2, in which the location sensor is responsive to signals transmitted by a cellular mobile communications network.

4. A moveable appliance according to claim 1 or 2, in which the location sensor is responsive to signals transmitted by a satellite positioning system.

5. A moveable appliance according to any one of the preceding claims, in which the appliance is a computer and the security controller is arranged at least to inhibit access to data stored in the computer when the location is not an authorised location.

6 A method of operating a moveable appliance including detecting with a location sensor integrated with the appliance the location of the appliance and, with a security controller integrated with the appliance, inhibiting at least some of the functions of the appliance when the location of the appliance indicated by data from the location sensor is not an authorised location.

7. A method according to claim 6, including communicating data from the location sensor to a centre remote from the appliance, determining from the said data and from a record of one or more authorised locations stored at the centre whether the appliance is in an authorised location, and returning to the security controller in the appliance a signal depending on the result of the determination.

8. A method according to claim 7, in which the signal returned to the security controller when the location is an authorised location is a permission code and the security controller is programmed to enable functions of the apparatus in response to the permission code.

9. A method according to claim 6, including determining when the apparatus is in an authorised location by comparing location data from the sensor with a record of at least one authorised location stored in the apparatus.

10. A method according to any one of claims 6 to 9, in which the moveable appliance is a computer and in which the security controller inhibits access to at least some of the data stored on the computer when the computer is determined to be away from an authorised location.