WO2004090828A1

WO2004090828A1 - Remote protection system

Info

Publication number: WO2004090828A1
Application number: PCT/GB2004/001539
Authority: WO
Inventors: Carl Bedford; Matthew James White
Original assignee: Farnway Limited
Priority date: 2003-04-08
Filing date: 2004-04-04
Publication date: 2004-10-21

Abstract

A remote protection system comprises a transmitter adapted to signal to a receiver, a receiver (1) adapted to receive a signal from a said transmitter and to control electrical equipment (6) coupled thereto, the receiver being responsive to a said signal to disable said electrical equipment.

Description

EMOTE PROTECTION SYSTEM

Field of the Invention

The present invention concerns systems, methods and apparatus for protecting equipment remotely. More particularly, the invention permits control of access to stored data in microprocessor-controlled apparatus by the use of a remote active tag. In one embodiment the complete disablement or even destruction of sensitive equipment can be achieved in certain circumstances. Background to the Invention

Various attempts have been made in the past to protect equipment, such as elec- trical, electronic, communications and the like equipment. Password protection is commonly used to prevent or at least hinder access to computer equipment, for example. Physical protection against theft can take many forms, including locks, barriers, concealment and so on. These tend to be local "solutions" to the problem but it is not always convenient or satisfactory to rely solely on such local solutions. Remote control of equipment or devices is extremely common nowadays, from domestic audio-visual equipment (televisions, hi-fi, VCRs etc) to some domestic appliances. Systems are also known in which domestic appliances can be remotely controlled by superimposing signals on the power circuits that supply power to those appliances. There have also been proposed specialist systems that enable remote operation of do- mestic appliances, lighting, curtains and so on by use of the telephone network.

All of these systems tend only to control the operation of devices, apparatus or appliances so as to turn them on or off or perhaps to adjust operating parameters, such as temperature, in the case of refrigerators and freezers, say.

So far, there have been few, if any, attempts to disable equipment completely from a remote location. The present application provides a solution. Summary of the Invention

In accordance with the present invention, a remote protection system comprises a transmitter adapted to signal to a receiver, a receiver adapted to receive a signal from a said transmitter and to control electrical equipment coupled thereto, the receiver being responsive to a said signal to maintain operability of said electrical equipment, whereby in the absence of said signal the receiver inhibits operability of the equipment. The receiver is preferably arranged to inhibit operability of the equipment in response to absence of said signal for a predetermined period of time. For example, the transmitter may be arranged to transmit a said signal at predetermined time intervals and the receiver is then arranged to inhibit operability of the equipment in response to ab- sence of the said signal for a predetermined number of said time intervals.

The receiver may respond to a said signal to damage or destroy the equipment to prevent its unauthorised use.

Preferably, the receiver operates a switch coupling power to the equipment. The switch may have an "enable" position, in which power is supplied to the equipment, a "disable" position, in which power is disconnected from the equipment, and a "protect" position, in which a surge of power is supplied to the equipment to damage or destroy part of the equipment so as to prevent its unauthorised use.

In the "protect" position, the power supply is preferably diverted to a capacitor discharge circuit that produces a surge of electrical power to damage or destroy a crucial part of the equipment. Such crucial part may be, for example a computer hard drive, essential control circuitry for an item of electrical equipment or an appliance. Alternatively, or additionally, in the case of a magnetic recording device such as a computer hard drive, means may be provided for permanently erasing or overwriting data recorded on the hard drive. Thus, for example, the signal may initiated operation of a software program which will cause random data to be written to the hard drive repeatedly so as to overwrite, and render unrecoverable, the data recorded on the hard drive. The software program suitably contained in a separate BIOS device whose operation is initiated by the signal a predetermined time interval before any power surge is produced to damage or destroy other components of the device. It may, for example, be necessary to provide a delay of, say, five minutes for this purpose. The capacitor discharge circuit may include a transformer to step up the power supply voltage to a higher voltage suitable for causing a destructive surge.

It would also be possible to incorporate into equipment to be protected remotely- triggered release of destructive chemicals to render the equipment unusable and, in the case of data storage devices, to prevent retrieval of data after theft of the equipment. ln extreme cases, the protected equipment may be irreparably damaged so as to protect sensitive information held in the equipment, even though it would occasion a loss to the owner/provider of the equipment.

The protect mode may be activated in response to detection by an anti-tamper unit of an attempt to gain unauthorised access to the equipment, to reprogram or otherwise interfere with data held on the equipment or in other case of emergency.

In addition, if an attempt were made to screen the equipment from radio signals to prevent its being remotely deactivated or destroyed, the anti-tamper unit may be arranged to trigger deactivation or destruction in the absence of, for example, regular "re- assurance" radio signals.

Where an individual component such as a hard disk is being protected by the system of the invention, it is preferred to provide the system with a backup power supply separate from the main system power supply so that, in the event of the component being removed from the main system and its power supply, the system of the invention will still be able to operate.

The transmitter may communicate with the receiver via a public cellular telephone network, the receiver being assigned its own cellular telephone number which can be called from any cellular or land line. The disabling signal may be initiated by means of a code sent to the receiver by way of the transmitter's key pad, or by a voice command. For security purposes, the detection of a voice command may be arranged to recognise a particular voice. Alternatively, the receiver may be arranged to respond to a specific predetermined SMS text message sent from a cellular telephone, for example. Brief Description of the Drawings

The invention will be described with reference to the drawing, which illustrate ex- emplary embodiments of the invention, and in which:

Figure 1 shows a system diagram of the remote protection system according to one embodiment of the present invention;

Figure 2 is a system diagram for an alternative embodiment; and

Figure 3 is a diagram illustrating the different modules which may be included in a system according to an alternative embodiment of the invention. Detailed Description of the Illustrated Embodiment Figure 1 illustrates schematically the receiver part of the system. The receiver includes a telecommunications receiver circuit 1 to receive remote signals from the transmitter (not shown). The receiver 1 is connected to a control processor 2 having three outputs to control selectively, in accordance with the received signal, enable 3, disable 4 and protect 5 functions of the equipment 6 to be protected.

The blocks 3 and 4 may be simple switches that selectively permit power to pass to the equipment 6. In this manner, the equipment 6 may be operative or dormant, according to the state of the switches 3, 4. In the present example, the equipment 6 is a computer hard drive, in which case the power will be derived from the power supply block of a computer housing the hard drive. Where the equipment to be protected is mains powered, the switches may be mains rated and similarly turn the equipment on or off at will, in accordance with the signal sent from the transmitter.

Under certain conditions, for example when a threat is perceived, it may be desirable or necessary to prevent the equipment or information held on the equipment, in the case of a computer hard drive, falling into the hands of an unauthorised person. In those circumstances it may be desirable or necessary for the equipment to be damaged or even destroyed to prevent such unauthorised access. In such an eventuality, the transmitter sends a "protect" signal to the receiver 1. The receiver 1 detects this signal and activates the "protect" block 5. This block may consist of a capacitor discharge device that causes a surge of power to pass to the equipment 6 and thereby cause damage or even its destruction. The protect signal may be sent manually or automatically upon detection of an attempt to access the equipment without authority or in other case of emergency.

The power for the surge may be derived from the normal power supply to the equipment or may come from another source. The power surge is targeted at a crucial part of the equipment 6, such as its main power feed. In the case of a hard drive, this may simply cause the heads to crash onto the disk and damage its surface irreparably. More drastic measures can be taken, such as igniting a device to ensure total destruction of the hard drive. Although this obviously entails complete loss of data for the authorised user of the equipment as well as the unauthorised person attempting to access the equipment, it may be preferable, depending on the sensitivity and/or security level of the data held on the hard drive. Alternatively, in order to erase data permanently from the hard disk, so as to prevent it being read by an unauthorised person, without having to destroy the hard disk, a separate BIOS type of program may be incorporated into the computer which, in response to the remote signal, repeatedly overwrite the hard disk with random data to pre- vent recovery of the original data on the disk. Such programs are known, and typically require repeated writing to the disk a number of times to obliterate the underlying data completely. On completion of the overwriting operation, a power surge may be triggered, as hereinbefore described, so as to destroy or disable the computer.

In other circumstances, it may be sufficient if the protection system does no more than "blow" a fuse in the power supply to or within the equipment.

In order to heighten the level of security even further, there may be more than one control path for the power surge to reach the equipment to be protected. Any or all of these paths may be activated when the power surge is generated.

The power surge may also be initiated by an anti-tamper unit 7 that responds to an attempt by an unauthorised person to access the equipment 6. The unit 7 may also respond to an attempt by an unauthorised person to reprogram or otherwise interfere with the hard drive or other electronic control unit being protected.

Where the equipment is one of a number of items of equipment protected by the system, it will be necessary to allocate unique numbers to the receivers so that only the selected equipment needs to be damaged or destroyed by a signal from the transmitter.

There may be other circumstances where it may be necessary to damage or destroy every item of equipment under the control of the protection system in a particular network, in which case the receivers can be coded to respond to a "panic" signal transmitted from the transmitter. The invention thereof provides a system for ensuring that equipment being protected can be remotely enabled, disabled, damaged or destroyed upon detection of a signal sent from another location. This may be controlled by a user-definable series of events programmed to suit user requirements.

Referring now to Figure 2, the system comprises three basic parts: • A hard disk manager module (HDM) 20 permanently fixed to a hard disk drive 21 (hdd) inside a computer having a processor and related components on a motherboard 22. The HDM 20 has two connectors, one of which connects to the normal data cable from the motherboard and the other of which plugs into the connector on the hard disk drive. The HDM 20 contains a radio transmitter and receiver, control circuitry, and switching means selectively op- erable to interrupt the connection between the data cable (and hence the motherboard) and the hard drive. This may be achieved by switching all the lines forming the data connection, or simply those controlling the data connection. Typical hard disk drive interface types controlled would be SATA, IDE, SCSI, ATA-100, but it will be appreciated that the invention is not limited to any particular type of data connection/interface.

• A portable module 23 communicates with the hard disk manager module 20 by radio signals and is referred to herein as an Active Tag.

• Software residing on the PC controls the sleep mode of the PC. Once all of the component parts of the system have been installed onto the computer, the system is intended to prevent access to data on the hard disk drive by normal means.

Code hopping and frequency hopping can be utilised to ensure the integrity of the system and to prevent the radio signal between the Active Tag 23 and the HDM 20 being

"grabbed" and reproduced to enable the computer without the use of an authorised Ac- tive Tag. A seed number for each of the code and frequency algorithms is programmed in at source when the HDM and Active Tag is manufactured.

The maintenance/supervisor mode is programmed into a specially programmed Active Tag and is defined to a fixed set of HDM and Active Tag pairs.

The frequency of operation for the HDM and Active Tag is suitably one of the free usage frequency bands. This would typically centre (at least in the UK) on the 433.92MHz FM band. Other frequencies typically used (but not restricted to) would be 315MHz, 418MHz, 434MHz, 868MHz, 915MHz.

It is envisaged that the transmitter/ receiver would be of the SAW type. It is envisaged that FSK/ASK modulation would be used. Code hopping is based on the rolling code principle with a seed number which is integral and unique to each HDM and Active Tag pairing. Frequency hopping is based on the rolling code principle with a seed number (different to the code hopping seed) which is integral and unique to each HDM and Active Tag.

The maintenance mode and supervisor modes require a password on the com- puter as an additional safeguard to the supervisor Active Tag.

The HDM is to be plugged into the hard disk drive connector and is then fixed in place by gluing or other permanent means. It will be appreciated that, while reference is made herein to "hard disk drives" and the like, this aspect of the invention is not limited to disk drives; it can be applied to solid-state data storage devices of any kind, for exam- pie.

The function of the HDM is to allow, in a controlled and user-definable manner, the access to data on the hard disk drive by the computer.

To achieve this control, the HDM has three modes of operation: o Intercept, where the computer requires access to the hard drive but the secu- rity measures are active. The HDM does not allow data to be read from the hard disk drive. • Monitor, where the computer is allowed full access to the hard disk drive but the system monitors any breach of system integrity through tamper etc or loss/ change of the signal from a valid Active Tag. • Maintenance, where the computer can be disassembled in a safe manner.

The mode of operation of the HDM is controlled by the Active Tag. The HDM has a built in RF transmitter and receiver by which means it can communicate to the Active Tag. The HDM sends a signal out to the Active Tag, which responds and sends a valid signal back to the HDM. The signal from the HDM would typically be sent every one second, although the precise interval will not be critical to the operation of the device.

Typically, if the Active Tag did not send a response back to the HDM for five consecutive transmission periods, the HDM would begin the process to shut down the hard disk drive and send the computer into sleep mode. Once the process to send the system to sleep has been started, the process must be completed. This or any other system cannot now access the hard disk drive. To wake the computer out of sleep mode, the Active Tag must be brought back within range of the computer.

Typically, once the HDM has recognised five consecutive responses from the Active Tag the hard disk drive unit is enabled and a password must be entered onto the computer to allow a controlled wake up condition. The system is now active and the user can operate the computer as normal.

In some circumstances, it may not be ideal to initially shut down the hard disk drive. Software may be provided to customise a user-definable sequence of events which may simply start with locking the keyboard or cursor on the screen. It may then be desir- able to freeze the screen. By using this sequence, the computer could still be enabled to keep running if for example it is downloading information. Timings between actions in the sequence of events could also be user definable. The sequence of events may be determined by the level of security, e.g. Military systems may require total shut down a lot quicker than most, and possibly destruction. Depending on the level of security required, the system may require more than one transmitted signal to allow access. In the case of higher confidential information residing in the protected system, or where limited access is required to run specific programmes, multiple tags may be required to access different levels.

The or each Active Tag has a built in RF transmitter and receiver by which means it can communicate to the HDM. The Active Tag is used as a means of controlling the mode of the HDM. The unit is rechargeable and in the preferred embodiment recharged by utilising the USB port on the PC. Other means of maintaining the charge on the unit may be provisioned. Typically, the Active Tag is to have a transmitting range of two metres. It is not desirable for the active tag to remain in the USB port for too long or after it has been fully charged. When the Active Tag is fully charged, an on-screen message can be displayed to advise the user that it should be removed from the computer. When the Active Tag is at a preset discharge limit, it will send a signal to the HDM to tell the user it needs charging. Software on the PC is required to take the operating system in and out of sleep mode in a graceful manner, such that it does not crash. The software performs a monitor function, so that the system can maintain integrity.

Also, an optional software programme may be made available to automatically create a log of the usage/ attempted access to the protected system.

Figure 3 illustrates a computer protection system arranged to prevent unauthorised access to data by automatically or remotely destroying functionality of the computer or damaging the connection to the hard disk drive to prevent access tcthe data stored thereon, for example where the computer is used to store especially sensitive data. The key fob or active tag can be used to send a signal to the system to disable it or set it to protect the computer. In addition, attempts to start the computer without the correct password can activate the protection system, or the pressing of a panic key on the system. In the illustrated embodiment, module 1 is arranged to destroy diodes and the IDE bus on the computer motherboard by applying an excessive voltage surge to them as hereinbefore described. Module 2 can receive a signal from Module 1 to cause it to permanently overwrite all data on the hard drive - a fairly time-consuming procedure - or only sensitive data, which can be quicker.

Modules 3, 4 and 5 relate to alternative mechanisms for remotely controlling the operation of Module 1 remotely using, respectively, a GSM receiver permitting one-way control, a GSM transmitter and receiver, permitting two-way remote control, and adding a GPS tracking unit to the previous configuration to permit remote control in conjunction with tracking of the location of the protected computer.

Claims

1. A remote protection system, comprising a transmitter adapted to signal to a receiver, a receiver adapted to receive a signal from a said transmitter and to control electrical equipment coupled thereto, the receiver being responsive to a said signal to maintain operability of said electrical equipment, whereby in the absence of said signal the receiver inhibits operability of the equipment.

2. A remote protection system according to Claim 1 , wherein the receiver is arranged to inhibit operability of the equipment in response to absence of said signal for a predetermined period of time.

3. A remote protection system according to Claim 2, wherein the transmitter is arranged to transmit a said signal at predetermined time intervals and the receiver is arranged to inhibit operability of the equipment in response to absence of the said signal for a predetermined number of said time intervals.

4. A remote protection system according to Claim 2, wherein the receiver is arranged to transmit a trigger signal at predetermined time intervals and the transmitter is arranged to transmit a said signal in response to receipt of the trigger signal, and wherein the receiver is arranged to inhibit operability of the equipment in response to absence of the said signal for a predetermined number of said time intervals.

5. A remote protection system according to any preceding claim, wherein the receiver is adapted to respond to a said signal to damage or destroy the electrical equipment to prevent its unauthorised use.

6. A remote protection system according to any of Claims 1 to 4, wherein the receiver is adapted to operate a switch coupling power to the electrical equipment.

7. A remote protection system according to Claim 6, wherein the switch has an "enable" position, in which power is supplied to the equipment, a "disable" position, in which power is disconnected from the equipment, and a "protect" position, in which a surge of power is supplied to the equipment to damage or destroy part of the equipment so as to prevent its unauthorised use.

8. A remote protection system according to Claim 7, wherein in the "pro- tect" position, the power supply is diverted to a capacitor discharge circuit that produces a surge of electrical power to damage or destroy a part of the equipment.

9. A remote protection system according to any preceding claim, wherein the electrical equipment comprises a data storage means, and the receiver is arranged to control access to data in the data storage means.

10. A remote protection system according to Claim 8, wherein said part is an essential control circuitry for an item of electrical equipment.

1 1. A remote protection system according to Claim 1 , wherein said equipment is an electrical appliance.

12. A remote protection system according to any preceding claim, further adapted to be activated in response to detection by an ant-tamper unit of an attempt to gain unauthorised access to the equipment.

1 3. A remote protection system according to Claim 9, further adapted to be activated in response to detection by an ant-tamper unit of an attempt to reprogram or otherwise interfere with data held in the data storage means.

14. A remote protection system has claimed in Claim 9 or 1 3, comprising means responsive to said signal to repeatedly write random data to the data storage means in order prevent subsequent recovery of any data previously recorded in said data storage means.

1 5. A remote protection system according to Claim 1 , wherein said equipment comprises a network of individual items of equipment, each said individual item adapted to respond to a unique code signalled by the transmitter.

16. A remote protection system as claimed in Claim 1 5, wherein said individual items are further adapted to respond to a panic signal in common with all other said items in the network.