Method and Apparatus for Using USB Flash Devices and Other Portable Storage as a Means to Access Prepaid Computing
A form of removable memory, such as a universal serial bus (USB) flash device (UFD), may allow secure storage of and access to a time balance of a pay-per-use or subscription computing system. A computing device may establish a secure connection to a portable secure computing device to access a stored time balance or other device-enabling, exhaustible data. During operation, the device may deplete the balance. Upon reaching a threshold depletion of the balance, the user may add more data to continue device use. The device may include a processor and a secure memory including identification and subscription data. Further, the device may store configuration data that may be used by the computer to bind the device to a particular subscription service or internet service provider.
1 . A system for enabling a subscription-based computer comprising:
a removable metered computing device including a cryptographic unit and a secure memory storing a number of subscription metering units;
a security module residing on the computer in communication with the removable metered computing device, the security module including a computer-readable medium having computer executable instructions comprising:
a communication module for establishing a secure communication channel between the removable metered computing device and the security module;
a provisioning module for accessing, decrementing, and storing the number of subscription units during operation of the subscription-based computer;
an authentication module in communication with the cryptographic unit for verifying the secure communication channel; and
a processing module for enabling execution of at least one application by the computer if the secure communication channel is verified and the number of subscription units remains above a threshold.
2 . The system of claim 1 , wherein the secure communication channel comprises a dedicated path between the removable metered computing device and the security module.
3 . The system of claim 1 , wherein the secure communication channel comprises a hardware switched communication port between the removable metered computing device and the security module.
4 . The system of claim 3 , wherein the hardware switched communication port includes a computer-readable medium having computer executable instructions comprising:
a multiplexing module for securely communicating between the removable metered computing device and the security module over a selected one of a dedicated path and an operating system of the computer.
5 . The system of claim 1 , further comprising a watchdog timer module for measuring an amount of time to load the operating system and drivers of the computer.
6 . The system of claim 5 , further comprising a disabling module for restricting the execution of the at least one application if the amount of time measured by the watchdog timer module is above a threshold.
7 . The system of claim 1 , further comprising a binding module for limiting access of the computer to at least one internet service provider.
8 . The system of claim 1 , wherein the communication module further comprises a secure boot environment module for enumerating and connecting the secure communication channel between the removable metered computing device and the security module.
9 . The system of claim 1 , wherein, through the secure connection, the removable metered computing device communicates only with the security module.
10 . A method for enabling a subscription-based computer including a security module comprising:
connecting a removable metered computing device including a number of metered access units to the security module of the subscription-based computer;
securing the connection between the metered computing device and the security module;
determining if the number of metered access units is above a threshold;
restricting a function of the computer if the number of metered access units is below a threshold;
executing at least one application by the computer if the number of metered access units is above a threshold;
maintaining the secure connection between the metered computing device and the security module during execution of the at least one application; and
decrementing the number of metered access units during execution of the at least one application.
11 . The method of claim 10 , wherein the connection between the metered computing device and the security module comprises a dedicated path.
12 . The method of claim 10 , further comprising multiplexing the connection between one of a dedicated path and an operating system of the computer;
measuring an amount of time to load the operating system and drivers of the computer; and
restricting the execution of the at least one application if the amount of time measured is above a threshold.
13 . The method of claim 10 , wherein the removable metered computing device includes service provider configuration data.
14 . The method of claim 13 , further comprising identifying a service provider and provider access data from the service provider configuration data; and
binding the computer to the identified service provider using the provider access data.
15 . The method of claim 10 , further comprising enumerating and connecting a secure channel between the removable metered computing device and the security module through a secure boot environment stored at the security module.
16 . A system including a removable metered computing device in communication with a security module of a subscription-based computer, at least one of the removable metered computing device and the security module including a protected memory and a protected processor physically configured to execute computer executable code for:
establishing a secure connection between the removable metered computing device and the security module of the subscription-based computer;
communicating a number of metered access units from the removable metered computing device to the security module;
executing at least one application of the computer if the number of metered access units is above a threshold; and
restricting a function of the computer if the number of metered access units is below a threshold.
17 . The system of claim 16 , wherein the connection between the removable metered computing device and the security module comprises a dedicated path.
18 . The system of claim 16 , further comprising computer executable code for:
multiplexing the secure connection between one of a dedicated path and an operating system of the computer;
measuring an amount of time to load the operating system and drivers of the computer; and
restricting the execution of the at least one application if the amount of time measured is above a threshold.
19 . The system of claim 16 , wherein the removable metered computing device includes service provider configuration data.
20 . The system of claim 19 , further comprising computer executable code for:
identifying a service provider and provider access data from the service provider configuration data; and
binding the computer to the identified service provider using the provider access data.