IP Library › Granted Patent US 11,157,635

Granted Patent B2

US 11,157,635 · App. 16/118,245 · Granted Oct 26, 2021

Secure interface disablement

Inventors: James Brehove (Vista, CA); Vijayalakshmi Raveendran (Del Mar, CA); Olav Haugan (San Diego, CA); Britton Kendall Bigelow (San Diego, CA); Kavita Paryani (San Diego, CA)

Assignee: QUALCOMM Incorporated

G06F21/604 G06F9/45558 G06F13/102 G06F2009/45579 G06F2009/45583

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,157,635
App. No.: 16/118,245
Granted: Oct 26, 2021
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Various embodiments include methods and devices for implementing secure peripheral interface disablement on a computing device. Various embodiments may include receiving a trigger to disable a peripheral interface associated with a peripheral device of the computing device, identifying a physical address of the peripheral interface, and securely removing a mapping of an intermediate physical address of the peripheral interface to the physical address of the peripheral interface.

Claims (122)

1. A method for secure peripheral interface disablement on a computing device to control use of the computing device, comprising:

receiving a wireless signal from a computing device management software configured to wirelessly signal to the computing device in response to the computing device being located in a proximity of the location,

wherein the wireless signal is configured to cause a trigger for disablement of a peripheral interface of a peripheral device on the computing device;

receiving the trigger to disable the peripheral interface in response to receiving the wireless signal, wherein the trigger is configured to indicate the peripheral interface to the computing device;

identifying a physical address of the peripheral interface;

removing a mapping of an intermediate physical address of the peripheral interface to the physical address of the peripheral interface from a stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface;

setting a state of the peripheral interface as locked by a secure execution environment;

storing the state of the peripheral interface at a secure location of the computing device; and

enabling the peripheral interface by adding the mapping in response to detecting a lack of the wireless signal when the state of the peripheral interface is locked.

2. The method of claim 1 , further comprising receiving a request to unmap the mapping of the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table,

wherein removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface comprises removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface and receiving the request to unmap.

3. The method of claim 1 , further comprising:

receiving a request to access the peripheral interface;

checking the stage 2 memory translation table for the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface;

determining that the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface is not found in the stage 2 memory translation table; and

issuing a memory exception in response to determining that the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface is not found in the stage 2 memory translation table.

4. The method of claim 1 , further comprising:

receiving a trigger to enable the peripheral interface associated with the peripheral device of the computing device;

receiving a request to map the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table; and

adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table in response to receiving the request to map.

5. The method of claim 4 , further comprising:

determining whether a state of the peripheral interface is locked,

wherein adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table comprises in response to determining that the state of the peripheral interface is locked:

adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table; and

setting a state of the peripheral interface to unlocked in response to determining that the state of the peripheral interface is locked.

6. The method of claim 1 , further comprising:

signaling to a high level operating system executing on a first virtual machine to shut down and unload a peripheral device driver of the peripheral device; and

executing a limited high level operating system on a second virtual machine excluding the peripheral device driver of the peripheral device.

7. The method of claim 1 , further comprising receiving, from a trusted execution environment that is different from an execution environment in which a high level operating system is executing, a request to unmap or to map the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table.

8. The method of claim 1 , further comprising accessing a peripheral device driver of the peripheral device executing in a trusted execution environment by a high level operating system executing in an execution environment via routing an access request to the peripheral device driver through the trusted execution environment.

9. The method of claim 1 , further comprising accessing a peripheral device driver of the peripheral device executing in a first virtual machine by a high level operating system executing on a second virtual machine via routing an access request to the peripheral device driver through the first virtual machine.

10. A computing device configured for control via secure peripheral interface disablement, the computing device comprising:

a memory; a peripheral device; a peripheral interface for communications with the peripheral device; and a processor communicatively connected to the memory and the peripheral interface and configured with processor-executable instructions to cause the processor to execute operations comprising:

wherein the wireless signal is configured to cause a trigger for disablement of the peripheral interface;

receiving the trigger to disable the peripheral interface in response to receiving the wireless signal, wherein the triggers is configured to indicate the peripheral interface to the computing device;

identifying a physical address of the peripheral interface;

setting a state of the peripheral interface as loved by a secure execution environment;

storing the state of the peripheral interface at a secure location of the computing device; and

enabling the peripheral interface by adding they mapping in response to detecting a lack of the wireless signal when the state of the peripheral interface is locked.

11. The computing device of claim 10 , wherein:

the processor is configured with processor-executable instructions to perform operations further comprising receiving a request to unmap the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table; and

the processor is configured with processor-executable instructions to perform operations such that removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface comprises removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface and receiving the request to unmap.

12. The computing device of claim 10 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving a request to access the peripheral interface;

checking the stage 2 memory translation table for the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface;

13. The computing device of claim 10 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving a trigger to enable the peripheral interface associated with the peripheral device of the computing device;

receiving a request to map the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table; and

14. The computing device of claim 13 , wherein:

the processor is configured with processor-executable instructions to perform operations further comprising:

determining whether a state of the peripheral interface is locked; and

setting the state of the peripheral interface to unlocked in response to determining that the state of the peripheral interface is locked; and

the processor is configured with processor-executable instructions to perform operations such that adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table comprises adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table in response to determining that the state of the peripheral interface is locked.

15. The computing device of claim 10 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

signaling to a high level operating system executing on a first virtual machine to shut down and unload a peripheral device driver of the peripheral device; and

executing a limited high level operating system on a second virtual machine excluding the peripheral device driver of the peripheral device.

16. The computing device of claim 10 , further comprising a trusted execution environment communicatively connected to the to the processor; and

wherein the processor is configured with processor-executable instructions to perform operations further comprising receiving, from the trusted execution environment that is different from an execution environment in which a high level operating system is executing, a request to unmap or to map the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table.

17. The computing device of claim 10 , further comprising:

a trusted execution environment communicatively connected to the to the processor; and

an execution environment communicatively connected to the to the processor,

wherein the processor is configured with processor-executable instructions to perform operations further comprising accessing a peripheral device driver of the peripheral device executing in the trusted execution environment by a high level operating system executing in the execution environment via routing an access request to the peripheral device driver through the trusted execution environment.

18. A computing device configured for control via secure peripheral interface disablement, the computing device, comprising:

means for receiving a wireless signal from a computing device management software configured to wirelessly signal to the computing device in response to the computing device being located in a proximity of the location,

wherein the wireless signal is configured to cause a trigger for disablement of a peripheral interface of a peripheral device on the computing device;

means for receiving the trigger to disable the peripheral interface in response to receiving the wireless a signal, wherein the trigger is configured to indicate the peripheral interface to the computing device;

means for identifying a physical address of the peripheral interface;

means for removing a mapping of an intermediate physical address of the peripheral interface to the physical address of the peripheral interface from a stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface;

means for setting a state of the peripheral interface as locked by a secure execution environment;

means for storing the state of the peripheral interface at a secure location of the computing device; and

a means for enabling the peripheral interface by adding the mapping in response to detecting a lack of the wireless signal when the state of the peripheral interface is locked.

19. The computing device of claim 18 , further comprising means for receiving a request to unmap the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table,

wherein means for removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface comprises means for removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface and receiving the request to unmap.

20. The computing device of claim 18 , further comprising:

means for receiving a request to access the peripheral interface;

means for checking the stage 2 memory translation table for the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface;

means for determining that the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface is not found in the stage 2 memory translation table; and

means for issuing a memory exception in response to determining that the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface is not found in the stage 2 memory translation table.

21. The computing device of claim 18 , further comprising:

means for receiving a trigger to enable the peripheral interface associated with the peripheral device of the computing device;

means for receiving a request to map the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table; and

means for adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table in response to receiving the request to map.

22. The computing device of claim 21 , further comprising:

means for determining whether a state of the peripheral interface is locked,

wherein means for adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table comprises means for adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table in response to determining that the state of the peripheral interface is locked; and

means for setting the state of the peripheral interface to unlocked in response to determining that the state of the peripheral interface is locked.

23. The computing device of claim 18 , further comprising:

means for signaling to a high level operating system executing on a first virtual machine to shut down and unload a peripheral device driver of the peripheral device; and

means for executing a limited high level operating system on a second virtual machine excluding the peripheral device driver of the peripheral device.

24. The computing device of claim 18 , further comprising means for receiving, from a trusted execution environment that is different from an execution environment in which a high level operating system is executing, a request to unmap or to map the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table.

25. The computing device of claim 18 , further comprising means for accessing a peripheral device driver of the peripheral device executing in a trusted execution environment by a high level operating system executing in an execution environment via routing an access request to the peripheral device driver through the trusted execution environment.

26. A non-transitory processor-readable storage medium having stored thereon processor-executable instructions configured to cause a processor of a computing device, configured for control via secure peripheral interface disablement, to perform operations comprising:

wherein the wireless signal is configured to cause a trigger for disablement of a peripheral interface of a peripheral device on the computing device;

receiving the trigger to disable a peripheral interface in response to receiving the wireless signal, wherein the trigger is configured to indicate the peripheral interface to the computing device;

identifying a physical address of the peripheral interface;

setting a state of the peripheral interface as locked by a secure execution environment;

storing the state of the peripheral interface at a secure location of the computing device; and

enabling the peripheral interface by adding the mapping in response to detecting a lack of the wireless signal when the state of the peripheral interface is locked.

27. The non-transitory processor-readable storage medium of claim 26 , wherein:

the stored processor-executable instructions are configured to cause the processor of the computing device to perform operations further comprising receiving a request to unmap the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table; and

the stored processor-executable instructions are configured to cause the processor of the computing device to perform operations such that removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface comprises removing the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface from the stage 2 memory translation table in response to receiving the trigger to disable the peripheral interface and receiving the request to unmap.

28. The non-transitory processor-readable storage medium of claim 26 , wherein the stored processor-executable instructions are configured to cause the processor of the computing device to perform operations further comprising:

receiving a request to access the peripheral interface;

checking the stage 2 memory translation table for the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface;

29. The non-transitory processor-readable storage medium of claim 26 , wherein the stored processor-executable instructions are configured to cause the processor of the computing device to perform operations further comprising:

receiving a trigger to enable the peripheral interface associated with the peripheral device of the computing device;

receiving a request to map the intermediate physical address of the peripheral interface and the physical address of the peripheral interface in the stage 2 memory translation table; and

30. The non-transitory processor-readable storage medium of claim 29 , wherein:

the stored processor-executable instructions are configured to cause the processor of the computing device to perform operations further comprising:

determining whether a state of the peripheral interface is locked; and

setting the state of the peripheral interface to unlocked in response to determining that the state of the peripheral interface is locked; and

the stored processor-executable instructions are configured to cause the processor of the computing device to perform operations such that adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table comprises adding the mapping of the intermediate physical address of the peripheral interface to the physical address of the peripheral interface in the stage 2 memory translation table in response to determining that the state of the peripheral interface is locked.

Assignments (1)

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 6, 2018

From: BREHOVE, JAMES; RAVEENDRAN, VIJAYALAKSHMI; HAUGAN, OLAV; BIGELOW, BRITTON KENDALL; PARYANI, KAVITA

To: QUALCOMM INCORPORATED

Reel/Frame 047690/0166 →

Continuity (2)

Provisional Application 62654473 · Apr 8, 2018

Related Publication 20190311141A1 · Oct 10, 2019