Reliable reporting of location data

[0001] This application is a continuation in part of co-pending application Ser. No. 11/322,683, filed on Dec. 30, 2005, entitled “Method And System For Providing Security And Reliability To Collaborative Applications.”

[0002] The invention generally relates to network based telephony applications such as the Voice over Internet Protocol (VoIP), and more particularly to providing a secure environment in which a location provider component can determine location data and securely hand it off to a telephony component without risk of tampering with the location data by other components of the environment.

[0003] With a traditional plain old telephone system (POTS), e.g., a wire line based telephone system, it was relatively easy to identify the location of a telephone engaging in a telephone call. A “911” service was created to allow simplified access to emergency services, where simply calling the number would route the caller to the geographically nearest emergency response center and provide the emergency response center with the name and address associated with the calling telephone.

[0004] With the advent of mobile telephony, such as cellular telephones, and network based telephony, such as VoIP through wired and wireless networks, area codes and telephone numbers are no longer bound to a particular physical location. The phrases “mobile telephony” and “mobile telephone” will be used to refer to telephony equipment, e.g., phones, computers, etc., not having a fixed location or address, including wireless equipment and equipment communicating over a wired network. Thus, when using mobile telephones, it is difficult to properly identify the source of a telephone call. For example, a wired based approach to identifying a cellular telephone based call may identify the source, e.g., physical location, of the land line used by the cellular telephone company to carry a cellular phone's call, and not the location of the cell phone itself. While some techniques have been created for locating the cellular phone with respect to the towers through with which it is communicating, e.g., triangulation techniques, for a VoIP telephone call, there is not even that option for trying to locate the physical location of a VoIP telephone.

[0005] Thus, with mobile telephony, when an emergency call is made to 911, the call will likely be routed to an incorrect emergency response center. Unfortunately, the error may not be minor, instead the call might be connected to a response center hundreds of miles away depending on how the telephone system identified the mobile telephone. In May 2005, however, the Federal Communications Commission (FCC) mandated that VoIP telephone companies provide an Enhanced 911 (E911) service that will provide a mobile telephone's identification and address information to a customer's local emergency response service. Unfortunately, to do so, telephony providers have statically assigned a customer's location information to their mobile telephones. This has a significant drawback because, as indicated above, the phones are mobile and thus may be calling from a location different from what was initially associated with the telephone.

[0011] FIG. 1 illustrates a high-level data flow 100 according to one embodiment for a platform having securely communicating domains to prevent tampering with data generated in one domain of the platform by another domain of the platform. In various embodiments, domains may be implemented in combinations of virtual machines (VMs) utilizing secure communication channels to allow data transfers between domains without risk of tampering or corruption of, for example, data created in one domain by rogue hardware or software somewhere else within the platform.

[0012] As will be appreciated by one skilled in the art, VMs provide isolation between domains, allowing each domain to have as desired its own independent operating system, and also provide consolidation of domains that would have run on separate devices because the domains and their various application and operating system combinations may now run on a single platform. A monitoring component such as a Virtual Machine Manager (VMM) or Hypervisor (see FIG. 2 item 204 discussion below) is assumed to manage domain operation within the Virtual Machines (VMs), as one of ordinary skill in the relevant art would appreciate based at least on the teachings provided herein.

[0013] As illustrated, a user activates 102 a user application program such as a VoIP application program identified, for example, in a graphical user interface (GUI) of the platform. This triggers execution 104 of a VoIP application program within a service provider domain maintained by the service provider. As part of executing the application program, the VoIP application program communicates with a Trusted Location Services Domain (TLSD) (see FIG. 2 item 208), a domain managed by a platform administrator. The TLSD, as will be discussed in more detail below, mediates 106 requests between different domains for location data or other data available by domains of the platform. In this description and claims that follow, the phrase “domain mediator” is intended to represent operation of a TLSD or equivalent, and the phrase “location data” is intended to represent data to facilitate identifying where a particular event, such as placing a telephone call, is occurring. Typically location data would include a geographic reference such as by way of coordinates, but it will be appreciated location data may also or instead include data for identifying the source of a call, such as an identifier for a user placing a call, identifiers for switches or network routers/hubs through which a call is being placed, etc. If 108 the VoIP application wants to obtain current location information for the platform so that it may, for example, provide it along with a telephone call as caller-ID data, the VoIP application contacts 110 the TLSD seeking mediated access to a Trusted Location Provider, e.g., a component of the platform that has hardware or other access to hardware that can determine a current location for the platform.

[0014] The TLSD 112 compares the request for location data to rules or policies associated with the TLSD to determine if 114 the VoIP application is authorized to receive the data. If so, the TLSD checks 116 whether a rule or policy requires the location data to be modified before presenting to the VoIP application, such as to make the location data less specific, or to change it in some other way. For example, location data may be changed depending on where the VoIP application seeks to call, from where the call is being made, when the call is being made, etc. If 116 no alteration rule or policy applies, the location data is securely presented 118 to the VoIP application over a secure communication channel. The VoIP application may in turn use the data as needed. If 118 an alteration rule or policy applies, the location data is modified 122 accordingly before it is presented 118 to the VoIP application for its use.

[0015] FIG. 2 illustrates a system 200 according to one embodiment that may be used in lieu of assigning static location information to mobile telephony devices. In the illustrated embodiment, current location information may be provided with respect to release policies or rules of a user utilizing a telephony device, e.g., restrictions on dissemination of information, granularity of information, etc., as well as with respect to policies or rules of a service provider managing the user's platform; indication of data reliability or security of information provided may also be provided with location data.

[0016] To ensure reliability in provided location, in the illustrated embodiment, it is assumed a telephony enabled device has a “trusted platform,” meaning it has trusted platform hardware 202, 204 based security support, such as a platform using Intel's LaGrande Technology™ (LT) and Vanderpool Technology (VT). As understood by one skilled in the art, LT is part of a versatile set of client hardware enhancements to Intel processors, chipsets, and platforms that help protect the confidentiality and integrity of data stored or created on the client. LT describes a system architecture overlaying and extending virtual machine technology by permitting verifiably secure installation, launch and use of a secured Virtual Machine Monitor (VMM) or Hypervisor 204. As understood by one skilled in the art, VT manages virtual machines launched within the platform 212 and enables a system to simultaneously run different programs or operating systems by machine multiplexing multiple virtual resources onto a single physical resource.

[0017] The Hypervisor 204 manages all hardware structures such as the MMU, I/O devices, DMA controllers, etc., to ensure applications or operating systems, when running, have a consistent virtual view of underlying hardware. Thus, LT and VT provide a hardware foundation protecting information from attacks without compromising usability by enabling protected execution, protected input/output (I/O), and sealed storage, which is a combination of measurements and encryption where sealed data is only available (unsealed) when an indicated measurement is present on a Trusted Platform Module (TPM) (see item 206 discussion below). In one embodiment, a “Dom0” special privileged domain (not illustrated) is communicatively coupled with the Hypervisor and provides support for device virtualization and may provide virtual device models to guest domains, including the Service Provider 218 and User Application 220 Domains. It will be appreciated by one skilled in the art Dom0 is a special virtual machine that serves to manage other virtual machines (e.g., create, destroy, migrate, save, restore, etc.) and assign of I/O devices to virtual machines.

[0018] For more information on LT and VT, see the LaGrande Technology Architectural Overview available at Internet Uniform Resource Locator (URL) ftp:// download#intel# com/technology/security/downloads/LT_Arch_Overview#pdf. See also, for example, the Intel Vanderpool Technology for IA-32 Processors (VT-x) Preliminary Specification at http://cache-www#intel#com/cd/00/00/29/76/297666_—297666#pdf. (Note, to prevent inadvertent hyperlinks in the preceding URLs, spaces were added and periods replaced with hash marks.) It is assumed the reader is familiar with these technologies. It should be appreciated that LT and VT are provided for exemplary purposes only and other technology may be utilized to implement the principles discussed herein. However, with LT and VT type technology available the trusted nature of the system 200 allows a recipient of location data or other data from the system to assume the data is secure, e.g., it has not been tampered with.

[0019] In the illustrated embodiment, the illustrated trusted platform hardware 202 contains a Trusted Platform Module (TPM) 206 in addition to other components such as processors, chipsets, etc. As will be appreciated by one skilled in the art, the TPM is a hardware component designed to enhance platform security by providing a protected space for cryptographic keys and key operations and other security critical tasks. The provides various security related hardware and functions, such as a random number generator for encryption algorithms, storage for cryptographic data and keys (so that keys may securely be stored as plain text), etc. In the illustrated embodiment, the TPM is used to securely sign location data as it leaves the trusted platform hardware so that other hardware or software may be assured received data is secure.

[0020] With underlying LT and VT security (or equivalent) and TPM support, we can now introduce the concept of a Trusted Location Service Domain (TLSD) 208. The TLSD mediates requests between hardware and software for location data or other data by coordinating secure data transfer 226 between, for example, Voice over Internet Protocol (VoIP) software and a Trusted Location Provider (TLP) 210 discussed below. As will be discussed, when application software or other hardware requests location information from the TLSD, such as would occur for an outgoing E911 VoIP telephone call, the TLSD obtains a current location from the TLP and bundles it with the outgoing call request. See for example the Session Initiation Protocol Location Conveyance draft-ieff-sip-location-conveyance-02.txt document dated Jul. 27th, 2005, which can be obtained at URL http://tools#ietf#org/id/draft-ieff-sip-location-conveyance-02#txt which explains one exemplary technique for using Session Initiation Protocd (SIP) messages to convey location information along with a telephone call. The TLSD 208 is responsible securely storing location data in the platform 212 for use. The TLSD responds to requests from internal domains as well as external sources, such from external software or hardware communicatively coupled with the platform.

[0021] In the illustrated embodiment, the TLSD may have selected ones of a Policy Manager 214 or a Rules Manager 216 to control how location data may be distributed to requesting application software (see, e.g., the User Domain discussion below). For example, when an E911 telephone call is placed, a full-disclosure policy or rule may be defined so no hiding occurs since providing exact information is important in an emergency call. However, under other circumstances, another policy or rule may say that if a call is placed to a business toll-free telephone number, only restricted location data and/or caller identification (ID) data (such as just an areas code or prefix) is provided to the called company without there being an exception rule to allow more data to pass. Rules may define when and/or from where location data may be provided, or to require certain characteristics of a recipient, such as a verifiable security policy associated with the business to show it will not abuse data received from the platform.

[0022] The TLSD 208 will interact with several other components of the platform 212 as discussed below, each component is referenced to as a Domain since each may be accessed independently of one another, and as discussed in FIG. 1, each may operate in a protected VM space within a LT, VT, TPM type of framework (or equivalent) discussed above. In the illustrated embodiment, the platform 212 has a Trusted Location Provider (TLP) 210. If the system is applied to solving the E911 problem discussed above, then having reliable location data is needed. The TLP is a hardware or software entity that provides location information to other portions of the platform or (not illustrated) to external requesters. It will be appreciated there are many different location technology options available today, such as using systems intended for position determination use like the Global Positioning System (GPS) which determines location based on satellite signals, or the Long Range Navigation (LORAN) system which determines location based on time displacement of radio signals from multiple known transmitters; location may also be determined based on systems not designed for providing location data, such as by triangulating a position based on one or more of: wired or wireless network access points, cellular tower triangulation, self-identifying sources, e.g., ones whose communication include their location, or communication with devices having discernable locations such as by way of correlation with a service map.

[0023] While the illustrated embodiment assumes the TLP 210 determines a location with hardware built-in to the platform 212, it will be appreciated an external third party location determination source (not illustrated) such as an external attached GPS device, may be used. However, reliability of location data depends on the reliability of the technique used to determine the location. Hence, while the trusted platform aspects of the platform 212, e.g., LT, VT, etc. may guarantee location data has not been altered, the data itself may not be reliable. Therefore, in some embodiments, depending on how the location data is determined, associated with the location data is a reliability factor indicating reliability of the utilized location technique. Thus, for example, GPS data would be deemed very reliable, while access point triangulation or an external GPS device would likely not. The reliability factor may also include a determination of probable risk of error in underlying data used to perform the location determination.

[0024] For example, time gaps between ability to obtain current location data becomes a factor in the deemed reliability of location data. In one embodiment, dead reckoning or other gap-filler techniques may be used to estimate gaps in location information. When a request for location data is received, immediately an attempt is made to get current location data from the TLP 210; however if the data is unavailable, estimated data may be provided (unless restricted by a policy or rule), but the reliability of the data will be indicted accordingly. Hence, if location data is requested and cannot be determined immediately, then last known location data can be adjusted based on gap filler techniques such as dead reckoning, and provided with a reliability factor based on how much gap filling has occurred since a good location was known.

[0025] In the illustrated embodiment, a Service Provider Domain (SPD) 218 provides a protected environment for service providers, such as telephony providers or other providers, to securely run platform services needing availability, security and easy deployment, the latter facilitated by the SPD being a separate domain within the platform 212. In a telephony device, the SPD is where a service provider would implement its VoIP application, and it is where the service provider may define its SIP services, network protocols, and other essential components needed to make the telephony communication work. And, due to the platform 202, 204 security features discussed above, the service provider need not worry that its domain may become corrupted through integration into a platform 212 having other active domains. According to some embodiments, Domains may communicate over a secure inter-Domain communication channel providing for encryption, parameter checking to ensure input values are valid, integrity checking to ensure requests received by the SPD are valid, and the like.

[0026] In the illustrated embodiment, to complement the SPD, a User Application Domain (UAD) 220 contains all user-level (or user-installable) applications and operating high-level operating systems (OS) or OS interfaces. The UAD offers a protected environment for Service Providers to run critical platform services that require availability, security, and easy deployment. However, the UAD, by virtue of being left to use by users, it is less controlled than the other Domains, and is more susceptible to attack by malicious code or through poorly configured interfaces. Since this is the domain that the user interacts with directly, user-level storage 222 may be used to store policies or rules (which may be applied along with TLSD policies or rules, see, e.g., items 214, 216) to control location dissemination or other data such as personal or sensitive information, as well as other data such as user preferences, graphical user interfaces, etc. For example, a user could specify a policy or rule that E911 call recipients or certain recipients such as family members receive location information that is accurate as possible, while all other recipients only receive regional geographic information or other information as desired by the user.

[0027] Also illustrated is a Data Recipient 224 which is an entity which receives secured data from the platform 212, such as location data derived by the Trusted Location Provider 210. As discussed above, in the exemplary context of an E911 telephone call, the Data Recipient would be a telephony call recipient that is provided the platform's 212 actual current location along with the call initiation data. As discussed above, this location data may also include an indication of the location data's reliability if data from the TLP 210 is not current, either due to inability of the TLP to get current data at the time of the call, or from some other issue resulting in stale location data. On receiving call initiation data, the Data Recipient strips off the location data from the call data and uses it as it deems appropriate, in accordance with the embodiments described herein.

[0028] In one embodiment, the platform 212 placing a telephone call may use cryptographic key exchange techniques, public key cryptography, or the like to establish a secure connection between the User Application Domain 220 telephony application, e.g., the VoIP or other software, and the Data Recipient 224. Once this secure connection is established, the telephony application may transfer a hash value or other authentication data to the Data Recipient so that the authenticity of the location data may be determined before the Data Recipient relies on the received data. It will be appreciated that voice data may also be securely transmitted through the secure connection of another such connection to minimize risk of eavesdropping.

[0029] FIG. 3 is a state diagram illustrating a call flow according to one embodiment for a call to an E911 service which requires passing the caller's current location (address, etc.) to the callee. As discussed above, while an E911 call is the primary example used herein to explain operation of the FIG. 2 platform 212, it will be appreciated that the data security techniques disclosed herein are applicable to transferring other data as well. As illustrated, the FIG. 2 the User Application Domain (UAD) 220, Service Provider Domain (SPD) 218, Trusted Location Services (Domain) (TLSD) 208, Trusted Location Provider (TLP) 210 and Data Recipient 224 may intercommunicate to determine a caller's current location when placing a call, and securely pass the location data to a telephony application in the User Application Domain for passage to the Data Recipient, e.g., the E911 callee.

[0030] It will be appreciated that the components of the platform 212 may perform other operations in addition to those illustrated. These are simply core operations to illustrate basic operational principles. Hence, a first operation is for a. user of the UAD to activate software, such as a VoIP telephony program, to place 302 an E911 call. Note that the platform 212 may be a computer system with a GUI in which the user engages a soft-phone application such as Skype™ (see, e.g., http://www#skype#com), or the platform may be integrated within a VoIP telephone adapter, e.g., a device that appears to be a conventional phone but to which is attached a network cable rather than a telephone line, where the VoIP telephone operates as a client of, for example, the Vonagem network (see, e.g., http://vonage#com). Thus, in the former example, placing a call may include clicking on a call button or equivalent in a GUI, and where in the latter example, placing the call may include picking up the telephone receiver and dialing 911 as one would do with a conventional telephone.

[0031] After trying to place the call, in some embodiments, the UAD and/or user thereof may have local policies or rules controlling call placement, e.g., restrictions based on time of day, user identity, call pricing, call destination, etc., or controlling data modification to automatically remove personally identifying information to preserve privacy except under certain circumstances, such as placing an emergency call that needs to know your current location. In the illustrated embodiment, assuming checking 304 local policies or rules indicates the callee can receive the caller's location data, the outgoing call request is routed 306 to the SPD with a request that location data be bundled with the call 302.

[0032] The Seamless Provider Domain then requests 308 the platform's current location information from the Trusted Location Services (Domain) 208. As discussed above with respect to FIG. 1, in some embodiments the TLSD mediates requests from Domains for information and manages secure data transfers between the various Domains. In the illustrated embodiment, the TLSD submits 310 a request to the Trusted Location Provider (TLP) for current location information. In one embodiment, the TLP determines a current location data and returns 312 it as a “location bundle” of data including the location data, e.g., geographic coordinates or other position representation data, along with other data to prevent data manipulation such as a replay attack.

[0033] This other data may include timestamps, an expiration time for the timestamp, nonces (a one time use unique number that can be derived in part from the location data to make the bundle collectively unique), an identifier of the TLP, and other information to prevent data attacks. In one embodiment, the bundle from the TLP may also include reliability data to provide an indication as to how reliable the TLP believes the location data is. As discussed above, various events or certain sources for location data may suggest the location data is unreliable to some extent. It will be appreciated that a scale used for reliability is arbitrary, e.g., it could simply be on a scale of 1 to 100 where 1 is worst and 100 is deemed entirely reliable. The bundle may be signed by the TLP, e.g., with the FIG. 2 TPM 206, with credentials associated with the TLP.

[0034] When the TLSD receives the location bundle from the TLP; it may validate the location bundle if desired to ensure there was no tampering with the data since it was sent by the TLP. The TLSD in turn provides 314 the location bundle to the Service Provider Domain. In the illustrated embodiment, the TLSD modifies the location bundle to include an identifier for the platform 212, and signs the location bundle with the TPM using platform credentials that enable a data recipient, such as a callee 224, to associate the location data provided by the TLP with this particular platform 212.

[0035] After the Service Provider Domain receives 314 the location bundle signed by the TLSD, it deconstructs the location bundle to pull out, for example, the location data provided by the TLP and the platform ID determined by the TLSD. The SPD then initiates the requested 306 call and re-bundles the location data, platform ID with the call invite sent 316 to the Date Recipient. For the purposes of this illustrated embodiment, the SPD utilizes the Jul. 27th, 2005 Session Initiation Protocol Location Conveyance IETF draft extension to the SIP for conveying location information to the Data Recipient, e.g., the callee. Based on the embodiments described herein, one of ordinary skill in the relevant art(s) would appreciate how other extensions may be used to convey location/source information.

[0036] When the Data Recipient receives the bundle from the SPD, the Data Recipient checks the validity of the TPM signature on the data bundle, and checks the location coordinates by verifying they were signed by credentials associated with the TLP. Assuming the cryptographic review indicates there was no tampering with the data determined by the TLP when the call was initiated 302, the Data Recipient can rely on the data being accurate and, with knowledge of the caller's current location, accept/establish 318 the call 306 from the Service Provider Domain's telephony application.

[0037] FIG. 4 and the following discussion are intended to provide a brief, general description of a suitable environment in which certain aspects of the illustrated invention may be implemented. As used herein below, the term “machine” is intended to broadly encompass a single machine, or a system of communicatively coupled machines or devices operating together. Exemplary machines include computing devices such as personal computers, workstations, servers, portable computers, handheld devices, e.g., Personal Digital Assistant (PDA), telephone, tablets, etc., as well as transportation devices, such as private or public transportation, e.g., automobiles, trains, cabs, etc.

[0038] Typically, the environment includes a machine 400 that includes a system bus 402 to which is attached processors 404, a memory 406, e.g., random access memory (RAM), read-only memory (ROM), or other state preserving medium, storage devices 408, a video interface 410, and input/output interface ports 412. The machine may be controlled, at least in part, by input from conventional input devices, such as keyboards, mice, etc., as well as by directives received from another machine, interaction with a virtual reality (VR) environment, biometric feedback, or other input source or signal.

[0039] As discussed above with respect to FIG. 2, the machine may be configured to support Intel's LaGrande Technology™ (LT) and Vanderpool Technology (VT) and include a Trusted Platform Module (TPM). As appreciated by one skilled in the art, the TPM includes hardware and supporting software and firmware providing a platform root of trust with ability to extend trust to other platform components by building a chain of trust. The TPM can be viewed as a secure micro-controller with cryptographic functionalities allowing cryptographic functions to be executed within TPM hardware. Hardware and software outside of the TPM do not have access to the execution of cryptographic functions within the TPM hardware, and hence can only provide input/output for the TPM.

[0040] The machine may include embedded controllers, such as programmable or non-programmable logic devices or arrays, Application Specific Integrated Circuits, embedded computers, smart cards, and the like. The machine may utilize one or more connections to one or more remote machines 414, 416, such as through a network interface 418, modem 420, or other communicative coupling. Machines may be interconnected by way of a physical and/or logical network 422, such an intranet, the Internet, local area networks, and wide area networks. One skilled in the art will appreciated that communication with network 422 may utilize various wired and/or wireless short range or long range carriers and protocols, including radio frequency (RF), satellite, microwave, Institute of Electrical and Electronics Engineers (IEEE) 802.11, Bluetooth, optical, infrared, cable, laser, etc.

[0041] While some aspects of the machine may be implemented with dedicated hardware components, it will be appreciated the invention may be described by reference to or in conjunction with associated data such as functions, procedures, data structures, application programs, etc. which when accessed by one or more processors of the machine results in the machine performing tasks or defining abstract data types or low-level hardware contexts. Associated data may be stored in, for example, volatile and/or non-volatile memory 406, or in storage devices 408 and/or associated storage media, including conventional hard-drives, floppy-disks, optical storage, tapes, flash memory, memory sticks, digital video disks, etc., as well as more exotic mediums such as machine-accessible biological state preserving storage. The term ‘machine readable medium’ shall accordingly include, but not be limited to memory 406, storage devices 408 and a carrier wave that encodes a data signal.” Associated data may be used in a compressed or encrypted format, and may be delivered over transmission environments, including network 422, in the form of packets, serial data, parallel data, propagated signals, etc. and which may be stored in a tangible medium for access by the machine. Associated data may be used in a distributed environment, and stored locally and/or remotely for access by single or multi-processor machines. Associated data may be used by or in conjunction with embedded controllers; in the claims that follow, the terms “circuitry” or “logic” is intended to refer generally to possible combinations of associated data and/or embedded controllers.

[0042] Thus, for example, with respect to the illustrated embodiments, assuming machine 400 embodies the FIG. 2 platform 212, then remote machines 414, 416 may respectively be the FIG. 2 Trusted Location Provider 210, assuming the source for geographic data is external to the TLP (recall this may make the data less reliable), and the FIG. 2 telephony Data Recipient 224. It will be appreciated that remote machines 414, 416 may be configured like machine 400, and therefore include many or all of the elements discussed for machine.

[0043] Having described and illustrated the principles of the invention with reference to illustrated embodiments, it will be recognized that the illustrated embodiments can be modified in arrangement and detail without departing from such principles. And, though the foregoing discussion has focused on particular embodiments, other configurations are contemplated. In particular, even though expressions such as “in one embodiment,” “in another embodiment,” or the like are used herein, these phrases are meant to generally reference embodiment possibilities, and are not intended to limit the invention to particular embodiment configurations. As used herein, these terms may reference the same or different embodiments that are combinable into other embodiments.

[0044] Consequently, in view of the wide variety of permutations to the embodiments described herein, this detailed description is intended to be illustrative only, and should not be taken as limiting the scope of the invention. What is claimed as the invention, therefore, is all such modifications as may come within the scope and spirit of the following claims and equivalents thereto.