Multi-factor secure appliance decommissioning

Abstract

A network-based appliance includes a mechanism to erase data on the appliance's local storage. The appliance's normal system reset operation is overridden to enable a local user to place the appliance into a safe mode during which remote erasure of the storage is permitted, provided that mode is entered within a first time period following initiation of a system reset. If the appliance is placed in the mode within the time period, it can then receive commands to wipe the local storage. Once the safe mode is entered by detecting one or more actions of a local user, preferably the appliance data itself is wiped by another person or entity that is remote from the device. Thus, physical (local) presence to the appliance is necessary to place the device in the safe mode, while non-physical (remote) presence with respect to the appliance enables actual wiping of the storage device.

1 . A method to invoke a privileged operation within a network-connected appliance using a privileged command, comprising:
 responsive to detecting, during a first time period, of a local action on the appliance, initiating a second time period and transitioning the appliance into a state in which invocation of the privileged operation is allowed; and   responsive to detecting, prior to expiration of the second time period, of an authorized remote request, initiating the privileged command;   wherein the operations are carried out by software executing in a hardware element in the device.   
     
     
         2 . The method as described in  claim 1  wherein the privileged command is a wipe command to securely erase storage device in the network-connected appliance. 
     
     
         3 . The method as described in  claim 1  wherein the local action is receipt of a button press on the appliance. 
     
     
         4 . The method as described in  claim 1  wherein the first time period is initiated upon detecting a system reset command. 
     
     
         5 . The method as described in  claim 1  wherein detecting the authorized remote request includes:
 detecting remote entry of a key uniquely assigned to a hardware element in the device and 
 responsive to detection of the remote entry of the key, interrupting the second time period to allow initiating the privileged command. 
 
     
     
         6 . The method as described in  claim 5  further including:
 detecting remote entry of a code uniquely assigned to a software element in the device prior to interrupting the second time period. 
 
     
     
         7 . The method as described in  claim 6  wherein the privileged operation is initiated upon receipt of a privileged command following detecting of remote entry of the key and the code. 
     
     
         8 . The method as described in  claim 1  further including initiating a system reset upon expiration of the first time period or the second time period.