DESC:TECHNICAL FIELD
[0001] The present invention relates to a provisioning system for a secure personal computer (SPC) and a method thereof. The invention, more particularly, relates to generally to provisioning system that provides a network infrastructure to boot the SPC over the network using a PXE protocol.
BACKGROUND
[0002] Currently, in order to conduct computer based tests or online examinations, third party vendors such as colleges, institutes and the like are employed. Most of the online examinations are hosted on general purpose computer systems that are vulnerable to hacking. With the help of advanced digital technologies, it has become easy for anyone to take control of a student’s or candidate’s computer and impersonate them from a remote location. The operating systems (OS) on the general purpose computer systems present at the examination venue cannot be utilized as it could be rigged with malware, remote desktop software, etc., and it could be a potential gateway to commit fraud.
[0003] The existing available technologies provide their own Preboot Execution Environment (PXE) solutions. These technologies require a standard set of server software components such as DHCP and TFTP. These server software components require trained staff to configure and operate them. In the existing mechanism, pre-configured server machines are carried to the venue. Further, these standard PXE software components are designed to deploy only standard OS systems. Since pre-configured servers are used, they introduce constraints like "no support for VLAN", "modifying venue's IP addressing", etc. Hence, such technologies are risky to use in view of security requirements.
[0004] In view of these above-defined problems wherein the online examinations are conducted on a non-trusted hardware, there is still a need for a technical solution that solves these problems and provide a method and a system that secures the personal computers (PCs) used by plurality of candidates which is the candidate terminal.

SUMMARY
[0005] This summary is provided to introduce concepts related to a provisioning system for a secure personal computer (SPC) and a method thereof. More specifically, the invention relates to a provisioning system that leverages PXE booting for secure personal computers for enabling organizations to efficiently deploy and manage computing devices while enforcing stringent security measures. By centralizing the provisioning process and automating security configuration, organizations can streamline operations and reduce the risk of security breaches. This summary is neither intended to identify essential features of the present invention nor is it intended for use in determining or limiting the scope of the present invention.
[0006] For example, various embodiments herein may include one or more provisioning systems for a secure personal computer (SPC) and a methods thereof. In one of the embodiments, the provisioning system providing a network infrastructure to boot a Secured Personal Computer (SPC) over an unsecured network is disclosed. The SPC has a custom Operating System (OS). The provisioning system includes a Master, a UI (User Interface) and a Node. The provisioning system automatically detects and configures a plurality of server components to provide a Preboot Execution Environment (PXE) protocol. Further, the provisioning system deploys the SPC on a plurality of candidate terminals based on the server components and on the PXE protocol. The candidate terminals are computer machines used by a plurality of candidates present in a venue for an online examination. The provisioning system further provides a custom web-browser with an exam engine based on proprietary handshakes. The exam engine includes plurality of exam server URLs. Further, the provisioning system blocks a plurality of common keystrokes that can take control of the candidate terminal by an end user and operates in a kiosk mode. The provisioning system further compartmentalizes each of a set of nodes running on a LAN segment such that no footprint is present on the candidate terminals after the online examination is concluded.
[0007] Further, in another embodiment of the present invention, the method for booting a Secured Personal Computer (SPC) over an unsecured network through a network infrastructure implemented by a provisioning system is disclosed. The SPC has a custom Operating System (OS). The provisioning system includes a Master, a UI (User Interface) and a Node. The method includes automatically detecting and configuring a plurality of server components to provide a Preboot Execution Environment (PXE) protocol. The method further includes deploying the SPC on a plurality of candidate terminals based on the server components and on the PXE protocol. The candidate terminals are computer machines used by a plurality of candidates present in a venue for an online examination. The method further includes providing a custom web-browser with an exam engine based on proprietary handshakes. The exam engine includes plurality of exam server URLs. The method further includes blocking a plurality of common keystrokes that can take control of the candidate terminal by an end user and operating in a kiosk mode. The method further includes compartmentalizing each of a set of nodes running on a LAN segment such that no footprint is present on the candidate terminals after the online examination is concluded.

BRIEF DESCRIPTION OF ACCOMPANYING DRAWINGS
[0008] The detailed description is described with reference to the accompanying figures. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. The same numbers are used throughout the drawings to reference like features and modules.
[0009] Figure 1 illustrates a block diagram representing a provisioning system for a secure PC on a simple single broadcast domain network, according to an exemplary implementation of the present invention.
[0010] Figure 2 illustrates a block diagram representing a provisioning system for a secure PC on a VLAN network, according to an exemplary implementation of the present invention.
[0011] Figure 3 illustrates a block diagram representing a provisioning system for a secure PC on a routed network, according to an exemplary implementation of the present invention.
[0012] Figure 4 illustrates a block diagram representing a provisioning system for a secure PC on a simple daisy chained network, according to an exemplary implementation of the present invention.
[0013] Figure 5 illustrates a block diagram representing a provisioning system for a secure PC on a large single broadcast domain network, according to an exemplary implementation of the present invention.
[0014] Figure 6 illustrates a block diagram representing a provisioning system for a secure PC on a daisy chained single broadcast domain network, according to an exemplary implementation of the present invention.
[0015] Figure 7 is a flow chart illustrating a method for booting a Secured Personal Computer (SPC) over an unsecured network through a network infrastructure implemented by a provisioning system, according to an exemplary implementation of the present invention.
[0016] Figure 8 is a flow chart illustrating the setup of the SPS Node, according to an exemplary implementation of the present invention.
[0017] It should be appreciated by those skilled in the art that any block diagrams herein represent conceptual views of illustrative apparatuses embodying the principles of the present invention. Similarly, it will be appreciated that any flow charts, flow diagrams, and the like represent various processes which may be substantially represented in computer readable medium and so executed by a computer or processor, whether or not such computer or processor is explicitly shown.
DETAILED DESCRIPTION
[0018] The various embodiments of the present invention provides about a provisioning system for a secure personal computer (SPC) and a method thereof. The provisioning system more particularly provides a network infrastructure to boot the SPC over the network using a PXE protocol. SPC is a custom-built OS capable of running from memory without leaving any footprint on the target PC. This custom-built OS provides an easy way of deploying it on the computer hardware used at the examination venue. Also, the SPS provides the mechanism for delivery on various types of hardware. The provisioning system is also referred to as SPS in the below description wherein SPS stands for SPC Provisioning System.
[0019] In the following description, for purpose of explanation, specific details are set forth in order to provide an understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without these details. One skilled in the art will recognize that embodiments of the present invention, some of which are described below, may be incorporated into a number of systems.
[0020] However, the methods and systems are not limited to the specific embodiments described herein. Further, structures and devices shown in the figures are illustrative of exemplary embodiments of the present invention and are meant to avoid obscuring of the present invention.
[0021] Furthermore, connections between components and/or modules within the figures are not intended to be limited to direct connections. Rather, these components and modules may be modified, re-formatted or otherwise changed by intermediary components and modules.
[0022] The objective of the present invention is to conduct a computer based test or online examination using hardware components and a customized OS in any untrusted and alien network.
[0023] In an embodiment of the present invention, a provisioning system for a secure personal computer (SPC) and a method thereof is disclosed. The provisioning system includes a Master (104), a UI (User Interface) (102) and a Node (106, 108). This system is deployed using a lab infrastructure (Lab1, Lab2, Lab3, Lab4) in a number of venues to conduct the online examination. This provisioning system for a secure PC uses standard PXE protocol to deploy the SPC on the candidate terminals, wherein the candidate terminals are computer machines used by the candidates present in the venue for the online examination. In order to enforce strict security on the candidate terminals, the custom Operating System i.e., the SPC blocks a plurality of common keystrokes that take control of the candidate terminal by the end user and runs in a kiosk mode. Further, there is a custom web-browser provided by the SPC. This custom web-browser ties tightly with an exam-engine using proprietary handshakes. The exam-engine is executed on another discrete server. The custom OS runs entirely from the memory, using the local disk only for caching, if available. Hence, there is no dependency on the host OS or anything that is installed in the venue hardware. Further, the OS detects and blocks various methods of controlling the candidate terminal remotely to avoid fraud. The candidate terminal also does photo capture (if required), for per candidate surveillance.
[0024] In another embodiment of the present invention, in order to reduce the dependency on trained staff, the provisioning system provides a simple deployment mechanism. This system mandates a simple process that can be easily known by a non-technical staff. This system automatically detects and configures the server software components to provide a PXE environment. The server software components themselves are custom built to effectively deploy the SPC on the candidate terminals. Since this provisioning system uses the IP addressing scheme of the venue, as is, it is able to support a wide set of network scenarios including VLANs.
[0025] In another embodiment of the present invention, the provisioning system automatically detects and configures a plurality of server components to provide a Preboot Execution Environment (PXE) protocol. Further, it deploys the SPC on a plurality of candidate terminals based on the server components and on the PXE protocol, wherein the candidate terminals are computer machines used by a plurality of candidates present in a venue for an online examination. Further, it provides a custom web-browser with an exam engine based on proprietary handshakes, wherein the exam engine includes plurality of exam server URLs. The provisioning system further blocks a plurality of common keystrokes that can take control of the candidate terminal by an end user and operates in a kiosk mode. The provisioning system further compartmentalizes each of a set of nodes running on a LAN segment such that no footprint is present on the candidate terminals after the online examination is concluded.
[0026] Figure 1 illustrates a block diagram representing a provisioning system for a secure PC on a simple single broadcast domain network, according to an exemplary implementation of the present invention. In this figure, the SPS is deployed on a simple single broadcast domain network.
[0027] Figure 2 illustrates a block diagram representing a provisioning system for a secure PC on a VLAN network, according to an exemplary implementation of the present invention. In this figure, the SPS is deployed on two VLAN networks.
[0028] Figure 3 illustrates a block diagram representing a provisioning system for a secure PC on a routed network, according to an exemplary implementation of the present invention. In this figure, the SPS is deployed on a routed network with network partitions.
[0029] Figure 4 illustrates a block diagram representing a provisioning system for a secure PC on a simple daisy chained network, according to an exemplary implementation of the present invention. In this figure, the SPS is deployed on a simple daisy chained network with network partitions.
[0030] Figure 5 illustrates a block diagram representing a provisioning system for a secure PC on a large single broadcast domain network, according to an exemplary implementation of the present invention. In this figure, the SPS is deployed on a large single broadcast domain network.
[0031] Figure 6 illustrates a block diagram representing a provisioning system for a secure PC on a daisy chained single broadcast domain network, according to an exemplary implementation of the present invention. In this figure, the SPS is deployed on a daisy chained single broadcast domain network.
[0032] Figure 7 is a flow chart illustrating a method for booting a Secured Personal Computer (SPC) over an unsecured network through a network infrastructure implemented by a provisioning system, according to an exemplary implementation of the present invention. The description for each step of the flowchart is provided below:
[0033] On the SPS (SPC Provisioning System) UI, ensure that SPS is in "Provisioning mode": This step involves accessing the user interface of the SPS (SPC Provisioning System) and verifying that the system is configured to operate in a mode specifically designed for allocating resources and configuring settings for the exam environment, known as “Provisioning mode.”
[0034] Configure the exam server URL's on the SPS UI: This action entails entering and setting up the Uniform Resource Locators (URLs) of exam servers within the user interface of the SPS (SPC Provisioning System), ensuring that the system is equipped to retrieve examination content from designated server locations.
[0035] Check whether the network is a VLAN-based network. Determine the network architecture to ascertain if it operates using Virtual Local Area Network (VLAN) segmentation. If VLANs are detected, establish specific SPS-Nodes (106, 108) for each VLAN segment to facilitate efficient management and coordination of resources within the network.
[0036] Boot the PC’s i.e., the candidate terminals in their host OS (whichever is installed on them): Power on the candidate terminals, initiating the boot process in their respective operating systems (OS). This step ensures the terminals to commence operation in their respective host operating systems (OS).
[0037] Initiate Scan from the SPS UI: Trigger a scanning process from the SPS user interface, which likely involves identifying and registering available candidate terminals within the network infrastructure for provisioning and inclusion in the exam environment.
[0038] Reboot the PC's i.e., the candidate terminals in network boot mode (PXE): Restart the candidate terminals, this time initiating the boot process in network boot mode, particularly employing the Preboot Execution Environment (PXE) protocol. This mode allows the terminals to boot from a network source, facilitating centralized management and deployment.
[0039] On the candidate terminal, a list of configured exam servers are listed. Choose the exam server to attach this candidate terminal to. This is the provisioning step: Present a list of configured exam servers on the candidate terminals, allowing users or administrators to select the appropriate server for connecting the terminal. This step finalizes the provisioning process, linking each terminal to its designated exam server.
[0040] Once the required candidate terminals are provisioned, switch SPS to “exam node” on the SPS UI. On all the provisioned machines, the selected exam server's URL is loaded. Machines that were not provisioned are shutdown: Transition the SPS system from “Provisioning mode” to “exam node” mode via the SPS user interface. This action activates the exam environment, ensuring that all provisioned candidate terminals load the content and settings from the selected exam server. Any terminals that were not provisioned are shut down to maintain the integrity and security of the exam environment.
[0041] Continue with the exam process: With the exam environment successfully established and candidate terminals configured and connected to the designated exam server, proceed with the examination process as planned. This includes administering the exam content, monitoring candidate activity, and managing exam-related tasks until completion.
[0042] Figure 8 is a flow chart illustrating the setup of the SPS Node, according to an exemplary implementation of the present invention. The description for each step of the flowchart is provided below:
[0043] Select a machine i.e., the candidate terminal in the exam venue in the given broadcast domain: Identify and choose a specific machine, referred to as the candidate terminal, located within the examination venue and operating within a defined broadcast domain, ensuring it meets the requirements for participation in the examination process.
[0044] Boot the machine in the host OS: Initiate the startup process of the selected candidate terminal, enabling it to commence operation in its primary operating system (OS), providing access to its standard functionality and configuration.
[0045] Note down the network parameters (IP, subnet mask, gateway) as configured on the host OS: Record and document the network configuration details, including the assigned IP address, subnet mask, and gateway settings, as configured within the host OS of the candidate terminal, facilitating subsequent network-related procedures.
[0046] Reboot the machine, and boot from the SPS Node (106, 108) USB stick: Execute a system restart on the candidate terminal, configuring it to initiate the boot process from a specified USB storage device, wherein the SPS (SPC Provisioning System) Node (106, 108) establishes connectivity with the SPS-Master (104).
[0047] The SPS Node (106, 108) will show a configuration page. Enter the IP, subnet mask, gateway, DNS server, and the SPS-Master (104) IP: Display a configuration interface or page on the SPS Node (106, 108), prompting the user to input essential network parameters, including the IP address, subnet mask, gateway address, DNS server details, and the SPS-Master (104) IP address of the SPS system, facilitating the establishment of communication and synchronization.
[0048] On successful setup, the Node (106, 108) will show up on the SPS UI (102): Upon successful completion of the configuration process, the SPS (SPC Provisioning System) Node (106, 108) becomes visible and accessible within the user interface (UI) (102) of the SPS system, indicating successful integration and readiness for further provisioning and management tasks.
[0049] In another embodiment of the present invention, the various individual components utilized in the entire system include SPS-Master (104), SPS-UI (User Interface) (102), SPS-Node (106, 108) and SPC. The SPS-Master (104) and the SPS-UI (102) are the windows applications that run on the exam-server machine of the provisioning system. These machines are carried by Chief Procter (CP) or a person in charge to the venue. Further, the SPS-Node (106, 108) is the machine that includes the USB stick based custom OS. The CPs carry these USB sticks to the venue. The SPC is the custom OS that is deployed on the candidate terminal over the network.
[0050] In another embodiment of the present invention, the process overview is disclosed. The CP defines a plurality of exam server URLs on the SPS-UI (102). These exam server URLs are the exam-engines. Further, the CP chooses a machine per network broadcast domain, at the venue network, and boots it with the SPS-Node (106, 108) USB stick. The CP uses the network configuration of the chosen machine to run the SPS-Node (106, 108). Once started correctly, the SPS-Node (106, 108) shows up on the SPS-UI (102) on the exam server. The CP boots all the required candidate terminals i.e., the machines in the labs (Lab1, Lab2, Lab3, Lab4), into the host OS. The CP initiates a scan from the SPS-UI (102) by pressing a button. The CP then reboots the required machines into the network boot by using the PXE protocol. Once booted, the candidate terminal will list the exam server defined on the UI (102). The CP marks each of the machines with the appropriate exam server. Once the required machines have been marked, the CP switches to an exam mode from the SPS-UI (102). In the exam mode, all the candidate terminals open the custom browser and proceed to the exam page. This process cuts out any technical training requirement on the CP.
[0051] In another embodiment of the present invention, the SPS is capable of handling its deployment to various types of network scenarios and telemetry. The SPC is a custom Linux-based OS with proprietary software components. The proprietary components provide a controlled environment for conducting online examinations, and collect telemetry such as the keystrokes, candidate photos, screenshots, connected devices and the like. This telemetry data from the candidate terminals is recorded on the SPS-Master (104) via the SPS-Node (106, 108). The SPS-Node (106, 108) enables a controlled PXE environment in the venue network with no modification to the venue network. It analyses the telemetry data coming from the candidate terminals for Live Fraud Detection. It also provides protection from IP spoofing. Further, the SPS-Master (104) holds the telemetry data and serves as master repository used in decision making. The SPS-UI (102) presents an interface to visualize the telemetry data and take further or corrective action. From the UI (102), the decision to provision system and start the exams is taken.
[0052] In another embodiment of the present invention, the provisioning system presents a compartmentalization for each set of nodes running on LAN segment and no footprint is present on individual machine after exam is conducted. A partition is created for various LAN segments and the individual nodes communicate only with the Master (104). This way a Node (106, 108) will be responsible to communicate with a set present in the segment for various network settings like VLAN, routed network. This helps in reducing latency and provides a more secure working approach.
[0053] It should be noted that the description merely illustrates the principles of the present invention. It will thus be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described herein, embody the principles of the present invention. Furthermore, all examples narrated herein are principally intended expressly to be only for explanatory purposes to help the reader in understanding the principles of the invention and the concepts contributed by the inventor to furthering the art and are to be construed as being without limitation to such specifically recited examples and conditions. Moreover, all statements herein reciting principles, aspects, and embodiments of the invention, as well as specific examples thereof, are intended to encompass equivalents thereof.
[0054] It should be noted that the description merely illustrates the principles of the present invention. It will thus be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described herein, embody the principles of the present invention. Furthermore, all the used cases recited herein are principally intended expressly to be only for explanatory purposes to help the reader in understanding the principles of the invention and the concepts contributed by the inventor(s) to furthering the art and are to be construed as being without limitation to such specifically recited used cases and conditions. Moreover, all statements herein reciting principles, aspects, and embodiments of the invention, as well as specific examples thereof, are intended to encompass equivalents thereof.
,CLAIMS:
1. A provisioning system providing a network infrastructure to boot a Secured Personal Computer (SPC) over an unsecured network, wherein the SPC has a custom Operating System (OS), said provisioning system including a Master (104), a UI (User Interface) (102) and a Node (106), the provisioning system configured to:
automatically detect and configure a plurality of server components to provide a Preboot Execution Environment (PXE) protocol;
deploy the SPC on a plurality of candidate terminals based on the server components and on the PXE protocol, wherein the candidate terminals are computer machines used by a plurality of candidates present in a venue for an online examination;
provide a custom web-browser with an exam engine based on proprietary handshakes, wherein the exam engine includes plurality of exam server URLs;
block a plurality of common keystrokes that can take control of the candidate terminal by an end user;
compartmentalize each of a set of nodes running on a LAN segment such that no footprint is present on the candidate terminals after the online examination is concluded.

2. The provisioning system as claimed in claim 1, wherein the Node (106) is a USB stick having the custom OS, said Node (106) is configured to:
enable the PXE environment in the network;
analyse telemetry data received from the SPC for detecting fraud and protecting from IP spoofing.

3. The provisioning system as claimed in claim 2, wherein the telemetry data includes the keystrokes, candidate images, screenshots and connected devices.

4. The provisioning system as claimed in claims 1 or 2, wherein the Master (104) is configured to:
store the telemetry data; and
serve as a master repository for decision making.

5. The provisioning system as claimed in claims 1 or 2, wherein the UI (102) is configured to:
provide an interface for visualizing the telemetry data and taking corrective action; and
determine to start the provisioning system for conducting the online examination.

6. The provisioning system as claimed in claim 1, wherein the SPC is configured to capture images of each candidate for surveillance.

7. The provisioning system as claimed in claim 1, wherein the custom OS runs entirely from the memory independent of a host OS in the candidate terminals.

8. The provisioning system as claimed in claim 1, wherein the provisioning system uses an IP addressing scheme of the venue for communication.

9. The provisioning system as claimed in claim 1, wherein the provisioning system compartmentalizes each of a set of nodes by creating a partition for the LAN segment and each of the nodes communicates with the Master (104).

10. The provisioning system as claimed in claim 1, wherein the server components includes web server, database server, mail server, file server and the like.

11. A method for booting a Secured Personal Computer (SPC) over an unsecured network through a network infrastructure implemented by a provisioning system, wherein the SPC has a custom Operating System (OS), the provisioning system comprising a Master (104), a UI (User Interface) (102) and a Node (106), the method comprising:
automatically detecting and configuring a plurality of server components to provide a Preboot Execution Environment (PXE) protocol;
deploying the SPC on a plurality of candidate terminals based on the server components and on the PXE protocol, wherein the candidate terminals are computer machines used by a plurality of candidates present in a venue for an online examination;
providing a custom web-browser with an exam engine based on proprietary handshakes, wherein the exam engine includes plurality of exam server URLs;
blocking a plurality of common keystrokes that can take control of the candidate terminal by an end user;
compartmentalizing each of a set of nodes running on a LAN segment such that no footprint is present on the candidate terminals after the online examination is concluded.