Title: Pre-boot authentication system
Abstract: Systems are provided for the enhancement of the system BIOS for microprocessor-based devices. Before the end of a BIOS start-up procedure, the BIOS operation is diverted to a BIOS security authentication system which may be a portion of an enhanced system BIOS. The BIOS security authentication system establishes communication with an information module, if the information module is present. The information module is typically a removable or installable card, which may be unique to one or more users. Based upon an information exchange between the security authentication module and the information module, the security authentication module controllably allows or prevents the system BIOS start-up procedure to resume and finish. In a preferred embodiment, the security authentication module is used as a pre-boot authentication system, to prevent a microprocessor-based device from booting up, unless a valid authorized information module is present. In other preferred embodiments, an adaptive security authentication module interface is provided, to allow information exchange with a variety of information modules having one or more information formats. In alternate embodiments, information from the information exchange may be transferred to the main system BIOS (such as to provide system functions to the BIOS, or to provide identity information of the user, based upon the information module).
Patent Number: 7,000,249 Issued on 02/14/2006 to Lee
| Inventors:
|
Lee; Shyh-Shin (Taipei, TW)
|
| Assignee:
|
02Micro (Grand Cayman, KY)
|
| Appl. No.:
|
860709 |
| Filed:
|
May 18, 2001 |
| Current U.S. Class: |
726/20; 726/34; 713/2; 713/193 |
| Current Intern'l Class: |
H04L 9/00 (20060101) |
| Field of Search: |
713/1,2,200,202,300,189,193,194
|
References Cited [Referenced By]
U.S. Patent Documents
| 3754148 | Aug., 1973 | Nye.
| |
| 4090089 | May., 1978 | Morello et al.
| |
| 4553127 | Nov., 1985 | Issa.
| |
| 4553511 | Nov., 1985 | Hayakawa et al.
| |
| 5008846 | Apr., 1991 | Inoue.
| |
| 5019996 | May., 1991 | Lee.
| |
| 5023591 | Jun., 1991 | Edwards.
| |
| 5176523 | Jan., 1993 | Lai.
| |
| 5191228 | Mar., 1993 | Sloan.
| |
| 5396635 | Mar., 1995 | Fung.
| |
| 5498486 | Mar., 1996 | Gatehouse.
| |
| 5555510 | Sep., 1996 | Verseput et al.
| |
| 5630090 | May., 1997 | Keehn et al.
| |
| 5671368 | Sep., 1997 | Chan et al.
| |
| 5716221 | Feb., 1998 | Kantner.
| |
| 5763862 | Jun., 1998 | Jachimowicz et al.
| |
| 5809312 | Sep., 1998 | Ansel et al.
| |
| 5878264 | Mar., 1999 | Ebrahim.
| |
| 5936226 | Aug., 1999 | Aucsmith.
| |
| 5963464 | Oct., 1999 | Dell et al.
| |
| 5964597 | Oct., 1999 | Hirata et al.
| |
| 5975959 | Nov., 1999 | Joly.
| |
| 5986891 | Nov., 1999 | Sugimoto.
| |
| 6015092 | Jan., 2000 | Postlewaite et al.
| |
| 6085327 | Jul., 2000 | Seng et al.
| |
| 6275933 | Aug., 2001 | Fine et al.
| |
| 6353885 | Mar., 2002 | Herzi et al.
| |
| 6480097 | Nov., 2002 | Zinsky et al.
| |
| 6633981 | Oct., 2003 | Davis.
| |
| 2002/0078372 | Jun., 2002 | Aluzzo et al.
| |
| 2002/0087877 | Jul., 2002 | Grawrock.
| |
| 2003/0196100 | Oct., 2003 | Grawrock et al.
| |
| Foreign Patent Documents |
| WO 93/1738/8 | Feb., 1993 | WO.
| |
| WO 00/1617/9 | Mar., 2000 | WO.
| |
Other References
Fryer et al, "Microsoft Press Computer Dictionary", 1997, Microsoft Corporation,
3rd Edition, p. 281.
|
Primary Examiner: Revak; Christopher
Attorney, Agent or Firm: Carlton Fields, P.A.
Claims
What is claimed is:
1. An adaptive pre-boot authentication process, comprising the steps of:
providing a device having a BIOS procedure having an interval, the interval having
a start and a finish, the device including an adaptive interface module, the adaptive
interface module being capable of communicating with a plurality of information
modules, each information module having a different format;
starting the BIOS procedure;
interrupting the BIOS procedure during the interval before the finish;
establishing contact with an information module through the adaptive interface
module sending corresponding interface signals;
determining by the adaptive interface module, a format for the information module;
transferring the information between the information module and the device according
to the format of the information module;
determining by the adaptive interface module, if the transferred information
is valid; and
commencing the BIOS procedure if the transferred information is valid.
2. The process of claim 1, further comprising the steps of:
providing a card reader for connecting the information module to the device; and
determining when the information module is present within the card reader.
3. The process of claim 2, further comprising the step of:
powering on the information module when the information module is determined
to be present within the card reader.
4. The process of claim 3, further comprising the step of:
powering off the information module after the information is transferred between
the information module and the device.
5. The process of claim 1, wherein the device further comprises a loadable operating
system, further comprising the step of:
loading the operating system after the BIOS procedure has commenced.
6. The process of claim 1, further comprising the step of;
preventing the commencing step if the determined transferred information is not valid.
7. The process of claim 1, wherein the information module further comprises a
defined format, and wherein the information is available within the defined format.
8. The process of claim 1, wherein the information module is an authentication card.
9. The process of claim 1, wherein the information module is a synchronous card.
10. The process of claim 1, wherein the information module is an asynchronous card.
11. The process of claim 1, wherein the device is a computer.
12. The process of claim 11, wherein the computer is a personal computer.
13. The process of claim 11, wherein the computer is a portable computer.
14. The process of claim 1, wherein the device is a personal digital assistant.
15. The process of claim 1, wherein the device is a portable phone.
16. A process, comprising the steps of:
providing a device having a BIOS procedure having an interval, the interval having
a start and a finish;
providing a security authentication module associated with the BIOS;
providing a library in communication with the security authentication module,
the library having a plurality of format modules;
providing a removable module having information;
starting the BIOS procedure;
interrupting the BIOS procedure during the interval before the finish;
establishing communication between the security authentication module and the
removable module, according to one of the plurality of format modules in the library;
determining by the security authentication module, a format for the removable module;
transferring the information between the removable module and the security authentication
module according to the format of the removable module;
determining by the security authentication module, if the transferred information
is valid; and
recommencing the BIOS procedure if the transferred information is valid.
17. The process of claim 16, further comprising the steps of:
providing a card reader for connecting the removable module to the device; and
determining when the removable module is present within the card reader.
18. The process of claim 17, further comprising the step of:
powering on the removable module when the removable module is determined to be
present within the card reader.
19. The process of claim 18, further comprising the step of:
powering off the removable module after the information is transferred between
the module and the security authentication module.
20. The process of claim 16, wherein the device further comprises a loadable
operating system, further comprising the step of:
loading the operating system after the BIOS procedure has recommenced.
21. The process of claim 16, further comprising the step of;
preventing the recommencing step if the transferred information is not valid.
22. The process of claim 16, wherein the removable module further comprises a
defined format, and wherein the information is available within the defined format.
23. The process of claim 16, wherein the removable module is an authentication card.
24. The process of claim 16, wherein the removable module is a synchronous card.
25. The process of claim 16, wherein the removable module is an asynchronous card.
26. The process of claim 16, wherein the device is a computer.
27. The process of claim 26, wherein the computer is a personal computer.
28. The process of claim 26, wherein the computer is a portable computer.
29. The process of claim 16, wherein the device is a personal digital assistant.
30. The process of claim 16, wherein the device is a portable phone.
31. An adaptive authentication system for a device having a basic input output
system (BIOS), the BIOS having a plurality of format modules, the adaptive authentication
system being capable of executing a BIOS procedure, the BIOS procedure comprising
an interval having a start and a finish, the adaptive authentication system comprising:
means for interrupting the BIOS procedure during the interval before the finish;
means for determining a format for a removable module; and
means in communication with the BIOS
means for communicating with the removable module through one of the plurality
format modules according to the format of the removable module,
means for receiving information from the removable module,
means for determining if the received information is valid; and
means for allowing the BIOS procedure to recommence if the received information
is valid.
32. The authentication system of claim 31, further comprising:
means for determining the presence of the removable module.
33. The authentication system of claim 31, further comprising:
a card reader for connecting the removable module to the the adaptive authentication system.
34. The authentication system of claim 33, further comprising:
means for powering on the removable module if the removable module is located
within the card reader.
35. The authentication system of claim 31, further comprising:
means for powering off the removable module after the information is transferred
between the removable module and the authentication module.
36. The authentication system of claim 31, wherein the the adaptive authentication
system further comprises a loadable operating system, wherein the operating system
is loaded after the BIOS procedure has recommenced.
37. The authentication system of claim 31, wherein the authentication module
prohibits the recommencing of the system BIOS if the received information is not valid.
38. The authentication system of claim 31, wherein the removable module further
having a defined format.
39. The authentication system of claim 31, wherein the removable module is an
authentication card.
40. The authentication system of claim 31, wherein the removable module is a
synchronous card.
41. The authentication system of claim 31, wherein the removable module is an
asynchronous card.
42. The authentication system of claim 31, wherein the device is a computer.
43. The authentication system of claim 42, wherein the computer is a personal computer.
44. The authentication system of claim 42, wherein the computer is a portable computer.
45. The authentication system of claim 42, wherein the device is a personal digital assistant.
46. The authentication system of claim 42, wherein the device is a portable phone.
47. An adaptive authentication system for a device having a basic input output
system (BIOS), the BIOS having a plurality of format modules, the adaptive authentication
system being capable of executing a BIOS procedure, the BIOS procedure comprising
an interval having a start and a finish, the adaptive authentication system comprising:
means for interrupting the BIOS procedure during the interval before the finish; and
an authentication module in communication with the BIOS
means for establishing communication with a removable module having information
stored in one of a plurality of formats,
means for determining a format for the removable module,
means for receiving authentication information from the removable module once
communication is established according to the format of the removable module,
means for determining if the received authentication information is valid, and
means for allowing the BIOS procedure to recommence if the received authentication
information is valid.
48. The adaptive authentication system of claim 47, further comprising:
means for determining the presence of the removable module.
49. The adaptive authentication system of claim 47, further comprising:
a card reader for connecting the removable module to the authentication module.
50. The adaptive authentication system of claim 49, further comprising:
means for powering on the removable module if the removable module is located
within the card reader.
51. The adaptive authentication system of claim 50, further comprising:
means for powering off the removable module after the authentication information
is transferred between the removable module and the authentication module.
52. The adaptive authentication system of claim 47, wherein the device further
comprises a loadable operating system, wherein the operating system is loaded after
the BIOS procedure has recommenced.
53. The adaptive authentication system of claim 47, wherein the authentication
module prohibits the recommencing of the BIOS procedure if the received authentication
information is not valid.
54. The adaptive authentication system of claim 47, wherein the removable module
further having a defined format.
55. The adaptive authentication system of claim 47, wherein the removable module
is an authentication card.
56. The adaptive authentication system of claim 47, wherein the removable module
is a synchronous card.
57. The adaptive authentication system of claim 47, wherein the removable module
is an asynchronous card.
58. The adaptive authentication system of claim 47, wherein the device is a computer.
59. The adaptive authentication system of claim 58, wherein the computer is a
personal computer.
60. The adaptive authentication system of claim 58, wherein the computer is a
portable computer.
61. The adaptive authentication system of claim 47, wherein the device is a personal
digital assistant.
62. The authentication system of claim 47, wherein the device is a portable phone.
Description
FIELD OF THE INVENTION
The invention relates to the field of BIOS systems and information card bus architecture
in microprocessor-based devices. More particularly, the invention relates to pre-boot
enhancement and/or authentication for BIOS applications and systems.
BACKGROUND OF THE INVENTION
In microprocessor-based devices, such as stationary desktop computers, laptop
computers, personal digital assistants, and/or portable cell phones, a basic input
output system (BIOS) is located in memory on the main logic board.
The system BIOS software typically performs a variety of roles in the start-up
sequence of a microprocessor-based device and associated hardware, which eventually
includes the loading of an operating system for the device. Before the operating
system is loaded, the system BIOS manages the start-up of other devices and sub-systems,
typically comprising power on self-testing for all of the different hardware components
in the system, activating secondary BIOS software located on different installed
cards, providing low-level routines that a loaded operating system uses to interface
to different hardware devices, such as for keyboards, displays, serial and/or parallel
ports, and managing other controllable system parameters.
When a microprocessor-based device is powered on, the system BIOS software,
which is typically located on the system logic board for a computer, is activated.
During the initial boot-up sequence, the BIOS checks the CMOS Setup, loads interrupt
handlers, and then typically determines the operational status of other devices,
such as the status of installed cards. Some installed cards have dedicated on-board
BIOS software, which initializes on-board memory and microprocessors. For cards
which do not have an on-board BIOS software, there is usually card driver information
on another ROM on the motherboard, which the main system BIOS loads to perform
the boot-up of the attached card.
The system BIOS then checks to see if the computer activation is a cold boot
or a reboot, which are often differentiated by the value of a memory address. If
the activation is a cold boot, the BIOS verifies the random access memory (RAM),
by performing a read/write test of each memory address. The BIOS also checks the
ports for external input/output devices, such as for a connected keyboard and for
a mouse. The system BIOS then looks outwardly, towards peripheral busses, and to
other connected devices.
The system BIOS then attempts to initiate the boot sequence from the first device
of one or more bootable devices, which are often arranged in a sequential order.
If the system BIOS does not find the first of one or more sequential devices, the
BIOS then attempts to find the next device in the sequential order.
If the BIOS does not find the proper files on at least one appropriate bootable
device, the startup process halts. If the system BIOS finds the appropriate files
on an appropriate bootable device, the system BIOS continues the boot-up operation,
thereby loading activating the operating system for the microprocessor-based device.
While some of the system parameter settings which the system BIOS uses during
the boot-up sequence can be established or modified by a user, such changes are
made after the operating system is presented to a user. For example, on a Macintosh™
computer operating system, by Apple Computer, Inc., of Cupertino, Calif., a user
can define one or more system parameters, through control panels, or through enabling
or disabling system extensions. While such system changes can be defined by a user,
the defined changes are not made until the device is restarted, such that the system
BIOS can re-boot the device, and reload the operating system, as defined by the user.
For devices which allow changes to the system BIOS at all, an updating process
is required, wherein a user and/or system manager typically installs an updating
program. The updating program typically erases the entire system BIOS, and installs
the updated system BIOS.
While modifications to a system BIOS are possible for some computer systems,
it would be advantageous to provide a modularized BIOS enhancement system, in which
external information is accessed before the system BIOS process is completed.
As well, while both hardware and/or software has been used to provide security
and authentication systems for microprocessor-based devices, it would be advantageous
to provide an authentication system which allows authorized access, while preventing
system boot-up to unauthorized users. Such a system would be a major technological breakthrough.
Some microprocessor-based devices, such as desktop computers, use smart cards
and associated hardware, as a means to authenticate a user with the device. For
example, for a desktop computer having conventional Smart Card Authentication,
the desktop computer typically has an attached Smart Card reader. User access to
the computer is allowed, if an authorized Smart Card is inserted into the Smart
Card reader. While the desktop computer provides authorized access, the computer
is required to be booted, i.e. the BIOS process has been completed and the operating
system has been loaded, at the time the user is prompted to enter a Smart Card.
In a Windows™ CE based Aero 8000 personal digital assistant (PDA), by
Compaq
Computer, Inc., an authentication system is provided which does not provide a universal
interface with BIOS security authentication. The Aero 8000 PDA system is a "closed-box"
embedded system, which includes non-standard firmware code to access a non-PC/SC
smart card for BIOS security authentication.
Other microprocessor-based devices, such as portable cell phones, use smart
cards and associated hardware, as a means to authenticate a user with the device.
Many portable cell phones include a small smart card, which is located internally
to the phone, that associates the phone with the host company, as well as with
the contracted user. Alternate portable cell phones, such as a V. Series™
V3682 phone, by Motorola, Inc., provide external access for a removable smart SIM
card which is associated with a contracted user, such that a portable cell phone
may be used for more than one user or account, and such that a user may use other
similarly equipped portable cell phones for communications which are associated
with the inserted smart card. While such portable cell phones associate smart cards
with users and host companies, the operating BIOS processes for such devices phones
are unaffected by the smart cards.
Password protection software has also been used to provide security for
desktop and portable computing devices. For example, FolderBolt-Pro™, by
Kent•Marsh Ltd., of Houston, Tex., provides software based security and
encryption for files, applications, and/or folders, whereby the user can select
varying levels of protection, such as with passwords, before access to the protected
file or folder is given. While security software provides some level of protection
to a device, such security software operates within a loaded operating system,
i.e. the protection software does not authorize or prevent the system BIOS boot
up process from being performed.
The disclosed prior art systems and methodologies thus provide basic authentication
systems, such as through the use of a smart card, or other memory media storage
device, e.g. such as a Memory Stick™, by Sony Electric Company, Inc., to
identify a user, once a device has been booted-up. However, the system BIOS for
such devices is unaffected, such that the operating system is already loaded, at
the time the user is prompted to provide authentication.
It would therefore be advantageous to provide a BIOS-based authentication security
enhancement structure and process, whereby the BIOS process is diverted by the
security authentication system, such that the system BIOS process is inherently
enhanced or halted, based upon the results of the pre-boot system. It would also
be advantageous that such a BIOS-based information system be integrated with information
contained within removable modules or cards. The development of such a BIOS-based
enhancement system would constitute a major technological advance. The development
of such a BIOS-based system for authentication would constitute a further technological advance.
SUMMARY OF THE INVENTION
Systems are provided for the enhancement of the system BIOS for microprocessor-based
devices. Before the end of a BIOS start-up procedure, the BIOS operation is diverted
to a BIOS security authentication system. The BIOS security authentication system
establishes communication with an information module, if the information module
is present. The information module is typically a removable or installable card,
which may be unique to one or more users. Based upon an information exchange between
the BIOS security authentication system and the information module, the BIOS security
authentication system controllably allows or prevents the completion of the BIOS
boot-up procedure. In a preferred embodiment, the BIOS security authentication
system is used as a pre-boot authentication system, to prevent a microprocessor
based device from booting up unless a valid, authorized information module is present.
In other preferred embodiments, an adaptive BIOS security authentication system
interface is provided, to allow an information exchange with a variety of information
modules, having one or more information formats. In alternate embodiments, information
from the information exchange may be transferred to the main system BIOS (such
as to provide system functions to the BIOS, or to provide identity information
of the user, based upon the information module.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a functional block diagram of a pre-boot authentication system integrated
with a device having a system BIOS;
FIG. 2 is a schematic diagram of computer system having an integrated BIOS security
authentication enhancement system;
FIG. 3 shows a simplified flow structure of a pre-boot authentication system;
FIG. 4 shows a simplified timeline for the flow structure of an integrated BIOS
security authentication enhancement system;
FIG. 5 is a flow chart of one embodiment of the pre-boot authentication system;
FIG. 6 shows exemplary coding for one embodiment of the pre-boot authentication system;
FIG. 7 shows exemplary coding for card bus controller initialization;
FIG. 8 shows coding for card resource reader controller initialization;
FIG. 9 shows coding for card resource insertion detection;
FIG. 10 shows coding for card resource power on and ATR retrieval;
FIG. 11 shows coding for card resource data exchange;
FIG. 12 shows coding for card resource power off;
FIG. 13 shows coding for card resource release;
FIG. 14 shows a first portion of a pre-boot authentication BIOS system call specification;
FIG. 15 shows a second portion of a pre-boot authentication BIOS system call specification;
FIG. 16 is a diagram of a portable computer system having an integrated pre-boot
BIOS security authentication system;
FIG. 17 is a diagram of portable personal digital assistant having an integrated
pre-boot BIOS security authentication system;
FIG. 18 is a schematic diagram of a portable phone having an integrated pre-boot
BIOS security authentication system; and
FIG. 19 is a schematic diagram of a preferred embodiment of the pre-boot authentication
system, in which the pre-boot interface establishes communication with information
modules having one or more formats.
DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
FIG. 1 is a functional block diagram of a pre-boot authentication system
10
which is integrated with a microprocessor-based device
34 (FIG. 2, FIG.
7, FIG. 15, FIG. 16, FIG. 17) having a basic input output system (BIOS)
12.
The standard system BIOS
12 for the device further comprises a BIOS security
authentication enhancement
14, whereby the system BIOS process
12
is diverted to a security authentication module
16 before the end (
58)
(FIG. 3) of the BIOS process.
As seen in FIG. 1, a security authentication module
16 comprises an interface
18 and a library
20. The security authentication module
16
is also associated with information module reader hardware
22, which comprises
a module interface
24 and one or more module contacts
28a-
28n.
The module interface
24 accepts a removable or installable information module
26. An information module
26 comprises stored information
32,
which is typically addressable or available within a defined format
30.
When an information module
26 is installed within the module interface
24 of the reader hardware
22, contacts
28a-
28n
are established between the information module
26 and the reader hardware
22.
FIG. 2 is a schematic diagram
32 of a microprocessor-based computer
34a,
having an integrated pre-boot authentication system
10. While the microprocessor-based
device
34a shown in FIG. 2 is illustrated as a desktop computer system
34a, it should be understood that the pre-boot authentication system
can be readily applied to a large variety of microprocessor-based devices
34
(FIG. 1), such as portable computers
34b (FIG. 16), personal digital
assistants
34c (FIG. 17), and/or cell phones
34c (FIG. 18).
The microprocessor-based computer
34a shown in FIG. 2 comprises
a logic board
36, having an associated system BIOS
12, which is integrated
14 with the security authentication module
16. The microprocessor-based
computer
34a also typically comprises associated hardware, such as
a display
38, input devices, such as a keyboard
40 and mouse
42,
and memory storage
44. The security authentication module
16 is connected
to a reader
22, which comprises means for connecting to an information module
26.
FIG. 3 shows a simplified flow structure
50 of a pre-boot authentication
system
10. When the microprocessor-based device
34 is activated
52,
the enhanced basic input output system (BIOS) process
70 (FIG. 5) is started,
at step
54. Preliminary BIOS procedures
56 are performed, until the
system BIOS
12 is diverted to the security authentication process
60.
As seen in FIG. 3, the pre-boot security enhancement process
50 is commonly
used for BIOS authentication
60. Based upon a successful authentication
60 within the pre-boot security process
50, the system BIOS
12
is allowed to continue, by performing post-authentication procedures
66,
which typically comprises the eventual loading of an operating system, at step
68. As also seen in FIG. 3, the pre-boot security enhanced BIOS process
50 is prevented from performing post-authentication procedures
66
and loading an operating system, if there is no authorization
60, i.e. the
micro-processor-based device
34 does not boot-up.
FIG. 4 shows a simplified timeline
70 for the flow structure of an integrated
pre-boot security system
10. At time T
0, the microprocessor-based
device
34 is activated
52, and the basic input output system (BIOS)
process
12 is started, at step
54. Preliminary BIOS procedures
56
are performed, until the system BIOS
12 is diverted to the security authentication
enhancement process
60, at time T
1 74. Based upon a successful
BIOS security authentication enhancement process
60, the system BIOS
12
is allowed to continue, at time T
2 76, in which post-process
procedures
66 are controllably allowed to occur. Post-process procedures
66 typically comprise the preparation and loading of an operating system,
at step
68, at the end
58 of the system BIOS process
12. As
described above, the enhanced BIOS process
50 is prevented from performing
post-process procedures
66 and loading an operating system, if the system
does not successfully complete the enhancement and/or authentication process
60.
FIG. 5 is a flowchart of a typical security authentication BIOS process
70.
Once the microprocessor device
34 is activated, the standard BIOS process
12 is enabled, at step
54. The system BIOS
12 continues, until
the security authentication set point is reached, at step
72. The card bus
controller interface
18 and card bus reader
22 are initialized, at
step
74. The controller interface
18 the checks for card insertion
into the module interface
24, at step
76. Once an information module
card
26 is inserted, the card is powered and the handshaking "answer to
reset signal function coding ATR (FIG. 10) is sent from the card
26 and
is received by the controller interface
18, at step
78. If an acceptable
handshaking answer to reset signal ATR is received, the controller interface
18
exchanges other information with the card
26, e.g. such as authentication
information, at step
80. After the data exchange step
80 is finished,
the card is powered off, at step
82, and the controller interface
18
releases the reader resource
22, at step
84. Based on a successful
pre-boot authentication process
70, the system BIOS is allowed to resume,
at step
86, such that the system BIOS process may be completed
58
(FIG. 4).
FIG. 6 shows coding
90, in C programming language, for one embodiment
of the pre-boot authentication system
70. FIG. 7 shows coding for card bus
controller initialization
74a. FIG. 8 shows coding for card resource
reader controller initialization
74b. FIG. 9 shows coding for card
resource insertion detection
76. FIG. 10 shows coding for card resource
power on and ATR retrieval
78. FIG. 11 shows coding for card resource data
exchange
80. FIG. 12 shows coding for card resource power off
12.
FIG. 13 shows coding for card resource release
84. FIG. 14 shows a first
portion of a pre-boot authentication BIOS system call specification. FIG. 15 shows
a second portion of a pre-boot BIOS system call specification.
Pre-Boot BIOS Enhancement for Authentication. As seen In FIG. 3 through
FIG. 6, the pre-boot BIOS enhancement system
10 is implemented before the
end of the system BIOS
12 for a microprocessor-based device
34. For
applications in which the pre-boot BIOS enhancement system provides authentication,
based upon the use of information card modules
26 comprising authentication
information
32, the microprocessor-based device
34 is prevented from
booting up at all, unless a valid information card
26 is inserted into the
card reader
22.
The pre-boot BIOS enhancement system
10 is particularly suitable for smart
card architectures, whereby the reader
22 and cards
26 are often
standardized. The pre-boot BIOS enhancement system
10 checks to see if an
inserted smart card
26 is valid, and determines if an inserted smart card
26 has valid function coding. When the device
34 is powered on, the
system BIOS process
12 begins. The BIOS process
12 is then interrupted,
at which time the pre-boot system BIOS module
16 looks to the authentication
card
26, to determine it's presence, and if so, queries the authentication
card
26 for information
32. Upon connection with a valid authentication
card
26, the enhanced BIOS
12,
14 continues the startup process.
If a valid authentication card
26 is not connected, the system BIOS
12
is prevented from continuing, and the operating system for the device
34
is prevented from being loaded, thereby providing robust protection against unauthorized access.
In prior authentication systems, the device system BIOS
12 is initially
completed, such is that access to further use of some or all computer functions
are controlled by an authentication system and associated process. For example,
in a conventional desktop card-based security system, the operating system of the
device is initialized at the end of the system BIOS process
12, at which
point, an authentication system is activated. In a card-based embodiment, when
a valid authorization card is entered, authentication system allows entry to the
device, such as to applications and files. In a software-based system, when a valid
password is entered, the software-based authentication system allows entry to the
device. However, in each of these conventional authentication systems, the system
BIOS is completed and the operating system is already loaded, such that any bypass
of the security structure may yield unauthorized access to an enabled operating system.
In contrast to such conventional authentication systems, which are activated
after
the system BIOS is completed, the pre-boot authentication system
10 is activated
before the system BIOS
12 is completed
58. In a typical embodiment,
therefore, the pre-boot authentication system
10 prevents any sort of user
interaction through the operating system of a microprocessor-based device
34,
until such time that a valid authentication occurs.
Pre-Boot Enhancement and Authentication Systems for Portable Devices. FIG.
16 is a diagram of a portable computer system
34b having an integrated
pre-boot enhancement or authentication system
10. FIG. 17 is a diagram of
a portable personal digital assistant
34c having an integrated pre-boot
enhancement or authentication system
10. FIG. 18 is a diagram of a portable
phone
34d having an integrated pre-boot enhancement or authentication
system
10.
Portable devices are often misplaced, lost, or stolen. The pre-boot system
10 is particularly advantageous for portable devices
34, providing
secure access to private information, such as personal and business files and contact
information. As the pre-boot system prevents loading of the operating system for
a device, the pre-boot system provides a useful deterrent to theft of portable
devices; there is no way to recover information through the operation system of
the device, and the device provides a greatly diminished value to unauthorized people.
Even for a stationary microprocessor-based device
34 which is located
in a large user environment, e.g. such as a large corporation, the pre-boot authentication
system
10 prevents access through the operating system of the device, unless
proper authentication
60 occurs during the system BIOS process
12.
Alternate Applications for the Pre-boot System. While the pre-boot authentication
system
10 is disclosed above as an authentication system, alternate embodiments
may provide other enhancements to a system BIOS
12, before the end
58
of a boot-up process for a microprocessor-based device
34. For example,
installable or insertable information modules
26 may contain other enhancements
for an operating system, or may include preferred system settings for an authorized
user, which are activateable or installable before the end
58 of the system
BIOS process
12.
For example, the information may preferably comprise coding information which
is used to extend or update the system BIOS for a particular device
34.
The information module
26 may preferably contain updated or new subroutines
for the system BIOS
12. Instead of requiring that an new system BIOS
12
be installed, or that an existing BIOS
12 be updated through existing methods,
the pre-boot enhancement system
12, as integrated with an information module
26, readily provides upgradeability for a system BIOS
12, such as
to work with changing operating system software and/or hardware.
Information Modules. Information modules
26 can be implemented
with a wide variety of card and information module formats
30. In a preferred
embodiment of the pre-boot BIOS enhancement system
10, the information modules
26a-
26n are insertable memory cards, e.g. such as a
Smart Card™, by Smart Card Alliance, a Memory Stick™, by Sony Electric
Company, Inc., or a Security Device™, by Toshiba Electronics, Inc.
While such information cards
26 often have different information formats
30 (FIG. 1), the physical structure and defined contacts
28a-
28n
for information cards
26 are often standardized. Therefore, the pre-boot
authentication system
10 provides a hardware interface that physically interfaces
with a variety of information cards
26a-
26n, while
providing an adaptive software interface
18, having a plurality of library
modules
20a-
20n, whereby communication may be established
with any of the cards
26a-
26n.
Adaptive Pre-Boot Enhancement and Authentication System. FIG. 19 is a simplified
functional block diagram of a preferred embodiment
100 of the pre-boot authentication
system
10, in which the pre-boot module
16, having an adaptive interface
18 and a plurality of library modules
20a-
20n,
establishes communication with information modules
26a-
26n
having one or more formats
30a-
30k, such as for
resource (memory and I/O port) management and security management.
The card reader
22 allows the insertion of information modules
26a-
26n,
based upon a variety of information formats
30a-
30k.
The adaptive BIOS enhancement module
16 comprises a plurality of format
library modules
20a-
20n, by which the system interface
24 establishes communication with an inserted information module
26.
The system BIOS
12 is integrated with the adaptive pre-boot enhancement
system
100, based upon the plurality of installed pre-boot libraries
20a-
20n.
The pre-boot libraries
20a-
20n define the structure
by which the BIOS is diverted to the pre-boot enhancement authentication system,
and defines the structure by which the system BIOS may resume, based upon a successful
data exchange with an acceptable information module
26.
As well, the libraries
20a-
20n define the integration
of the reader hardware
22 and validation rules for information modules
26.
Therefore, the libraries
20a-
20n comprise information
and communication protocols necessary to establish a communication exchange with
the information modules
26a-
26n.
During the system BIOS boot-up operation of the device
34 shown in
FIG. 19, the system BIOS
12, having pre-boot system integration
14,
is diverted to the adaptive pre-boot enhancement system module
16, having
an adaptive interface
18. When an information module
26, e.g. such
as card
26b having a format
30, e.g. such as format
30b,
is inserted within the module reader
22, the adaptive pre-boot module
16
detects the insertion, at step
76 (FIG. 5). The adaptive pre-boot BIOS enhancement
module
16 then attempts to establish communication with the information
module
26b. In an exemplary embodiment of the process, the adaptive
pre-boot BIOS enhancement module
16 iteratively sends a handshake prompt
signal
102a-
102n to the information module
26,
based upon a corresponding appropriate handshake prompt (ATR) signal
102a-
102n
associated with each of the stored plurality of format library modules
20a-
20n.
Once the adaptive BIOS enhancement module
16 sends an acceptable handshake
prompt ATR signal
102, i.e. one that is recognized by the information module
26, the information module
26 responds by sending a matching handshake
return signal
104b. Upon receipt of a matching handshake return signal
104b, which is preferably matched to the stored format library module
20, the adaptive BIOS enhancement module
16 performs the data exchange
with the information module
26, within the library format
30 defined
by the successful matching handshake pair
102,
104.
The adaptive BIOS enhancement system
100 can therefore distinguish the
type of information module
26 which is inserted, and can provide BIOS enhancement,
such as authentication, using a variety of information modules
26a-
26n,
i.e. for both standard and nonstandard cards
26. For example, in a large
organization environment, the use of a variety of removable authentication cards
26a-
26n, having a variety of formats
30a-
30k,
may be used for authentication purposes.
Even for information cards
26 having synchronous or asynchronous formats
30, the adaptive pre-boot BIOS system
100 can be programmed with
corresponding library modules
20a-
20n, having appropriate
command sets, which correspond to both synchronous or asynchronous formats
30.
As well, a single information module
26, such as a smart card
26
that is unique to a user, may preferably be used to authenticate other microprocessor-based
devices
34, either having the pre-boot system
10 which has an appropriate
reader
22 and library
20, or having another adaptive BIOS enhancement
system
100, provided that the information module comprises appropriate authentication
information
32.
Although the pre-boot authentication system and its methods of use are described
herein in connection with a personal computers and other microprocessor-based devices,
such as the apparatus and techniques can be implemented for a wide variety electronic
devices and systems, or any combination thereof, as desired.
Accordingly, although the invention has been described in detail with
reference to a particular preferred embodiment, persons possessing ordinary skill
in the art to which this invention pertains will appreciate that various modifications
and enhancements may be made without departing from the spirit and scope of the
claims that follow.
*
