WO2006010462A1

WO2006010462A1 - Method for accessing to a computer firmware

Info

Publication number: WO2006010462A1
Application number: PCT/EP2005/007507
Authority: WO
Inventors: Werner Schneider
Original assignee: Siemens Aktiengesellschaft
Priority date: 2004-07-27
Filing date: 2005-07-12
Publication date: 2006-02-02
Also published as: DE102004036374A1

Abstract

The invention relates to a method for accessing to a computer firmware. The information carriers of an information carrying and processing device are used also for authenticating a user with respect to the computer. The computer access information is also stored in the memory of said information carrier. During authentication, said access information is wirelessly transmitted from the information carrying and processing device to the computer. A BIOS password is automatically transmitted from said information carrying and processing device to the computer through a wireless communication channel.

Description

Method of accessing the firmware of a computer

Technical area

The invention relates to a method for accessing the firmware in a computer, which has an interface device for line-bound data transmission with a mobile, information-carrying and processing device.

State of the art

The firmware, more precisely as "BIOS" (BASIC Input Output

System) is an initialization program which is stored in a non-volatile memory of the computer and immediately after switching different Funktions¬ units of the computer brings in a defined initial state. This firmware prompts the user to enter a password when booting the system. If this inputted BlOS password coincides with an access password previously stored in the system (for example in a CMOS RAM), the process of initialization is continued and the operating system is loaded into the main memory of the computer.

An incorrect entry has the consequence that the booting up of the computer is interrupted. The operating system is not loaded in this case and the user thus has no access to the resources in the computer.

The entry of an access code is not only in a computer but also in other mobile, informationstra¬ ing and processing devices, such as Mobil¬ phones or PDA's (Personal Digital Assistant) required lent. Many of these portable devices, especially mobile phones, are widely used nowadays. Modern versions of these small-format devices often have a cut Positioning device for wireless data transmission with other mobile or permanently installed devices.

An internationally standardized interface device in short-range data transmission (up to 100 m) is Bluetooth, in which the data is transmitted by radio in the ISM band (Industrial Scientific Medical Band).

Against this background, many users who have already authenticated themselves, for example, with respect to their mobile phones and are about to put their computer into operation find it cumbersome to re-enter the computer from the firmware of the computer Password be requested.

Presentation of the invention

It is an object of the present invention to provide a method and a device such that the procedure for authenticating a user to a computer is simpler.

This object is achieved for a method by the features of claim 1 and for a device by the features of claim 11. Advantageous embodiments, aspects and details of the invention will become apparent from the dependent claims, the description and the accompanying drawings.

The invention is based on using the information carrier of a mobile, information-carrying and processing device also in the authentication of a user to a computer. For this purpose, the access information to the computer is also stored in the memory of this information carrier. During the authentication process, this access information is transmitted wirelessly from the mobile, information-carrying the and-processing device transmitted to the computer. For example, a user who has already authenticated himself to his mobile phone no longer needs to remember the password for the computer thanks to the invention. The BIOS password is automatically transmitted from the mobile phone to the computer via a wireless communication channel.

The transmission can take place via short-range radio data transmission or optoelectronically. The process according to the invention is characterized by the following process steps:

a) providing data authenticating a user to the mobile information-bearing and processing device and to the computer on an information carrier of the mobile information-carrying and processing device; b) introducing the mobile information-carrying and processing device into the detection area of the interface device; c) establishing a communication channel between the mobi¬ len, information-bearing and processing device and the computer; d) transmitting the data for authenticating a user from the mobile, information-carrying and processing device to the computer via the communication channel; e) evaluating the data received from the computer to authenticate a user by the firmware of the computer, so that it is decided on the basis of these data whether an operating system is loaded into the computer or the booting of the computer is interrupted.

Advantageously, a mobile telephone is used as a mobile, information-carrying and processing device, in whose Subscriber Identity Module (SIM) the data for authenticating the user to the computer is kept ready. The interface device used is preferably a radio interface. This can be implemented, for example, as a built-in Bluetooth computer interface, or as an additional device in the form of an adapter which is connected to the USB interface of the computer. Bluetooth is a quasi-standard not only for mobile phones, but also for PDAs and organizers. With a Bluetooth interface is a short-range data radio, depending on the power class, from about 10 cm, about 10 meters, or with special variants up to about 100 m possible.

Since, in the case of a Bluetooth interface, interception and manipulation of the data stream is possible, if at all, only from close proximity, especially in the two lower performance classes, this form of wireless transmission of the authentication data can be classified as restricted. In order to increase security, encrypted data transmission is provided in a preferred embodiment of the invention. It is favorable in this case that in the case of a Bluetooth radio transmission, the authentication data is e.g. can be encrypted with a key up to 128 bits long. In addition, an asymmetric key method can be used. As a result, a manipulation of the data stream is largely excluded, especially since the range is already set to a predetermined limit anyway.

In order to further increase the security during the transmission of the password, it is provided that, depending on a security class assigned to the computer, the user is requested to enter a PIN before the password is transmitted. The security class results from the Bluetooth communication. In this case, a PIN is preferably used which is already familiar to the user from the use of the mobile, information-processing device. As a result, the user does not need to remember a large number of different access authorizations. A special embodiment variant of the method according to the invention is characterized in that the computer, by receiving a password at the Bluetooth interface from a sleep mode, in which the energy consumption of the

Computer is set to a minimum value, is booted to a normal operating state. This eliminates the switching on of the device.

In a further embodiment of the invention, the information carrier of the mobile, information-carrying and processing device not only contains the data required for the authentication of the user with respect to the computer, but also the subsequently required BlOS password Startup of the operating system required entry of the user ID (user account) and the personal password for the operating system. As a result, comfortable access to the operating system and thus also to other security devices, such as screen savers, is ensured.

In a variant of the invention, the computer is connected to a chip card reader and the firmware is set up in such a way that the password can alternatively be entered into the reader via the bloetooth interface or via the insertion of a chip card.

Brief description of the drawing

To further explain the invention, reference is made to the drawings, in which further advantageous embodiments and details of the invention can be found on the basis of an exemplary embodiment. Show it:

FIG. 1 is a schematic representation of an embodiment of the invention in which data representing a groove zer compared to a computer, and which are stored in a modified SIM card of a Mobilte¬ phone, are transmitted via a Leitungsungsebun¬ dene transmission path to a computer;

FIG. 2 shows a block diagram of the SIM card of the mobile phone modified according to the invention, having a first memory area in which data for authenticating the user to the mobile phone are stored and having a second memory area in which data for authentication of the User are stored opposite the computer.

Embodiment of the invention

FIG. 1 shows a computer 1 with conventional operating devices, such as keyboard 9, screen 10 and a pointing device, designed as trackball 11.

The computer 1 has a Universial Serial Bus (USB) interface 8. The USB interface 8 is used to connect an adapter 2, in the exemplary embodiment, a Bluetooth radio interface. The Bluetooth radio interface has a detection area E, in which a mobile telephone 4, which is likewise equipped with a corresponding Bluetooth radio interface 7, is located. The Bluetooth address of the computer 1 is configured on the mobile phone 4 as a known Bluetooth device. The detection range of a Bluetooth interface is usually about 10 m. Depending on the power class, a range of about 10 cm or about 100 m can be achieved.

The mobile phone 4 has an identification module, the SIM card 5 (SIM Subscriber Identity Module). On the SIM card are - as before - the user-specific data, such as the customer number of the user stored, resulting in the user of the mobile phone 4 identifi ^¬ against the network identifi ^¬ . Likewise, the cryptographic algorithm for authentication and user data encryption is implemented on the SIM card. According to the invention, the SIM card is now designed so that it is also used as an information carrier for the access code to a computer. That is to say, in the memory 10 (FIG. 2) of the SIM card 5, besides the above-mentioned access information and functionalities for the mobile radio network, also authentication data, such as the boot password for the access to the firmware, are stored to a computer. This modified SIM card is used in conjunction with the functionality of the line-bound, cryptographic data transmission existing on the mobile phone 4 when the computer is started up.

In detail, access to the firmware of the computer now takes place so that after turning on the computer 1, the boot program initially starts in the usual way, stops at a defined point and waits for the correct entry of the boot password. In contrast to the prior art but the firmware of the computer 1 is set up so that this input is not expected from the keyboard 9, but it is additionally the interface device (adapter 2 in USB port 8) queried. Thus, the cumbersome input of the password on the keyboard 9 of the computer 1 is replaced by a wireless transmission method.

If the BlOS password on the interface device matches the access code expected by the BIOS, then the

Firmware the operating system installed on the computer into the main memory and start it.

If the BlOS password provided at the interface device differs from the access code of the boot software, the startup at this point stops and the access to resources on the computer is blocked. The Bluetooth interface can advantageously be set up so that after the production of the transmission channel, the devices involved in the communication are identified and assigned to a security class. Depending on this security class, the radio interface decides whether the BlOS password is transmitted automatically or is made dependent on the input of a PIN on the keyboard β on the mobile telephone 4.

In systems with lower safety requirements, the BlOS password is automatically transmitted from the mobile phone 4 to the computer 1 and read in by the interface 8, so that the previously required manual input of the BlOS password is completely eliminated. The access to the firmware of the computer thus requires the mere presence of the user's mobile phone. For a computer that is used at home, this access is particularly comfortable.

If greater security is required, the user is prompted to enter a PIN, which he enters either on the keyboard 6 of the mobile phone 4 or on the keyboard 9 of the computer. The PIN is advantageously the PIN for access to the mobile phone 4. This means that even in the present case of increased security requirements of the user does not need to know the BlOS password by heart, but only the access code to his mobile phone, the him from the Nut¬ the mobile phone is familiar.

The boot program is usually housed on a flash ROM on the motherboard of the computer. The boot program is not part of the operating system, can work together with operating systems from different manufacturers and can be configured differently. For example, in the so-called power management settings, the way in which the PC behaves with a longer waiting time can be adjusted. The computer can be used until it is completely stand disabled. Hard disks can be shut down and the monitor designed. Thus, in a BIOS configuration, a switched-on computer can be brought into a so-called sleep mode before the input of a BlOS password, in which case it receives only low power. In this operating state, the computer remains until it is woken up by a corresponding signal. This waking can be done so that the mobile phone 4 is brought into the detection area of the interface device and the BlOS password is transmitted. The adapter 2 of the Bluetooth interface on the USB port 8 is arranged according to the invention so that it generates an interrupt signal. The firmware (BIOS) detects this interrupt signal and continues booting. As a result, the computer is awakened from hibernation and the system expects a BlOS password in a conventional manner at a particular point in the boot program. This is transmitted in the manner described above via Bluetooth and evaluated by the firmware. Since the BIOS program is not part of the operating system, implementation of the invention does not require customization of the operating system.

In FIG. 2, the SIM card 5 modified according to the invention is shown in greater detail as a block diagram. The SIM card 5 has a system bus 14 which connects a processor 12, an input / output unit 11, a controller 13 and the memory 10. The memory 10 includes various volatile (RAM) and non-volatile memories (ROM, EPROM, EPROM) and is structured in the second memory area 8 and 9. In the first memory area 8 - as hitherto - those data ge stored and managed, by which the user identifies himself as authorized to the mobile phone 4 and the network operator of the mobile network. In a second memory area 9 those authentication data are stored, which identify the user to the computer as an authorized user. Of course, the line-bound Schnittstel¬ leneinrichtung can also be designed as an infrared interface.

The term computer is synonymous with a PC, a laptop or other stationary data processing device. The access control system according to the invention can also be used for other access systems, such as parking barriers or door openers. In this case, the robot device may be a suitably equipped vehicle.

As already mentioned at the outset, the term "mobile, information-carrying and -processing device" covers devices of different design, such as PDAs and organizers, but also vehicles of various kinds ¬ tion carrier of such a device is used both for storing and managing data by which a user identifies himself as entitled to this device, as well as for storing and managing access information, through which the user to the firmware or the Betriebssys¬ tem authenticated by a computer.

Claims

claims

1. A method for accessing the firmware of a computer which is in a sleep mode with reduced energy consumption, which has an interface device in order to communicate with a mobile device, in particular information-carrying and processing device, located in a detection area for unpowered data transmission, characterized by the steps of: a) providing data to authenticate a user to the mobile, information carrying and processing device and to the computer on an information carrier of the mobile, information carrying and processing

equipment; b) introducing the mobile information-carrying and processing device into the detection area of the interface device; c) establishing a communication channel between the mobile information-carrying device and the computer, the interface device generating a signal which drives the computer from the sleep mode into an operating mode; d) transmitting the data for authentication of the user to the computer from the mobile, information-carrying and -processing device to the computer via the communication channel; e) evaluating the data received from the computer by the firmware of the computer, so that it is decided on the basis of these data, whether an operating system is loaded into the computer, or the booting of the computer is interrupted.

2. The method according to claim 1, characterized in that the signal is an interrupt signal.

3. The method according to claim 1 or 2, characterized marked, that as a mobile, information-carrying and - processing device, a mobile phone is used, and the data for authentication of the user gegen¬ on the computer in the subscriber identity module of the Mo bile phone be kept ready.

4. The method according to claim 1, characterized in that serves as a mobile device, a vehicle to land, water, and in the air, which is an information-bearing and

-processing device, and the data for authenticating the user to the computer in the subscriber identity module of the information-carrying and -processing device are kept ready.

5. The method of claim 1, 2, 3 or 4, characterized in that a radio interface is used as the interface device.

6. The method according to claim 5, characterized in that a permanently installed in the computer Bluetooth interface is used as a radio interface.

7. The method according to claim 5, characterized in that as a radio interface to a USB port or other, similar purposes serving port of the computer pluggable recorded adapter of a Bluetooth interface is used.

8. The method according to any one of claims 1 to 7, characterized ge indicates that the transmission of the data for authentication of the user against the computer is encrypted ver¬.

9. The method according to claim 6 to 8, characterized gekennzeich¬ net, that before the transmission of the data for Authenti¬ fication of the user to the computer depending on a, the computer assigned security class, the user is prompted to enter a PIN ,

10.A method according to any one of the preceding claims, da¬ characterized in that the data for the authentication of the user to the computer include the BIOS password for the firmware, the user ID and the personal password for the operating system of the Compu¬ ters.

11. Access control device for a computer, which is in a sleep mode with reduced power consumption, the an interface device for line-bound data transmission with a located in a detection range mobile, information-carrying and

-processing device, characterized in that the interface device receives authentication data from the mobile, information-carrying and -processing device, that after receiving the authentication data, the interface device generates a signal which the computer from the sleep mode in starts up an operating mode and provides the authentication data of the firmware of the computer at power-up.

12. Access control device according to claim 11, characterized in that the signal is an interrupt signal.

13. The method according to claim 11 or 12, characterized gekenn¬ characterized in that the mobile, information-carrying and - processing device is a mobile phone, the one Subscriber Identity module has, in which data for authentication of the user to the mobile radio network and data for authentication of the user are stored relative to the computer.

14. Access control device according to claim 11, characterized in that the mobile device is a vehicle on land, on water, and in the air, which contains an information-carrying and processing device, and has a subscriber identity module, in which Data for authenticating the user to the mobile device and data for authenticating the user to the computer are stored.

15. Access control device according to claim 11, 12, 13 o- 14, characterized in that the interface Stel leneinrichtung is a built-in computer Blue¬ tooth interface.

16. Access control device according to claim 11, 12, 13 o- 14, characterized in that the interface Stel¬ len device formed by a port on a USB port or other similar purposes serving port of the computer plug adapter of a Bluetooth interface is.

17. Access control device according to one of claims 11, 15 or 16, characterized in that the computer is connected to a chip card reading device and the firmware of the computer is set up so that the data for authenticating the user in relation to the computer can alternatively be replaced by the Bluetooth Interface or be evaluated by the smart card reader.

18. Access control device according to claim 11, 12, 13 or 14, characterized in that the interface leneinrichtung is designed as an infrared interface device.