Computer including at least one connector for a replaceable storage medium, and method for starting and operating a computer via a replaceable storage medium

• US 20070061880A1
• Filed: 09/11/2006
• Published: 03/15/2007
• Est. Priority Date: 09/09/2005
• Status: Active Grant

• Current Assignee: Fujitsu Client Computing Limited (Lenovo Group Ltd.)
• Original Assignee: Fujitsu Siemens Computers GmbH (Fujitsu Limited)
• Inventors: Depta, Robert
• Granted Patent: US 8,151,115 B2
• Time in Patent Office: Days
• US Class Current: 726/20
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

A method starts and operates a computer with an operating system held on a replaceable storage medium. The method includes: checking the authenticity of the replaceable storage medium and/or checking a user'"'"'s authority for executing the operating system held on the replaceable storage medium. The operating system held on the replaceable storage medium is executed if the replaceable storage medium is authentic and/or the user is authorized to use the operating system. Checking the authenticity of the replaceable storage medium and the user'"'"'s use authority ensures the integrity of the operating system. Thereby, modifications to the operating system and to the computer are made more difficult. The invention also relates to a computer and a replaceable storage medium which are suitable for carrying out the method.

Claims

1. A computer configured to execute an operating system that is stored on a replaceable storage medium, comprising:

at least one replaceable storage medium connector configured to receive the replaceable storage medium; and

a boot control apparatus configured to authenticate the replaceable storage medium and validate a user'"'"'s authorization to use the operating system, the boot control apparatus allowing execution of the operating system on the computer in response to successfully authenticating the replaceable storage medium and validating the user'"'"'s authorization.

2. The computer as claimed in claim 1, wherein the boot control apparatus is configured to authenticate the replaceable storage medium via a certificate.

3. The computer as claimed in claim 1, wherein the boot control apparatus is configured to request a password from the user and to validate the password for user authorization.

4. The computer as claimed in claim 1, wherein the boot control apparatus is an independent hardware unit of the computer.

5. The computer as claimed in claim 1, wherein the boot control apparatus is implemented via a program stored in an unalterable memory.

6. The computer as claimed in claim 1, wherein the at least one replaceable storage medium connector is coupled to the boot control apparatus such that all data exchanged between the replaceable storage medium and the computer is routed via the boot control apparatus.

7. The computer as claimed in claim 6, wherein the boot control apparatus comprises an encryption and decryption unit configured to encrypt and decrypt all data that is exchanged between the replaceable storage medium and the computer.

8. The computer as claimed in claim 7, wherein the boot control apparatus is configured to request a key from the user and to use the key for the encryption and decryption unit.

9. The computer as claimed in claim 8, wherein the boot control apparatus is configured to check a user'"'"'s authority via testing the suitability of the key specified by the user for decrypting data stored on the replaceable storage medium.

10. The computer as in claim 1, wherein the boot control apparatus is configured to request a key from the user and to transmit the key to the replaceable storage medium in the event the replaceable storage medium has an internal encryption and decryption unit.

11. The computer as claimed in claim 1, wherein the computer is configured such that only an operating system stored on the replaceable storage medium is executable by the computer.

12. The computer as claimed in claim 1, wherein the boot control apparatus is configured to prevent copying of the operating system stored on the replaceable storage medium to a mass memory.

13. The computer as claimed in claim 1, wherein the boot control apparatus permits the operating system stored on the replaceable storage medium to be copied to a mass memory only when an access-protected backup file is created as a copy and is transmitted to the mass memory.

14. The computer as claimed in claim 13, wherein the boot control apparatus is configured such the operating system, copied as the access-protected backup file, can be written back only to a checked and authenticated replaceable storage medium.

15. The computer as claimed in claim 1, further comprising:

a mechanical locking apparatus suitable for preventing the removal of the replaceable storage medium.

16. The computer as claimed in claim 15, wherein the mechanical locking apparatus is also suitable for preventing the insertion of a replaceable storage medium.

17. The computer as claimed in claim 15, wherein the mechanical locking apparatus is electromechanically operable.

18. The computer as claimed in claim 17, wherein the mechanical locking apparatus is controlled via the boot control apparatus.

19. The computer as claimed in claim 18, wherein the computer is configured such that the removal of the replaceable storage medium is prevented while an operating system stored on the replaceable storage medium is being executed on the computer.

20. The computer as claimed in claim 1, further comprising:

at least one switch for activating and deactivating the replaceable storage medium.

21. The computer as claimed in claim 1, wherein the at least one replaceable storage medium connector is configured as a serial data transmission port.

22. The computer as claimed in claim 21, wherein the at least one replaceable storage medium connector complies with one of the following specifications:

Universal Serial Bus (USB), Serial Attached Small Computer System Interface (SAS), and Serial Advanced Technology Attachment (SATA).

23. In combination, the computer of claim 1 and the replaceable storage medium, where the replaceable storage medium comprises:

at least first and second memory areas; and

a memory control unit configured to permit the computer to effect only read access to the first memory area in a first operating mode and read and write access to the first memory area in a second operating mode and to permit the computer to effect read and write access to the second memory area in both the first and second operating modes.

24. A replaceable storage medium for use with a computer, comprising:

at least first and second memory areas; and

a memory control unit configured to permit the computer to effect only read access to the first memory area in a first operating mode and read and write access to the first memory area in a second operating mode and to permit the computer to effect read and write access to the second memory area in both the first and second operating modes.

25. The replaceable storage medium as claimed in claim 24, wherein the memory control unit is configured to permit operation of the replaceable storage medium in the first and/or second operating mode only if access protection data supplied by the computer has been validated.

26. The replaceable storage medium as claimed in claim 25, wherein the access protection data is different for the first and second operating modes.

27. The replaceable storage medium as claimed in claim 24, further comprising an encryption and decryption unit that encrypts and decrypts all data to be stored on the replaceable storage medium and all data to be read from the replaceable storage medium.

28. The replaceable storage medium as claimed in claim 24, wherein the first memory area includes an operating system.

29. The replaceable storage medium as claimed in claim 24, wherein the first memory area includes a certificate for authenticating the replaceable storage medium.

30. A method for starting and operating a computer with an operating system stored on a replaceable storage medium, the method comprising:

authenticating the replaceable storage medium;

validating a user'"'"'s use authority to execute the operating system stored on the replaceable storage medium; and

executing the operating system stored on the replaceable storage medium in response to authenticating the replaceable storage medium and validating the user'"'"'s authorization.

31. The method as claimed in claim 30, wherein the authentication of the replaceable storage medium is validated using a certificate stored on the replaceable storage medium.

32. The method as claimed in claim 30, wherein the user'"'"'s use authority is validated via a password request and verification.

33. The method as claimed in claim 30, further comprising encrypting and decrypting data that is exchanged between the replaceable storage medium and the computer.

34. The method as claimed in claim 30, further comprising storing user-specific data, produced during operation of the operating system, in a write memory area of the replaceable storage medium.

35. The method as claimed in claim 30, further comprising storing data, specific to the computer and required during operation of the operating system, in a write memory area of the replaceable storage medium.

36. The method as claimed in claim 35, wherein the data is stored with a distinct identifier for the computer.