METHOD AND APPARATUS FOR SECURE CREDENTIAL ENTRY WITHOUT PHYSICAL ENTRY

• US 20070150953A1
• Filed: 10/06/2006
• Published: 06/28/2007
• Est. Priority Date: 10/07/2005
• Status: Active Grant

• Current Assignee: Kingston Digital, Inc. (Kingston Technology Corporation)
• Original Assignee: Imation Corporation (Glassbridge Enterprises, Inc.)
• Inventors: Hamid, Laurence, Reusing, Lawrence
• Granted Patent: US 8,661,540 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 9/4406 Loading of operating system

Abstract

A method and apparatus are disclosed wherein a portable memory storage device is provided for interfacing with a communications port of the computer system. During operating system start up of the operating system of the computer, fields relating to security of the operating system are prompted for. The portable memory store retrieves from memory therein data for populating said fields and provides same to the computer system mimicking a data entry device other than a portable memory store.

Claims

1. A method comprising:

providing a computer system;

providing a peripheral memory storage device coupled with an interface of the computer system for communication therewith;

starting a Windows®

based operating system on the computer system;

displaying a Windows®

login screen; and

,

automatically populating fields within the Windows®

login screen with data extracted from the peripheral memory storage device and provided to the computer system via the interface, the interface enabled by the Windows®

operating system prior to display of the login screen.

2. A method according to claim 1, comprising completing a login process by performing one of authenticating and rejecting the user in dependence upon the data extracted from the peripheral memory storage device and populated within the fields of the Windows®

login screen.

3. A method according to claim 2 wherein the interface comprises an external interface to the computer system.

4. A method comprising:

providing a computer system comprising a BIOS memory having a BIOS stored therein;

providing a peripheral memory storage device coupled with an interface of the computer system for communication therewith, the interface enabled by execution of default interface drivers forming part of the BIOS, the peripheral memory storage device having stored therein user authorization data of a user;

in response to a system login request event, transferring from the peripheral memory storage device said user authorization data via the interface in accordance with a functionality of a manual symbol entry device.

5. A method according to claim 4, wherein the symbol entry device comprises a keyboard.

6. A method according to claim 5, wherein transferring comprises:

extracting user authorization data from memory of the peripheral storage device; and

providing the user authorization data sequentially to the computer system in accordance with a functionality of a manual symbol entry device.

7. A method according to claim 6, wherein transferring provides data for supporting an automated logging in operation to an application in execution on the computer system.

8. A method according to claim 7, wherein the application is an operating system of the computer system.

9. A method according to claim 8, comprising:

prior to transferring of data therefrom providing second user authorization data to the peripheral memory storage device;

verifying the second user authorization data against previously stored data to form a comparison result;

when the comparison result is indicative of an authorized user, transferring the data therefrom; and

when the comparison result is indicative of other than an authorized user, other than transferring of the data therefrom

10. A method according to claim 9, wherein the second user authorization data comprises biometric information.

11. A method according to claim 10, wherein the biometric information comprises a fingerprint.

12. A method comprising:

providing a computer system comprising a BIOS memory having a BIOS stored therein, the BIOS including support programming for a first symbol entry device for having symbols manually entered therewith for provision to the computer system, the BIOS further including a default interface driver forming part of the BIOS and for supporting a default interface and peripheral devices coupled therewith;

providing a peripheral memory storage device having stored therein user authorization data and coupled with the default interface for communication therewith, the default interface enabled by execution of the default interface driver;

executing an operating system application of the computer system comprising a system login request event;

retrieving from memory within the peripheral storage device first user authorization data; and

,

transferring from the peripheral storage device in response to the system login request event the first user authorization data via the default interface mimicking data entered at the first symbol entry device.

13. A method according to claim 12, wherein the symbol entry device comprises a keyboard.

14. A method according to claim 12, wherein the symbol entry device comprises a handwriting tablet.

15. A method according to claim 12, wherein the symbol entry device comprises a microphone.

16. A method according to claim 12, wherein the symbol entry device comprises a touch sensitive display.

17. A method according to claim 12, wherein the default interface of the computer system is the Universal Serial Bus (USB)

18. A method according to claim 12, wherein the default interface of the computer system is the PMCIA interface port.

19. A method according to claim 12, wherein the default interface of the computer system is a wireless interface port.

20. A method according to claim 12, wherein executing an operating system application comprises starting a Microsoft®

based operating system and automatically populating fields within the Microsoft®

login screen with the first user authorization data.

21. A method as defined within claim 20, wherein the computer operating system is one of Microsoft®

Windows 98™

, Microsoft®

Windows NT™

, and Microsoft®

Windows XP™

.

22. A method according to claim 20, wherein the interface is enabled by the Windows®

operating system prior to display of the system login prompt.

23. A method as defined within claim 22, wherein the computer operating system is one of Microsoft®

Windows 98™

, Microsoft®

Windows NT™

, and Microsoft®

Windows XP™

.

24. A method according to claim 12, wherein executing an operating system application comprises starting a UNIX operating system and automatically populating fields within the UNIX login prompt with the first user authorization data.

25. A method according to claim 12, wherein the peripheral memory storage device employs a generic peripheral interface driver loaded from the BIOS even when a device is other than coupled thereto.

26. A method as per claim 12, wherein the peripheral memory storage device comprises a biometric sensor for providing a biometric sample of the user to validate the user prior to transmitting the user authorization data via the interface.

27. A method according to claim 26, wherein the biometric sample comprises a fingerprint.

28. A method according to claim 12, wherein the user authorization data includes text character data that is other than enterable from a standard keyboard.

29. A method according to claim 26, comprising a timer for, upon expiration of a known time limit, requiring a biometric sample of the user to revalidate the user prior to transmitting the user authorization data via the interface.