Method and apparatus for controlling network and workstation access prior to workstation boot

• US 5,444,850 A
• Filed: 08/04/1993
• Issued: 08/22/1995
• Est. Priority Date: 08/04/1993
• Status: Expired due to Term

• Current Assignee: Trend Software Technology, Inc.
• Original Assignee: Trend Micro Devices, Inc.
• Inventors: Chang, Steve M.
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US08/101,837
• Time in Patent Office: 748 Days
• Field of Search: 395/700, 395/200, 395/575, 395/325, 395/600, 380/25, 380/49, 380/3, 380/23
• US Class Current: 709/222
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/805 using a security table for the storage sub-system
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: G06F 9/4416 Network booting; Remote initial program loading [RIPL]
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and apparatus for preboot file and information transfer between workstations and other workstations or workstations and servers on local area networks. During a workstation boot sequence, the various components of the workstation and network operating system are loaded and executed. Since all control of the workstation after the boot sequence is passed to the workstation operating system, any management tasks performed after boot must be performed by application programs running on the workstation. The present invention overcomes problems created by using such application programs to perform management tasks by providing a hardware component, for example a ROM or PROM containing appropriate programming placed in the usually unused boot ROM socket of a LAN card installed in the individual workstations, or a chip including a PROM or ROM built onto the motherboard or system board of the individual workstations. The program in the PROM is set up so that, at system startup, prior to loading of the workstation operating system software during the boot sequence, it performs certain operating system functions by using the basic input/output system (BIOS) of the workstation to enable the workstation to communicate with a server on the network and make the necessary resources of the workstation available to a server management application running on the server via the network. This process, controlled by a system administrator, allows a variety of preboot functions to take place in the workstation.

Claims

1. An apparatus for enabling predetermined workstation resources to be controlled via a network connection prior to loading of a complete workstation operating system onto a storage medium accessible to a processor of the workstation comprising:

a) transferring control means, operable upon workstation startup for transferring control from a workstation preboot process to an external process prior to loading the complete workstation operating system onto a storage medium of the workstation accessible to a processor of the workstation;

b) responsive to the external process, network connection initiation means for initiating a network connection of the workstation to a server on the network;

c) upon initiating the network connection, workstation authentication means for authenticating the workstation identification through the server to ensure that the workstation is authorized to be connected to the network;

d) upon authenticating the workstation identification, file updating means for updating selected files located within the workstation based upon data located within files in the server;

e) upon updating the selected files, return control means for returning control to the workstation boot process to load the complete workstation operating system.

2. The apparatus defined by claim 1 wherein the transferring control means comprises means for detecting existence of a program module in a ROM socket of a network interface card to which control is passed upon the detection of its existence.

3. The apparatus defined by claim 1 wherein the network connection initiation means comprises:

a) means for loading a network communications program onto a storage medium accessible to a processor of the workstation;

b) means for executing said loaded network communications program to establish connection with a server management application which is executing in a server coupled to said network.

4. The apparatus defined by claim 3 wherein the workstation authentication means comprises:

a) means for receiving instructions from said server management application instructing the workstation to send a unique identifier to the server over the network;

b) means for receiving from said server one of an authorization and a denial of authorization.

5. The apparatus defined by claim 4 wherein the file updating means comprises means for determining that said authorization has been received receiving file update information from said server and sending a confirmation upon completion of said updating to said server.

6. The apparatus defined by claim 1 wherein the return control means comprises means for exiting the program module in the ROM socket and returning to said workstation boot process.

7. An apparatus for enabling predetermined workstation resources to be controlled via a network connection prior to loading of a complete workstation operating system onto a storage medium accessible to a processor of the workstation comprising:

a) transferring control means, operable upon workstation startup for transferring control from a workstation preboot process to an external process prior to loading the complete workstation operating system onto a storage medium of the workstation accessible to a processor of the workstation;

b) responsive to the external process, network connection initiation means for initiating a network connection of the workstation to a server on the network and sending a network connection signal;

c) responsive to the network connection signal, workstation authentication means for authenticating the workstation identification through the server to ensure that the workstation is authorized to be connected to the network and sending an authentication signal; and

d) responsive to the authentication signal, return control means for returning control to the workstation boot process to load the complete workstation operating system.