Method for controlling access to a computer system by utilizing an external device containing a hash value representation of a user password

• US 5,887,131 A
• Filed: 12/31/1996
• Issued: 03/23/1999
• Est. Priority Date: 12/31/1996
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Compaq Computer Corporation (HP Inc.)
• Inventors: Angelo, Michael F.
• Primary Examiner(s): Palys, Joseph E.
• Application Number:
  US08/777,621
• Time in Patent Office: 812 Days
• Field of Search: 395/188.01, 395/186, 395/187.01, 395/750.02, 395/750.05, 395/750.06, 395/183.12, 380/3, 380/4, 380/23, 380/25, 340/825.3, 340/825.34, 705/18, 705/44, 705/405
• US Class Current: 726/20
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A method for permitting access to secured computer resources based upon a two-piece user verification process. In the disclosed embodiment, the user verification process is carried out during a secure power-up procedure. At some point during the secure power-up procedure, the computer user is required to provide an external token or smart card to the computer system. The token or smart card is used to store an authentication value(s) required to enable secured resources. The computer user is then required to enter a plain text user password. Separate passwords can be used to enable various portions of the computer system. Once entered, a one-way hash function is performed on the user password. The resulting hash value is compared to an authentication value (token value) downloaded from the token. If the two values match, the power-on sequence is completed and access to the computer system and/or secured computer resources is permitted. If the two values do not match, power to the entire computer system and/or secured computer resources are disabled. The two-piece nature of the authorization process requires the presence of both the user password and the external token in order to access protected computer resources.

Claims

1. A method for permitting access to secured resources in a computer system incorporating circuitry for communicating with an external token that includes an authentication value, the computer system further incorporating a secure power-up procedure or other secure operating mode, the method comprising the steps of:

providing a plain text user password to the computer system while the computer system is in a secure period of operation, the secure period of operation being independent of the external token;

performing a one-way hash function on the plain text user password to produce a hash value;

communicatively coupling the external token to the computer system;

comparing the hash value with the authentication value stored in the external token, the comparison occurring in the computer system; and

enabling access to a secured internal computer resource in response to the result of said step of comparing the hash value with the authentication value stored in the external token.

2. The method of claim 1, wherein the secure period of operation includes a secure power-up procedure.

3. The method of claim 1, wherein said step of comparing the hash value with the authentication value stored in the external token occurs in secure computer memory.

4. The method of claim 1, wherein said step of comparing the hash value with the authentication value stored in the external token occurs in the secured computer resource.

5. The method of claim 1, wherein said step of performing a one-way hash function on the plain text user password to produce a hash value occurs in secure computer memory.

6. The method of claim 1, wherein the external token is a smart card.

7. The method of claim 1, wherein the external token is a Touch Memory™

device.

8. The method of claim 1, wherein the one-way hash function is SHA.

9. A method for enabling or disabling power in a computer system incorporating circuitry for communicating with an external token that includes an authentication value, the computer system further incorporating a secure power-on process or other secure operating mode and a power supply providing at least one power supply voltage to computer system components, the method comprising the steps of:

providing a plain text user password to the computer system while the computer system is in a secure period of operation, the secure period of operation being independent of the external token;

performing a one-way hash function on the plain text user password to produce a hash value;

communicatively coupling the external token to the computer system;

comparing the hash value with the authentication value stored in the external token; and

enabling or disabling at least one power supply voltage in response to the result of said step of comparing the hash value with the authentication value stored in the external token.

10. The method of claim 9, wherein said step of enabling or disabling at least one supply voltage comprises disabling all power supply voltages in the computer system if the hash value is not equal to the authentication value stored in the external token.

11. The method of claim 9, wherein the external token is a smart card.

12. The method of claim 9, wherein the external token is a Touch Memory™

device.

13. A computer system having security capabilities that operate in conjunction with an external token containing an authentication value, the computer system further having system memory and a secure power-on process or other secure operating mode, comprising:

a system bus;

a processor coupled to said system bus;

communication circuitry coupled to said processor for communicating with the external token;

a secured internal computer resource coupled to said processor;

security code stored in a processor readable medium for causing the processor to perform the steps of;

receiving a plain text user password while the computer system is in the secure operating mode, the secure operating mode being independent of the external token;

performing a one-way hash function on the plain text user password to produce a hash value;

receiving the authentication value from the external token;

comparing, in the computer system, the hash value with the authentication value stored in the external token; and

enabling or disabling said secured computer resource in response to the result of said step of comparing the hash value with the authentication value stored in the external token.

14. The computer system of claim 13, wherein said secure operating mode is a secure power-on procedure.

15. The computer system of claim 13, wherein said communication circuitry is configured to communicate with a smart card.

16. The computer system of claim 13, wherein said communication circuitry is configured to communicate with a Touch Memory™

device.

17. The computer system of claim 13, wherein said secured computer resource is a disk drive.

18. A computer system having security capabilities that operate in conjunction with an external token containing an authentication value, the computer system further having system memory and a secure power-on process or other secure operating mode, comprising:

a system bus;

a processor coupled to said system bus;

communication circuitry coupled to said processor for communicating with the external token;

a power supply providing at least one power supply voltage to computer system components;

power-on code stored in a processor readable medium for causing the processor to perform the steps of;

receiving a plain text user password while the computer system is in the secure operating mode, the secure operating mode being independent of the external token;

performing a one-way hash function on the plain text user password to produce a hash value;

receiving the authentication value from the external token;

comparing, in the computer system, the hash value with the authentication value stored in the external token; and

enabling or disabling at least one power supply voltage from said power supply in response to the result of said step of comparing the hash value with the authentication value stored in the external token.

19. The computer system of claim 18, wherein said step of enabling or disabling at least one supply voltage comprises causing the processor to disable all power supply voltages in the computer system if the hash value is not equal to the authentication value stored in the token.

20. The computer system of claim 18, wherein said step of enabling or disabling at least one supply voltage comprises causing the processor to enable a power supply voltage to a portion of the computer system if the hash value is equal to the authentication value stored in the token.