Networked computer security system

• US 6,125,457 A
• Filed: 12/29/1997
• Issued: 09/26/2000
• Est. Priority Date: 12/29/1997
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Compaq Computer Corporation (HP Inc.)
• Inventors: Crisan, Adrian, Jones, Brant W.
• Primary Examiner(s): Coleman, Eric
• Application Number:
  US08/999,439
• Time in Patent Office: 1,002 Days
• Field of Search: 712/1, 709/225, 709/229, 714/36, 713/201, 713/202
• US Class Current: 714/36
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power

Abstract

A hardware security password mechanism that allows administrators to manage the passwords more easily by managing them centrally on a network rather than on an individual system. Further, each individual machine interacts with the network to allow the system administrator to lock down the hardware features without having any local, hardware-based password mechanisms.

Claims

1. A computer network, comprising:

a plurality of computer systems, each having

a memory,

a microprocessor operatively connected to read and write said memory,

a graphics controller operatively connected to said microprocessor,

a video display connected to said graphics controller;

a local storage device storing applications to be executed;

an authorization server, having a unique server identifier and operable to verify user logon information;

wherein when one of said systems is powered on, said system checks said unique server identifier and selectively disables said system if said identifier does not match a predetermined set of acceptable identifiers.

2. The computer network of claim 1, further comprising an authentication circuit operatively connected to disable said computer system.

3. The computer network of claim 1, wherein said authorization server resides in the operating system of a network server.

4. The computer network of claim 1, wherein said authorization server resides in a stand-alone utility on a network server.

5. The computer network of claim 1, wherein said system is disabled by disabling said microprocessor of said system.

6. The computer network of claim 1, wherein said system is disabled by disabling a system motherboard of said system.

7. A computer network, comprising:

a plurality of computer systems, each having

a memory,

a microprocessor operatively connected to read and write said memory,

a graphics controller connected to said microprocessor,

a local storage device storing applications to be executed;

a video display connected to said graphics controller;

an authentication circuit operatively connected to disable said computer system;

an authorization server, having a unique server identifier and operable to verify user logon information;

wherein when one of said computer systems is powered on, both of the following occur;

said one of said computer systems requests said security identifier from said authorization server and selectively disables said system according to the results of said request; and

said one of said computer systems verifies said logon information with said authorization server, and said authentication circuit selectively disables said system according to said verification.

8. The computer network of claim 7, wherein said authentication circuit comprises unerasable floating-gate memory cells.

9. The computer network of claim 7, wherein if said user logon information identifies an administrator for one of said computer systems, said user logon information identifies an administrator for all said computer systems.

10. The computer network of claim 7, wherein said authorization server resides in the operating system of a network server.

11. The computer network of claim 7, wherein said authorization server resides in a stand-alone utility on a network server.

12. The computer network of claim 7, wherein said user logon information consists of a username and a password.

13. The computer network of claim 7, wherein said system is disabled by disabling said microprocessor of said system.

14. The computer network of claim 7, wherein said system is disabled by disabling a system motherboard of said system.

15. A computer system, comprising:

a memory,

a microprocessor operatively connected to read and write said memory,

a graphics controller operatively connected to said microprocessor,

a video display connected to said graphics controller;

a local storage device storing applications to be executed;

wherein said system is powered on, said system checks a server identifier of a computer network and selectively disables said system if said identifier does not match a predetermined set of acceptable identifiers.

16. The computer system of claim 15, wherein after starting said computer system, no application may be executed until said server identifier is checked.

17. The computer system of claim 15, wherein after a reset of said computer system, no application may be executed until said server identifier is checked.

18. The computer system of claim 15, further comprising an authentication circuit operatively connected to disable said computer system.

19. The computer system of claim 15, wherein said system is disabled by disabling said microprocessor of said system.

20. The computer system of claim 15, wherein said system is disabled by disabling a system motherboard of said system.

21. A method, comprising the steps of:

(a.) starting a computer system and executing a power-on-self-test;

(b.) determining if said computer system is connected to a computer network, and disabling said computer system is it is not;

(c.) transmitting to an authorization server, by said computer system, a request for a network identifier;

(d.) receiving said network identifier from said authorization server;

(e.) verifying said network identifier and disabling said computer system if said verification fails;

(f.) transmitting user logon information by said computer system to said authorization server;

(g.) receiving user authorization from said authorization server and selectively disabling said computer system according to said authorization; and

(h.) executing an application program on said computer system.

22. The method of claim 21, wherein said authorization server resides in the operating system of a network server.

23. The method of claim 21, wherein said authorization server resides in a stand-alone utility on a network server.

24. The method of claim 21, wherein said user logon information consists of a username and a password.