Method and system for preboot user authentication

• US 7,174,463 B2
• Filed: 10/04/2001
• Issued: 02/06/2007
• Est. Priority Date: 10/04/2001
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Cromer, Daryl Carvis, Locker, Howard Jeffrey, Jankowsky, Joshua James, Ward, James Peter, Trotte, Andy Lloyd
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Cervetti; David Garcia
• Application Number:
  US09/971,553
• Publication Number:
  US 20030070079A1
• Time in Patent Office: 1,951 Days
• Field of Search: 713/186
• US Class Current: 713/186
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/575 Secure boot

Abstract

A method for authentication in a computer system includes registering a biometric template in the computer system, thereafter, verifying the authenticity of the registered biometric template and then comparing the biometric template with a biometric image of a user if the biometric template is authentic. If the user'"'"'s biometric image matches the biometric template, the computer system will continue to boot.

Claims

1. A method for authenticating a user of a computer system, the method comprising the steps of:

(a) registering a biometric template for the user in the computer system;

(b) verifying the authenticity of the biometric template each time the user attempts to log on to the computer system; and

(c) comparing the biometric template with a biometric image of the user if the biometric template is authentic.

2. The method of claim 1, wherein the registering step (a) further includes the steps of:

(a1) prompting an authorized user to enter biometric information via a sensor coupled to the computer system;

(a2) creating the biometric template from the biometric information;

(a3) calculating a biometric template hash of the biometric template by hashing a copy of the biometric template; and

(a4) encrypting the biometric template hash.

3. The method of claim 2, wherein the registering step (a) further includes the steps of

(a5) linking the biometric template to the encrypted biometric template hash;

and

(a6) storing the linked biometric template and encrypted biometric template hash in a memory in the computer system.

4. The method of claim 2, wherein the step of calculating the biometric template hash (a3) further includes the step of:

(a3i) applying a hash algorithm to the biometric template to hash the biometric template.

5. The method of claim 4, wherein the step of encrypting (a4) further includes the steps of:

(a4i) performing a digital signature on the biometric template hash.

6. The method of claim 3, wherein the step of storing (a6) further includes the step of

(a6i) providing a nonvolatile memory for storing the linked biometric template and encrypted biometric template hash.

7. The method of claim 3, wherein the step of comparing the user'"'"'s biometric image (c) further includes the steps of:

(c1) initiating a preboot sequence in a BIOS;

(c2) prompting the user to enter his or her biometric information through the sensor; and

(c3) sending the biometric image from the sensor to the BIOS.

8. The method of claim 7, wherein the verifying step (b) further includes the steps of:

(b1) retrieving from memory the linked biometric template and encrypted biometric template hash;

(b2) hashing the linked biometric template to form a first digest value;

(b3) decoding the encrypted biometric template hash to form a second digest value; and

(b4) comparing the first digest value to the second digest value.

9. The method of claim 8 further including the step of:

(d) terminating the preboot sequence if the first digest value and the second digest value do not match.

10. The method of claim 9, wherein the comparing step (c) further includes the steps of:

(c4) loading the biometric template into a matching engine in the BIOS;

(e5) loading the user'"'"'s biometric image into the matching engine; and

(c6) applying a matching algorithm to compare points in the user'"'"'s biometric image to points in the biometric template.

11. The method of claim 10 further including the step of:

(e) booting the computer system if the user'"'"'s biometric image matches the biometric template.

12. The method of claim 11 further including the step of:

(f) terminating the preboot sequence if the user'"'"'s biometric image fails to match the biometric template.

13. A computer readable medium containing programming instructions for authenticating a user of a computer system, the programming instructions for:

(a) registering a biometric template for the user in the computer system;

(b) verifying the authenticity of the biometric template each time the user attempts to log on to the computer system; and

(c) comparing the biometric template with a biometric image of the user if the biometric template is authentic.

14. The computer readable medium of claim 13, wherein the registering instruction (a) includes:

(a1) prompting an authorized user to enter biometric information via a sensor coupled to the computer system;

(a2) creating the biometric template from the biometric information;

(a3) calculating a biometric template hash of the biometric template by hashing a copy of the biometric template; and

(a4) encrypting the biometric template hash.

15. The computer readable medium of claim 14, wherein the registering instruction (a) further includes instructions for:

(a5) linking the biometric template to the encrypted biometric template hash; and

(a6) storing the linked biometric template and encrypted biometric template hash in a memory in the computer system.

16. The computer readable medium of claim 14, wherein the instruction for calculating the biometric template hash (a3) further includes instructions for:

(a3i) applying a hash algorithm to the biometric template to hash the biometric template.

17. The computer readable medium of claim 16, wherein the instruction for encrypting (a4) further includes the instructions for:

(a4i) performing a digital signature on the biometric template hash.

18. The computer readable medium of claim 15, wherein the instruction for storing (a6) further includes the instruction for:

(a6i) providing a nonvolatile memory for storing the linked biometric template and encrypted biometric template hash.

19. The computer readable medium of claim 15, wherein the instruction for comparing the user'"'"'s biometric image (c) further includes the instructions for:

(c1) initiating a preboot sequence in a BIOS;

(c2) prompting the user to enter his or her biometric information through the sensor; and

(c3) sending the biometric image from the sensor to the BIOS.

20. The computer readable medium of claim 19, wherein the verifying instruction (b) further includes the instructions for:

(b1) retrieving from memory the linked biometric template and encrypted biometric template hash;

(b2) hashing the linked biometric template to form a first digest value;

(b3) decoding the encrypted biometric template hash to form a second digest value; and

(b4) comparing the first digest value to the second digest value.

21. The computer readable medium of claim 20 further including the instruction for:

(d) terminating the preboot sequence if the first digest value and the second digest value do not match.

22. The computer readable medium of claim 21, wherein the comparing instruction (c) further includes the instructions for:

(c4) loading the biometric template into a matching engine in the BIOS;

(c5) loading the user'"'"'s biometric image into the matching engine; and

(c6) applying a matching algorithm to compare points in the user'"'"'s biometric image to points in the biometric template.

23. The computer readable medium of claim 22 further including the instruction for:

(e) booting the computer system if the user'"'"'s biometric image matches the biometric template.

24. The computer readable medium of claim 23 further including the instruction for:

(f) terminating the preboot sequence if the user'"'"'s biometric image fails to match the biometric template.

25. A system for authenticating a user of a computer system comprising:

a processor running an application program for registering a biometric template for the user;

means for verifying authenticity of the biometric template each time the user attempts to log on to the computer system;

a sensor coupled to the processor for allowing the user to enter his or her biometric image into the computer system; and

means for comparing the biometric template with the biometric image of the user if the biometric template is authentic.

26. The system of claim 25, wherein the application program hashes a copy of the biometric template to form a biometric template hash.

27. The system of claim 26 further including an embedded security system for encrypting the biometric template hash by performing a digital signature on the biometric template hash.

28. The system of claim 27, wherein the application program links the biometric template to the encrypted biometric template hash, and writes the linked biometric template and encrypted biometric template hash to a memory in the computer system.

29. The system of claim 28, wherein the memory is non-volatile memory accessible by a BIOS.

30. The system of claim 29, wherein the means for verifying is in the BIOS.

31. The system of claim 30, wherein the BIOS retrieves the linked biometric template and encrypted biometric template hash, hashes the linked biometric template to form a first digest value, decodes the encrypted biometric template hash to form a second digest value, and compares the first digest value to the second digest value.

32. The system of claim 31, wherein the means for comparing is a matching engine in the BIOS, wherein the biometric image of the user and the authenticated biometric template is loaded into the matching machine.

33. The system of claim 31 further including means for terminating a preboot sequence if the first digest value and second digest value do not match.

34. The system of claim 33 further including means for terminating the preboot sequence if the user'"'"'s biometric image fails to match the biometric template.

35. A method for registering a biometric template in a computer system, the method comprising the steps of:

(a) prompting a user to provide biometric information to a computer system via a sensor coupled to the computer system;

(b) creating a biometric template from the biometric information;

(c) calculating a biometric template hash from the biometric template by hashing a copy of the biometric template; and

(d) encrypting the biometric template hash.

36. The method of claim 35, wherein the step of encrypting (d) further includes the steps of:

(d1) performing a digital signature on the biometric template hash.

37. The method of claim 35 further including the steps of:

(e) linking the biometric template to the encrypted biometric template hash; and

(f) storing the linked biometric template and encrypted biometric template hash in a memory in the computer system.

38. The method of claim 37, wherein the step of storing (f) further includes the step of:

(f1) providing a nonvolatile memory for storing the linked biometric template and encrypted biometric template hash.

39. A computer readable medium containing programming instructions for registering a biometric template in a computer system, including the instructions for:

(a) prompting a user to provide biometric information to a computer system via a sensor coupled to the computer system;

(b) creating a biometric template from the biometric information;

(c) calculating a biometric template hash from the biometric template by hashing a copy of the biometric template; and

(d) encrypting the biometric template hash.

40. The computer readable medium of claim 39, wherein the instruction for encrypting (d) further includes the instructions for:

(d1) performing a digital signature on the biometric template hash.

41. The computer readable medium of claim 39 further including instructions for:

(e) linking the biometric template to the encrypted biometric template hash; and

(f) storing the linked biometric template and encrypted biometric template hash in a nonvolatile memory in the computer system.