Self modifying access code for altering capabilities

• US 5,365,587 A
• Filed: 06/30/1993
• Issued: 11/15/1994
• Est. Priority Date: 03/11/1993
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chan, Michael J., Wiltgen, Paul L., Campbell, John E., Hajek, Steven F.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/085,216
• Time in Patent Office: 503 Days
• Field of Search: 380/4, 380/23, 380/25, 380/48, 380/49, 380/50, 380/24, 380/46, 340/825.21, 340/825.34, 395/275
• US Class Current: 713/183
• CPC Class Codes: G01R 31/31701 Arrangements for setting the Unit Under Test [UUT] in a test mode
• CPC Class Codes: G01R 31/31719 Security aspects, e.g. preventing unauthorised access during test
• CPC Class Codes: G06F 11/006 Identification G06F11/2289 takes precedence
• CPC Class Codes: G06F 11/2273 Test methods
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A system is disclosed for selectively altering the functional characteristics of a data processing system without physical or mechanical manipulation by providing an access code from a remote personal identification number generator to a secure controller and store of the computer system. This enables remote authorization of change in function of the computer system, such as performance tune up, speeding clock time, changing function and like changes. The computer system is first manufactured having a predetermined set of functional characteristics. A multibit alterable code which includes a functional characteristic definition is then initially loaded into physically secure, nonvolatile memory within the data processing system, utilizing an existing bus, or a fusible link which may be opened after loading is complete. The functional characteristic definition is loaded from nonvolitile memory into a nonscannable register within a secure portion of a control logic circuit each time power is applied to the data processing system and the definition is then utilized to enable only selected functional characteristics. Alternate functional characteristics may thereafter be selectively enabled by entering a security code which matches one of a number of preloaded codes and an encoded alternate functional characteristic definition. The alternate functional characteristic definition may be enabled on a one-time, metered, or regularly scheduled basis and variable capability data processing systems may be implemented in this manner utilizing a single manufactured system, without the necessity of manufacturing and storing multiple data processing system models.

Claims

1. A data processing system comprising:

a locally accessed computer system,

a secure remote access number generator for generating an access number for selectively transmitting said access number to said locally accessed computer system,

a local secure access control within said locally accessed computer system,

a data link for transmitting said access number along with a unique entered personal identification number of altering parameters of the locally accessed computer system after the locally accessed computer system has been accessed by a transmission from the secure remote access number generator, and

means within the locally accessed computer system for comparing said entered personal identification number to said access number a predetermined number of times,

wherein if there is a match between said entered personal identification number and said access number prior to said predetermined number, parameters of said locally accessed computer system are altered.

2. A data processing system according to claim 1 wherein the locally accessed computer system includes a processor, a memory, said local secure access control, means for altering parameters of said locally accessed computer system, and an I/O port.

3. A data processing system according to claim 2 further comprising a transmitter associated with said secure remote access generator for transmission of a generated security signal through the data link of the data processing system.

4. A data processing system according to claim 2 wherein said secure remote access number generator passes a personal identification number and a parameter modification code to the local secure access control of the locally accessed computer system, and further including a nonvolatile data area for storing personal identification numbers, a personal identification number generator and a function control register.

5. A data processing system according to claim 4 wherein said non-volatile data area includes a plurality of N data fields, a pointer to the Nth data field, and an operator responsible for managing the data fields and generating a new personal identification number to be used for altering the parameters of the locally accessed computer system.

6. A data processing system according to claim 5 wherein the local secure access control of the locally accessed computer system compares the personal identification number with a stored code or generated number and if the comparison results in a match new parameters are enabled.

7. A data processing system according to claim 6 further comprising:

control means for enabling a selected subset of parameters from a predetermined set of parameters, said control means being enabled each time a validated personal identification number is provided to the locally accessed computer system by comparison with a state of multibit alterable code within said non-volatile storage area.

8. The data processing system according to claim 7 further including means for selectively altering said multibit alterable code, wherein, based on said multibit alterable code, said control means enables an alternate subset of said set of parameters each time power is applied to said data processing system.

9. The data processing system of claim 8 wherein said multibit alterable code includes a unique identification code and wherein said means for selectively altering said multibit alterable code comprises means for entering an identification code and thereafter altering said multibit alterable code only in response to a match between said entered identification code and said unique identification code.

10. The data processing system of claim 9 wherein said multibit security code is initially stored within said physically secure nonvolatile storage device via a physically alterable electronic link and wherein said system further includes means for destroying said physically alterable electronic link after said initial storing of said multibit alterable code.

11. The data processing system of claim 10 further including means for storing said unique identification code at a central control facility where said remote access code generator is located.

12. The data processing system according to claim 9 wherein a particular subset of said predetermined set of parameters comprises a valid memory address range within said memory within said data processing system and wherein said system further includes means for limiting a user of said data processing system to access within said valid memory address range in response to enabling of said particular subset of said predetermined set of parameters.