Method for providing security to a computer on a computer network

• US 6,823,463 B1
• Filed: 05/16/2000
• Issued: 11/23/2004
• Est. Priority Date: 05/16/2000
• Status: Expired due to Term

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Newman, Palmer Eugene, Challener, David Carroll, Dayan, Richard Alan
• Primary Examiner(s): MOISE, EMMANUEL LIONEL
• Application Number:
  US09/571,192
• Time in Patent Office: 1,652 Days
• Field of Search: 713/200, 713/201, 713/202, 713/100, 709/217, 709/219, 709/220, 709/221, 709/222, 709/223, 709/225
• US Class Current: 726/5
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method for providing security to a computer on a computer network is disclosed. When a network-supplied privileged-access password (PAP) is encountered during a system boot-up operation of the computer, the network-supplied PAP is compared with a system-installed PAP. The network-supplied PAP is stored in a first location of a non-volatile memory of the computer, and the system-installed PAP is stored in a second location of the non-volatile memory of the computer. The system-installed PAP is previously entered to the computer via a keyboard of the computer. If the network-supplied PAP does not match the system-installed PAP, a tamper evident mechanism within the computer is set. Otherwise, if the network-supplied PAP matches the system-installed PAP, the boot-up operation continues to be performed. After the boot-up operation has been completed, configuration of the computer is allowed to be performed remotely over the computer network.

Claims

1. A method for providing security to a computer on a computer network for allowing remote configuration of said computer, said method comprising the steps of:

in response to a network-supplied privileged-access password (PAP) during a boot-up operation of said computer, comparing said network-supplied PAP with a systems installed PAP;

if said network-supplied PAP does not match said system-installed PAP, setting a tamper evident mechanism within said computer;

if said network-supplied PAP matches said system-installed PAP, continue performing said boot-up operation; and

after completion of said boot-up operation, allowing configuration of said computer to be performed remotely over said computer network.

2. The method according to claim 1, wherein said system-installed PAP is previously entered by a user via a keyboard associated with said computer.

3. The method according to claim 1, wherein said network-supplied PAP is supplied to said computer via a network message.

4. The method according to claim 1, wherein said method further includes a step of storing said system-installed PAP in a first location within a non-volatile memory.

5. The method according to claim 4, wherein said method further includes a step of storing said network-supplied PAP in a second location within said non-volatile memory.

6. The method according to claim 5, wherein said method further includes a step of locking said system-installed PAP and said network-supplied PAP to prevent access to said system-installed PAP and said network-supplied PAP.

7. The method according to claim 1, wherein said setting step further includes a step of halting said computer.

8. A computer system on a computer network, wherein said computer system can be configured remotely over said computer network, said computer system comprising:

means for comparing a network-supplied privileged-access password (PAP) with a system-installed PAP, in response to said network-supplied PAP during a boot-up operation of said computer system;

means for setting a tamper evident mechanism within said computer system if said network-supplied PAP does not match said system-installed PAP;

means for continuing to perform said boot-up operation if said network-supplied PAP matches said system-installed PAP; and

means for allowing configuration of said computer system to be performed remotely over said computer network after completion of said boot-up operation.

9. The computer system according to claim 8, wherein said system-installed PAP is previously entered by a user via a keyboard associated with said computer.

10. The computer system according to claim 8, wherein said network-supplied PAP is supplied to said computer via a network message.

11. The computer system according to claim 8, wherein said computer system further includes a means for storing said system-installed PAP in a first location within a non-volatile memory.

12. The computer system according to claim 11, wherein said computer system further includes a means for storing said network-supplied PAP in a second location within said non-volatile memory.

13. The computer system according to claim 12, wherein said computer system further includes a locking mechanism for locking said system-installed PAP and said network-supplied PAP to prevent access to said system-installed PAP and said network-supplied PAP.

14. The computer system according to claim 8, wherein said setting means further includes a means for halting said computer system.