 |
Description  |
|
|
BACKGROUND OF THE INVENTION
1. Field of the Invention
The invention generally relates to hard drives used with computer systems
and more particularly to a method and apparatus for preventing access to
the hard drive until a password is entered.
2. Description of the Related Art
The rising popularity of portable computers has corresponded to the
extraordinary improvements in the field, as portable computer systems
rapidly develop the capabilities and characteristics of desktop models.
For example, LCD displays for portable computers have become more
sophisticated and readable. Many portables now include floppy disk drives
to allow improved versatility and capacity. Furthermore, hard disk units
are becoming common, offering greater speed and capacity than floppy
drives.
The integration of hard drives into portable computers provides the user
with much greater memory than floppy disk drives. Hard drives offer
considerably shorter access times to data and programs. Consequently, the
information that is most important to the user is commonly stored on the
hard drive where the user has ready access. Information on the hard disk,
therefore, may be extremely confidential and valuable, and must be
protected. Ordinarily, access to the system as a whole is protected by a
password program that restricts access to those that enter a password.
Password programs commonly employ a power-on password stored in the
computer's CMOS memory. When the computer system initially powers up and
completes the self-test operations, the computer executes a power-on
password program. The password is read from the CMOS and compared to the
password entered by the user on the keyboard to determine whether the
correct password has been given. If so, the user is allowed access to the
system. If not, the system remains inaccessible until the correct password
is entered. Many systems allow only a few attempts at entering a password,
after which the system must be turned off and powered up again to make
another attempt.
For conventional desktop models, password programs generally provide
sufficient defense to unauthorized access. For portable computers,
however, power-on password protection may not be enough. Unlike their
desktop counterparts, portable computers are easily stolen. A portable
computer may be equipped with power-on password protection, which will
prevent unauthorized access to the information on the hard disk unit
through the computer system, but the hard drive unit may be physically
removed from the computer and installed in another system. Because the new
system does not employ password protection, the hard drive becomes
accessible to an unauthorized user, and the data vulnerable to theft and
misuse.
To prevent unauthorized access of this sort, the data may be encrypted
before it is placed on the hard disk. Encryption involves altering the
standard data code into a secret code, which must be decoded when it is
retrieved from memory before the data can be used. An unauthorized user
may thus put the drive in another computer to gain access to the code on
the hard disk, but the data will be meaningless if it is not decoded.
Encryption, however, requires support hardware and software in the
computer system to encode and decode the data. Encryption also reduces the
computer system's performance due to the delay while the encryption
mechanism encodes or decodes the data.
SUMMARY OF THE PRESENT INVENTION
The present invention prevents unauthorized access to the hard drive unit
by placing an access password on the hard drive itself. When the computer
system is powered up, the hard drive unit is in a LOCKED state and demands
the password before access is allowed. No access to the hard drive, other
than to wipe all of the data from the drive or to check the drive's
status, is permitted until the password on the hard disk is entered by the
user. If the user attempts to gain access to the drive by removing the
drive from the original computer and placing it in another system, the
hard drive remains inaccessible. Because the password is located on the
hard drive instead of in the system CMOS, the disk will remain LOCKED
regardless of the computer system in which it is operating.
In the preferred embodiment, the hard drive contains two passwords. The
first: is a user defined password that is established by the usual
operation of the computer. The second is a password determined by the
manufacturer, stored on the drive after encryption according to an
algorithm known only to the manufacturer. Only one of the passwords is
required to unlock the system. If the first password is forgotten, the
user can contact the manufacturer or authorized facility. After verifying
true ownership, the manufacturer or authorized facility uses the serial
number of the hard drive to determine the unit's second password and allow
the user access. After regaining access, the user may then change the
first password to something the user is more likely to remember.
Alternatively, the user may choose to restrict access to the hard drive
with only a single password. The password is created by the user and
provides the sole means of access to the hard drive. The manufacturer's
password is omitted from the drive so that even the manufacturer cannot
gain access to the drive unit. If the password is forgotten, however, the
user's only option is to wipe all of the data from the unit, thereby
losing all of the information stored on the disk. The hard drive is then
reset to its UNLOCKED status, and the user can provide a new password for
the drive.
Capabilities to activate and deactivate the hard drive password feature are
also provided.
BRIEF DESCRIPTION OF THE DRAWINGS
A better understanding of the present invention can be obtained when the
following detailed description of the preferred embodiment is considered
in conjunction with the following drawings, in which:
FIG. 1 is a block diagram of a computer incorporating the present
invention;
FIG. 2 is a flowchart illustration of a portion of the power on sequence of
a hard drive according to the present invention;
FIGS. 3A and 3B are flowcharts illustration of a portion of the command
sequence of a hard drive according to the present invention;
FIG. 4 is a flowchart illustration of operating sequences of the main
processor for setting up the hard disk password feature according to the
present invention; and
FIG. 5 is a flowchart illustration of the operating sequence of the main
processor for the hard disk password security system according to the
present invention.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
Referring now to FIG. 1, the letter C generally represents a computer
incorporating the present invention. A number of different blocks are used
in the computer C. This description of the computer C is provided to be
exemplary of the environment of the invention and is not intended to be
limiting as to the particular arrangement of the illustrated computer C.
The foundation of a computer system C according to the present invention is
a microprocessor 10. The microprocessor 10 has a host address bus 12, a
host data bus 14, and a host control bus 16. A main memory 18, composed of
random access memory (RAM), is connected to each of the host buses 12, 14,
16. The computer system C also includes a system control bus 20, a system
address bus 22, and a system data bus 24. The exchange of signals between
the system buses 20, 22, 24 and host buses 12, 14, 16 is controlled by a
bus controller 26. An address buffer 28 is connected to the host address
bus 12 and the system address bus 22, and a data buffer 30 is connected to
the host data bus 14 and the system data bus 24. Each buffer 28, 30 is
controlled by signals from the bus controller 26.
The system buses 20, 22, 24 are connected to a series of peripheral
devices. A video controller 32 is coupled to each of the buses 20, 22, 24,
and to communicate information to the user, a display 34 is connected to
the video controller 32. In addition, a keyboard interface 36 is connected
to the system buses 20, 22, 24. Connected to the keyboard interface 36 is
a keyboard 38 to allow the user to enter desired character sequences and
commands. Coupled to each of the system buses 20, 22, 24 is a port
interface 40, which provides a parallel port 42 and a serial port 44. A
floppy disk controller 46 is further connected to each system bus 20, 22,
24. A floppy disk unit 48, used to provide storage for the computer C, is
connected to the floppy disk controller 46. An electrically erasable
programmable read only memory (EEPROM) 50, connected to each bus 20, 22,
24, retains the extended setup information relating to board
configuration, as needed in a system according to the Extended Industry
Standard Architecture (EISA) or as needed for other purposes. A read only
memory (ROM) 52 includes the necessary basic operating software utilized
in a computer system C and is connected to each of the system buses 20,
22, 24. In addition, a real time clock (RTC)/CMOS memory 54 is connected
to the system buses 20, 22, 24 to provide constant time of day functions
and allow storage of various system constants and values related to the
system configuration and options. Finally, a hard disk unit 60 is
connected to each bus 20, 22, 24. The hard disk unit 60 includes a hard
drive and a controller for regulating access to and from the hard disk.
For the storage of particular operating data, the hard disk controller
includes a precompensation register. Preferably the hard drive is an IDE
or integrated drive electronics unit wherein the drive controller includes
a microprocessor and is affixed to the drive and receives commands via a
port connected to the buses 20, 22, 24. Operation and conventional
commands of an IDE drive are known to those skilled in the art.
Alternatively, other hard drives which contain microprocessors, such as
SCSI and ESDI drives, may also operate according to the present invention.
Proceeding now to the operation of the hard drive security system, the hard
disk password option allows the user to choose one of three levels of
security. The user may choose no security at all, in which case the hard
disk password is disabled and all hard disk commands are functional. If
protection is desired, the user has a choice of two levels of security.
LEVEL 1 provides the highest degree of protection to the user, as only one
password, up to seven characters defined by the user, is stored on the
hard drive. All hard drive commands become functional only after the user
defined password is entered following the power-on self-test (POST)
procedure. This is the UNLOCKED state. Until the password is entered, the
drive remains LOCKED, a non-volatile programmable state in which the drive
honors only a limited set of commands, as specified below. All other
commands are aborted. No data may be retrieved from the bus interface or
any service port. Consequently, only those that know the user defined
password have access to the hard drive. If the user forgets the password,
however, there is no way for the user to retrieve data. The only way to
regain access to the drive is by executing the WIPE DATA command, which
writes over all data on the hard drive, as described in more detail below.
For LEVEL 2 security, two passwords unlock the hard drive. The first is the
user defined password as described above. The second password is
preferably derived from the hard drive's serial number and is encrypted
according to a particular algorithm and stored at a second location on the
hard drive. Either password unlocks the hard drive. If the user forgets
the user defined password, the user can take the drive to the manufacturer
or a dealer. After verifying ownership, the dealer contacts the
manufacturer and conveys the hard drive's serial number. The manufacturer
encrypts a portion of the serial number, such as the last seven non-blank
characters, using the same algorithm as that included in the computer.
When the encryption is complete, the manufacturer gives the resulting
password to the dealer, who then uses the password to unlock the hard
drive. After the hard drive has been UNLOCKED, the user defined password
can be changed to suit the user.
Thus, the user can enable the hard disk password option by choosing LEVEL 1
or LEVEL 2 security. Either option places the disk unit in a LOCKED state
when the hard drive is next power cycled. When power is applied to the
system, the system commences its POST or power on, self-test procedure.
While POST is running, the POST program tests the hard drive to insure
that it is operating, and checks the CMOS memory to be certain that it
contains the correct hard disk information. The hard drive unit spins up
and becomes ready to operate, but remains in its LOCKED state. When all
sub-system tests have been completed, the POST program executes the
power-on password code, if it is enabled, followed by the hard disk
password code. The screen is cleared and the user is prompted for the hard
disk password. Until the password is entered, the drive remains LOCKED,
and only a limited set of commands is honored by the drive. All other
commands are aborted, allowing no data retrieval from the user sectors,
interfaces, or service ports. The set of commands honored by the drive
while in the LOCKED state includes, however, those that are required to
complete the POST operations. These commands allow the computer system to
determine whether the disk drive is operating properly. The commands do
not, however, allow any data retrieval from the disk. These commands are
the ID, initiate drive parameters, seek, recalibrate, write to the buffer
and read verify commands.
While LOCKED, the disk drive particularly responds to three commands. The
first is the ID command, which causes the hard drive to provide
information and a series of parameters identifying the hard drive's
characteristics and status. When the ID command is issued, the response
indicates the serial number of the drive, whether the password option is
supported on that drive, and whether the drive is LOCKED or UNLOCKED. The
ID command must be honored while the drive is LOCKED to allow the system
to determine whether the password routine should be executed.
The WIPE DATA command, a new command, is honored only when the drive is in
a LOCKED state, and aborts if the drive is UNLOCKED. When the WIPE DATA
command is issued, the drive is set busy until all user data sectors have
been written over. Upon completion, the drive resets to an UNLOCKED,
password-disabled state and clears the busy signal. If the drive is
interrupted during the WIPE DATA command, it remains in a LOCKED state.
The WIPE DATA command allows the user to regain usage of the disk drive if
the password is forgotten, although all data on the disk drive is lost.
The disk drive also honors the PASSWORD command, another new command, which
performs different functions, depending on the contents of a
precompensation register and whether the disk drive is LOCKED or UNLOCKED.
One of two preferred values, such as AAh or 55h, must be in the
precompensation register for the PASSWORD command to work. Otherwise, an
aborted command message will be returned. If an AAh value is in the
precompensation register and the drive is UNLOCKED when the PASSWORD
command is asserted, the disk drive will receive the contents of the
sector buffer, encrypt the contents of the second half of the buffer, and
store the contents of both halves at two password locations on the hard
drive. Thus new password values are written to the hard drive. If an AAh
value is in the precompensation register and the drive is LOCKED, however,
the drive unit will receive the contents of each half of the sector buffer
and compare them to the passwords stored at the two locations on the hard
disk, respectively. If the sector buffer contents match either of the
passwords, the drive unit will be unlocked.
When the PASSWORD command is issued with a 55h value in the precompensation
register and the drive is UNLOCKED, the set or change password capacity of
the disk drive is disabled. When the set or change password capacity is
disabled, the passwords stored at the two locations on the hard disk
cannot be changed or removed. The set or change password capacity will
remain disabled until the drive is power cycled. If the drive is LOCKED
when the PASSWORD command is issued with a 55h value in the
precompensation register, an aborted command will be returned. Therefore,
the set or change password capacity can only be disabled when the disk
drive is UNLOCKED.
In spite of the password security system on the drive, an unauthorized
person might be able to bypass the password feature by exchanging the
firmware associated with the microprocessor located on the drive. The
simplest way to change the firmware would be to replace the printed
circuit board on the drive with a circuit board that does not the employ
password security code. A circuit board from another disk drive could also
be used to access the data without using the password routine. To prevent
this sort of access, the password protected drives incorporate a unique
sector format so that circuit boards from prior model hard drives are not
compatible. As a result, the unauthorized user would be denied access.
To enhance security, the two passwords may also be stored at two more
locations elsewhere on the disk. In addition, the hard drive includes;
another method for detecting a circuit board swap. When the user enters
the user defined password, the password is stored on the magnetic media
and in an EEPROM located on the drive as well. The next time the system is
powered up, the password stored at the first location on the hard disk is
compared to the password stored in the EEPROM. If the passwords match, the
circuit board has not been replaced, and the system power up sequence
proceeds. If the passwords do not match, however, the circuit board has
been swapped. The password code then exits, and the drive remains LOCKED.
The drive cannot be unlocked until the original circuit board is returned
to the drive.
Operation of the drive as discussed above is shown in FIGS. 2, 3A and 3B.
In step 300 the drive will have proven performing prior power-on
operations. Control then proceeds to step 302 to determine if the password
values contained in the EEPROM and on the magnetic media are equal. If
not, this is an indication that the circuit board has been swapped and
control proceeds to step 304 to set a swapped flag. If not, control
proceeds to step 306 where the swapped flag is cleared. From steps 304 and
306 control proceeds to step 308 to determine if the password feature is
enabled. If not, control proceeds to step 310 where the LOCKED bit is
cleared. If it is enabled, control proceeds from step 308 to step 312
where the LOCKED bit is set. Control proceeds from step 310 or step 312 to
the remaining operations in power-on.
Once the hard drive is in operation and power-on procedures have been
completed, one of the functions of the drive is to scan for drive
commands. When a command is received it proceeds to an interpreter
sequence 400 shown in FIG. 3. The first step of sequence 402 determines if
the password command has been received. If not, control proceeds to step
404 to determine if the ID command had been received. If so, control
proceeds to step 406 and the ID command is performed. Control then
proceeds to step 408 where the ID value is returned. If it is not an ID
command, control proceeds from step 404 to step 410 to determine if the
swapped flag is set. If not, control proceeds to step 412 to determine if
the drive is LOCKED. If not, control proceeds to step 406 and the desired
command is performed. If the drive is LOCKED as determined in step 412 or
the board has been swapped as determined in step 410, control proceeds to
step 414 to determine if the command is one of those allowed as indicated
previously. If so, control proceeds to step 406 and the command is
performed. If not, control proceeds to step 416 where an error value is
set and control is returned.
If it was determined in step 402 that a password command had been received,
control proceeds to step 420 to determine if the swapped flag has been
set. If so, control proceeds to step 422 where an error flag is set and
control is returned. If not, control proceeds to step 421 to determine if
a 55h value is in the precompensation register. If so, control proceeds to
step 423 to determine if the drive is LOCKED. If so, control proceeds to
step 422. If not, control proceeds to step 425 where password changing is
disabled. Control then returns in step 427.
If a value of 55h was not present in step 421, control proceeds to step 424
to determine if the drive is LOCKED. If not, control proceeds to step 429
to determine if password changing is disabled. If so, control proceeds to
step 422. If not, control proceeds to step 426 to determine if an AAh
value is located on the precompensation register. If not, control proceeds
to step 422. If so, control proceeds to step 428 where the password values
located in the sector buffer are stored, both to the magnetic media and to
the EEPROM. Control then proceeds to step 430 which is a return.
If the drive was locked in step 424, control proceeds to step 432 to
determine if the AAh value is located in the precompensation register. If
not, control proceeds to step 422. If so, control proceeds to step 434 to
determine if the user or first passwords are equal. If so, control
proceeds to step 436 where the drive is unlocked and to step 438 where the
command status is returned. If the passwords are not equal as determined
in step 434, control proceeds to step 440 to determine if the manufacturer
or second passwords are equal. If not, control proceeds to step 422. If
so, control proceeds to step 436. Therefore the hard drive operates
according to the conditions and parameters set forth above.
A setup program initially sets and enables the hard disk password. The flow
diagram shown in FIG. 4 depicts the enabling procedure for the hard disk
password. Initially, the system determines at step 110 whether the drive
supports the hard drive password security using the ID command as
discussed below. If the drive does not support the hard drive password,
the routine exits at step 112. If the unit supports the hard drive
password, the user is prompted at step 114 to enter a desired level of
security. After the user enters a choice, control proceeds to step 116, to
determine whether the selected security level was NONE. If the NONE option
was selected, control proceeds to step 118. Because the hard disk password
is currently disabled, the drive unit is already UNLOCKED, the feature not
being enabled by the manufacturer. Thus, the sector buffer is cleared, and
control proceeds to step 120 where the PASSWORD command is issued and
zeros are stored on the disk. When zeros are placed in the sector buffer
and stored at the hard disk locations for the passwords, the hard disk
password feature is disabled. In the disabled state, the drive is UNLOCKED
and the set or change password capacity remains enabled. The routine then
exits at step 122, and the hard disk remains UNLOCKED.
If LEVEL 1 or LEVEL 2 security is chosen in step 114, control proceeds from
step 116 to step 124, where the system determines whether the power-on
password is enabled. The power-on password feature protects the entire
computer system from unauthorized access as discussed above. If the
power-on password feature is disabled, control proceeds to step 126, where
the user is prompted to enter a seven character, user defined password. If
the power-on password feature is enabled, control proceeds to step 128,
where the user is prompted to choose whether to set the hard disk password
equal to the power-on password. Setting the hard disk password equal to
the power-on password allows the user to enter only one password to gain
access to the system following a cold boot, as described below, instead of
entering both a power-on password and a hard disk password. If the user
chooses to set the two passwords equal, control proceeds to step 130,
where the hard disk password is set equal to the power-on password. If the
user chooses to use a different password, control proceeds to step 126,
and the user provides a personally chosen seven character password.
From steps 126 and 130, control proceeds to step 132, where the password
determined in steps 126 and 130 is entered in the first half of the sector
buffer. Control then proceeds to step 134 where a determination is made
whether LEVEL 1 or LEVEL 2 security was chosen. If LEVEL 1 was chosen,
control proceeds to step 136 and the password defined by the user in step
126 or 130 is stored in the second half of the sector buffer as well. If
LEVEL 2 security was chosen, control proceeds to step 138 where certain
characters of the drive serial number, such as the last seven non-blank or
non-space digits, are placed in the second half of the sector buffer. The
drive serial number is stored in the drive's memory, and is retrieved
using the ID command. Control proceeds from step 136 and step 138 to step
140 and the PASSWORD command is issued. The drive looks for one sector of
data containing two seven-byte password entries in the sector buffer. The
first password entry is stored directly at a first location on the hard
disk. The password is stored in a reserved location on the disk that is
not accessible to users. Control then proceeds to step 142 and the second
password entry is encrypted using circuitry located on the hard drive. The
encryption is performed according to a proprietary algorithm known only to
the manufacturer. Control then proceeds to step 144 and the encrypted
second password entry is stored at a second non-user location on the hard
disk. After the second password is stored by the hard drive, a completion
signal is provided and operation of the system program proceeds to step
146 where a 55h value is stored in the precompensation register. In hard
drives according to the preferred embodiment the precompensation register
is used as a scratch pad register, the register remaining for
compatibility reasons and the drive not needing externally provided
precompensation values. The PASSWORD command is then issued and the set or
change password capacity is disabled, preventing further alteration of the
password. The routine then exits at step 148 and returns to the main setup
program.
If the hard disk password was to be set or changed after the initial
setting, the above program would be modified to determine if the hard
drive was not swapped and was UNLOCKED before prompting for the security
level. If not, the program would exit.
The hard disk password code is executed each time the system is power
cycled. After the system completes the POST operations, the power-on
password code is executed if it is enabled. The hard disk password code,
depicted by the flow diagram in FIG. 5, then begins. First, the ID command
is issued in step 210, and the results are tested in step 212 to determine
whether the drive supports the hard disk password option. If it does not
support the option, the routine exits at step 214. If it does, the results
are again tested in step 216 to determine whether the disk drive is
currently LOCKED. If the drive is not LOCKED, the routine exits. If the
drive is LOCKED, control proceeds to step 218, where an attempt counter,
described in greater detail below, is cleared. Control then proceeds to
step 220 which prompts the user to enter a password. The user then enters
a password of up to seven characters. From step 220, control proceeds to
step 222 and the password entered by the user is downloaded to each half
of the sector buffer.
Because an AAh value is preferably stored in the precompensation register
at the time the system is powered up, when the PASSWORD command is given
at step 224, the drive expects to receive one sector of data containing
two seven-byte password entries in the sector buffer. The hard drive
controller compares the entry in the first half of the sector buffer with
the password stored at the first location on the hard drive. If the
password matches the entry, the hard drive controller unlocks the disk. If
the password is incorrect, however, the entry in the second half of the
sector buffer is compared to the encrypted password stored at the second
location on the hard drive. If a match is found, the hard drive is
UNLOCKED. If not, the drive remains LOCKED. At step 226, the processor
issues the ID command and determines whether the password unlocked the
drive at step 228. If the drive is unlocked, an OK symbol is displayed in
step 230, a system internal drive status flag is set to the UNLOCKED
state, and the system proceeds with all of the hard drive commands
available. In step 232, a 55h value is stored in the precompensation
register and the PASSWORD command is issued at step 234, thus disabling
the set or change password capacity.
If the entry matches neither password, the drive remains LOCKED. Control
proceeds from step 228 to step 236, where the attempt counter is
incremented by 1. The attempt counter reflects how many times the user has
tried to enter a valid password and failed. Control then proceeds to step
238 and it is determined whether the counter value equals 3. If the
counter has not yet reached a value of 3, control returns to step 220 to
prompt the user for a another attempt at the password. If the counter
value has reached 3, a bad password prompt is displayed and the hard disk
is marked as non-bootable at step 240, the set or change password capacity
remains enabled, and the routine exits. After the disk is so marked, it
remains inaccessible to the user until the system is power cycled and the
user enters the correct password, or the WIPE DATA command is executed.
In an alternative embodiment:, the hard drive may also be unlocked using
the power on password program, which runs immediately before the hard disk
password code. When the user enters the password for access to the
computer system, the password is first used as the power on password.
Next, the password is directed to the hard drive and an attempt is made to
unlock it using the power on password. If the passwords are not the same,
the attempt to unlock the hard drive fails and has no other effect. If the
passwords are the same, however, the hard drive is unlocked and the set or
change password capacity will be disabled. The processor then finishes the
power on password routine.
The computer system then executes the hard drive password routine. When the
processor checks the status of the hard drive, the hard drive will be
UNLOCKED. Therefore, the routine will exit and the password will not have
to be entered a second time.
The hard disk password may preferably be changed or disabled in the hard
drive p | | |
