 |
Claims  |
|
|
What is claimed is:
1. A portable computer system comprising:
input means for inputting at least a password;
main processor means for controlling the operation of the system to perform
data processing; and
password control means for holding one or more registered passwords, the
one or more registered passwords being unreadable by direct access from
said main processor means, for allowing the main processor means to
perform the data processing when a password identical to one of the
registered passwords held in the password control means is input by said
input means,
wherein said password control means includes nonvolatile password memory
means for storing one or more registered passwords, and password checking
means for checking whether the input password coincides with any one of
the registered passwords stored in said password memory means,
wherein said main processor means is connected to said password checking
means via a system bus, and said password checking means is connected to
said password memory means via a memory bus that is independent of said
system bus, to hide said password memory means from said main processor
means, and
wherein said password checking means includes sub-processor means for
performing the password checking on an input password, and control logic
means connected to said sub-processor means via an internal bus, for
searching said password memory means for a registered password which
coincides with the input password, and for reporting the result of the
search to said sub-processor means, under the control of said
sub-processor means.
2. A system according to claim 1, wherein said password control means
includes restricting means for restricting a functional range of the data
processing based on a type of the registered password which coincides with
the input password.
3. A system according to claim 1, wherein said password control means
includes means for registering, updating, and deleting passwords in said
password memory means.
4. A system according to claim 1, wherein said input means includes a
keyboard whose keys may be selectively operated to input at least a
password, and said sub-processor means includes a keyboard control means
for sensing the keys of said keyboard being operated for inputting the
password.
5. A system according to claim 13, wherein said password checking means
includes communication register means for temporarily storing a password
checking request supplied from said main processor means and a password
checking result supplied from said sub-processor means.
6. A system according to claim 1, wherein said main processor means
includes setup means for setting up a system configuration with respect to
available functional modes and hardware resources.
7. A system according to claim 5, wherein said main processor means
includes means for supplying a password checking request to said password
checking means when a power source is switched on in a power-on password
checking mode.
8. A system according to claim 6, wherein said password memory means
includes a memory area for storing one or more registered passwords along
with access right data which concern the available hardware resources and
are respectively assigned to the registered passwords, said password
checking means includes retrieving means for retrieving from said password
memory means the access right data assigned to the registered password
which coincides with the input password, and said password control means
includes configuration changing means for changing the system
configuration based on the access right data retrieved by said retrieving
means.
9. A system according to claim 7, wherein said configuration changing means
includes security register means for storing access right data retrieved
by said retrieving means, and logic means for selectively disabling access
to the hardware resources according to the access right data stored in
said security register means.
10. A system according to claim 7, wherein said password checking means
includes means for registering, updating, and deleting passwords in said
password memory means.
11. A system according to claim 6, wherein said system further comprises
secondary power-supported system memory means, for storing processing
state data obtained when the data processing is interrupted, wherein said
main processor means includes suspend means for interrupting the data
processing and saving the registered password which is detected to
coincide with an input password during the password checking necessary for
allowing the data processing to proceed, along with the processing state
data in said system memory means when a main power source is switched off
in a resume mode, and resume means for restoring the saved processing
state data when the main power source is switched on in the resume mode,
and wherein said password checking means includes checking means for
checking whether an input password coincides with the registered password
saved in said system memory means, when a password checking request is
supplied from said main processor means in the resume mode.
12. A system according to claim 11, wherein the password checking effected
by said password checking means is set prior to the operation of said
resume means.
13. A system according to claim 5, wherein said system further comprises
BIOS memory means, for storing a basic input and output system program for
said main processor means, and various peripheral devices provided for the
data processing, wherein said main processor means is connected via a
system bus to hardware resources, including said BIOS memory means, said
various peripheral devices, and said password control means.
14. A system according to claim 10, wherein said various peripheral devices
includes a hard disk drive, a floppy disk drive, a serial port, a printer
port, and an IC card, selectively.
15. A system according to claim 5, wherein said system further comprises
secondary power-supported display memory means, for storing display data
produced by said main processor means, display means for displaying the
display data stored in said display memory means, secondary
power-supported system memory means, for storing processing state data
obtained when the data processing is interrupted, and wherein said main
processor means includes suspension means for interrupting the data
processing and saving the processing state data in said system memory
means when a main power source is switched off in a resume mode, resume
means for restoring the saved processing state data when the main power
source is switched on in the resume mode, and display inhibiting means for
inhibiting the display data stored in said display memory means from being
displayed until the data processing is permitted by said password control
means.
16. A system according to claim 15, wherein said display inhibiting means
includes means for causing the display means to be either a blank display
state or a nonoperative state to inhibit the display data from being
displayed.
17. A system according to claim 16, wherein said display inhibiting means
includes saving means for temporarily moving the display data from said
display memory means into said system memory means to inhibit the display
data from being displayed.
18. A system according to claim 17, wherein said main processor means
includes means for setting display data representing a password-input
requesting message into said display memory means instead of the display
data temporarily moved into said system memory means by said saving means.
19. A system according to claim 16, wherein said display means has a
graphic display mode for displaying display data of a graphic-form and a
text display mode for displaying display data of a text form, said display
memory means including a first memory area for selectively storing all of
the text-form display data and part of the graphic-form display data and a
second memory area for storing the remainder of the graphic-form display
data, and said display inhibiting means including display mode switching
means for temporarily switching the display means from the graphic display
mode to the text display mode to inhibit the graphic-form display data
stored in said display memory means from being displayed.
20. A system according to claim 19, wherein said main processor means
includes means for temporarily saving the graphic-form display data stored
in a portion of the first memory area of said display memory means and
setting text-form display data representing a password-input requesting
message, in the portion of said first memory area, after the display mode
of said display means is switched to the text display mode by said display
mode switching means.
21. A portable computer system comprising:.
input means for inputting at least a password;
main processor means for controlling the operation of the system to perform
data processing; and
password control means for holding one or more registered passwords, the
one or more registered passwords being unreadable by direct access from
said main processor means, for allowing the main processor means to
perform the data processing when a password identical to one of the
registered passwords held in the password control means is input by said
input means,
wherein said main processor means includes operation lock means for locking
and unlocking the operations of said input means and other predetermined
hardware resources during the data processing, wherein the inputting of a
password is excepted from the operation lock on said input means, and said
password control means holds one or more second registered passwords in
addition to the first registered passwords to allow the unlocking of the
locked operations when a password identical to one of the second
registered passwords is input by said input means during the operation
lock.
22. A system according to claim 21, wherein said password control means
includes nonvolatile password memory means for storing the first
registered passwords with the second registered passwords, each of the
second registered passwords being assigned to a corresponding one of said
first registered passwords, and password checking means for checking
whether a power-on password input by said input means coincides with any
one of the first registered passwords in response to a password checking
request supplied from said main processing means prior to start of the
data processing, and whether an operation password input by said input
means coincides with the second registered password assigned to the first
registered password which is detected to coincide with the input power-on
password, in response to a password checking request supplied from said
main processing means succeeding the operation lock.
23. A system according to claim 22, wherein said password checking means
includes means for subjecting the first registered password which is
detected to coincide with the input power-on password, to the operation
password checking in a case where no second registered password has been
assigned to the detected first registered password. |
|
 |
|
 |
Claims |
|
|
|
Description |
|
|
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to a portable computer system having a
security function for confirming that the operator is an authorized user.
2. Description of the Related Art
Recently, personal computers have been reduced in size and weight to be
more easily portable, and enhanced in performance and functions.
Particularly, laptop type personal computers driven by a battery and
having a large capacity memory such as a Hard Disk Drive (HDD), a RAM
pack, and further a card interface, for example, of Personal Computer
Memory Card International Association (PCMCIA) cards are widely popular.
The most advantageous feature of these personal computers resides in that
everyone can easily use them by a simple operation irrespective of a
place. On the other hand, wide spread of the personal computers tends to
increase the opportunity of processing secret information. Therefore,
sufficient consideration is required with regard to the security function.
Conventionally, the security function is realized by programming the
computer to check a password input by the operator each time the power
source is switched on. In this password check, inputting of a password is
requested immediately after start of power supply, and then it is checked
whether the input password coincides with a password previously
registered. When coincidence is detected therebetween, the personal
computer becomes active to start a data processing corresponding to an
instruction input by the operator.
However, the conventional security function has the following drawbacks.
(a) In a case where the personal computer incorporates a hard disk storing
secret information, anyone of authorized users can obtain the information
by instructing the computer to access the hard disk. This bothers a
restricted number of the authorized users who take responsibility for the
management of the secret information. Further, if there are many
authorized users who knows the password, there is a possibility that an
unauthorized user easily gets the password from one of them.
(b) The aforementioned personal computer generally includes a CPU for
controlling the system operation, a password memory for storing a
registered password, and a system bus connected between the CPU and the
password memory. The CPU accesses the password memory via the system bus
to read the registered password stored in the password memory. Therefore,
there is a possibility that an unauthorized user gets the registered
password from the password memory by an unacceptable access method.
(c) Some of the personal computers has a resume function in which a data
processing is interrupted after the main power source is switched off, and
restarted from the interrupted point after the main power source is
switched on. In a case where an operator has switched off the main power
source after setting a mode of the resume function to leave the computer,
a display stops to display the display data stored in a video RAM. At this
time, a backup power is supplied to the video RAM and the video RAM
maintains the display data under the backup power. When the main power
source is switched on, the display starts to display the display data
stored in the video RAM. At this time, a password-input window is
displayed on a part of the display screen. Therefore, anyone can obtain
information concerning the interrupted data processing from the display
data displayed in the background of the password-input window. In other
words, an unauthorized user can obtain the information without inputting
any password.
(d) Some of the personal computers has an instant security function such as
an operation lock function in which display and keyboard operations are
locked without interrupting the data processing. To unlock the operations,
it is necessary to input a password that is identical to that accepted in
the password checking effected at the time of power-on. In this power-on
password checking, if a wrong password has been input, for example, more
than two times, inputting of the next password is generally rejected for
at least a preset period of time thereafter. If the password is simplified
to facilitate the unlocking, the reliability of the security function will
be lowered. In addition, the number of times a wrong password is input is
not counted in the operation lock password checking, since this checking
is effected after the operator is detected to be an authorized user in the
power-on password checking. Therefore, it is possible for an unauthorized
user to find the registered password by repeatedly inputting a password
selected at random.
(e) Assume that an operator left the computer after setting a mode of the
resume function and switching off the main power source. The interrupted
data processing will be restarted when a password indicating an authorized
user is input after the main power source is switched on. However, if the
password is input by another unfamiliar operator, this operator may cause
the restarted data processing to be in a state that the operator who left
the computer cannot continue his or her job.
SUMMARY OF THE INVENTION
An object of the present invention is to provide a portable computer system
which can improve the reliability of its security function.
According to a first aspect of the present invention, there is provided a
portable computer system which comprises: an input section for inputting
at least a password; a main processor section for controlling the
operation of the system to perform a data processing; and a password
control section, holding one or more registered passwords as being
unreadable by direct access from the main processor section, for allowing
the main processor section to perform the data processing when a password
identical to one of the registered passwords held therein is input by the
input section.
According to a second aspect of the present invention, there is provided a
portable computer system which comprises: an input section for inputting
at least a password; a main processor section for controlling the
operation of the system to perform a data processing; and a password
control section, holding one or more registered passwords as being
unreadable by direct access from the main processor section, for allowing
the main processor section to perform the data processing when a password
identical to one of the registered passwords held therein is input by the
input section, wherein the password control section includes a restricting
section for restricting a functional range of the data processing based on
the type of the registered password which coincides with the input
password.
According to a third aspect of the present invention, there is provided a
portable computer system which comprises an input section for inputting at
least a password; a main processor section for controlling the operation
of the system to perform a data processing; and a password control
section, holding one or more registered passwords as being unreadable by
direct access from the main processor section, for allowing the main
processor section to perform the data processing when a password identical
to one of the registered passwords held therein is input by the input
section, wherein the password control section includes a non-volatile
password memory for storing one or more registered passwords, and a
password checking section for checking whether the input password
coincides with any one of the registered passwords stored in the password
memory, the main processor section is connected to the password checking
section via a system bus, and the password checking section is connected
to the password memory via a memory bus independent of the system bus to
hide the password memory from the main processor section.
According to a fourth aspect of the present invention, there is provided a
portable computer system which comprises an input section for inputting at
least a password; a main processor section for controlling the operation
of the system to perform a data processing; a password control section,
holding one or more registered passwords as being unreadable by direct
access from the main processor section, for allowing the main processor
section to perform the data processing when a password identical to one of
the registered passwords held therein is input by the input section; a
secondary power-supported display memory, for storing display data
produced by the main processor section; a display for displaying the
display data stored in the display memory; and a secondary power-supported
system memory, for storing processing state data obtained when the data
processing is interrupted, wherein the password control section includes a
nonvolatile password memory for storing one or more registered passwords,
and a password checking section for checking whether the input password
coincides with any one of the registered passwords stored in the password
memory, and the main processor section includes a setup section for
setting up a system configuration with respect to available functional
modes and hardware resources, a suspension section for interrupting the
data processing and saving the processing state data in the system memory
when a main power source is switched off in a resume mode, a resume
section for restoring the saved processing state data when the main power
source is switched on in the resume mode, and a display inhibiting section
for inhibiting the display data stored in the display memory from being
displayed before the data processing is permitted by the password control
section.
According to a fifth aspect of the present invention, there is provided a
portable computer system which comprises: an input section for inputting
at least a password; a main processor section for controlling the
operation of the system to perform a data processing; and a password
control section, holding one or more registered passwords as being
unreadable by direct access from the main processor section, for allowing
the main processor section to perform the data processing when a password
identical to one of the registered passwords held therein is input by the
input section, wherein the main processor section includes an operation
lock section for locking and unlocking the operations of the input section
and other predetermined hardware resources during the data processing, the
inputting of a password is excepted from the operation lock on the input
section, and the password control section holds one or more second
registered passwords in addition to the first registered passwords to
allow the unlocking of the locked operations when a password identical to
one of the second registered passwords is input by the input section
during the operation lock.
According to a sixth aspect of the present invention, there is provided a
portable computer system which comprises: an input section for inputting
at least a password; a main processor section for controlling the
operation of the system to perform a data processing; a password control
section, holding one or more registered passwords as being unreadable by
direct access from the main processor section, for allowing the main
processor section to perform the data processing when a password identical
to one of the registered passwords held therein is input by the input
section; and a secondary power-supported system memory, for storing
processing state data obtained when the data processing is interrupted,
wherein the password control section includes a nonvolatile password
memory for storing one or more registered passwords, and a password
checking section for checking whether the input password coincides with
any one of the registered passwords stored in the password memory, and the
main processor section includes a setup section for setting up a system
configuration with respect to available functional modes and hardware
resources, a supply section for supplying a password checking request to
the password checking section when a power source is switched on in a
power-on password check mode, a suspension section for interrupting the
data processing and saving the registered password which is detected to
coincide with an input password during the password checking necessary for
allowing the data processing to proceed, along with the processing state
data in the system memory when a main power source is switched off in a
resume mode, and resume means for restoring the saved processing state
data when the main power source is switched on in the resume mode, and the
password checking means includes checking section for checking whether an
input password coincides with the registered password saved in the system
memory, when a password checking request is supplied from the main
processor section in the resume mode.
According to the invention, it becomes more difficult for unauthorized
users to obtain secret information from the computer system. Therefore,
the reliability of the security function can be improved.
Additional objects and advantages of the invention will be set forth in the
description which follows, and in part will be obvious from the
description, or may be learned by practice of the invention. The objects
and advantages of the invention may be realized and obtained by means of
the instrumentalities and combinations particularly pointed out in the
appended claims.
BRIEF DESCRIPTION OF THE DRAWINGS
The accompanying drawings, which are incorporated in and constitute a part
of the specification, illustrate a presently preferred embodiment of the
invention, and together with the general description given above and the
detailed description of the preferred embodiment given below, serve to
explain the principles of the invention.
FIG. 1A is a block diagram showing a first essential construction of a
portable computer according to one embodiment of the present invention;
FIG. 1B is a diagram showing an example of various passwords and `access
rights`0 data provided according to types of the passwords;
FIG. 2 is a block diagram showing the whole system construction of the
portable computer;
FIG. 3 is a block diagram showing a main portion of the portable computer
computer shown in FIG. 2;
FIG. 4 is a block diagram showing an internal construction of a PCMCIA gate
array shown in FIGS. 2 and 3;
FIG. 5 is a diagram for explaining the passwords and `access right` data
stored in an EEPROM shown in FIGS. 2 and 3;
FIG. 6 is a memory map of the EEPROM shown in FIGS. 2 and 3;
FIG. 7 is a diagram showing a control logic circuit which operates
according to the `access right` data stored in a security register of the
PCMCIA gate array shown in FIGS. 2 to 4;
FIGS. 8A and 8B are flowcharts for explaining processes which a CPU and
keyboard controller shown in FIG. 2 perform in a power-on password check
mode, respectively;
FIG. 9 is a flowchart for explaining a power-on password checking process
performed by the keyboard controller in the power-on password check mode
in a case where `access right` data are stored with passwords in the
EEPROM shown in FIGS. 2 and 3;
FIG. 10 is a block diagram showing a second essential construction of the
portable computer shown in FIG. 2;
FIG. 11A is a block diagram showing a third essential construction of the
portable computer shown in FIG. 2;
FIG. 11B is a memory map of a video memory shown in FIG. 2;
FIG. 12 is a block diagram showing a fourth essential construction of the
portable computer shown in FIG. 2;
FIG. 13 is a flowchart for explaining an operation unlocking process
performed by the keyboard controller;
FIG. 14 is a block diagram showing a fifth essential construction of the
portable computer shown in FIG. 2; and
FIGS. 15 and 16 are flowcharts for explaining processes which the CPU and
keyboard controller perform in a combination of the resume mode and the
power-on password check mode, respectively.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
A portable computer according to one embodiment of the present invention
will be described below with reference to the drawings.
FIG. 1A is a block diagram showing an essential construction of the
portable computer.
This portable computer includes password memory means 2A for storing a
plurality of registered passwords along with `access right` data assigned
to the registered passwords, and password control means 1A for checking
whether an input password coincides with registered passwords.
Registering, deleting, and updating of passwords and access right data are
effected under the control of the password control means 1A. The password
control means 1A has a function of retrieving from the password memory
means 2A the access right data assigned to the registered password which
is detected to coincide with the input password, and changing the setup
system configuration with respect to hardware resources provided in the
personal computer.
More specifically, the password control means 1A responds to a password
control command generated in a setup process or generated as a MS-DOS
command in order to perform its control operation. When registration of
passwords is requested by the password control command, input passwords
and input access right data assigned to the input passwords are stored in
the password memory means 2A. In a case where the password memory means 2A
has memory areas storing six pairs of passwords and access right data, two
memory areas are provided for maintenance passwords and four memory areas
are provided for four user passwords, for example. The access right data
assigned to the user password represents a device access right which
permits access to peripheral devices selected from the available hardware
resources, and the access right data assigned to the maintenance password
represents a system access right which permits access to the peripheral
devices and other available hardware resources.
Further, when checking of an input password is requested by the password
control command, the password control means 1A checks whether an input
password coincides with any one of the registered password stored in the
password memory means 2A to determine the validity of the input password.
After detecting the validity of the input password, the password control
means 1A controls a hardware control section based on the access right
data assigned to the registered password which is detected to coincide
with the input password. If the detected password is a user password, the
hardware control section selectively enables accessing of the various
peripheral devices such as an HDD, an FDD, a serial port, a printer port,
a PCMCIA specification card, and the like. On the other hand, if the
detected password is a maintenance password, the hardware control section
selectively enables accessing of the aforementioned peripheral device and
other hardware resources such as a flash memory for storing a BIOS
program, the password memory means 2A, and the like.
In the personal computer described above, a plurality of passwords are
provided for hardware maintenance persons and users as shown in FIG. 1B,
and a functional range of the data processing is restricted when the input
password coincides with a user password. On the other hand, the functional
range is not restricted when the input password coincides with a
maintenance password. Thus, the maintenance is facilitated and the
reliability of the security function can be improved.
The detailed construction of the portable computer will be described below.
FIG. 2 shows the whole system construction of the portable computer, FIG. 3
shows a main portion of the portable computer computer, and FIG. 4 shows
an internal construction of a PCMCIA gate array shown in FIGS. 2 and 3.
In FIG. 2, the password control means 1A shown in FIG. 1A is realized by a
keyboard controller (KBC) 30 and a register group provided in a PCMCIA
gate array (PCMCIA-GA) 28. The password memory means 2A is realized by an
EEPROM 29 coupled to the keyboard controller (KBC) 30 through the PCMCIA
gate array (PCMCIA-GA) 28. In this computer, a command and its parameter
from a CPU 21 to the keyboard controller (KBC) 30 and a response
(data/status) from the keyboard controller (KBC) 30 to the CPU 21 are
transferred via data communication registers in a status LCD control gate
array (SLCDC-GA) 26. Data and address are transferred from the PCMCIA gate
array (PCMCIA-GA) 28 to the EEPROM 29 via a memory bus 15.
This portable computer is of a laptop type or notebook type personal
computer, and has a system bus (ISA-BUS) 11 of an ISA (Industry Standard
Architecture) specification, a high speed graphic transfer peripheral
interface bus (PI-BUS: Peripheral Interface BUS) 12, a keyboard interface
bus (KBC-BUS) 13 and a power source interface bus (PSC-BUS) 14.
The CPU 21 and an I/O controller (I/O-CONT) 22 are connected to the system
bus (ISA-BUS) 11. The CPU 21 and the I/O controller 22 are respectively
formed of a microprocessor 80386SL and its family chip 82360SL
manufactured and sold by Intel Co. (in the USA).
The overall system is controlled by the CPU 21 to perform a data processing
corresponding to the program stored in a system memory 23. The CPU 21
performs an initializing process (IRT process), a resuming process, and an
operation unlocking process after the system power source is switched on.
In the processes, password control commands (a power-on password status
command, a power-on password mode command, an operation lock password
status command, an operation lock password mode command, etc.) are issued
from the CPU 21 and sent to the keyboard controller (KBC) 30 via data
communication register (CR) of the status LCD control gate array
(SLCDC-GA) 26 shown in FIG. 3. The details of the password control command
will be described later.
The CPU 21 sends a password registration verify command (power-on password
status command) to the keyboard controller (KBC) 30 via the data
communication register (CR) of the status LCD control gate array
(SLCDC-GA) 26 shown in FIG. 3 in the initialization process (IRT process)
at the time of system power-on. When the registrati | | |
