Method and apparatus for securing user operation of and access to a computer system
The present invention provides methods and apparatuses for computer system security. According to certain aspects, embodiments of the invention comprise a portable storage device that, when attached, “unlocks” a computer system, such as a desktop, laptop, tablet computer running a conventional operating system such as Windows, thereby creating added security. More particularly, embodiments of the invention use a standard USB memory stick as an “ignition key” to unlock and operate a PC, tablet or other computer system. The ignition key can be required to boot the computer, utilize peripheral devices, ports, network connections, a keyboard and/or a mouse of the computer system, and limit access to certain parts of computer. According to further aspects, in these and other embodiments, the invention is implemented using a modified BIOS that prevents a computer from fully booting into an operational state until verifying the presence of, and information stored on the “ignition key” connected to the computer.
1. A computer system, comprising:
a port for connecting a removable device to the computer system; and
a Basic Input Output System (BIOS) stored on the computer system that uses data on a storage device connected to the port to control access to the computer system, wherein in an initial boot process of the computer system, the BIOS is configured to determine if an appropriate type of the removable device is connected to the port, and if it is connected, the BIOS is further configured to halt the boot process and either shut down the computer system unless the BIOS can retrieve and verify the data from the connected device or display an error screen if the BIOS cannot verify that the appropriate type of the removable device contains the data,
wherein the data comprises an ignition key ID, and one or both of a system ID, and a cryptographic signature, and
wherein the storage device has an ID that is unique to the storage device and is in the form of a USB ID or a universally unique identifier (UUID), and wherein the verification performed by the BIOS during the initial boot process includes determining if the ID of the storage device is the same as the ignition key ID in the data.
2. A computer system according to claim 1 , further comprising an operating system stored on the computer system, wherein the BIOS is further operative to prevent the operating system from being loaded into program memory of the computer system until the data on the storage device has been retrieved and has been verified as being authentic.
3. A computer system according to claim 1 , further comprising interfaces to peripheral components including one or more of a display, a mouse and a keyboard, wherein the BIOS is operative to disable certain or all of the interfaces if the storage device is determined to be disconnected from the port.
4. A computer system according to claim 1 , further comprising flash memory for storing the BIOS.
5. A computer system according to claim 1 , wherein the computer system has an ID, and wherein the verification performed by the BIOS during the initial boot process includes determining if the computer system ID matches the system ID.
6. A computer system according to claim 1 , wherein the storage device has a block containing the ignition key ID and the system ID, and wherein the verification performed by the BIOS during the initial boot process includes determining if the cryptographic signature can be verified with a public key.
7. A computer system according to claim 1 , wherein the port comprises a Universal Serial Bus (USB) port.
8. A computer system according to claim 1 , further comprising interfaces to peripheral components including one or more of a disk drive, a USB device and a network access card (NIC), wherein the BIOS is operative to override default BIOS settings so as to disable certain or all of the interfaces based on settings provided in the data on the storage device.
9. A method, comprising:
detecting whether a storage device is connected to a removable device port of a computer system; and
using a Basic Input Output System (BIOS) stored on the computer system to control access to the computer system based on data stored on the storage device, wherein in an initial boot process of the computer system, the BIOS is configured to, determine if an appropriate type of the removable device is connected to the port, and if it is connected, the BIOS is further configured to halt the boot process and either shut down the computer system unless the BIOS can retrieve and verify the data from the connected device or display an error screen if the BIOS cannot verify that the appropriate type of removable device contains the data,
wherein the data comprises an ignition key ID, and one or both of a system ID, and a cryptographic signature, and
wherein the storage device has an ID that is unique to the storage device and is in the form of a USB ID or a universally unique identifier (UUID), the method further comprising using the BIOS verification performed by the BIOS during the initial boot process includes determining if the ID of the storage device is the same as the ignition key ID in the data.
10. A method according to claim 9 , further comprising using the BIOS to prevent an operating system from being loaded into program memory of the computer system until after the storage device is detected as being connected and the data on the storage device has been retrieved and has been verified as being authentic.
11. A method according to claim 9 , wherein the computer system includes interfaces to peripheral components including one or more of a display, a mouse and a keyboard, the method further comprising using the BIOS to disable certain or all of the interfaces if the storage device is determined to be disconnected from the port.
12. A method according to claim 9 , further comprising storing the BIOS in a flash memory of the computer system.
13. A method according to claim 9 , wherein the removable device port comprises a Universal Serial Bus (USB) port.
14. A method according to claim 9 , further comprising interfaces to peripheral components including one or more of a disk drive, a USB device and a network access card (NIC), wherein the BIOS is operative to override default BIOS settings so as to disable certain or all of the interfaces based on settings provided in the data on the storage device.
15. A method according to claim 9 , wherein the computer system has an ID, the method further comprising using the BIOS to verification performed by the BIOS during the initial boot process includes determining if the computer system ID matches the system ID.
16. A method according to claim 9 , wherein the storage device has a block containing the ignition key ID and the system ID, the method further comprising using the BIOS to verification performed by the BIOS during the initial boot process includes determining if the cryptographic signature can be verified with a public key.