DE102004036366A1 - Method and device for accessing resources in a computer - Google Patents

Abstract

Information carrier of a mobile, information-bearing and processing device also in the authentication of a user against the Operating system of a computer used. This will be the authentication data kept in the memory of this information carrier. During the Authentication process, this data by means of the interface device wireless from mobile, information-bearing and -processing Device for Computer render. This requires a user, for example, already across from has authenticated his mobile phone and is now in the process of to use his computer, opposite this device no longer authenticating again.

Description

technical area

The The invention relates to a method and device for access to resources of a computer, which is an interface device for line-bound data transmission with a mobile, information-carrying and processing device.

Around Preventing unauthorized access to computer resources requires this Operating system or possibly program-controlled by the operating system the user to enter authentication data. This authentication data usually consist of a user ID and a personal one Password. Both will be at startup of the system and if necessary even while over the operation of the computer entered the keyboard.

In modern data processing systems whose terminal has a chip card reader or in whose housing such a reader is housed, this manual input via the keyboard is no longer necessary. The authentication data are stored on the smart card of the user and are read in automatically. Such a chip card for contactless transmission of electrical signals to a terminal is for example off DE 195 43 426 C1 known.

The Entering an access code is not only required on computers, but also in the commissioning of a number of other mobile, information-bearing and -processing devices, such as For example, mobile phones or personal digital assistant (PDA), with organizers or camcorders.

Either Computers as well as mobile phones are widely used. Many of these equipment have one nowadays Interface device for wireless data transmission with other mobile or permanently installed devices. An internationally standardized interface device in the Short distance radio (up to 100 m) is Bluetooth, in which the Data transmitted by radio in the ISM band (Industrial Scientific Medical Band) become.

In front This background is used by many users, for example already opposite have authenticated their mobile phone and are about to complete their To put computers into operation, it felt cumbersome when they from the computer's operating system again to enter authentication data will be prompted.

presentation the invention

Of the The present invention is based on the object, a method and means for accessing resources of a computer so indicate that the process is to authenticate a user across from the operating system of a computer is easier.

These Task is for a method by the features of claim 1 and a device solved by the features of claim 11. Advantageous embodiments, Aspects and details of the invention will be apparent from the dependent claims, which Description and attached Drawing.

The Invention assumes the information carrier of a mobile, information-carrying and -processing device also in the authentication of a user against the Operating system of a computer to use. This will be the authentication data kept ready in the memory of this information carrier. During the Authentication process, this data by means of the interface device wireless from mobile, information-bearing and -processing Transfer device to the computer. This requires a user, for example, already across from has authenticated his mobile phone and is now about to Computer to use, opposite this device no longer authenticating again. The user needs neither Remember password or user ID. Another chip card is not mandatory. Access to the computer is easier.

The method according to the invention therefore proposes that the data for authentication of a user to a computer be kept ready on an information carrier which at the same time also contains those data for authentication by which the user already identified himself as authorized user to the information-bearing and processing device Has. If such a device is now brought into the detection range of a line-less interface device, such as a radio interface or an optoelectronic interface, then, after the devices mutually identified, a communication channel is established between them. The authentication data is transmitted wirelessly to the computer via this communication channel. The computer's operating system handles the received data as if it had been entered manually from the keyboard. That is, the user gets access to the resources of the computer when the transferred da correspond to the access code previously stored in the computer. If not, the operating system locks the access. This authentication process occurs when the system is booted or during operation, during which a screen saver, which is usually started automatically by the operating system after a settable time, locks the system until the user re-identifies access to the system Has.

In a particularly preferred embodiment of the invention, the for access to the computer required authentication data in a modified according to the invention SIM card one Mobile phones ready. At startup and / or during the Operating the computer, this data is transmitted from the mobile phone to the computer.

to wireless transmission of authentication data is advantageously a radio interface, in particular uses a Bluetooth interface. A significant advantage arises from the fact that nearly all leading mobile and computer manufacturers are currently on the market with Bluetooth products. Bluetooth is on Quasi-standard not only for Mobile phones, but also for PDAs and organizers. With a Bluetooth interface is a short-range data radio depending on the power class, from about 10 cm, about 10 meters, or with special variants up to about 100 m possible.

In a preferred embodiment is this bluetooth interface already built into the computer. In another preferred embodiment becomes an accessory in the form of an adapter, which is connected to the USB port of the computer is used. Since with a Bluetooth interface a listening and a manipulation of the data stream, if any, especially at the two lower performance classes are only possible from close proximity, can this form of wireless transmission the authentication data is classified as limited secure.

Around to further increase safety is in a preferred embodiment the invention an encrypted data transfer intended. Cheap Here is that in a Bluetooth wireless transmission, the authentication data e.g. can be encrypted with a key up to 128 bits long. moreover can use an asymmetric key procedure become. As a result, a manipulation of the data stream is largely excluded, especially since the range anyway on a predetermined limit is fixed.

Around To achieve a particularly high level of security, sees the invention in one embodiment, that in dependence a security class associated with the computer, the user the transmission the password is requested to enter a PIN. The security class results from the Bluetooth communication. Preference is given here used a PIN informing the user of the use of the mobile, Information processing device already familiar. Therefore, the user does not need an access code for the Remember more computers. After repeated incorrect entries is usually the PIN is locked.

alternative to the radio interface, it may also be advantageous to use an optoelectronic Interface, such as an infrared interface to use.

A Variant of the access control device according to the invention is characterized in that the computer is connected to a smart card reader and the authentication data is alternatively from the Bluetooth interface or from the chip card reader to be provided.

Summary the drawing

to further explanation The invention is referred to the drawings, in which on the basis of a Ausführungsbei game further advantageous embodiments and details of the invention can be seen. Show it:

1 a schematic representation of an embodiment of the invention, in which data identifying a user to a computer and stored in a modified SIM card of a mobile phone are transmitted via a cable-free transmission link to the computer;

2 a block diagram of the present invention modified SIM card of the mobile phone, with a first memory area in which data for authentication of the user to the mobile phone are stored, and with a second memory area in which data for the authentication of the user to the computer are stored.

Execution of the invention

The 1 shows a computer 1 , with well-known controls like keyboard 9 , a trackball 11 and a screen 10 , The computer 1 has a USB interface 8th , The USB interface 8th serves to connect an adapter 2 a Bluetooth radio interface. The Bluetooth radio interface has a detection function rich E in which is a mobile phone 4 located. The mobile phone 4 is also with a corresponding Bluetooth radio interface 7 equipped. The Bluetooth address of the computer 1 is on the mobile phone 4 configured as a known Bluetooth device. The detection range of the Bluetooth radio interface is usually about 10 m. Depending on the power class, a range of about 10 cm or about 100 m can be achieved.

The mobile phone 4 has a Subscriber Identity Module (SIM) 5 , also referred to as SIM card for short. Similar to a chip card combines the conventional SIM card on a plate-shaped information carrier, which has approximately the size of 25 millimeters by 15 millimeters by 0.8 millimeters, a memory, an arithmetic unit and an input / output functionality. The Subscriber Identity Module is an important part of communication equipment in a mobile network, because it contains the user-specific information by which a user identifies himself in the network, is charged by the operator of the network and gives it the opportunity to identify the identity of users to check at any time throughout the network. Likewise, the cryptographic algorithm for authentication and user data encryption is implemented on the SIM card.

According to the invention, this SIM card 5 of the mobile phone 4 modified so that it not only has the above-mentioned functionality, but also serves as an information carrier for the access code to a computer. That means that in memory 10 ( 2 ) of the SIM card 5 Not only the above-mentioned access information for the mobile network are stored, but also authentication data, such as the user name (user name), the personal password and possibly other login data for the operating system or data for unlocking the screensaver.

Specifically, access to the resources of the computer is now such that after turning on the computer and the usually required input of the boot password, the operating system stops at a defined point and waits for the input of the user ID and the personal password. In contrast to the prior art, however, is the operating system of the computer 1 set up so that this input is not only from the keyboard 9 of the computer 1 is expected, but it is also the interface device (A dapter 2 in USB port 8th ). If this information is available at the interface, it is processed in the usual way by the operating system. That is, if this information matches the access code previously stored in the operating system, then in the case of booting, the operation of the operating system is continued. Upon completion of the loading process, the user has access to the resources of the computer. The same applies to the case of a computer in operation whose access is blocked by the operating system-controlled screensaver.

In the case, that the pending on the interface device access code does not match the access code previously stored in the operating system, Ramps up or blocks the access to the operating system the resources in the computer.

Of the Access protection according to the invention let yourself Naturally apply in the same way when the computer is in a so-called. Sleep mode is located, that is if the operating system due to a prolonged usage interruption the data processing system to a state with reduced power has switched. After establishing the communication channel between the mutually identified Bluetooth devices, the computer's Bluetooth interface generates an interrupt signal which the operating system uses to get the computer out of sleep mode wake up and into a state of normal operation and energy absorption bring to.

Also in this case, thanks to the invention, the cumbersome manual input of password and / or user identification via the keyboard 9 of the computer 1 replaced by the comfortable, wireless data transmission.

The Bluetooth interface can advantageously be set up in such a way that, after establishing the transmission channel, it identifies the devices involved in the communication and assigns them to a security class. Depending on this assigned security class, the radio interface decides whether the authentication data automatically to the computer 1 or is made dependent on the input of a PIN on the keyboard 6 of the mobile phone 4 or at the keyboard 9 of the computer 1 is to be made.

For example, for a computer that is used at home and thus has lower security requirements, the authentication data is automatically transmitted from the mobile phone 4 to the computer 1 transmitted. In this case, neither the computer 1 still on the mobile phone 4 a manual input required.

In cases in which increased Safety is required, the user, as shown above, before the transmission the authentication data to enter a PIN.

In 2 is the inventively modified SIM card 5 shown in more detail as a block diagram. The SIM card 5 has a system bus 14 on, the one processor 12 , an input-output unit 11 , a controller 13 and a memory 10 combines. The controller 13 serves for the encrypted transmission of the access code. The memory 10 is divided according to the invention in a first area 8th in which in the usual way those data are stored, by which the user faces the mobile phone 4 or the mobile network operator as authorized identifies. In a second storage area 9 According to the invention, those authentication data are stored which informs the user about the computer 1 as an authorized user.

Of course, instead of the mobile phone 4 Any other small-format communication device, if it has the information carrier according to the invention. As already mentioned at the beginning, the term "mobile, information-carrying and processing device" covers various, above all, small-format devices of different design, such as mobile phones, PDAs, organizers and other movable communication devices for image / voice transmission. Decisive in the sense of the invention is merely that the information carrier of these devices is used both for storing and managing data by which a user in each case identifies as legitimate to this device, as well as for storing and managing access information by the same user to the operating system, and possibly a program controlled by the operating system, of a computer.

The access control system according to the invention can also for other access systems, such as parking gates door openers and similar Applications are used. In this case, the mobile device can be a corresponding be equipped vehicle.

Claims (16)

Method of accessing resources in a computer, having an interface device to in a detection area a communication channel for a line-bound data transmission build with a mobile, information-bearing and processing device, characterized by the following steps: a) Stand by Data to a user compared the mobile, information-carrying and -processing device and against the Computer to authenticate on a mobile information carrier equipment; b) Introducing the mobile, information-bearing and -processing equipment in the detection area of the interface device; c) Establishing a communication channel between the mobile, information-bearing and -processing device and the computer; d) submit the data for authentication of the user against the Computer of the mobile, information-bearing and -processing Device to the Computer over the communication channel; e) Evaluating the data received from the computer Data through the operating system of the computer, so based on this Data is decided whether the user granted access or is locked. Method according to claim 1, characterized in that that as a mobile, information-carrying and processing device a mobile phone is used and the data to authenticate the user against the Computer in the subscriber identity module of the mobile phone ready being held. Method according to claim 1, characterized in that that as a mobile device A vehicle on land, on water and in the air serves as an information bearing and -processing device includes, and the data for authenticating the user against the Computer in the subscriber identity module of the information-bearing and -processing device be kept ready. Method according to claim 1, 2 or 3, characterized in that a radio interface is used as the interface device becomes. Method according to claim 1, characterized in that that the line-bound data transmission by optoelectronic Signals take place. Method according to claim 4, characterized that as a radio interface built into a computer Bluetooth interface is used. Method according to claim 4, characterized in that that as a radio interface on a USB port or another similar Purpose serving port of the computer pluggable adapter a Bluetooth interface is used. Method according to one of claims 1 to 7, characterized that data transfer between the interface device of the computer and that of the mobile, information-carrying and processing device is encrypted. Method according to one of claims 1 to 8, characterized in that prior to the transmission of the data for authentication of the user to the computer, in dependence of the Com computer assigned security class, the user is prompted to enter a PIN. Method according to one of claims 1 to 9, characterized that the non-wireline interface after establishing the Communication channel a signal, in particular an interrupt signal generates the computer from a sleep mode to an operating mode boots up. Access control device for a computer that has a Interface device for line-bound data transmission with a mobile, information-carrying and -processing device, characterized in that the interface device of a in the field of coverage mobile, information-bearing and -processing device Authentication data of the user to the computer receives and this to authenticate a user to the operating system of the computer provides. Access control device according to claim 11, characterized characterized in that the information-bearing and -processing Device Mobile phone is and has a Subscriber Identity module, which in a first memory area data for authentication of User opposite includes the mobile network and in a second memory area data for authentication of the user stored on the computer. Access control device according to claim 11, characterized that as a mobile device a vehicle to land, too Water and air, that is an informational and -processing device includes, and has a Subscriber Identity module, which in a first memory area data for authentication of the user across from the mobile device contains and in a second memory area data for authentication of the user stored on the computer. Access control device according to claim 11 or 12, characterized in that the interface means a in the computer is built-in Bluetooth interface. Access control device according to claim 11, 12 or 13, characterized in that the interface device through one on a USB port or another similar Serving port of the computer pluggable adapter a Bluetooth interface is formed. Access control device according to claim 14, characterized in that the computer is connected to a chip card reading device and the authentication data is alternatively from the Bluetooth interface or from the chip card reader ready be put.