WO2006010460A1

WO2006010460A1 - Method and device for accessing to computer resources

Info

Publication number: WO2006010460A1
Application number: PCT/EP2005/007505
Authority: WO
Inventors: Werner Schneider
Original assignee: Siemens Aktiengesellschaft
Priority date: 2004-07-27
Filing date: 2005-07-12
Publication date: 2006-02-02
Also published as: DE102004036366A1

Abstract

The information carriers of a mobile information carrying and processing device are used for authenticating a user with respect to a computer operating system. Authentication data is kept ready on the information carrier. During authentication, said data is transmitted by means of the wireless interface of the mobile information carrying and processing device to a computer, whereby a user who, for example, is already authenticated with respect to the mobile telephone thereof and who is about to use the computer thereof has no need to be authenticated once again with respect to said device.

Description

Method and device for accessing resources in a computer

Technical area

The invention relates to a method and a device for accessing resources of a computer, which has an interface device for line-bound data transmission with a mobile, information-carrying and processing device.

State of the art

In order to preclude unauthorized access to resources of a computer, the operating system or possibly program programs controlled by the operating system prompts the user to input authentication data. As a rule, this authentication data consists of a user account and a personal password. Both are entered via the keyboard when the system starts up and, if necessary, during operation of the computer.

In modern data processing systems whose terminal has a chip card reader or in whose housing such a reader is housed, this manual input via the keyboard is no longer necessary. The authentication data are stored on the chip card of the user and are read in automatically. Such a chip card for contactless transmission of electrical signals to a terminal is known, for example, from DE 195 43 426 C1.

However, the entry of an access code is not only necessary for computers, but also for the commissioning of a computer Range of other mobile information-bearing and processing devices, such as mobile phones or Personal Digital Assistant (PDA), or organizers or camcorders.

Both computers and cell phones are widely used. Many of these devices today have a Schnitt¬ device for wireless data transmission with other mobile or permanently installed devices. An interna- tionally standardized interface device in short-range radio data transmission (up to 100 m) is Bluetooth, in which the data is transmitted by radio in the ISM band (Industrial Scientific Medical Band).

Against this background, many users who have already authenticated themselves, for example, with respect to their mobile phones and are about to put their computer into operation find it cumbersome to re-enter from the operating system of the computer the input of Authentication data.

Presentation of the invention

The present invention is based on the object of specifying a method and a device for accessing resources of a computer so that the process for authenticating a user to the operating system of a computer is easier.

This object is achieved for a method by the features of patent claim 1 and for a device by the features of claim 11. Advantageous embodiments, aspects and details of the invention will become apparent from the dependent claims, the description and the accompanying drawings. The invention proceeds from using the information carrier of a mobile, information-carrying and processing device also in the authentication of a user to the operating system of a computer. For this purpose, the authentication data in the memory of this Informationsträ¬ gers are kept ready. During the authentication process, these data are transmitted wirelessly from the mobile, information-carrying and -processing device to the computer by means of the interface device. As a result, a user who has, for example, already authenticated to his mobile phone and is now about to use his computer, no longer needs to authenticate himself to this device. The user needs to remember the password or the user ID. Another chip card is not required. Access to the computer is easier.

The method according to the invention therefore proposes that the data for authentication of a user to a computer be kept ready on an information carrier which at the same time also contains those data for authentication by which the user is referred to the information-carrying and processing device has already identified eligible users. If such a device is now brought into the detection range of a line-bound interface device, such as a radio interface or an optoelectronic interface, then after the devices have mutually identified, a communication channel is established between them. The authentication data is transmitted wirelessly to the computer via this communication channel. The computer's operating system handles the received data as if it had been entered manually via the keyboard. This means that the user gains access to the resources of the computer if the transmitted data matches the access code previously stored in the computer. If not, the operating system locks the access. This process of Authentication takes place when the system is booted or during operation, during which a screen saver is usually started automatically by the operating system after an adjustable time and blocks the system until the user again identifies himself as being authorized to access the system Has.

In a particularly preferred embodiment of the invention, the authentification data required for access to the computer are kept ready in a modified SIM card of a mobile phone according to the invention. During startup and / or during operation of the computer, these data are transmitted from the mobile phone to the computer.

For wireless transmission of authentication data, a radio interface, in particular a Bluetooth interface, is advantageously used. One major advantage derives from the fact that almost all leading mobile radio and computer manufacturers are currently on the market with Bluetooth products. Bluetooth is a quasi-standard not only for mobile phones, but also for PDAs and organizers. With a Bluetooth interface, a short-range data radio depending on the power class, from about 10 cm, about 10 meters, or with special variants up to about 100 m possible.

In a preferred embodiment, this Bluetooth interface is already built into the computer. In another preferred embodiment, an attachment in the form of an adapter connected to the USB interface of the computer is used. Since, in the case of a Bluetooth interface, it is possible to monitor and manipulate the data stream, if at all, only from the immediate vicinity, in particular in the two lower performance classes, this form of wireless transmission of the authentication data can be classified as restricted. In order to further increase security, encrypted data transmission is provided in a preferred embodiment of the invention. It is favorable in this case that, in the case of a Bluetooth radio transmission, the authentication data can be encrypted, for example, with a key that is up to 128 bits long. In addition, an asymmetric key method can be used. As a result, a manipulation of the data stream is largely excluded, especially since the range is already set to a predetermined limit anyway.

In order to achieve a particularly high level of security, the invention provides, in one embodiment, for the user to be requested to enter a PIN before the password is transmitted as a function of a security class assigned to the computer. The security class results from the Bluetooth communication. In this case, a PIN is preferably used which is already familiar to the user from the use of the mobile, information-processing device. Therefore, the user no longer needs to remember an access code for the computer. After repeated incorrect entries, the PIN is usually blocked.

As an alternative to the radio interface, it may also be advantageous to use an optoelectronic interface, such as an infrared interface.

A variant of the access control device according to the invention is characterized in that the computer is connected to a chip card reader and the authentication data is alternatively provided by the Bluetooth interface or by the chip card reader.

Brief description of the drawing

For a further explanation of the invention, reference is made to the drawings, in which reference is made to an exemplary embodiment. game further advantageous embodiments and details of the invention can be found. Show it:

Figure 1 is a schematic representation of a Ausführungsbei¬ game of the invention, in which data which a Nut¬ zer compared to a computer and which are stored in a modified SIM card of a Mobiltelele¬ transmitted via a leitungsungebunde¬ ne transmission path to the computer become;

FIG. 2 shows a block diagram of the SIM card of the mobile phone modified according to the invention, with a first memory area in which data for authenticating the user relative to the mobile phone are stored, and with a second memory area in which data for authentication stored by the user in relation to the computer.

Embodiment of the invention

1 shows a computer 1, with known Bedienein¬ directions such as keyboard 9, a trackball 11 and a screen 10. The computer 1 has a USB interface 8. The USB interface 8 is used to connect an adapter 2 a Bluetooth radio interface. The Bluetooth radio interface has a detection area E, in which a mobile phone 4 is located. The mobile telephone 4 is likewise equipped with a corresponding Bluetooth radio interface 7. The Bluetooth address of the computer 1 is configured on the mobile phone 4 as a known Bluetooth device. The detection range of the Bluetooth radio interface is usually about 10 m. Depending on the power class, a range of about 10 cm or about 100 m can be achieved. The mobile phone 4 has a Subscriber Identity Module (SIM) 5, also referred to as a SIM card for short. Similar to a chip card, the conventional SIM card on a plate-shaped information carrier, which has approximately the size of 25 millimeters by 15 millimeters by 0.8 millimeters, combines a memory, an arithmetic unit and an input / output functionality. The Subscriber Identity Module is an important component of communication devices in a mobile radio network because it contains that user-specific information by means of which a user identifies himself in the network, is charged by the operator of the network and gives him the opportunity to do so there is to verify the identity of users at any time network-wide. Likewise, the cryptographic algorithm for authentication and user data encryption is implemented on the SIM card.

According to the invention, this SIM card 5 of the mobile phone 4 is modified such that it not only has the above-mentioned functionality, but additionally also serves as an information carrier for the access code to a computer. This means that not only the above-mentioned access information for the mobile radio network is stored in the memory 10 (FIG. 2) of the SIM card 5, but also authentication data, such as the user name (user name), the personal password and possibly further login data for the operating system or data for unlocking the screen saver.

In detail, access to the resources of the computer now takes place so that after switching on the computer and the usually required input of the boot password, the operating system stops at a defined point and waits for the input of the user ID and the personal password. In contrast to the prior art, however, the operating system of the computer 1 is set up such that this input is not only expected from the keyboard 9 of the computer 1, but also the interface device (A- adapter 2 in USB port 8). If this information is available at the interface, it is processed in the usual way by the operating system. That is to say, if this information matches the access code previously stored in the operating system, then the charging process of the operating system is continued in the case of power-up. After completing the download process, the user has access to the resources of the computer. The same applies to the case of a computer in operation whose access is blocked by the screen saver controlled by the operating system.

In the event that the access code at the interface device does not match the access code previously stored in the operating system, the startup process stops or blocks access to the resources in the computer.

The access protection according to the invention can of course be applied in the same way when the computer is in a so-called. Sleep mode, that is, when the operating system

Due to a prolonged interruption of use the data processing system has switched to a status with a reduced power supply. After establishing the communication channel between the mutually identified Bluetooth devices, the computer's Bluetooth interface generates an interrupt signal which the operating system uses to wake the computer from sleep mode and place it in a state of normal operation and power consumption ,

Also in this case, thanks to the invention, the cumbersome manual input of password and / or user identification via the keyboard 9 of the computer 1 is replaced by the comfortable, wireless data transmission.

The Bluetooth interface can advantageously be set up so that after the establishment of the transmission channel the identifies devices involved in communication and assigns ei¬ ner security class. Depending on this assigned security class, the radio interface decides whether the authentication data is automatically transmitted to the computer 1 or is made dependent on the input of a PIN which is to be made on the keyboard 6 of the mobile phone 4 or on the keyboard 9 of the computer 1.

For a computer that is used, for example, at home and thus lower safety requirements vor¬, the authentication data are automatically transmitted from the mobile phone 4 to the computer 1. In this case, neither the computer 1 nor the mobile phone 4, a manual input is required.

In cases where increased security is required, the user is prompted to enter a PIN, as shown above, prior to transmission of the authentication data.

In Figure 2, the invention modified SIM card 5 is shown in more detail as a block diagram. The SIM card 5 has a system bus 14 which connects a processor 12, an input / output unit 11, a controller 13 and a memory 10. The controller 13 is used for encrypted transmission of the access code. According to the invention, the memory 10 is subdivided into a first area 8 in which the data is stored in a conventional manner, by means of which the user identifies himself as authorized by the mobile telephone 4 or the mobile radio network operator. In a second memory area 9, according to the invention, those authentication data are stored which identify the user to the computer 1 as the authorized user.

Of course, instead of the mobile telephone 4, any other small-format communication device can also be used, provided that it has the information carrier according to the invention. As already mentioned at the beginning, the beginning riff "mobile, information-carrying and processing Ge rät" various, especially small-sized devices unter¬ different execution, such as mobile phones, PDAs, Or¬ ganizer and other movable communication devices for image / voice transmission. Decisive in the sense of the invention is merely that the information carrier of these devices is used both for storing and managing data by which a user identifies himself as being authorized in relation to this device as well as for storing and managing access information the same user authenticated against the operating system, and possibly a program controlled by the operating system, of a computer.

The access control system according to the invention can also be used for other access systems, such as parking barriers

Door openers and similar applications are used. In this case, the mobile device may be a suitably equipped vehicle.

Claims

claims

1. A method for accessing resources in a computer, which is in a sleep mode with a reduced energy consumption, which has an interface device, in a detection area a Kommuni¬ cation channel for a line-bound Datenübertra¬ tion with a mobile, information-carrying and processing device, characterized by the steps of: a) keeping data available to authenticate a user to the mobile, information carrying and processing device and to the computer on an information carrier of the mobile device; b) bringing in the mobile, information-bearing and

processing device in the detection area of the interface device; c) establishing a communication channel between the mobile information-carrying device and the computer, the interface device generating a signal which powers up the computer from the sleep mode to an operating mode; d) transmitting the data for authentication of the user to the computer from the mobile, information-carrying and processing device to the computer via the communication channel; e) evaluating the data received from the computer by the operating system of the computer so that a decision is made on the basis of this data as to whether the user is granted or blocked access.

2. The method according to claim 1, characterized in that the signal generated is an interrupt signal.

3. The method according to claim 1 or 2, characterized gekennzeich¬ net that is used as a mobile, information-bearing and - processing device, a mobile phone and the data for authenticating the user against the computer in the subscriber identity module of the mobile phone is kept ready.

4. The method according to claim 1, characterized in that serves as a mobile device, a vehicle on land, on water and in the air, which includes a information-bearing and - processing device, and the data for authentication of the user to the computer in the Subscriber Identity modules of informationstragen¬ the-processing device and be kept ready.

5. The method of claim 1, 2, 3 or 4, characterized gekenn¬ characterized in that a radio interface is used as an interface device.

6. The method according to claim 1, characterized in that the line-bound data transmission takes place by optoe¬ lektronische signals.

7. The method according to claim 5, characterized in that a built-in Bluetooth computer interface is used as a radio interface.

8. The method according to claim 5, characterized in that as a radio interface to a USB port or other, similar purposes serving port of the computer pluggable recorded adapter of a Bluetooth interface is used.

9. The method according to any one of claims 1 to 8, characterized ge indicates that the data transmission between the interface device of the computer and the mo bile, information-carrying and -processing device tes done encrypted.

10.A method according to any one of claims 1 to 9, characterized ge indicates that prior to the transmission of the data for authentication of the user to the computer, in response to a security class assigned to the computer, the user requested auf¬ to enter a PIN becomes.

11. Access control device for a computer, which is in a sleep mode with reduced power consumption, the auf¬ an interface device for lei¬ tion unbound data transmission with a mobile, information-carrying and -processing device, characterized in that the interfacing device of a In the area of coverage, the mobile user carries information about a computer to the computer that after the authentication data has been received, the interface device generates a signal which powers up the computer from the sleep mode to an operating mode Authentification data provides the operating system.

12. Access control device according to claim 11, characterized in that the signal generated is an interrupt signal.

13. Access control device according to claim 11 or 12, characterized in that the information-carrying and -processing device is a mobile phone and has a Subscriber Identity module which contains in a first memory area data for authentication of the user to the mobile network and in ei¬ nem second memory area data for the authentication of the user to the computer are stored.

14. Access control device according to claim 11, characterized in that as a mobile device to a vehicle Land, on water and in the air, which includes an information-carrying and processing device, and a Subscriber Identity module containing in a first storage area data for authenticating the user to the mobile device and in one second memory area data for Authen¬ tification of the user against the computer are stored chert.

15. Access control device according to claim 11, 12 or

13, characterized in that the interface device is a permanently installed in the computer Bluetooth interface.

16. Access control device according to claim 11, 12 or

13, characterized in that the interface device is formed by an adapter of a Bluetooth interface that is pluggable and is pluggably received on a USB port or another port of the computer that serves similar purposes.

17. Access control device according to claim 15, characterized in that the computer is connected to a chip card reading device and the authentication data is alternatively provided by the Bluetooth interface or by the chip card reading device.