Pocket PC with access control

0001The invention relates to a pocket PC with means for Access control according to the preamble of claim. 1

0002As Pocket-PC small portable computers are called. alternative they will also organizer or PDA (Personal Digital Assistant) called. They usually have two different Species of memories. A non-volatile memory, often based on Flash technology, the storage is of operating systems and programs. User data are contrary stored in a volatile memory, which typically is constructed in CMOS technology. Even in so-called off State of the Pocket PC is this volatile Memory further energized so that its memory contents preserved.

0003To protect data from unauthorized access and theft protection is on Pocket PC devices of the prior art authentication via a password entry in the operating system implemented as a first means for access control. Often this password, as all user data, stored in the volatile memory. Interrupting the power supply, eg by temporarily removing the battery, clears the volatile memory, thereby circumventing the Find Password is enabled. The password will then offer no protection against unauthorized use of the Pocket PC. This vulnerability can be closed by the password is stored in nonvolatile memory. Also in this case however is not a reliable antitheft given. To perform updates of the operating system, offer Pocket PCs during the boot phase, the option with Aid of a further computer, and a corresponding compound between the two computers, a new operating system to write in the nonvolatile memory of the Pocket PC. The boot phase may be either by interrupting the Power supply, for example by briefly removing the battery, by a predetermined key combination (cold start function) or by means of a specially designated user program be initiated.

0004It is therefore an object of the invention to describe a Pocket PC, of them by interrupting the power supply a reliable protection against unauthorized access offers.

0005This object is achieved by the fact that at a Pocket PC is provided a cold start, which the before the operating system starts operations in a running a non-volatile memory stored BIOS be, second means activated for access control will.

0006The invention provides an effective protection against unauthorized access reached in that the second means for Access control is performed before the possibility of transferring a new operating system on the Pocket PC and thereby implemented in the operating system first Means to circumvent access control.

0007Advantageously provides the second means for access control an input before a second password. incorrect Entering the second password is a use of the Pocket PCs prevented. Further, in case of wrong entry the second password to install an operating system prevented on the Pocket PC.

0008According to one embodiment of the invention, a third be provided password, wherein the second means for Access Control a mistake while entering the second and / or the third password prevents the use of Pocket PCs and a mistake while entering the password third installation an operating system on the Pocket PC prevented.

0009In case of multiple incorrect entry of the second and / or third Password may also further use of Pocket PCs be prevented by a barrier, said barrier authorized only by the manufacturer or by the manufacturer Persons may be lifted. Both the second and the third password may be stored encrypted.

0010Further details and embodiments of the invention are specified in the subclaims.

0011The invention will be described with reference to a figure. The figure shows a block diagram of an exemplary embodiment the invention.

0012In a non-volatile memory 1, there is a BIOS 2 and as part of the BIOS 2, a second means of access control 3. The second has means for access control 3 Access to a second password 4 and a third password 5, which are also located in the nonvolatile memory. 1 Further, in the nonvolatile memory 1, an operating system 6 and as part of the operating system 6 first means for Access Control 7 stored. The first means for Access control 7 has access to a first password 8, as the additional user data in a volatile memory 9 10 stored. With the BIOS 2, a keyboard 11 is connected, and is connected to the second means for access control 3 a power supply controller 12. All further Functional units of the Pocket PC, such as screen, processor etc., are summarized as further components. 13

0013In normal operation of the Pocket PC operating system is 6 and possibly run user programs. Disabling the Pocket PC is done via a predetermined key combination on the keyboard 11 to be controlled via the BIOS 2 OS 6 is notified. suspended the operating system 6 any running application programs and has again via the BIOS 2, the power supply controller 12 to, all unused so-called off-state Components must be disconnected. As before, be the volatile memory 10 as well as means for monitoring the Keyboard 11 power. Thereby, a predetermined Key combination to turn the power on the keyboard 11 are detected, first, the power supply controller 12 acts and secondly the operating system 6 again starts.

0014The operating system 6 may be so arranged that after each Start the first means for access control 7 enabled is that the user to enter a password for authentication required. The password you entered is with the stored in the nonvolatile memory 10 first password 8 compared and allowed according to the use of Pocket PCs or denied.

0015This conventional method of turning on the Pocket PC is also called "warm boot" or "soft start". In contrast this is the cold start feature of the invention, the by interrupting the power supply or by typing executed predetermined key combination on the keyboard 11 becomes. In this cold-start function, the BIOS executes 2 and activates the second means for access control 3. The second means for access control 3 requires then from User to enter a password, which the non-volatile Memory 1 deposited second password 4 compared becomes. is then only in accordance BIOS 2 the operating system starts 6 and so the use of Pocket PCs allows. Votes input and second password 4 do not match, the second means for access control 3, the power supply controller 12 to, the Pocket PC as described above off. Turning the Pocket PCs via the power supply controller 12 is only an exemplary way since, as the second means for Access Control 3 using the Pocket PC for input can prevent an incorrect password. Other agents that prevent the use of the Pocket PC are also possible, eg: blocking the keyboard, prevention of starting from Operating system or application programs, prohibiting any Access to the memory, connected by possibly additional computers.

0016The second means of access control 3 is activated, even before the BIOS 2 allows the option of using a another computer and a connection between this computer and the Pocket PC to the non-volatile memory 1 To access or the volatile memory 10 and so to install a new operating system on the Pocket PC to obtain or access to stored data.

0017It is also possible, in addition to the second password 4 shows a third Password provided. 5 These passwords can different be assigned user powers. is example possible, via the second password 4 the use of the to allow Pocket PCs, but to prevent any installations, whereas the third password both use the Pocket PC as well as the installation of a new operating system allowed. Any changes of the second 4 and / or third 5 password only after successful password entry possible.

0018Additionally, as further protection against unauthorized be set up to access the Pocket PC, that the second Means for access control 3 with repeated false entry the second password 4 or third password 5 no allows further password entry more and so the Pocket PC permanently locks. This lock can be designed so that only the replacement of the nonvolatile memory 1 by the Manufacturer or similarly qualified persons this Barrier dissolves again. As a further security measure can the second 4 and / or 5 the third encrypted password in Memory be deposited.

0019Since user access control may not is desired or is bothersome, can the second Means to be designed for access control 3 so that the then users are not prompted for a password , when a as the second 4 and / or 5 the third password Default password is stored. This could also be the configuration be, in the Pocket PC is shipped. The Default password can be a predefined password that for all Pocket PCs a production run is the same. Alternatively, used as a default password a device-dependent password will. Here such passwords or metrics come into consideration, which are permanently stored in the Pocket PC, such as the UUID (Universal Unique IDentifier) ​​of the nonvolatile Memory 1. With such UUIDs the memory modules are clear and unchangeable labeled by the manufacturer, wherein the UUID in a similar manner as the memory content can be read from the memory module. The second Means for access control has thus easily Access to the UUID as a default password, the second 4 Compare and / or third 5 password with this and only when Diversity, the entry of a password by the User demand.

LIST OF REFERENCE NUMBERS

0020<dl tsize="2" compact="compact"><dt>1</dt><dd>non-volatile memory</dd><dt>2</dt><dd>BIOS</dd><dt>3</dt><dd>second means for access control</dd><dt>4</dt><dd>second password</dd><dt>5</dt><dd>third password</dd><dt>6</dt><dd>operating system</dd><dt>7</dt><dd>first means for access control</dd><dt>8th</dt><dd>first password</dd><dt>9</dt><dd>other user data</dd><dt>10</dt><dd>volatile memory</dd><dt>11</dt><dd>keyboard</dd><dt>12</dt><dd>Power Control</dd><dt>13</dt><dd>other components of Pocket PCs</dd></dl>