International Business Machines Corporation

John W Blackledge, Jr

Richard Alan Dayan

Richard Bealkowski

Robert Sachsenmaier

Kevin M Zyvoloski

Doyle S Cronk

Matthew S Palka, Jr

Scott G Kinnear

George D Kovach

Dennis L Moeller

Palmer E Newman

Douglas R Geisler

Matthew T Mittelstedt

Kenneth J Zubay

Bradly George Frey

Michael Robert Turner

Kenneth D Smeltzer

Lisa R Arnold

John D Paul

Peter A Woytovech

Jay H Neer

Andrew B McNeill

Bechara F Boury

David Lee Randall

Jerry D Dixon

Edward I Wachtel

Sagi Katz

Ronald E Valli

Grant L Clarke, Jr

Ariel Cohen

James D Reid

JoAnna B Yoder

Kimthanh D Le

Cindy M Merkin

Patrick E McCourt

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. The present invention protects a trusted personal computer system against a probing attack, in which an unauthorized user would attempt to overcome the security feature elements of the personal computer system by inserting some form of probe into an opening provided in the system enclosure for other, legitimate, purposes such as cooling air flow or removable media insertion. A plurality of security feature elements are mounted within the enclosure for selective activation to secure and non-secure states and are disposed at locations inaccessible to any unauthorized user of the personal computer system attempting to affect the operation of any one of the security feature elements by insertion of a probe through an opening.

Trusted personal computer system with limited accessibility

An information processing system comprises a processor, a first bus for conducting signals in accordance with a first bus protocol that does not support I/O address signals; a second bus for conducting signals in accordance with a second bus protocol that supports input/output (I/O) address signals; and a bridge circuit for coupling the first bus to the second bus. The processor includes a circuit for emitting address signals and an address type signal directed to a selected peripheral device. The bridge circuit comprises a filter for determining whether the address signal emitted by the processor corresponds to a peripheral device coupled to a bus subordinate to the bridge circuit; and a translation circuit, coupled to the filter, for translating signals in accordance with the first bus protocol to signals in accordance with the second bus protocol for transmission to the selected peripheral device.

Address space architecture for multiple bus computer systems

A method and apparatus for extending initialization of a personal data processing system using multiple levels of bootstrap code is provided. The first level of bootstrap code is stored in a non-volatile memory device associated with a processor of the data processing system. The second level of code is stored on a system partition or other section of a fixed disk memory storage device. The second level of bootstrap code is user configurable, and also provides access to a file system. A first initialization procedure is performed by executing the first level of bootstrap code, where the first initialization procedure performs a memory check self-test of the data processing system and conditions the data processing system for a program load. The second level of bootstrap code is then executed performing a second initialization procedure which performs specific initialization steps according to the configuration of the second level of bootstrap code. A file system containing any required test and initialization code may be accessed by the second initialization procedure. After initialization is complete, the initial program load of an operating system is executed.

Extended initialization for personal data processing systems

An information processing system includes a processor for processing information; a processor bus, a first expansion bus; a host bridge for coupling the processor bus to the first expansion bus; a second expansion bus; a first bus bridge for coupling the first expansion bus to the second expansion bus; a plurality of input/output (I/O) devices coupled to the second expansion bus; and a first storage device for storing a first set of configuration data for the plurality of I/O devices; a second storage device for storing additional configuration data. The first storage device includes a register for storing a pointer for pointing to addresses in the first storage device for forwarding addresses sent from the processor to the I/O devices.

Method and apparatus for configuring a bus-to-bus bridge

A method and system for efficient bus allocation in a multimedia computer system which includes a processor, a memory and multiple input/output devices which are coupled together via a bus which has a maximum data transfer rate. The transfer of audio, video, or other time sensitive data within the computer system to various presentation devices must be accomplished at certain predetermined rates in order to support selected applications. An arbitration level indicator which may be utilized to indicate a priority of bus access is associated with each presentation device which may contend for bus access. The bus access is then divided into a series of time frames which are subdivided into smaller time intervals. During selected time intervals the arbitration level indicators associated with a particular presentation devices are temporarily reordered to guarantee bus access at the required data rate.

Method and system for efficient bus allocation in a multimedia computer

A personal computer system is disclosed which is compatible with application programs and operating system software. The personal computer system includes a microprocessor electrically coupled to a data bus, non-volatile memory electrically coupled to the data bus, volatile memory electrically responsive to the data bus, a memory controller electrically coupled to the microprocessor, the volatile memory and the non-volatile memory, and a direct access storage device electrically responsive to the data bus. The non-volatile memory stores a first portion of operating system microcode and the volatile memory includes a volatile operating system portion intended for use by the first portion of the operating system microcode. The memory controller regulates communications between the volatile memory, the non-volatile memory and the high speed microprocessor. The direct access storage device stores a second portion of operating system microcode which is accessed by the microprocessor as needed.

Method and apparatus for dynamic load of an ABIOS device support layer

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. The features here described include a prioritized initial loading program for enabling initial loading of an operating system from a selected one of a plurality of sources, the prioritized initial loading program normally designating an interpreter program as a final option default in the event of failure of access to an operating system from any other one of the plurality of sources; a security utility program for enabling a designated user to (a) selectively modify the initial loading program by specifying the number and priority order of the plurality of sources and (b) selectively modify the initial loading program by deleting the interpreter program from the plurality of sources; a master cryptographic key for use in encrypting and decrypting data processed by the system CPU; and a second security utility program for enabling a designated user to modify the master cryptographic key.

Trusted personal computer system with management control over initial

An apparatus and method for loading BIOS from a diskette drive into a personal computer system normally connected to a hardfile, such as a fixed disk. The personal computer system further includes a system processor, a random access main memory, a read only memory and a switching means. The switching means generates a signal to indicate a mode for whether BIOS loads from either diskette or disk. In a priority mode, BIOS loads immediately from diskette. In a recovery mode, BIOS loads from diskette after testing the disk subsystem.

Apparatus and method for loading BIOS from a diskette in a personal

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. In particular, a personal computer system in accordance with this invention has a normally closed enclosure, at least one erasable memory element for selective activation to active and inactive states and for receiving and storing a privileged access password when in the active state, an option switch operatively connected with the erasable memory element for setting the erasable memory element to the active and inactive states, a tamper detection switch operatively connected with the erasable memory element for detecting opening of the enclosure and for invalidating any privileged access password stored in the erasable memory element in response to any switching of the tamper switch, and a system processor operatively connected with the erasable memory element for controlling access to at least certain levels of data stored within the system by distinguishing between the active and inactive states of the memory element and between entry and non-entry of any stored privileged access password. In the presently preferred form of the invention, two non-volatile erasable memory elements are provided, one an EEPROM and the other battery backed CMOS RAM.

Personal computer system with security features and method

An apparatus for loading BIOS stored on a direct access storage device in a personal computer system, the system comprising direct access storage device, and a processor card removably mounted to a planar board. The processor card comprises a system processor and ROM memory, while the planar board includes a main memory. A master boot record is stored on the direct access storage device. The master boot record contains a data segment and an executable code segment, the data segment representing the hardware configuration of the personal computer system. A first portion of BIOS included in the ROM memory initializes the system and causes loading of the master boot record into main memory. This first portion of BIOS further compares the hardware configuration data of the master boot record with the hardware configuration data in the ROM memory to verify compatibility with the system processor. Once compatibility of the master boot record with the system processor is verified, the first portion of BIOS transfers control to an executable code segment of the master boot record to effect loading of the remaining portion of BIOS into main memory, and the first portion of BIOS is discarded.

Bios load for a personal computer system having a removable processor

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. This invention contemplates protecting a personal computer system which has the capability of becoming a secure system from being placed into that condition by an attack on an unsecured machine. Additionally, in a network environment, it is important to maintaining network security that any given particular system be uniquely identified to the network, in order to guard against the substitution of an insecure 'alternate' which would open the network to attack through an insecure system. This invention contemplates provision for such identification in a secure manner.

Trusted personal computer system with identification

A personal computer system according to the present invention comprises a system processor, a random access memory, a read only memory, and at least one direct access storage device. A direct access storage device controller coupled between the system processor and direct access storage device includes a protection mechanism for protecting a region of the storage device. The protected region of the storage device includes a master boot record, a BIOS image and a system reference diskette image. The BIOS image includes a section known as Power on Self Test (POST). POST is used to test and initialize a system. Upon detecting any configuration error, system utilities from the system reference diskette image, such as set configuration programs, diagnostic programs and utility programs can be automatically activated from the direct access storage device.

Apparatus and method for loading a system reference diskette image from

An apparatus and method for loading BIOS stored on a direct access storage device into a personal computer system. The personal computer system comprises a system processor, a system planar, a random access main memory, a read only memory, and at least one direct access storage device. The first portion of BIOS initializes the system and the direct access storage device to read in a master boot record into the system from the direct access storage device. The master boot record includes a data segment and an executable code segment. The first BIOS portion vectors the system processor to execute the executable code segment of the master boot record. The executable code segment loads in the remaining BIOS portion from the direct access storage device into random access memory.

Initial BIOS load for a personal computer system

An apparatus and method for decreasing the memory requirements of BIOS in a personal computer system includes storing a first portion of BIOS in memory and a second portion on a direct storage access device. The personal computer system comprises a system processor, a random access main memory, a read only memory, and at least one direct access storage device. The first portion of BIOS only includes routines for initializing the system and the direct access storage device to read in a master boot record into the system from the direct access storage device. The master boot record includes a data segment and an executable code segment. The first BIOS portion vectors the system processor to execute the executable code segment of the master boot record. The executable code segment loads in the remaining BIOS portion from the direct access storage device into random access memory superseding the first BIOS portion.

Growing community of inventors

Boca Raton, FL, United States of America

John W Blackledge, Jr