Method and system for preboot user authentication

3

system 10 includes a computer system 20 coupled to a biometric sensor 30. The sensor 30 can either be a standalone device, which can be coupled to the computer system 20 via a Universal Serial Bus ("USB") port, for example, or the sensor 30 can be an integral part of the computer system 5 20. The computer system 20 includes a processor 50 coupled to the sensor 30 for receiving biometric information. The processor 50 runs a program application 55 that registers an authorized user's biometric information.

As is shown, the computer system 20 includes a BIOS 70 10 and nonvolatile memory 60 accessible by the BIOS 70. The computer system 20 also includes an embedded security system 80, which is coupled to both the processor 50 and the BIOS 70.

To understand the preferred embodiment of the present 15 invention, please refer first to FIGS. 2 and 2A. FIG. 2 is a flowchart illustrating a process for registering the biometric information of an authorized user in accordance with one preferred embodiment of the present invention. FIG. 2A is a block diagram illustrating the same process. The registering 20 process 100 begins at step 110 by receiving biometric information from an authorized user via the sensor 30. The sensor 30 then renders the biometric information and creates a biometric template 122 (FIG. 2A) for the authorized user via step 120. The biometric template 122 is a mathematical 25 representation of the biometric information, e.g., fingerprint, collected by the sensor 30. The biometric template 122 is then passed to the application program 55 running on the processor 50.

Next, in step 130, the application 55 hashes a copy of the 30 biometric template to form a biometric template hash 132. By hashing the biometric template 122, i.e., applying a hash algorithm to the template, slight changes between the template 122 and another hashed template (not shown) can be easily detected, as is well known to those skilled in the art. 35 The biometric template hash 132 is then encrypted in step 140 by the embedded security system 80'.

The embedded security system ("ESS") 80' is preferably a computer chip that performs a digital signature on the biometric template hash 132. In order to access the func- 40 tionality of the ESS 80', the user or administrator could be required to enter a valid password 82, which would be verified by the ESS 80'. Once the template hash 132 is encrypted, i.e. digitally signed, it is passed back to the application 55, which then links the encrypted template hash 45 142 to the biometric template 122, via step 150. The linked template and encrypted template hash pair 152 is then stored in memory 60' in step 160. In the preferred embodiment of the present invention, the linked template/template hash 152 is written to a designated area in CMOS 60', so that it can 50 later be accessed by the BIOS 70.

After registering the authorized user's biometric template 122, the linked template/template hash 152 is now available for user authentication during the next system boot. Because the application program 55 performs the registration process 55 outside of BIOS 70, it is more efficient and user friendly.

FIG. 3, also a flowchart, illustrates the process for preboot system authentication in accordance with the preferred embodiment of the present invention. FIG. 3A is an associated block diagram illustrating the same. The process 200, 60 begins when the BIOS 70 initiates a booting sequence in step 210. The BIOS 70 then prompts the user in step 220 to provide his or her biometric information, e.g., fingerprint, via the sensor 30' (FIG. 3A). In step 230, a biometric image 232 is transmitted from the sensor 30' to BIOS 70. 65

Next, BIOS verifies that the biometric template stored in memory is authentic, i.e., the biometric template is the one

4

certified by the administrator. First, in step 240, BIOS retrieves the linked template/encrypted template hash 152' from memory 60" and separates the pair into the template 122' and the encrypted template hash 142.' In step 242, a hash of the template 122' is calculated to form a first digest value 243. Next, in step 244, BIOS retrieves a public key 245 for the administrator from the ESS 80" and uses it to decode the encrypted template hash 142.' The result is a second digest value 247 representing the decoded template hash 142'. Finally, the first digest value 243 is compared to the second digest value 247 in step 246, and in step 248, it is determined whether the digest values 243, 247 match. If the digest values 243, 247 do not match, the boot sequence is terminated and the administrator notified via step 250. If the digest values 243, 247 match, BIOS 70 has verified that the template 122' has not been altered since the administrator registered the template 122,' and that the template 122' can now be used to verify the identity of the user attempting to log onto the computer system.

Thus, once the template 122' is authenticated, it is loaded into a matching engine 75 in BIOS 70, via step 260, along with the biometric image 232 provided by the user. There, the template 122' and biometric image 232 are compared in step 270. One should note that an exact match between the template 122' and biometric image 232 is not necessarily required because a user would not be expected to provide his or her biometric information in the exact same manner or location each and every time. For instance, the user providing a finger print (biometric information) might place his or her finger in a slightly different location on the sensor 30' each time he or she is prompted to provide biometric information. Thus, in one embodiment of the present invention, a matching algorithm is used in the matching engine 75 to compare "points" from the biometric image 232 and the template 122'. Other methods and algorithms to compare the image 232 and the template 122' would be readily apparent to those skilled in the art, and such methods would fall within the scope and spirit of the present invention.

In step 275, it is determined whether the biometric image 232 matches the template 122.' If a match is determined, the user is the authorized user certified by the administrator, and BIOS 70 will continue to execute the boot sequence in step 280. If a match is not determined, the user is not authorized to operate the computer system and the boot sequence will terminate and the administrator notified, via step 250.

The preferred embodiment of the present invention, therefore, provides a system and method for performing user authentication during the initial boot sequence using biometric information. Through aspects of the present invention, an unauthorized user would be prevented from tampering with the stored template, i.e., replacing the registered template with an unauthorized template, because of the additional encryption steps provided by the ESS during the registration phase. Thus, the present invention offers multiple layers of security in that it verifies the authenticity of the stored template before the template is used to authenticate the identity of the user attempting to log onto the computer system. In this manner, the computer system is protected from intruders. Moreover, because registration of the template is performed by an application program outside of BIOS, the limited resources available in BIOS are not depleted.

Although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accord