Keyboard Password Lock

1. Field of the Invention

The invention generally relates to keyboards used with computer systems and more particularly to a method and apparatus for locking access to the computer through the keyboard until a password is entered.

2. Description of the Related Art

Personal computer systems are becoming more elaborate and are being used for more critical functions. For example, originally personal computers were only used for very simple word processing tasks and spreadsheet applications of relatively limited complexity. Today however, personal computers are being used to form elaborate network systems, both as the work stations and as the file servers and applications of great sensitivity or complexity are being executed. As the complexity of the various applications has gone up dramatically from a simple small spreadsheet application to horribly complex spreadsheets, so has the time required to perform the calculations. In many cases it is convenient for the user to do other tasks and leave his office, leaving the computer unattended. This unattended state is quite common in file server applications of the computer.

Security in the personal computer either locally or on to a network is always of concern. For instance, if an administrator's station is connected into a network, the administrator will have various rights which other users are not allowed. If an ordinary user were to gain access to the network via the administrator's station and begin performing privileged options, disastrous results could occur to the network system. The same is true of access to the file server itself. Alternatively, if a spreadsheet program is in the midst of performing a very long recalculation and the operator wishes to leave for a period of time, another party could come in and see the computer doing apparently nothing and hit a key on the keyboard. This could result in the long recalculation being terminated midstream and having to be restarted. For these reasons it is desireable to be able to lock the keyboard so that access cannot be obtained without some clearance.

In personal computers according to the International Business Machines (IBM) PC/AT class, a physical key switch was used to disable the keyboard activity. If the key switch was in the unlocked position, the keyboard characters were transmitted to the computer system, while when the key switch was in a locked position the characters were not transmitted to the computer system. One advantage of this was that it was very easy to allow keyboard security to be developed in that the key switch merely had to be turned to the locked position, but a disadvantage was that the key switch had to be readily accessible. If for instance the unit was located in a remote location, on the floor or had a very small size so that the key switch had to be located other than on the front of the unit, this need to physically access the key switch became inconvenient. One large advantage of the key switch was that it required no intervention by the processor in the computer system to perform the locking function and thus long tasks could be left running without interference.

When IBM introduced the PS/2 series of personal computers a software based password feature was included. The password value could be loaded into the keyboard interface and activated by software in the computer system so that the keyboard interface did not transfer characters to the system until the password was entered. This was typically done to prevent data entry to the computer system upon initial turn-on, but this feature could be enabled at a later time by means of a utility program. However, because a separate program was needed, this program could not be initiated while other programs had control of the system, such as a spreadsheet program during recalculation. While it was possible to do a hot key scanning sequence using the system processor, a drawback to this technique was that certain operating systems blocked access to the keyboard interface and therefore the password mode could not be initiated.

In a computer system according to the present invention the keyboard password capability can be activated without interference to any other programs which are operating in the computer system. The password and a key to complete a hot key sequence is downloaded into the keyboard interface, which is continually scanning the input sequence of key codes received from the keyboard. If a particular sequence of key codes, in the preferred embodiment, the CRTL, ALT and L make codes, are simultaneously present, this is an indication to the keyboard interface that password protected or active mode should be activated. The keyboard interface on its own then proceeds to block all incoming key codes until the complete password is entered. The keyboard interface then scans the received codes to see if the password is being entered. If the password is not entered, the scanning continues. If the password is entered, the password protected or active mode is exited. After the password active mode has been exited, the keyboard interface sends break codes for the CTRL and ALT keys to indicate to the running program that those keys have been released. Thus in this way the main processor in the computer system does not have to perform any function other than initially enabling the keyboard password sequence in the keyboard interface during the initial phases of operation of the computer system. The keyboard controller then performs all scanning functions without assistance from the central processor, which can thus be performing other duties, such as spreadsheet recalculation or file server functions.

A better understanding of the present invention can be obtained with the following detailed description of the preferred embodiment is considered in conjunction with the following drawings, in which:

FIG. 1 is a block diagram of a computer incorporating the present invention; and

FIGS. 2A, 2B and 2C are flowchart illustrations of operating sequences of the keyboard controller of FIG. 1 according to the present invention.

Referring now to FIG. 1, the letter C generally represents a computer incorporating the present invention. A number of different blocks are used in the computer C. This description of the computer C is provided to be exemplary of the environment of the invention and is not intended to be limiting as to the particular arrangement of the illustrated computer C. The microprocessor 20 used is preferably an 80386 microprocessor manufactured by Intel Corporation (Intel). The microprocessor 20 has an address bus PA and a data bus PD, these buses PA and PD being referred to as the local buses. Coupled to the local bus are an arithmetic processing unit or numerical coprocessor 22, preferably an 80387 manufactured by Intel; a cache controller 24, preferably an 82385 manufactured by Intel or similar; cache RAM 26 and an address latch 28. The cache controller 24 cooperates with the cache RAM 26 to provide the necessary control to handle a cache system in the computer C. The local bus is connected to an intermediate bus by means of a latch 30 which connects the local address bus PA to an intermediate address bus HA. A latched transceiver 32 connects the local data bus PD to an intermediate data bus HD. Connected to the intermediate bus is the main memory 34 in the computer C and a memory interface 36. The memory 34 is thus relatively tightly coupled to the processor 20.

Various other buses are developed from the intermediate bus. For example, intermediate address bus HA is coupled by a transceiver 38 to an early system address bus LA and by a latch 40 to a latched system address bus SA. The intermediate data bus HD is coupled by a latch 42 and a transceiver 44 to the system data bus SD. Numerous devices are coupled to the system buses LA, SA and SD, as are a series of slots 70 which are used for receiving interchangeable circuit boards which contain additional functions which can be utilized in the computer C. A serial interface 46 is connected to the system data bus SD and the latched system address bus SA. a printer interface 48 is also connected to the system data bus SD and the latched system address bus SA, with a printer 50 being attached to the printer interface 48. The read only memory (ROM) 52 which contains the basic operating software of the computer C is connected to the system data bus SD and the latched system address bus SA. A floppy disk controller 54 is connected to the system data bus SD and the latched system address bus SA. A floppy disk unit 56 which is used for providing storage for the computer C is connected to the floppy disk controller 54. Similarly, a hard disk controller 58 is connected to the system data bus SD and the latched system address bus SA, with a hard disk unit 60 being attached to the hard disk controller 58. A video system 64 which controls the presentation of data to the user is connected to the early system address bus LA and the latched system address bus SA, and coupled to the system address data bus SD by means of a transceiver 62. Connected to the video system 64 are the Random Access Memory (RAM) 66 used to form the video memory and a monitor 68 which presents the desired display to the user.

Various other subsystems are coupled to the intermediate data and address buses HD and HA. A transceiver 72 is connected to the intermediate address bus HA and to an extended address bus XA. A transceiver 74 is connected between the intermediate data bus HD and input/output (I/O) data bus IOD. Connected to the extended address bus XA and the data bus IOD, is a combined unit 76 which contains the DMA controller for the computer C, a series of timers and the interrupt controller. A keyboard interface 78 is also connected to the extended address bus XA and the I/O data bus IOD. A keyboard 80 is connected to the keyboard interface 78 to allow the user to enter desired character sequences and commands. A mouse 81 or other compatible pointing device, sometimes referred to as an auxiliary input device, is also connected to the keyboard interface 78. The keyboard interface 78 is preferably an 8042 class of microcontroller or peripheral interface device as commonly used in IBM PC compatible computers. A real time clock (RTC)/CMOS memory 79 is connected to the data bus IOD to provide constant time of day functions and allow storage of various system constants and values related to system configuration and options.

Proceeding now to the operation of the keyboard interface 78, operation commences at the reset sequence 100 (FIG. 2A) of the keyboard interface 78. Control commences at step 102 where various initialization activities are performed. Example initialization items are clearing of all memory except the password value, setting up the internal time and ports and setting up the various RAM values to be utilized during operation. Control then proceeds to step 104 where the keyboard interface 78 determines whether password protected mode is active. If not, control proceeds to step 106 where a determination is made as to whether any key break characters or codes are to be sent. In personal computers according to the IBM PC and those compatible therewith, every time a key contact is made on the keyboard 80 a make character or code is sent from the keyboard interface 78 to the microprocessor 20 and every time a key is released a break character is sent to the microprocessor 20. This way the microprocessor 20 has the capability of determining at any time which keys are actually depressed and determining the sequencing of the keys. These breaks would be present in step 106 after exiting password active mode because when entering password active mode certain keys have been depressed and passed through to the microprocessor 20 and these keys need to be released. Therefore the operating sequence 100 queues up these breaks when password protected mode is entered for transmission when password protected mode is exited. If there are breaks to send, indicating that this is the first loop after leaving password protected mode, control proceeds to step 108 where the key break codes are transmitted to the processor 20. If there were no breaks to send or the breaks have been sent, control proceeds to step 110 to determine if an event of interest to the keyboard interface 78 has occurred. These events can be either an input from the auxiliary device, commonly the mouse 81; keyboard activity, such as making or breaking of a key, or a command being received from the microprocessor 20. If an event has not occurred, control loops 110, back to step so that operation stays on step 110 until an event does occur. If an event has occurred, control proceeds to step 112 to determine if it was received from the auxiliary device, the keyboard 80 or is a command from the microprocessor 20. If it is an auxiliary input from the mouse 81, control proceeds to step 114 where the operation requested is performed. Control then proceeds to step 104 to form a loop.

If a command was received from the microprocessor 20, control proceeds from step 112 to step 116 where an evaluation is made if the command was as A5 command. If so, control proceeds to step 118 where the password is loaded. In this way the microprocessor 20 can load up the memory in the keyboard interface 78 with the password which has been stored in the CMOS 79 or has just been entered by the user using a utility program. Control proceeds from step 118 to step 104.

If the command was not an A5 command, control proceeds from step 116 to step 120, where a determination is made whether the command is an A6 command. The A6 command is a command for the keyboard interface 78 to directly enter password active mode. If the command is not an A6 command, control proceeds to step 122 where the requested command is performed. One of these commands allows the microprocessor 20 to transfer a value directly to a location in the keyboard interface 78. By this method the microprocessor 78 can provide the final key, the character key, in the password protection activation sequence. There are numerous other commands which can be performed but they are generally known and are ancillary to the present invention and therefore not described in detail. After performing the requested command, control proceeds to step 104. If the command was determined in step 120 to be an A6 command, control proceeds to step 124 (FIG. 2C).

If in step 112 it was determined that keyboard activity was the basis for leaving step 110, control proceeds to step 126 (FIG. 2B). The keyboard interface 78 determines whether the event that occurred was the making of a CTRL or control key. If so, control proceeds to step 128 where a control key depressed bit is set in the keyboard interface 78. This bit is used to keep track of the various depressions of one of the keys required to establish the password activation sequence. Control proceeds from step 128 to step 130 where the character, in this case the control make key code, is transmitted to the microprocessor 20. Control then proceeds to step 104.

If in step 126 it was determined that a CTRL key was not made, control proceeds to step 132 where a determination is made if a CTRL key break code was received. If so, control proceeds to step 134 where the CTRL key depressed bit is cleared and control proceeds to step 130. If the CTRL key break character was not received in step 132, control proceeds to step 136 where a determination is made if an ALT key has been made. If so, the ALT key depressed bit is set in step 138 and control proceeds to step 130 to transmit the make character code to the microprocessor 20.

If an ALT key was not made as determined in step 136, control proceeds to step 140 where the keyboard interface 78 determines whether the received character was an ALT key break code. If so, control proceeds to step 142 where the ALT key depressed bit is cleared and then control proceeds to step 130. If the ALT key break code was not received in step 140, control proceeds to step 144 to determine if the CTRL key depressed bit is set. If not, control proceeds to step 130. If so, control proceeds to step 146 where the keyboard interface 78 determines if the ALT key depressed bit is set. If not, control proceeds to step 130, while if it is set control proceeds to step 148. In step 148 the keyboard interface 78 determines if the hot key is loaded. The hot key is considered the third key in this sequence of CTRL, ALT and a character which is used to initialize entry into the password active or lock mode purely from the keyboard. The hot key may have a certain default value, preferably stored in the CMOS 79 and provided at power up by the microprocessor 20 in addition to the password, but which can be provided or changed by a utility program. The preferred hot key is the L, but other keys can be used if desired. If the hot key has not been loaded into the keyboard interface 78, this is an indication that the hot key password protected activity is not desired and thus the sequence is aborted. Therefore if the hot key is not loaded into the keyboard interface 78, control proceeds to step 130.

If the hot key is loaded, control proceeds from step 148 to step 150 where a determination is made if the hot key make code has been received. If not, control proceeds to step 130. If so, this is an indication that the CTRL, ALT and hot keys are all simultaneously depressed, the indication that password protected mode is to be entered. Control thus proceeds to step 152 where the break codes are set for the ALT and CTRL keys. This is necessary because the ALT and CTRL key make codes have been transmitted to the microprocessor 20 in step 130 as those keys were depressed and therefore an indication of the release of these keys must be sent when key code transmission to the microprocessor 20 is resumed after exiting password protected mode because the keys will have been released to enter the password, but the release will have been completed prior to resuming transmission and so the release key codes will not have been sent to the microprocessor 20, but it is still necessary to indicate release of the keys. Therefore the break codes are loaded up for transmission in step 108. The break code for the hot key is not needed because that key make code has not been transmitted to the microprocessor 20 and therefore does not have to be undone.

Control then proceeds from step 152 to step 124 where a determination is made as to whether a password is present in the keyboard interface 78. If not, this is yet another indication that the feature is not enabled and therefore control proceeds to step 104. If a password is present, control proceeds to step 154 where the password protected mode is set. Control proceeds to step 156 to obtain the first byte of the password. In step 158, the next step, a determination is made as to whether the first byte of the password is 0. If so, this an error condition and an error flag is set 160. If not, control proceeds to step 162, which is also were control proceeds from step 160, where a pointer to the first byte of the password stored in the keyboard interface 78 is loaded into a register in the keyboard interface 78 for addressing purposes. Control then proceeds to step 164 where the password byte at the pointer value is obtained for comparison purposes. Control then proceeds to step 166 to determine if a keyboard character make code has been received from the keyboard 80. If not, control proceeds to step 168 to determine if a command has been received from the microprocessor 20. If not, control returns to step 168, thus forming a scanning loop between looking for keyboard characters and microprocessor commands. If a command is present, control proceeds from step 168 to step 112 for command processing.

If in step 166 it is determined that a keyboard character was depressed, control proceeds to step 170 to determine if it was shift key that was depressed. If so, control proceeds to step 166 in as much as shift keys are ignored in the password process. If it was not a shift key, control proceeds to step 172 where a determination is made as to whether the keyboard character received is equal to the password character at the pointed location. If not, control returns to step 162 wherein the password pointer is reloaded to the first byte so that scanning then recommences at the beginning of the password. If the character is equal to the pointed password character, control proceeds to step 174, where the pointer value is incremented to point to the next character in the password. In step 176 a determination is made as to whether the pointed byte has a value of 0. If so, this is an indication that the entire password has been scanned and thus received from the keyboard 80. If the pointed byte is not equal to 0, control proceeds to step 164 to continue scanning for the next password character. If the pointed byte is 0, control proceeds to step 178 where the password protected mode is cleared so that keyboard processing and transmission to the microprocessor 20 can commence and the break codes will be sent in step 108. Control then proceeds to step 104.

If in step 104 it was determined that password mode was active, control proceeds to step 180 where a determination is made as to whether an input was received from the auxiliary device. If so, control proceeds to step 114 and this operation is processed. If not, control proceeds to step 166 to determine if a keyboard character had been depressed, thus entering a sequence of looking for the password to enable keyboard activity.

Thus it can be seen that when a predetermined keyboard sequence is developed, in the preferred embodiment the simultaneous depression of the CTRL, ALT and a particular hot key, the keyboard interface 78 stops transmitting characters to the microprocessor 20 without any intervention whatsoever from the microprocessor 20. The microprocessor 20 has only to perform the initial enabling of the feature by setting the password and hot key values and then the operations are performed solely in the keyboard interface 78. It is noted that the password and hot key values can either be present in the CMOS 79 and loaded when the computer C is performing its power-on self-test or initialization operations or can be loaded by a utility program running on the computer C, which then terminates leaving the keyboard interface 78 awaiting the hot key sequence to enter password protected mode. Thus a program on the computer C need not be active to enable password protected mode and this allows alternate programs which need the microprocessor 20 to be performed.

The foregoing disclosure and description of the invention are illustrative and explanatory thereof, and various changes in the size, shape, materials, components, circuit elements, wiring connections and contacts, as well as in the details of the illustrated circuitry and construction and method of operation may be made without departing from the spirit of the invention.