Security system and method for computers

A method of securing and protecting a storage device of a computer from unauthorized access including protecting data indicative of a computer operating system stored on the storage device, the computer including a host central processing unit (CPU) and computer memory used by the host CPU to load host computer programs in order to operate the computer, the method comprising:

• providing a security device arranged to control access through a data access channel to the storage device by the host CPU independently of the host CPU after loading of an operating system from the storage device;
• directing all data passing between the host CPU and the security device through the data access channel;
• storing access control computer programs in a location separate from the computer memory and not addressable by the host CPU, said access control computer programs effecting said access control;
• intercepting a boot sequence of the computer during operation of a BIOS of the computer such that in response to a request for a boot loader by the BIOS of the computer, a custom boot loader is forwarded to the host CPU instead of the requested boot loader, the custom boot loader being arranged to cause the host CPU to request an authentication program;
• in response to the request for the authentication program, forwarding an authentication program from the security device to the host CPU through the data access channel during initialization of the computer prior to loading of an operating system of the computer from the storage device,
• authenticating a user using the authentication program;
• and
• blocking all access to the storage device by the host CPU and not loading the operating system from the storage device until the user is correctly authenticated by the authentication program.

A security device for a computer having a host central processing unit (CPU), computer memory used by the host CPU to load programs in order to operate the computer, and a storage device to store data to be used by the computer including data indicative of a computer operating system, the security device being arranged so as to be disposed during use in a data access channel between the host CPU and the storage device, and the security device being arranged such that during use all data passing between the host CPU and the security device passes along the data access channel, the security device comprising:

• a processor independent of the host CPU to control operation of the security device after loading of an operating system from the storage device;
• a device memory separate to the computer memory and not addressable by the host CPU, the device memory separate to the computer memory and not addressable by the host CPU, the device memory storing at least one computer program for use by the processor to control operation of the security device;
• an authentication program for authenticating a user of the computer;
• and
• the security device being arranged during use to intercept a boot sequence of the computer during operation of a BIOS of the computer by forwarding a custom boot loader to the host CPU instead of a requested boot loader, the custom boot loader being arranged to request the authentication program;
• and
• in response to the request for the authentication program, to forward the authentication program through the data access channel to the host CPU for use by the host CPU during initialization of the computer prior to loading of an operating system of the computer from the storage device;
• and
• the security device being arranged such that access by the host CPU to the storage device is blocked and the operating system is not loaded from the storage device until the user is authenticated by the authentication program.