Method for operating an electronic data processing system and electronic data processing system

Abstract

The invention relates to a method for operating an electronic data processing system (10) which is capable of running under an operating system, the electronic data processing system (10) comprising a boot system (13) for selectively loading the operating system from one of a plurality of storage media (12, 30), the boot system (13) being accessible to an external user when executing a recognition protocol between the boot system (13) and the user, wherein the recognition protocol is a challenge-response protocol based on a challenge generated by the boot system (13), more specifically randomly generated by the boot system (13), and communicated to the user in an outgoing message, and on a verification of a response generated by the user on the basis of the challenge and received by the boot system (13) as an incoming message generated by the user. Furthermore, the invention relates to an electronic data processing system and to a weighing scale (1) and an authentication system comprising the electronic data processing system (10).

Description

Technical Field

[0001] The present invention relates to a method for running an electronic data processing system capable of operating under an operating system, the electronic data processing system including a boot system for selectively loading the operating system from one of a plurality of storage media, the boot system being accessible to an external user when executing an identification protocol between the boot system and the user.

[0002] Furthermore, the present invention relates to an electronic data processing system, and to a weighing scale including the electronic data processing system and an authentication system. Background Technology

[0003] Electronic data processing systems (EDS) are typically equipped with an operating system, which is software that manages the various hardware and software components of the EDS. After the central processing unit (CPU) of the EDS is turned on, the operating system must be loaded into main memory by the boot system. For example, in the case of a personal computer, the operating system can boot from the computer's internal storage media, such as a hard disk or solid-state drive (SSD). Alternatively, the operating system can boot from an external storage media connected to the computer's interface, such as a USB port or Thunderbolt interface. For example, the operating system can boot from a USB flash drive connected to the computer's USB port. The user can choose which storage media the boot system loads the operating system from, or the user can change the boot order by pressing specific keys on the computer keyboard during computer startup.

[0004] With advancements in information processing technology, the use of electronic data processing systems in public places has become increasingly common. To name just a few examples, these might include devices such as weighing scales, point-of-sale terminals, information terminals, minicomputers, and electronic displays. Typically, these devices provide external hardware interfaces, such as USB ports. These interfaces can be used, in particular, to connect keyboards or printers. Furthermore, USB ports allow data to be transferred to or from external storage media (such as USB flash drives) connected to the USB port.

[0005] Because data can be easily transferred to or from external storage media, these hardware interfaces and external storage media present potential security risks.

[0006] In the event that an external storage medium, such as a USB flash drive, is lost or stolen, the data stored on that external storage medium must be protected, for example, in the manner set forth in US 10,146,706 B2.

[0007] When using an electronic data processing system in a public environment, the aforementioned hardware interface may present a potential "safety door opening." Therefore, it is necessary to protect the data on the electronic data processing system from unauthorized access during system operation, as illustrated, for example, in EP 1 450 144 A2 and in US 6,810,355 B1 for weighing scales. Furthermore, it may be necessary to restrict access to the data on the electronic data processing system by implementing an authentication protocol during the system's startup process, as illustrated, for example, in US 2008 / 0222718 A1.

[0008] Another security concern arises during boot time, as the boot system may load an operating system from external storage media, such as a USB flash drive connected to a USB port, as described above. This operating system may intentionally or unintentionally contain malware or viruses, and thus could potentially damage the electronic data processing system.

[0009] For example, electronic data processing systems might be included in self-service scales or checkout counters used in supermarkets. These scales typically provide USB ports. A potential attacker gaining access to the supermarket can directly access the self-service scales or checkout counters. The attacker can then insert a USB drive containing an operating system and boot from it within seconds. Once booted, they can begin an attack on the supermarket's network or directly on the scales or checkout counters, and software and data can be uploaded or downloaded. In this scenario, the attacker could potentially disrupt the supermarket's operations for hours, days, or longer, or steal relevant data.

[0010] In another example, a company might offer IT services for its products, including installing new software from external storage media, such as a USB flash drive connected to a USB port. An employee of that company might have the idea to start his own IT services business and use his expertise to mirror existing products using a new image by booting from external storage media.

[0011] Therefore, it is important to find a way to prevent unauthorized booting from external storage media.

[0012] One known solution to this problem is to disable the hardware interface. For example, USB ports can be permanently blocked using epoxy resin, or they can be reversibly blocked via a mechanical lock. However, this solution is not very secure because the key to the mechanical lock can be lost. Furthermore, providing the key is expensive. Alternatively, electronic locks can be used. This requires expensive additional hardware and a not-so-secure software unlocking system.

[0013] Another known solution is proprietary storage devices, such as proprietary USB flash drives. However, this setup requires specialized hardware and software and has too many operational possibilities.

[0014] EP 2 284 506 B1 proposes associating a given removable storage medium with a measuring device, and specifically checking whether the removable storage medium connected to the measuring device is an associated device when the measuring device is started. However, this excludes the possibility of using non-associated storage media with the measuring device, making this approach less flexible.

[0015] Another known possibility is Secure Boot, a protocol that ensures a secure boot process by preventing the loading of drivers or operating system loaders that do not have an acceptable digital signature. Because Secure Boot checks every software component, it is not feasible for systems with many components from different vendors.

[0016] Alternatively, a Trusted Platform Module (TPM) can be used, which is a security feature on an additional chip used to authenticate hardware devices. However, such chips are expensive.

[0017] A different approach is to use an identification protocol between the boot system and the user. A simple and known example of such an identification protocol is password protection for the boot system, such as password protection in the form of Basic Input / Output System (BIOS) or Unified Extensible Firmware Interface (UEFI). However, this kind of password only provides weak protection because the password may be known to many people, such as supermarket staff, technicians, etc. Sometimes, BIOS or UEFI passwords are even publicly available on the Internet. Summary of the Invention

[0018] In view of the above problems, the present invention is proposed, and the object of the present invention is to further develop a method for operating the above-mentioned electronic data processing system, which is safe, easy to use and inexpensive, and to provide an electronic data processing system, a weighing scale including the electronic data processing system and an authentication system.

[0019] According to the present invention, this objective is achieved by the following means: the identification protocol is a challenge-response protocol based on a challenge generated by the launch system—more specifically, based on a challenge randomly generated by the launch system—and conveyed to the user in an outgoing message, and based on the verification of a response generated by the user based on the challenge and received by the launch system as an incoming message generated by the user.

[0020] According to the present invention, a method is provided for running an electronic data processing system capable of operating under an operating system. The electronic data processing system may include a central processing unit (CPU) and memory. The electronic data processing system may include an x86 processor, an ARM (Advanced RISC Machine) processor, or any other known processor. When the electronic data processing system starts, the operating system is loaded into memory by a boot system. The boot system may include a BIOS or UEFI stored in the non-volatile memory of the electronic data processing system.

[0021] Electronic data processing systems can be incorporated into personal computers. They can also be integrated into or connected to devices such as weighing scales, point-of-sale terminals, kiosks, information terminals, and displays, and can operate to control the operation of said devices.

[0022] The boot system can load an operating system from one of multiple storage media. There can be two, three, or more storage media accessible to the boot system. For example, one operating system can be stored on the internal storage media of the electronic data processing system, such as a hard disk drive or SSD, while another operating system can be stored on an external storage media connected to the electronic data processing system via a hardware interface. For example, the hardware interface could be a USB port, and the external storage media could be a USB flash drive or other storage device that can be connected to a USB port.

[0023] When executing the identification protocol between the boot system and the user, the boot system is accessible to external users. Once a user has access to the boot system, the user can choose the storage medium from which to load the operating system. For example, the user can choose whether to load the operating system from an external or internal storage medium. For example, the user can choose to load the operating system from a USB flash drive connected to the USB port of the electronic data processing system.

[0024] The startup system is accessible when the electronic data processing system is started. To access the startup system, a user can, for example, press a key on a keyboard or touch an icon on a touchscreen that communicates with the electronic data processing system.

[0025] Accessibility to the boot system may include access to any of the boot system's functions. Alternatively, access to the boot system may include access to only a subset of the boot system's functions. For example, when accessing the boot system, a user may be able to change the boot order and / or a user may be able to enable or disable loading an operating system from a specific storage medium. For example, a user may be able to enable or disable a USB port on an electronic data processing system, thereby enabling or disabling the possibility of loading an operating system from a storage medium connected to said USB port.

[0026] According to the present invention, the identification protocol is a challenge-response protocol between the initiating system and the user. The concept of the challenge-response protocol is that the user can prove their identity to the initiating system by demonstrating knowledge of a secret associated with them, without needing to reveal the secret itself (see, for example, US 7,552,476 B2, US 2011 / 0302421 A1, and US 10,313,333B2). To this end, the user must present a response to the challenge generated by the initiating system. In this respect, the initiating system can be referred to as the "verifier," and the user as the "requester."

[0027] At the start of the protocol, a challenge is generated by the initiation system. The challenge can be randomly generated by the initiation system. The challenge can be generated based on new random numbers. In the context of the challenge-response protocol, "new" means recent, meaning it originated after the start of the current protocol instance.

[0028] The random number can be generated by a random number generator implemented in the boot system. For example, the random number generator can be implemented in the BIOS or UEFI of the boot system.

[0029] Alternatively, challenges can be generated using quasi-random methods. For example, challenges can be generated based on time values ​​(such as the system time when the system was started). Alternatively, challenges can be generated by randomly or quasi-randomly selecting a value from a challenge table.

[0030] Challenges can be represented by random bit strings. For example, a challenge can be represented by random numbers generated by a random number generator. Challenges can also be represented by strings. Challenges can be represented by strings of numbers and / or strings of letters.

[0031] Next, the challenge is conveyed to the user in an outgoing message. This outgoing message can be conveyed via a data output device that communicates with the startup system. The data output device may include a display connected to the startup system. The challenge can then be presented to the user on the display in a human-readable form. For example, the challenge may be represented by a generated random number displayed on the display. For example, the challenge may be represented as a nine-digit random number. Alternatively, the challenge may be represented as a barcode or QR code displayed on the display. The data output device may include a voice output device. The data output device may include an electronic data communication channel, such as Near Field Communication (NFC), Bluetooth, Wi-Fi, USB, USB On-The-Go, etc., and the challenge can be conveyed to the user through this channel.

[0032] Upon receiving a challenge, the user generates a response to the challenge. For this purpose, the user may use a response generation device. The response generation device may use electronic data processing to generate the response. The response is generated in a manner that allows user authentication. The response may be displayed on a display associated with the user. The response may be represented as a bit string, such as a sequence of numbers. For example, the response may be represented as a six-digit number. Alternatively, the response may be represented as a barcode or QR code displayed on the display.

[0033] The response is received as an incoming message by the initiation system. The incoming message can be received via a data input device connected to the initiation system. For example, the data input device may include a keyboard or touchscreen for inputting the response. The data input device may include a voice input device. The data input device may include an electronic data communication channel, such as Near Field Communication (NFC), Bluetooth, Wi-Fi, USB, USB On-The-Go, etc., for receiving user-generated incoming messages.

[0034] Once the startup system has received a response, it verifies whether the received response is a correct response to the challenge. If the response is correct, access to the startup system is granted. As described above, the user can then access any function of the startup system. Alternatively, the user may be able to access only a subset of the startup system's functions.

[0035] If the response is incorrect, access to the startup system is denied. The startup system may then generate another challenge and repeat the identification protocol. The number of times the identification protocol is repeated after the startup system receives an incorrect response can be limited to a certain number, after which no further challenges will be generated. Then, a reset by the administrator may be necessary before a new challenge can be generated. Alternatively, access to the startup system can be blocked for a predetermined period before generating new random numbers. This can improve the security of the identification protocol.

[0036] Possible implementations of the challenge-response protocol will be further described below.

[0037] The challenge can be communicated to the user in encrypted form. Additionally, or alternatively, the response can be communicated to the initiating system in encrypted form.

[0038] The method according to the invention uses a challenge-response protocol to identify the user. In this way, a one-time password is generated each time the identification protocol is executed. This improves the security of the authentication method compared to known methods. The method is inexpensive because there are no licensing fees or additional hardware costs. There is no dependence on additional tools produced by external vendors. Furthermore, the method is independent of the hardware used and is therefore universal. The method is easy to use and easy to manage access permissions.

[0039] In one embodiment of the method according to the invention, the challenge can be generated by executing a challenge generation algorithm implemented in the boot system using electronic data processing. The challenge generation algorithm can be implemented in the BIOS or UEFI of the boot system. The challenge generation algorithm may include a random number generator.

[0040] Additionally, or alternatively, the response can be generated by using electronic data processing to execute a response generation algorithm implemented in an electronic response generation device that can be run by a user. The response generation device can be a personal computer, laptop, tablet, smartphone, or any other electronic data processing device. This method is highly practical because users can easily carry portable electronic data processing devices.

[0041] Alternatively, the verification can be performed using a verification algorithm implemented in the boot system via electronic data processing. The verification algorithm can be implemented in the boot system's BIOS or UEFI. Implementing this method using algorithmic techniques and electronic data processing is very user-friendly.

[0042] In one embodiment of the invention, the challenge-response protocol may be based on symmetric key technology. In one embodiment of the method according to the invention, the challenge-response protocol may be based on a symmetric key shared between the boot system and the user. On the verifier side, the key may be stored in the boot system, for example, in the BIOS or UEFI. On the requester side, the key may be stored in the response generation device.

[0043] In one embodiment, the challenge-response protocol can be based on a one-way function that accepts the challenge and the shared symmetric key as input. The one-way function can be a Key Hash Message Authentication Code (HMAC). The HMAC can involve a cryptographic hash function, such as SHA-256. Other cryptographic hash functions can also be used. This approach is highly secure because it is technically impossible to know the challenge from the response calculated from the given HMAC.

[0044] One possibility for implementing a symmetric-key-based challenge-response protocol is as follows: The challenge is generated by the initiating system. For example, the challenge could be randomly generated by the initiating system. The challenge could be represented as a random number generated by the initiating system. This random number can be communicated to the user. The user can generate a response using HMAC or another one-way function and a shared secret key, which is the function value of the HMAC (or one-way function) given the secret key and the challenge as input. The response is then communicated to the initiating system. The initiating system uses the same HMAC (or one-way function) as the user and the shared secret key to generate a verification value, which is the function value of the HMAC (or one-way function) given the secret key and the challenge as input. When the user and the initiating system do indeed share the same secret key, the response and verification value are identical. On the other hand, if the user does not possess the shared secret key, it is impossible for the user to generate a response identical to the verification value.

[0045] Alternatively, the symmetric key technology can be based on symmetric key encryption known in the art.

[0046] According to another example of the method according to the invention, the challenge-response protocol can be based on public-key cryptography. The challenge-response protocol can be based on a pair of asymmetric keys, one of which is a public key accessible to the initiating system, and the other is a private key used to generate the response. The protocol can be based on public-key decryption or digital signatures known in the art.

[0047] To ensure the security of the challenge-response protocol, it is crucial that one or more secret keys remain confidential. Therefore, in one embodiment of the method according to the invention, the user receives the key through secure or confidential communication with a server or another device. The server can be an external server, i.e., a server located in a different location from the electronic data processing system. The server can be a licensed server. The user does not permanently hold the key but receives it, for example, when communicating with the server through a website interface. In this way, the security of the identification protocol can be improved. For example, login data to the server can be provided to the user, and once the user is no longer considered trustworthy, login can no longer be performed using the login data provided to the user. Alternatively, the user can have a response generation device, such as a portable electronic data processing device adapted for secure communication with the server. When the user is no longer considered trustworthy, the possibility of communication between the user and the server can be terminated. This ensures that once the user is no longer considered trustworthy, the user can no longer access the startup system.

[0048] Alternatively, the key can be obfuscated to ensure its confidentiality. For example, the key can be stored in an obfuscated form within a local application. Alternatively, the key can be encrypted using another key. Alternatively, the key can be broken down into multiple parts. These parts are used to assemble the original key when an identification protocol is executed. Alternatively, the key can be made unreadable through specific logical operations. Combinations of the three possibilities mentioned can be used.

[0049] To ensure the security of the challenge-response protocol, a random challenge can be used. This can be ensured by using a challenge based on random numbers. These random numbers may include pseudo-random numbers. In one embodiment of the method according to the invention, the challenge can be generated in the startup system as a function of the system startup time and random user input. For example, after the electronic data processing system is started, it can be accessible when a key is pressed. In the startup system, a time measuring device can begin measuring the time from the start of the electronic data processing system until the user presses the key. When the time measurement is sufficiently accurate, for example, to milliseconds or microseconds, a random number can be generated as a function of the measured time. The challenge can be the generated random number.

[0050] In one embodiment of the method according to the invention, the challenge can be device-related. For example, the challenge can be based on the serial number or MAC address of the electronic data processing system and / or the startup system. In this case, the same challenge is generated for each instance of the challenge-response protocol, and therefore, the response will always be the same. However, for two different electronic data processing systems, the challenge and the corresponding response will be different. Therefore, the control system can determine which electronic data processing system conveyed the challenge. In this way, a log file can be created to track the activity of the electronic data processing system over time.

[0051] The challenge-response protocol according to the invention requires the communication of incoming and outgoing messages between the initiation system and the user. In one embodiment of the method according to the invention, the outgoing message conveying the challenge may be displayed in a human-readable or machine-readable form on a first display associated with the initiation system. The user can manually type the displayed message into an electronic response generation device associated with the user and capable of operating to display the generated response in a human-readable or machine-readable form on a second display associated with the response generation device. The user then manually types the displayed response as an incoming message into the initiation system. For this purpose, the electronic response generation device may be connected to or include a keyboard. Additionally, or alternatively, the initiation system may be connected to a keyboard. Alternatively, the response may be communicated to the initiation system via a machine-writable method. This may include Bluetooth, NFC, etc. Indicating or displaying the challenge and / or response in a machine-readable form may include displaying the challenge and / or response as a barcode or QR code.

[0052] The electronic data processing system may be or may include a personal computer or laptop computer. Alternatively, the electronic data processing device may be used to control other devices. In one embodiment of the method according to the invention, the electronic data processing system may operate to control the operation of weighing scales and / or point-of-sale terminals and / or personal computers or computer equipment in public or unprotected environments. Alternatively, the electronic data processing system may operate to control the operation of kiosks, information terminals, or displays. When a computer or laptop computer or other device is used in a public or unprotected environment, the computer or laptop computer or other device is therefore protected from the possibility of unauthorized booting from external storage media.

[0053] According to another aspect of the present invention, an electronic data processing system capable of operating under an operating system is provided. The electronic data processing system includes a boot system for selectively loading the operating system from one of a plurality of storage media, the boot system being accessible to an external user when executing an identification protocol between the boot system and the user. The electronic data processing system includes an input device for receiving incoming messages and an output device for outputting outgoing messages. The identification protocol is characterized by being a challenge-response protocol based on a challenge generated by the boot system—more specifically, randomly generated by the boot system—and conveyed to the user in an outgoing message via the output device, and based on verification of a response generated by the user based on the challenge and received by the boot system via the input device as an incoming message generated by the user.

[0054] Everything described above concerning the methods for operating an electronic data processing system, including the attributes and components of the electronic data processing system, challenge-response protocols, and response generation devices, also applies to the electronic data processing system. The electronic data processing system can be adapted to perform any aspect of the methods given above.

[0055] In one embodiment, the electronic data processing system according to the present invention may include a central processing unit (CPU). The electronic data processing system may include an x86 processor, an ARM processor, or any other known processor.

[0056] The challenge can be based on a new random number generated by a random number generator implemented in the startup system. The challenge can be a new random number.

[0057] In one embodiment of the electronic data processing system according to the invention, the generation of the challenge may be by executing a challenge generation algorithm implemented in the startup system. Additionally, or alternatively, the verification of the response may be by executing a verification algorithm implemented in the startup system.

[0058] In one embodiment of the electronic data processing system according to the invention, the boot system may include a BIOS or a UEFI. The generation of the challenge may be achieved by executing a challenge generation algorithm implemented in the BIOS or UEFI. Additionally, or alternatively, the verification of the response may be achieved by executing a verification algorithm implemented in the BIOS or UEFI.

[0059] The electronic data processing system may include a USB port. The boot system may be configured to selectively load an operating system from a storage medium connected to the USB port. This storage medium may be a USB flash drive.

[0060] According to another aspect of the present invention, a weighing scale is provided, comprising a weighing device and an electronic data processing system according to any of the above aspects. The electronic data processing system can operate to control the operation of the weighing scale.

[0061] According to another aspect of the present invention, an authentication system is provided, the authentication system comprising an electronic data processing system according to any of the above aspects and an electronic response generation device for generating a user response through electronic data processing. Attached Figure Description

[0062] In the following description, the invention will be illustrated in more detail by way of example with reference to the accompanying drawings. In the drawings: Figure 1 This is a schematic diagram of the electronic data processing system and response generation device according to the present invention; Figure 2 This is a schematic diagram of a weighing scale and a response generation device operating according to the electronic data processing system of the present invention, and... Figure 3 This is a flowchart of the method according to the present invention. Specific Implementation Figure 1 This is a schematic diagram of the electronic data processing system 10 and the response generation device 20 according to the present invention.

[0064] The electronic data processing system 10 includes a central processing unit (CPU) 11, an internal storage medium 12, and a boot system 13. A first operating system is stored on the internal storage medium 12. The CPU 11 may include an x86 processor or an ARM processor.

[0065] The electronic data processing system 10 also includes at least one hardware interface 18 for communicating with an external storage medium 30. The at least one hardware interface may include a USB port 18. The external storage medium 30 may be connected to the at least one hardware interface 18, thereby allowing data exchange between the external storage medium 30 and the electronic data processing system 10. Specifically, a second operating system may be stored on the external storage medium 30, and the boot system 13 may be adapted to load the second operating system from the external storage medium 30. The external storage medium 30 may be a USB flash drive or other storage medium that can be connected to the hardware interface 18 (e.g., a USB port).

[0066] The boot system 13 may include a BIOS or UEFI. The BIOS or UEFI may be stored on non-volatile memory.

[0067] The startup system 13 also includes a verification unit 17, which is further described below.

[0068] The electronic data processing system 10 and the response generation device 20 can be adapted to execute algorithms using electronic data processing. The challenge generation algorithm can be implemented in the startup system 13. For this purpose, the startup system 13 can include a challenge generator 19. For example, the startup system 13 can include a random number generator that generates random or pseudo-random numbers. If the startup system 13 includes a BIOS or UEFI, the random number generator can be implemented in the BIOS or UEFI of the startup system 13. The challenge generation algorithm can generate a challenge based on the generated random numbers. The generated challenge can be a representation of the random numbers generated by the random number generator. The challenge generator can correspond to the random number generator.

[0069] The startup system 13 can communicate with the output device 15 to convey the challenge to the response generation device 20.

[0070] The response generation device 20 includes a central processing unit (CPU) 21, a storage medium 22, and a response generator 27. The response generation device 20 is held by the user.

[0071] A secret is provided to the response generation device 20. This secret may be a second key 26. The second key 26 may be stored in the response generation device 20. The second key 26 is not publicly accessible; rather, it is kept secret. The response generation algorithm can be implemented in the response generator 27. The response generation algorithm accepts a challenge and the second key 26 as input and generates a response. This response may be generated using a one-way function (e.g., HMAC). HMAC may involve a cryptographic hash function, such as SHA-256.

[0072] The generated response is communicated to the startup system 13. The startup system 13 can communicate with the input device 14 to receive incoming messages containing the response generated by the user.

[0073] The verification algorithm can be implemented in the verification unit 17 of the boot system 13. The verification algorithm can be implemented in the BIOS or UEFI (if present). The verification unit 17 is adapted to verify whether the response generated by the response generator 27 is a correct response. For this purpose, the first key 16 can be stored in the boot system 13. The verification algorithm accepts a challenge, a response, and the first key 16 as input. For example, the verification algorithm can be based on the same HMAC as the HAMC used by the response generation device 20, and the first key 16 can be the same as the second key 26. Access to the boot system 13 is granted when the response is correct; otherwise, access to the boot system 13 is denied.

[0074] The first key 16 and the second key 26 can be the same. The challenge-response protocol can then be based on this shared symmetric key. Alternatively, the second key 26 can be a private key, while the first key 16 can be a public key.

[0075] Figure 2 This is a schematic diagram of a weighing scale 1 and a response generation device 20 operated by an electronic data processing system according to the present invention. The weighing scale 1 includes a weighing device in the form of a load cell (not shown) and a weighing plate 2. Optionally, the weighing scale 1 may include a printer 3 for printing out weighing data.

[0076] The electronic data processing system of the weighing scale 1 and in Figure 1 The electronic data processing system 10 shown is similar, and this electronic data processing system refers to the above reference. Figure 1 The electronic data processing system 10 may include an x86 processor or an ARM processor.

[0077] The weighing scale 1 also includes a first display 15. The first display 15 can correspond to the above reference. Figure 1 The aforementioned output device 15. The challenge is displayed on the first display 15 in a human-readable form, i.e., in digital form. Figure 2 In the illustrated embodiment, the displayed number may be a representation of a random number generated by a random number generator implemented in the startup system.

[0078] Keyboard 14 can be connected to the weighing scale 1. Keyboard 14 can allow user input, for example, to initiate a user identification protocol as outlined in more detail below. Keyboard 14 can correspond to reference... Figure 1 The input device mentioned above. Keyboard 14 can allow the input of the generated responses mentioned below.

[0079] The weighing scale 1 may also include at least one hardware interface, such as a USB port. This hardware interface can be connected to an external storage medium. A second operating system can be stored on the external storage medium. For example, the external storage medium can be a USB flash drive.

[0080] Figure 2 A response generation device 20, in the form of a laptop computer, is further shown. The response generation device 20 may include... Figure 1 All components of the response generation device 20.

[0081] The laptop includes a second keyboard 24. The user can read the challenge displayed on the first display 15 of the weighing scale 1 and transmit the challenge to the response generation device 20 by inputting the challenge via the second keyboard 24.

[0082] As described above, the second key can be stored on the storage medium of the response generation device 20. Alternatively, as in Figure 2 As shown, the second key 26 can be stored on the server 40, and the response generation device 20 can access the second key 26 via secure or confidential communication with the server 40.

[0083] The laptop computer 20 includes a second display 25. The second display 25 can display the response generated by the response generation device 20 in a human-readable format. Figure 2 In the embodiment shown, the response is displayed digitally on the second display 25.

[0084] The response can be read by the user from the second display 25 and entered into the boot system via the first keypad 14. Access to the boot system is then granted or denied based on whether the entered response is correct.

[0085] Figure 3 An embodiment of the method according to the present invention is shown. The method will be referred to... Figure 2 The weighing scale 1 is described by way of example.

[0086] The method begins with a user request to execute an identification protocol (S1). For example, the user may press a specific key on the first keypad 14 when the weighing scale 1 is started. The key may be, for example, DEL or F7.

[0087] Then, system 13 is initiated to generate a challenge, such as a random challenge (S2). This challenge can be represented by a bit string (e.g., numbers only). The challenge can be a representation of random numbers generated in system 13.

[0088] The challenge is communicated to the user (S3). For example, the challenge can be displayed on the first display 15 of the weighing scale 1 in a human-readable form. For example, a bit string (e.g., a sequence of numbers) can be displayed on the first display 15. The user can read the challenge from the display 15 and type it into the response generation device 20. For example, the user can use the second keypad 24 to input the sequence of numbers displayed on the first display 15 into the response generation device 20.

[0089] Next, the response is generated by the user (S4). For example, the response generation device 20 can generate the response by executing the response generation algorithm described above. The response generation algorithm can accept a challenge and a second key 26 as input. The challenge-response protocol can be based on symmetric key technology or public key technology. If the protocol is based on symmetric key technology, then the second key 26 can be the same as the first key 16 (see below).

[0090] The generated response is then communicated to the startup system 13 via an incoming message (S5). For example, the response may be displayed on the second display 25 in a human-readable form. The user can read the response and, for example, type it into the startup system 13 using the keyboard 14.

[0091] The response is then verified by the startup system 13 (S6). For example, the startup system 13 may execute a verification algorithm implemented in the startup system 13. This verification algorithm may accept a challenge, a response, and a first key 16 as input, and verify whether the response input by the user is correct.

[0092] If the response is correct, grant the user access to the startup system 13 (S7); otherwise, deny the access (S8). Then, a new challenge can be generated (S2).

[0093] List of reference numerals 1 Weighing scale 2 Weighing plate 3. Printer 10 Electronic Data Processing System 11. Processor (CPU) 12 Internal storage media 13 Start the system 14 First Keyboard (Input Device) 15 First display (output device) 16 First Key 17 Verification Units 18 Hardware Interfaces (USB Ports) 19 Challenge Generator 20 laptops 21. Processor (CPU) 22 Storage Media 24 Second Keyboard 25 Second monitor 26 Second Key 27 Response Generator 30 External storage media 40 servers

Claims

1. A method for operating an electronic data processing system (10) capable of running under an operating system, the electronic data processing system (10) comprising a boot system (13) for selectively loading the operating system from one of a plurality of storage media (12, 30), the boot system (13) being accessible to the external user when executing an identification protocol between the boot system (13) and the external user, the identification protocol being a challenge-response protocol based on a challenge generated by the boot system (13) and conveyed to the user in an outgoing message, and based on verification of a response generated by the user based on the challenge and received by the boot system (13) as an incoming message generated by the user, characterized in that, The execution of the identification protocol allows the external user to select the storage medium from which the operating system is loaded.

2. The method according to claim 1, wherein, The identification protocol is a challenge-response protocol based on a challenge randomly generated by the initiation system (13) and conveyed to the user in an outgoing message, and based on the verification of a response generated by the user based on the challenge and received by the initiation system (13) as an incoming message generated by the user.

3. The method according to claim 1 or 2, wherein, The challenge is generated by executing a challenge generation algorithm implemented in the startup system (13) using electronic data processing, and / or the response is generated by executing a response generation algorithm implemented in an electronic response generation device (20) that can be run by the user using electronic data processing, and / or the verification is executed by executing a verification algorithm implemented in the startup system (13) using electronic data processing.

4. The method according to claim 1 or 2, wherein, The challenge-response protocol is based on a symmetric key shared between the startup system (13) and the user.

5. The method according to claim 4, wherein, The challenge-response protocol is based on a one-way function that accepts the challenge and the shared symmetric key as input.

6. The method according to claim 5, wherein, The one-way function is a key hash message authentication code.

7. The method according to claim 1 or 2, wherein, The challenge-response protocol is based on a pair of asymmetric keys, one of which is a public key accessible to the startup system, and the other is a private key used to generate the response.

8. The method according to claim 5 or 6, wherein, The user receives the key through secure or confidential communication with the server (40) or another device.

9. The method according to any one of claims 1-2 and 5-6, wherein, The challenge is generated in the startup system (13) as a function of the startup system time and random user input.

10. The method according to any one of claims 1-2 and 5-6, wherein, The challenge is equipment-related.

11. The method according to any one of claims 1-2 and 5-6, wherein, The outgoing message conveying the challenge is indicated in a human-readable or machine-readable form on a first display (15) associated with the startup system (13), the user manually enters the displayed message into an electronic response generation device (20) associated with the user and capable of operating to display the generated response in a human-readable or machine-readable form on a second display (25) associated with the response generation device (20), and the user manually enters the displayed response as the incoming message into the startup system (13), or wherein the response is communicated to the startup system (13) in a machine-writable manner.

12. The method according to any one of claims 1-2 and 5-6, wherein, The electronic data processing system (10) operates to control the operation of weighing scales (1) and / or point-of-sale terminals and / or personal computers or computer equipment in public or unprotected environments.

13. An electronic data processing system (10) capable of operating under an operating system, the electronic data processing system (10) comprising a boot system (13) for selectively loading the operating system from one of a plurality of storage media (12, 30), the boot system (13) being accessible to an external user when executing an identification protocol between the boot system (13) and an external user, the electronic data processing system (10) comprising an input device (14) for receiving incoming messages and an output device (15) for outputting outgoing messages, the identification protocol being a challenge-response protocol based on a challenge generated by the boot system (13) and conveyed to the user in an outgoing message via the output device (15), and based on verification of a response generated by the user based on the challenge and received by the boot system (13) via the input device (14) as an incoming message generated by the user, characterized in that, The execution of the identification protocol allows the external user to select the storage medium from which the operating system is loaded.

14. The electronic data processing system (10) according to claim 13, wherein, The identification protocol is a challenge-response protocol based on a challenge randomly generated by the initiation system (13) and conveyed to the user in an outgoing message via the output device (15), and based on the verification of a response generated by the user based on the challenge and received by the initiation system (13) via the input device (14) as an incoming message generated by the user.

15. The electronic data processing system (10) according to claim 13 or 14, wherein, The boot system (13) includes a BIOS or a UEFI, wherein the generation of the challenge is performed by executing a challenge generation algorithm implemented in the BIOS or the UEFI, and / or the verification of the response is performed by executing a verification algorithm implemented in the BIOS or the UEFI.

16. The electronic data processing system (10) according to claim 13 or 14, wherein the electronic data processing system includes a USB port (18), and wherein, The boot system (13) is configured to selectively load an operating system from a storage medium (30) connected to the USB port (18).

17. A weighing scale (1), the weighing scale comprising a weighing device (2) and an electronic data processing system (10) according to any one of claims 13 to 16.

18. An authentication system comprising an electronic data processing system (10) according to any one of claims 13 to 16 and an electronic response generation device (20) for generating a response generated by the user through electronic data processing.

Images