Security arrangement for microprecessor-controlled electronic equipment

Abstract: A lock-out security arrangement for and method of maintaining microprocessor-controlled electronic equip­ ment normally operational until the occurrence of a dis­ abling event, such as physical removal of the equipment from its normal installation, and/or electrical removal of the equipment from a source of electrical power, and thereupon for disabling the equipment after detecting the disabling event and for maintaining the equipment disabled, even after the disabling event has been discontinued, until a code manually entered via a keyboard associated with a micro­ processor for controlling the normal operation of the equip­ ment matches a private access code whose identity is protected from external interrogation by reason of being stored in an internal non-volatile memory of the micro­ processor. The private access code is preferably selected by and known only to the user, and may be changed to a different private access code at the user's option.

Description: The present invention generally relates to a security arrangement for and method of maintaining microprocessor-controlled electronic equipment normally operational until the occurrence of a disabling event, and thereupon for rendering the electronic equipment inoperative after the occurrence of the disabling event, as well as for maintaining the electronic equipment inoperative even after the disabling event has been terminated until a private code is entered to the microprocessor which controls the operation of the equipment. There have been various proposals as to how to secure electronic equipment against theft. In the case of electronic equipment of the type controlled by a microprocessor manually accessed keyboard, it has been proposed, for example, in European Patent EP-A-0 141 468 (published 15.05.85), in connection with an automobile radio, to provide a separate external memory chip in which a code can be stored at the factory. Each time before the radio is turned on, one must enter an access code via the keyboard. If the access code matches the stored code, the radio is activated. However, external memory chips can be readily compromised. An intruder can interrogate the electrical lines leading into and out of the external chip with readily available electronic equipment and deduce the stored code. Also, many users may not wish to be bothered by being repeatedly compelled to unlock the equipment by entering the access code prior to each use. IT-A-1 108 081 discloses an arrangement in which a security code contained in a PROM provides a limited degree of protection for equipment such as car radios. DE-A-29 31 988 discloses a thief proofing device for a car which takes advantage of the input keys usually found in a car radio. Before the car can be driven, a code input via the radio is compared in a microprocessor with a permanently stored code. No secure method is disclosed for entering or protecting the stored code. It is an object of the present invention to secure microprocessor-controlled electronic equipment against theft by rendering the stolen equipment essentially valueless to the thief. It is an additional object of the present invention to reliably maintain microprocessor-controlled electronic equipment normally operational until the occurrence of a disabling event, to reliably render the equipment inoperative after the occurrence of the disabling event, and to reliably maintain the equipment inoperative, even after the disabling event has been terminated, until a private access code is entered to the microprocessor which controls the operation of the equipment. It is yet a further object of the present invention to protect the private access code stored in a microprocessor from external interrogation, both visual and electronic. Still another object of this invention is to allow a user to conveniently select his own private code. An additional object of this invention is to allow a user to easily change the private access code to another. Still another object of the present invention is to avoid the necessity of compelling a user to enter a private access code prior to each and every usage of the equipment. A further object of the present invention is to provide absolute code security which is immune to tampering techniques. It is additionally an object of the present invention to provide a user with a wide choice of codes of which the user may select any one which ensures ease of memorization. Yet another object of the present invention is to eliminate any factory record of codes that could be compromised by a security breach in the factory. A still further object of the present invention is to severely restrict the problem of guessing the identity of the private access code by trial-and-error techniques to a minimal percentage by devising a code of increased complexity and by introducing lengthy time delays between attempted code entries. An additional object of the present invention is to provide a custom-made security arrangement whose private access code is known only to the user. Another object of the present invention is to provide a reliable security arrangement which is simple in construction and inexpensive to manufacture. In keeping with these objects and others which will become apparent hereinafter, one object of the invention resides, briefly stated, in a security arrangement for, and method of, rendering electronic equipment, e.g. an automobile radio, a television set, a video cassette recorder, a computer terminal, a stereo system, an office typewriter, etc., inoperative after the occurrence of a disabling event,for example, a theft event wherein the equipment is removed from its normal authorised operating location or from its source of electrical power. The invention as defined in the claims comprises a programmed microprocessor, preferably a single integrated circuit chip, operative for executing a program having an operational routine for controlling the normal operation of the equipment, and a security routine for controlling the security of the equipment. The microprocessor has an internal non-volatile memory, e.g. a read/write random access memory (RAM) with a battery back-up circuit, or an electrically erasable programmable read only memory (EEPROM) accessed solely from within and protected from external interrogation, both physical and electronic. The microprocessor is programmed for distinguishing between a complete initial execution of the program and a subsequent execution thereof. By distinguishing between the initial execution of a security routine and all subsequent executions thereof throughout the life of the security arrangement, the present invention - as will be further explained - provides a degree of security not available in the prior art. In one approach, the microprocessor is programmed to permanently load a flag in a predetermined location in the protected memory after the initial program execution. When the flag is not present in the predetermined memory location, the microprocessor is conditioned to accept and to temporarily store a common public code in the protected microprocessor memory. In another approach, a code entry means, for example a manual entry keyboard, is operative to enter a code to the microprocessor. In this approach, the microprocessor is programmed with a code entry routine which is erased after the initial program execution. Before erasure, the microprocessor is conditioned to accept and to temporarily store a common public code. Alternatively, in each of the above mentioned cases where a public code was stored in the protected memory, a code entry means, e.g. a manual entry keyboard, is used to change and enter a unique private access code whose identity is selected by and known only to the user. An embodiment of this invention yet further includes detector means, e.g. a power interrupt detector and/or a position detector operatively associated with the microprocessor for detecting the occurrence of the disabling event; and disabling means also operatively associated with the microprocessor for causing the same to execute the security routine after the detection of the disabling event in order to disable the equipment from normal operation. The microprocessor is programmed to compare a code entered by the keyboard during the subsequent program execution, as determined by the distinguishing means, to the stored private code whose identity is protected from external interrogation. The disabling means is further operative for maintaining the equipment disabled, even after the disabling event has been terminated, until the code entered during the subsequent program execution matches the stored private code. In accordance with an advantageous aspect of this invention, the private code is unique for each microprocessor, is known only by the user, and is stored in an internal non-volatile memory of the microprocessor so that it is protected from external interrogation by even sophisticated electronic equipment. This is in contrast to previously tried approaches where different private codes were stored in PROMs but were easily interrogated to reveal their stored codes, and where duplicate PROMs were easily manufactured and substituted for the original ones. This is also in contrast to prior art proposals where only the same fixed code was stored in each microprocessor, an approach which was easily defeated once the code was obtained for any one microprocessor. The stolen equipment, in accordance with this invention, is essentially valueless to the thief because the equipment will remain inoperative unless the private code is entered to the microprocessor. Inasmuch as the private code is just that, i.e. secret and selected by and known only to the user, there is no way for the thief to obtain the code. To ensure added code privacy, the user can change the private code at will to any other private code. Any attempt to enter the code by trial-and-error techniques is thwarted by introducing a lengthy time delay between code entry attempts. Brief Description of the drawings FIG. 1 is an electronic schematic block diagram depicting a security arrangement; FIG. 2 is a program flow chart depicting the operation of the security arrangement in accordance with FIG. 1; FIG. 3 is a program flow chart depicting the operation of the security arrangement in accordance with a first embodiment of the present invention; and FIG. 4 is a program flow chart depicting the operation of the security arrangement in accordance with a second embodiment of the present invention. Detailed Description of the Preferred Embodiments Referring now to the drawings, FIG. 1 depicts a security arrangement 10 for rendering a piece of electronic equipment, e.g. an automobile radio 12, inoperative after the occurrence of a disabling event, e.g. a theft event wherein the car radio is physically removed from its normal installed location in an automobile, and/or electrically removed from its source of electrical power, i.e. a 12-volt automobile battery. Although the following description of the invention is outlined in connection with an automobile radio, this invention is not intended to be so limited. It will be expressly understood that many pieces of electronic equipment located in many types of environment will be within the claimed scope of this invention. By way of non-limiting example, the security arrangement can be used to protect such diverse electronic equipment as a television set, a video cassette recorder, a computer terminal, a stereo system, a typewriter, etc., any of which can be located in such diverse environments as an automobile, a home, an office, a hotel, a boat, etc. It is preferable if the radio 12 has a built-in microprocessor 14 which controls all or some of the control functions for controlling the normal operation of the radio. For example, the microprocessor 14 may be used to control the desired radio station frequency or any other normal radio function without which the radio would be essentially useless for its normal operation. However, the microprocessor 14 can be an additional device dedicated to controlling the security of the radio. The microprocessor 14 is a single integrated circuit chip having a central processing unit (CPU) 16, a read only memory (ROM) 18, a non-volatile read/write internal random access memory (RAM) 20, and input/output terminals for connection to such external devices as a radio subsystem 22, a display 24, a keypad 26, a power interrupt detector circuit 28, a position detector circuit 30, and a programming interface connector 32 to which factory programming equipment 34 is connected. All major components of the microprocessor are internal and self-contained. The micro-processor 14 is programmed to execute a program having an operational routine for controlling the normal operation of the radio, and a security routine for controlling the security of the radio, i.e. the theft-resisting function. The program is permanently stored in ROM 18. The CPU is the sole source of access to the ROM 18 and to the RAM 20 in which data is stored. External interrogation of any data stored in the ROM 18 or the RAM 20 is impossible. A CMOS micro-processor like the industry standard Model No. 80C48 can be used with a battery back-up circuit 36 to provide non-volatile memory storage so that the data stored in the RAM 20 will remain intact even after power to the radio has been removed. A standard lithium battery can retain data in such a memory for several years. A rechargeable battery will retain data after power removal, and will recharge during normal powered operation. Newer single chip EEROM microprocessors, e.g. Seeq, Inc. Model No. 72720, contain an internal non-volatile memory which does not need a battery back-up circuit to maintain the integrity of stored data. In addition, the Seeq microprocessor inhibits external access to the data stored in its non-volatile memory, thus preventing interrogation or duplication of the device. Other examples of devices having non-volatile memories are NOVRAMs, EAROMs, EEPROMs, EPROMs, etc. As explained in detail below in connection with FIGS. 3-4, the microprocessor is programmed as part of its security routine for distinguishing between a successful initial execution of the program and a subsequent execution thereof. During the initial program execution, the microprocessor is conditioned to accept a code for storage and to store the code in the RAM 20. In accordance with an arrangement shown in FIG. 1, which does not embody the present invention, the microprocessor is conditioned by connecting the factory programming equipment 34 to the microprocessor via the programming interface connector 32. The factory programming equipment 34 inputs a factory initialization code signal which is a predetermined number of eight-bit data bytes synchronised to a strobe line. The microprocessor stores each data byte. If the correct factory initialization code signal was stored, then the microprocessor is operative for enabling the radio subsystem 22 to become functional. If it is desired that the radio owner be able to select his own unique private access code known only to him, then the factory initialization code signal is used to condition the microprocessor to accept a common public code for storage and to temporarily store this common public code in the RAM 20. In a given production run for a multitude of microprocessors, the manufacturer of the integrated circuit applies the same initialization code signal to each microprocessor so that the common public code is the same for all future equipment owners. Once the radio is installed, the owner may enter this known public code via the keypad 26 to the microprocessor, and thereupon the user may enter his own personally selected private access code via the keypad. This entered private access code overwrites the stored common public code and is stored in the ROM 20. The user, at his option and at any time, may change the private access code by entering the old private access code via the keypad, followed by a new private access code which then overwrites the previous one. It is desired that the access code be fixed and unchangeable by the owner, then the public code can be dispensed with, and a private code can be directly entered at the factory. In this case, the factory programming equipment 34 is operative to apply a different factory initialisation code signal to each microprocessor in a production run so that each microprocessor has a unique, different private access code. This can be done, for example, by changing the content of the data bytes. An identification tag or the like must be issued by the factory to each owner to identify the individual private access code for each radio in this latter initialisation technique. In either of the two aforementioned initialisation techniques, a private access code is eventually stored in the RAM 20 and, after such storage, the microprocessor is programmed to execute the operational routine, i.e. to render the radio operative and to maintain the radio normally operational until the occurrence of the disabling event. For example, the desired station frequency may be entered via the keypad 26, and the microprocessor is programmed to interpret the key strokes, to display the entered station frequency on the display 24 and to activate the appropriate tuner control lines of the radio subsystem 22 to tune in the desired station, and to broadcast the station signal over a radio speaker 38. Detector means, e.g. power interrupt detector circuit 28 and/or position detector circuit 30, are operatively associated with the microprocessor 14 for detecting the occurrrence of the disabling event. As shown in FIG. 1, when the radio 12 is initially installed in an automobile, power from the 12-volt battery is simultaneously applied through a power regulator circuit 40 to the power interrupt detector circuit 28 comprised of a resistor R 1 , a capacitor C 1 and a device CR 1 , and the micro-processor 14. The capacitor C 1 is initially discharged. Upon the application of power, the microprocessor begins functioning almost immediately. However, because its RESET line is connected to the capacitor C 1 which is initially at zero volts, i.e. at a logic zero, the microprocessor 14 is programmed to enter its reset mode. The capacitor C 1 begins to charge with a time constant determined by R 1 and C 1 . The time constant is chosen to allow sufficient time for the micro-processor to reset. When the capacitor C 1 charges to a value exceeding a predetermined threshold voltage, i.e. a logic 1 value, the microprocessor begins executing its program from the beginning, which starts with the aforementioned security routine that requires entry of the proper private access code. Hence, after any interruption of power, for example due to theft, the micro-processor is reset and is caused to execute its security routine which is operative to disable the equipment from normal operation, and to maintain the equipment disabled even after the theft event has been discontinued, for example by installing the radio in the same or in a different automobile. The radio subsystem becomes activated only after the private access code is entered via the keypad 26. The microprocessor is programmed to compare the code entered via the keypad during the subsequent program execution to the stored private access code and, upon a successful match, the radio is restored to normal operation. The position detector circuit 30 can be of any number of standard alarm-type, normally-open or normally-closed switches which will sense the removal of the radio from its normal installation. When one or more switches are activated, even if power is not removed, the microprocessor will halt execution of the operational routine and will cause the security routine to begin, which, as described above, requires entry of the proper private access code. The theft event can be recorded in the RAM 20 for possible later use. Since the microprocessor is an integral part of the operational equipment, it is impossible to bypass it. The only means available to advance the program to its operational routine is by a correct code entry. Replacing the microprocessor with another is not feasible because it can be made a proprietary device obtainable only from the original equipment manufacturer. The factory initialisation code signal must be kept secure from public knowledge, since it can compromise the security of the private access code. In other words, a thief who has knowledge of the factory initialisation code signal can apply said signal to the microprocessor and condition the same to accept and store the common public code. However, since the factory initialisation code signal need be entered only at the factory, it can be done on an automated basis at a locked, secure test station. The code itself can then be made long and complex to ensure adequate security. For example, the code can be comprised of five data bytes of eight bits each, with a minimum delay between bytes of one second. Normally, factory programming would take less than five seconds, but it would take 2 40 seconds to try every possible combination of data. To foil guessing of the factory code by trial-and-error techniques, the microprocessor could be programmed with built-in time-outs to cause it to ignore codes for a given time duration after an erroneous code entry. The keypad 26 will typically consist of one or more momentary push-button, rotary or slide switches which are depressed in a predetermined sequence, and/or for a predetermined sequence of time durations. Upon an unsuccessful code entry, a time delay circuit will cause the micro-. processor to ignore additional code entry attempts for a predetermined time duration. This will discourage attempts at guessing the private access code. Due to the internal storage of the private access code in the RAM 20, the private access code cannot be determined by physical examination of the internal components of the radio. Hence, the radio cannot be made operative by removing, bypassing, replacing or modifying any components therein. The security routine for the arrangement of FIG. 1 is shown in the flow chart of FIG. 2. Thus, after the application of power to the micro-processor (block 42), the microprocessor is programmed to wait for a predetermined waiting period (block 44), and thereupon to check, as shown in block 46, whether the factory initialisation code signal is being inputted via the interface connector 32, or whether a code is being manually entered from the keypad 26. If a factory code signal has been entered (block 48), then its validity is checked at block 50. If the factory code signal is valid, as determined at block 51, then the microprocessor is programmed to store (block 52) a common public code in the RAM 20. The aforementioned sequence of events occurs during the initial program execution, i.e. the first time that power has been applied to the micro-processor. On the other hand, if a code has been entered (block 54) from the keypad, then the micro-processor is programmed to check (block 56) if the entered code matches the stored code. If no match has occurred, as determined at block 58, then it is assumed that a thief is at work, and the microprocessor is programmed to return to block 44 and wait for a predetermined waiting time to discourage the thief from making another code entry attempt. If a match has occurred, as determined by block 58, then the microprocessor checks (block 60) to see if a code change has indeed been requested. If a change has been requested (block 62), then a code entry routine is initiated (block 64) to enter and store a new private code. If a code change has not been requested, or if a new private code has already been stored, then the microprocessor enables the radio to execute its normal operational routine and to function in its intended fashion, as depicted by block 66. The factory initialization code signal technique shown in FIG. 2 is used solely to allow for storage of the public code. Since the public code is temporarily stored in a non-volatile memory, the factory initialization code signal need only be used once in initializing the arrangement. If it were possible to permanently record the fact that the public code had already been stored, then the factory initialization code signal would not be necessary at all to ensure the security of the arrangement. This is not feasible in an arrangement where the data stored in the RAM 20 can be readily erased by removal or disconnection of the back-up battery circuit 36. However, in an arrangement which uses an inaccessible passive non-volatile data memory which does not use a battery back-up circuit, e.g. a self-adaptive EEROM, the factory initialization code technique can be eliminated. The microprocessor can then in accordance with the present invention, detect whether the public code has been initialized by examining its memory in either of the ways depicted in the flow charts of FIGS. 3 and 4. Turning to FIG. 3, upon the application of power (block 68), the microprocessor again waits for a predetermined waiting period (block 70), and then begins program execution by checking (block 72) a predetermined location in its non-volatile data memory for a unique predetermined initialization flag word. If the microprocessor has never before executed its program, only random bits which would not match the pattern expected by the program would be read at this memory location. A non-match, as determined at block 74, would cause the microprocessor to condition itself to accept and to temporarily store the public code in the RAM 20, as depicted by block 76, as well as to permanently load the flag into its proper location in the RAM 20, as depicted by block 78. The aforementioned sequence of events occurs during the initial program execution of the microprocessor. Now that the flag is permanently stored in the RAM 20, as determined by block 74, whenever the microprocessor is restarted, it will find that the already-stored flag matches the data it expects. Instead of routing to the public code storage routine, it will route itself to a code entry routine. The code entry routine includes the steps of waiting for the entry of a code from the keypad 26 (block 80), and checking if the entered code matches the stored code (block 82). If the entered code does not match the stored code, as determined by block 84, then, as before, it is assumed that a thief is at work, and the microprocessor is programmed to return to block 70. However, if a match has occurred, then the microprocessor checks to see if the user wants to change the stored code (block 86). If a code change has been requested, as determined by block 88, then the microprocessor enters and stores the new private code (block 90). If a code change has not been requested, or if the new private code has already been stored, then the microprocessor enables the radio to execute its normal operational routine and to function in its regular fashion, as depicted by block 92. Turning now to FIG. 4, upon the application of power (block 94), the microprocessor is programmed to execute a code entry routine, i.e. program block A. This code entry routine conditions the microprocessor to enter a new public or private code directly from the keypad, as depicted at block 96, and to store the entered code in the RAM 20, as depicted by block 98. In addition, the program block A includes the erasure of all its original instructions upon the completion of the initial program execution, as depicted by block 100. After the erasure, a jump instruction is added, as depicted by blocks 102 and 104, wherein the microprocessor is programmed to skip over what was program block A upon each and every subsequent program execution to block B. This self-adaptive capability, i.e. wherein the microprocessor program can modify itself during execution, can be used to cause the microprocessor to execute a routine once, then erase the program code entry routine just executed and substitute a different instruction. The change becomes permanent since the program memory is non-volatile and externally inaccessible. Upon each and every subsequent program execution, the microprocessor is programmed to wait for a code entry from the keypad (block 104), and thereupon to check (block 106) if the entered code matches the previously stored code. If a match is not made (block 108), then it is assumed that a thief is at work, and the microprocessor is programmed to go to block 110 which introduces a waiting period sufficient in duration to discourage a thief. If a match has occurred at block 108, then the microprocessor checks to see whether the user wishes to change the stored code (block 112). If a code change has been requested (block 114), then the microprocessor is conditioned to accept and to store a new private code entered from the keypad, as depicted in block 116. If a code change has not been requested, or if the new private code has already been stored in the RAM 20, then the microprocessor enables the radio to execute its normal operational routine and to function in a regular fashion, as depicted in block 118. It will be understood that the routines of FIGS. 3 and 4 (which form part of this invention) offer the advantage over the routine of FIG. 2 (which does not form part of this invention) that there is no factory initialization code signal which might fall into the hands of thieves. The microprocessor is preferably constituted as a single integrated chip but, in some cases, could be constituted on more than one chip. If more than one chip is utilized, then it is preferable if the chips are mounted in a single package or housing. The term "microprocessor" as used throughout this specification and in the following claims is not intended to be limited solely to a programmable integrated circuit device, but is specifically intended to also cover dedicated integrated circuit devices which perform the same functions described herein.

Claims: A lock-out security arrangement (10) for rendering electronic equipment (12) having a normal operation inoperative after a disabling event has occurred, and for maintaining the equipment (12) inoperative after the disabling event has terminated, comprising: (a) a micro-processor (14) having an internal, non-volatile, protected memory (18, 20) accessed solely by the microprocessor (14) and protected from interrogation external to the microprocessor (14), said microprocessor (14) being operative for executing a program stored in the internal memory (18, 20), said program having an operational routine for controlling the normal operation of the equipment (12), and a security routine for controlling the security of the equipment (12); (b) said security routine having means (74) for distinguishing between the initial execution of the security routine and all subsequent executions of the security routine; (c) means (76, 78) responsive to the initial execution of the security routine, for storing a first code in a secured manner in the internal memory (18, 20) of the microprocessor (14) such that the stored first code is protected from interrogation external to the microprocessor (14); (d) code entry means (26) operatively connected to the microprocessor (14), for entering a second code to the microprocessor (14); (e) said security routine having code validity means (80, 82, 84) for comparing the second code entered using the code entry means (26) to the stored first code whose identity is protected from external interrogation; (f) enabling means (92) responsive to a subsequent execution of the security routine, for enabling the microprocessor (14) to execute the operational routine after the entry of a second code matching the first code stored in the internal memory (18, 20) of the microprocessor (14), and for maintaining the equipment (12) normally operational until the disabling event has occurred; (g) detector means (28, 30) operatively connected to the microprocessor (14), for detecting when the disabling event has occurred; and (h) disabling means (110) responsive to the detector means (28, 30) and operatively connected to the microprocessor (14), for disabling the equipment (12) from normal operation after the disabling event has occurred, said disabling means being further operative for maintaining the equipment (12) disabled, even after the disabling event has terminated, until the second code matches the stored first code. The security arrangement (10) as recited in claim 1, wherein the disabling event is a theft event, and the detector means (30) is operative for detecting the removal of the equipment (12) from its authorized location. The security arrangement (10) as recited in claim 1, wherein the microprocessor (14) includes an integrated circuit chip in a self-contained housing built into the equipment (12), said chip having a central processing unit (16), and said internal memory (18, 20) including a read-only memory (18) in which the program is permanently stored and a read/write random access memory (20) in which the first code is stored; and wherein the central processing unit (16), the read-only memory (18) and the random access memory (20) are all self-contained within the housing to protect the program and the stored first code from both visual and electronic examination. The security arrangement (10) as recited in Claim 1, wherein a plurality of microprocessors (14) are to be used for protecting a corresponding plurality of electronic equipment (12), and wherein the stored first code is different and unique for each microprocessor (14). The security arrangement (10) as recited in Claim 4, wherein the distinguishing means associated with each microprocessor (14) includes means (72) for permanently loading a flag in a predetermined location in the internal memory (18, 20) of each microprocessor (14) in response to the initial execution of the security routine, and wherein the storing means associated with each microprocessor (14) is operative for directing each microprocessor (14) when the flag is not loaded in the predetermined memory location to accept a common public code for storage and to temporarily store the common public code in the internal memory (18, 20), and wherein the security routine associated with each microprocessor (14) is operative after the flag has been loaded in the predetermined memory location to change the common public code to each different first code upon entry of the latter by respectively associated code entry means (20). The security arrangement (10), as recited in Claim 4, wherein the security routine associated with each microprocessor includes means (98) for programming the microprocessor (14) with a code entry routine, and means (100) for erasing the code entry routine in response to the initial execution of the security routine; and wherein the storing means associated with each microprocessor (14) is operative for directing each microprocessor (14) when the code entry routine is not erased to accept a code for storage and to store the code in the internal memory (18, 20); and wherein the code validity means (106) associated with each microprocessor (14) is operative after the code entry routine has been erased for comparing the second code entered by the code entry means (26) to the first code stored in the protected memory (18, 20). The security arrangement (10) as recited in Claim 6, wherein each storing means (96) directs the associated microprocessor (14) when the code entry routine is not erased to accept a common public code for storage and to temporarily store the common public code in the internal memory (18, 20) and wherein the security routine of each microprocessor (14) is operative after the code entry routine has been erased to change the common public code to each different first code upon entry of the latter by the respectively associated code entry means (26). The security arrangement (10) as recited in Claim 1, and further comprising user-operated means (88, 114) for changing the first code to a different user-selected private code by user operation of the code entry means (26). The security arrangement (10) as recited in Claim 1, wherein the disabling event is a theft event, and the detector means (28) is operative for detecting the removal of the equipment (12) from its source of electrical power. The security arrangement (10) as recited in Claim 1, wherein the disabling means includes a time delay means (110) for introducing a waiting period when the second code does not match the stored first code, said code validity means (108) being inoperative until the waiting period has expired. A method of rendering electronic equipment (12) having a normal operation inoperative after a disabling event has occurred, and for maintaining the equipment (12) inoperative after the disabling event has occurred, comprising the steps of: (a) programming a microprocessor (14) having an internal, non-volatile, protected memory (18, 20) for executing a program stored in the internal memory (18, 20), said program having an operational routine for controlling the normal operation of the equipment (12), and a security routine for controlling the security of the equipment (12); (b) accessing the internal memory (18, 20) of the microprocessor (14) solely by the microprocessor (14), and protecting the internal memory (18, 20) from interrogation external to the microprocessor (14); (c) distinguishing (74) between the initial execution of the security routine and all subsequent executions of the security routine; (d) storing (76, 78) in response to the initial execution of the security routine a first code in a secured manner in the internal memory (18, 20) of the microprocessor (14) such that the stored first code is protected from interrogation external to the microprocessor (14); (e) entering (26) a second code to the microprocessor; (f) comparing (84) the entered second code to the stored first code whose identity is protected from external interrogation; (g) enabling (92) the microprocessor (14) in response to a subsequent execution of the security routine, to execute the operational routine after the entry of a second code matching the first code stored in the internal memory (18, 20) of the microprocessor (14), and maintaining the equipment (12) normally operational until the disabling event has occurred; (h) detecting (28, 30) when the disabling event has occurred; (i) disabling (110) the equipment (12) from normal operation after the disabling event has occurred; and (j) maintaining (108) the equipment (12) disabled, even after the disabling event has terminated, until the entered second code matches the stored first code. The method as recited in Claim 11, and further comprising the step of providing a plurality of microprocessors (14) for protecting a corresponding plurality of electronic equipment (12), and wherein the storing step is performed by storing the first code as different and unique for each microprocessor (14) in the internal memory (18, 20) thereof. The method as recited in Claim 11, wherein the code entering step (80) is manually performed by each user, who selects and manually enters each different first code to ensure code privacy. The method as recited in Claim 13, and further comprising the step of changing (88, 114) the first code selected by the user to a different private code selected by the user. The method as recited in Claim 11, wherein the distinguishing step is performed by permanently loading (72) a flag in a predetermined location in the internal memory (18, 20) of each microprocessor (14) after the initial execution of the security routine, and wherein the storing step is performed by directing (76) each microprocessor (14) when the flag is not loaded in the predetermined memory location to accept a common public code for storage and to temporarily store the common public code in the internal memory (18, 20), and wherein the storing step is performed after the respective flag has been loaded in the predetermined memory location by changing (80) the common public code to each different first code upon entry of the latter during the code entering step. The method as recited in Claim 11, wherein the distinguishing step includes the step of programming each microprocessor (14) with a code entry routine, and the step of erasing (100) the code entry routine after the initial execution of the security routine; and wherein the storing step is performed by directing (104) each microprocessor (14) when the code entry routine is not erased to accept a code for storage and to store the code in the internal memory (18, 20), and wherein the comparing step (108) is performed after the code entry routine has been erased for comparing a code entered during the code entering step to the code stored in the protected memory (18, 20). The method as recited in Claim 16, wherein the storing step is performed when the code entry routine is not erased to accept a common public code for storage and to temporarily store the common public code in the protected memory (18, 20), and wherein the storing step is performed after the code entry routine has been erased to change the common public code to each different first code upon entry of the latter during the code entering step. The method as recited in Claim 11, and further comprising the step of changing (88, 114) the first code to a different private code selected by user entry. The method as recited in Claim 11, wherein the detecting step is performed by detecting (28) the removal of the equipment (12) from its source of electrical power. The method as recited in Claim 11, wherein the detecting step is performed by detecting (30) the removal of the equipment from its authorized location. The method as recited in Claim 11, wherein the disabling step is performed (110) by introducing a waiting period when the first code entered during the code entering step does not match the stored first code, said comparing step being inoperative until the waiting period has expired.

Inventors: KAISH NORMAN, KAISH, NORMAN
Applicants: INT ELECTRONIC TECH, INTERNATIONAL ELECTRONIC TECHNOLOGY CORPORATION
Application year: 1984
Main classification: B60R11
IPC codes: G08B13, G06F11, G06F21, G06F12, G07C9