HP OmniBook 2100 User manual

1
HP Encryption
Smart Card Security System
User’s Guide

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
%HIRUH<RX%HJLQ
2 English
Before You Begin
Package Contents
Your Encryption Smart Card Security System package contains:
• 1 PCMCIA smart card reader
• 2 GPK4000 smart cards (one spare card for backup/recovery purposes)
• 1 CD-ROM containing the Encryption Smart Card Security System
software
• 1 User’s Guide (this manual)
An optional pack of five smart cards is also available as a separate
OmniBook accessory (order no. F1613A).
System Requirements
To install the Smart Card Security System, you need:
• An OmniBook 900 or 4150 or later with Windows 95 OSR2,
Windows 98, or Windows NT 4.0 (a Smart Card BIOS is included), or
An OmniBook 2100, 3100, 4100, 7100, 7150 with Windows 95
OSR2, Windows 98, or Windows NT 4.0 (BIOS security features
require a Smart Card BIOS, not included), or
An OmniBook XE with Windows 98. BIOS security features are not
supported. Future models may support other operating systems and
BIOS security.
• A CD-ROM drive installed in your OmniBook or available via a
network (on certain OmniBook models the CD-ROM drive is an option
that must be purchased separately).
• 1 free PCMCIA slot
• At least 7 megabytes of free hard disk space

English 3
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
%HIRUH<RX%HJLQ
HP also recommends that you have a formatted floppy diskette on hand to
use as a safe place to store the recovery file generated during the smart
card setup process.
The HP Encryption Smart Card Security System
With the HP Encryption Smart Card Security System, your smart card can
provide several types of security for your OmniBook. The security you
have available depends on your operating system, your security setup
options, and your system BIOS.
• BIOS Security
These features require a Smart Card BIOS, which is not available for
all OmniBook models. If you don’t have a Smart Card BIOS, you can
use the normal BIOS password for BIOS security.
Startup authorization.
Resume authorization.
Undock authorization.
BIOS Setup authorization.
• Windows NT Security
Logon authorization.
Secure screen saver.
Lock at card removal.
• Windows 95/98 Security
Secure screen saver.
Lock at card removal.
• Encryption Security
Data encryption.
Lock at card removal.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
2YHUYLHZRIWKH6HWXS3URFHGXUH
4 English
Overview of the Setup Procedure
Windows NT requires that an NT administrator set up the Smart Card
Security System on an OmniBook. For a Windows 95/98 system, setup
can be performed by the user.
To ensure the setup procedure is successful, the following steps must be
completed in order:
1. Install the drivers, software, and PCMCIA card reader
2. Initialize a smart card (Windows NT)
3. Update your OmniBook’s system BIOS
4. Enable BIOS smart card security
5. Set up a Secure folder on your hard disk
6. Make a recovery file
These steps are discussed on the following pages.
Caution Do not insert your smart card reader until instructed to do so by the
installation program.

English 5
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
6WHS,QVWDOOWKHGULYHUVVRIWZDUHDQG3&0&,$FDUGUHDGHU
Step1:Installthedrivers,software,andPCMCIAcard
reader
Caution Do not insert your smart card reader until instructed to do so by the
installation program.
1. Start your OmniBook (for Windows NT, log on as Administrator) and
wait for your Windows desktop to display.
2. Insert the Smart Card Security System CD. If your CD-ROM drive is
configured to “autorun”, the smart card installation process will begin
automatically. If it is not, use Windows Explorer to browse the CD
contents and double-click the file setup.exe in the root directory to run
the installation.
3. Click “Install HP Encryption Smart Card Security System” to start the
setup.
4. When the installation process asks you to install the PCMCIA card
reader, make sure the label is facing up.
For Windows NT, if Service Pack 4 (SP4) is not installed, the system will
prompt you to let it be installed from the Smart Card Security System CD.
Your Secure folder will be C:\Private by default, but may be changed
during installation if desired.
Your OmniBook will be restarted when the installation is complete.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
6WHS,QLWLDOL]HDVPDUWFDUG:LQGRZV 17
6 English
Step 2: Initialize a smart card (Windows NT)
For Windows 95/98, go to “Step 3” on page 8.
A smart card can be initialized only after the software has been installed
and your OmniBook has been restarted (Step 1).
1. For Windows NT, if you have just installed the software and your
OmniBook has been restarted, you will be asked to insert an
uninitialized smart card into the card reader. Insert the card face-up and
so the end nearest the gold memory emblem goes in first.
2. Enter the card holder’s name and a PIN (personal identification
number). The name is permanent and can not be changed. The PIN
must be exactly eight digits long and contain only numbers. You must
enter the PIN twice for verification.
3. Click OK.
Note Memorize your PIN! You will not be able to use your smart card to gain
access to your OmniBook if you forget the PIN. You may wish to write the
PIN on a piece of paper and keep it in a safe place, such as a safety deposit
box.
4. Enter the NT logon name, password, and domain name, followed by
the card’s PIN.
5. Click OK.
The smart card is now ready for use.
Initializing Further Smart Cards
You can initialize as many cards as you want. Each authorized user can
have their own smart card with user name and PIN. Two blank
uninitialized smart cards are provided with the Smart Card Security
System.

English 7
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
6WHS,QLWLDOL]HDVPDUWFDUG:LQGRZV 17
Once you have initialized the first smart card, you can initialize further
cards at any time as follows:
1. Log on to your OmniBook using your smart card.
2. Click Start, Programs, HP Security System, Smart Card Security
Manager to run the Smart Card Security Manager.
3. For Windows NT, click the NT Logon tab, then click Options.
Change the “On card removal” setting to “Continue.”
For Windows 95/98, click the Win95/98 tab. Disable the option
“Launch screen saver on smart card removal.”
4. Insert an uninitialized smart card into the reader.
5. Click the Smart Card tab.
6. Click Initialize.
7. Follow the instructions to initialize the card.
8. On the NT Logon or Win 95/98 tab, restore the card-removal setting
you changed above.
Multiple Accounts on a Single Smart Card
You can create multiple NT logon accounts on a single card. Each account
has its own user name, password and domain. This means you can access
several different accounts with one smart card.
For further information, refer to the online help.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
6WHS8SGDWH\RXU2PQL%RRN·VV\VWHP%,26
8 English
Step 3: Update your OmniBook’s system BIOS
For an OmniBook 900 or 4150 with a BIOS version earlier than 2.20, or
for an OmniBook with a Smart Card BIOS available on the OmniBook
website, www.hp.com/omnibook, update the BIOS to support BIOS
security features. To determine your BIOS version, reboot the computer
and press F2 when you see the HP logo—the first screen of BIOS Setup
shows the BIOS version.
Skip these steps if your BIOS is a Smart Card BIOS or if none is available
for your model.
Follow these steps to update your BIOS:
1. Start Windows Explorer.
2. Insert the Smart Card Security System CD and run setup.exe.
3. In the Smart Card Setup window, click the “Smart Card BIOS Update”
option.
Caution Your OmniBook must be on ac power during BIOS update because a
power loss will completely disable your OmniBook computer.
4. Follow the displayed instructions to create a BIOS update floppy and
update the BIOS.

English 9
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
6WHS(QDEOH%,26VPDUWFDUGVHFXULW\
Step 4: Enable BIOS smart card security
This step must be performed by the BIOS administrator. Follow these
steps to enable BIOS smart card security on your OmniBook (if it is
supported):
1. Click Start, Programs, HP Security System, Smart Card Security
Manager to run the Smart Card Security Manager.
2. Click the BIOS Password tab.
3. Insert a smart card into the reader. Ensure this card is the one you want
to be the BIOS Administrator card. For Windows NT, this could be the
NT administrator card.
4. If the Enable button is dimmed, BIOS security is not supported. Skip
to “Step 5” on page 10.
5. Click Enable to create the BIOS Administrator card.
Note For ease of use, HP recommends that you do not enable the option
requiring the PIN at boot. The presence of the card unlocks the computer.
Setting Up a BIOS User Password Card
Follow these steps to set up a BIOS user password in the BIOS and store it
on a smart card.
1. Click Start, Programs, HP Security System, Smart Card Security
Manager to run the Smart Card Security Manager.
2. Click the BIOS Password tab.
3. Click Set next to “BIOS User Password” and follow the instructions to
create a BIOS user password card. You must have the BIOS
administrator card available.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
6WHS6HWXSD6HFXUHIROGHURQ\RXUKDUGGLVN
10 English
Step 5: Set up a Secure folder on your hard disk
The Secure folder holds files that are automatically encrypted. The
encryption key is kept on the user smart card.
1. Insert your user smart card into the reader.
2. Click Start, Programs, HP Security System, Smart Card Security
Manager to run the Smart Card Security Manager.
3. Click the Encryption tab.
4. Click Create and follow the instructions.

English 11
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
6WHS0DNHDUHFRYHU\ILOH
Step 6: Make a recovery file
Note HP strongly recommends you make a new encrypted recovery file of your
smart card data now and also whenever you change a smart card password.
This recovery file will allow you to recreate your smart card (and, more
importantly, access your computer) if the card is lost, stolen, or damaged.
You can keep old recovery files in case you need to create an old card.
Even if you created a recovery file earlier, you should make another one
now to ensure it includes all the latest information entered up to this point.
To make a recovery file of your smart card:
1. Click Start, Programs, HP Security System, Smart Card Security
Manager to run the Smart Card Security Manager.
2. Click the Smart Card tab.
3. Insert a formatted floppy disk in the floppy drive.
4. In the Recovery section, click Create and follow the instructions.
The recovery file is encrypted and saved on the floppy disk.
5. Store the floppy disk in a safe place.
Note Memorize the recovery file password! You will not be able recreate your
smart card from the recovery file if you forget the password. You may wish
to make a note of the password on a piece of paper and keep it in a safe
place, such as a safety deposit box.
Do not save the recovery file on your OmniBook’s hard disk because you
will not be able to access the file without your smart card. Furthermore, the
recovery file may be accessible to others, which can pose a security risk.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
8VLQJ<RXU6PDUW&DUG
12 English
Using Your Smart Card
When properly set up, the HP Smart Card Security System ensures only
users with your smart card and the correct PIN (personal identification
number) can use your OmniBook. See page 15 for setup options.
Starting or Logging On To Your OmniBook
To start or log on to your OmniBook, insert your smart card into the reader
and enter your PIN if prompted.
Note If the PIN is entered incorrectly seven times, the smart card will be
automatically locked (disabled) to ensure the OmniBook’s security. Once
disabled, the smart card is permanently unusable and should be discarded.
If you don’t have a smart card BIOS, the normal BIOS password and NT
logon provide security.
Logging Off or Locking Your OmniBook
To lock your OmniBook, remove your card from the reader. The
OmniBook will automatically lock—if the Smart Card Security Manager
is configured to do this. Or you can allow the secure screen saver to
activate.
For Windows NT users, the NT logon options can be changed only by the
administrator.
Undocking Your OmniBook or Resuming From Suspend
To undock your OmniBook or resume from suspend, you must insert the
smart card into the reader and enter your PIN.
Note that you cannot undock your OmniBook while in MS-DOS mode.
First exit back to Windows, then undock.

English 13
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
8VLQJ<RXU6PDUW&DUG
Note DonotleavetheOmniBookunattendedinMS-DOSmode.TheSmartCard
Security System is inactive in this mode.
If you don’t have a Smart Card BIOS, the normal BIOS password provides
security.
Using the Secure Folder
By default, your Secure folder is located in C:\Private.
After you have inserted your smart card and correctly entered your PIN,
you can create directories and files within the Secure folder in exactly the
same way as outside the Secure folder. The following guidelines apply.
Storing existing files in the Secure folder
Use your application or Windows Explorer to Save as or Copy to the
Secure folder. Windows NT will also allow you to move files using drag
and drop.
Note that Save as can and Copy to will leave a copy of your document
in the unsecure part of your hard disk, which presents a potential security
risk.
If you move files out of your Secure folder they are decrypted.
Using an existing file in the Secure folder
Use your application to Open and then Save or Save as files stored in
your Secure folder just like you would files in any other folder. Files are
encrypted when they’re saved.
Deleting a file in the Secure folder
Use Shift+Delete to permanently delete files from your Secure folder
and not send them to the Recycle Bin.
Note Do not use Delete to remove files from your Secure folder because this
would decrypt the files and place them in the Recycle Bin.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
8VLQJ<RXU6PDUW&DUG
14 English
Backing up secure files
It is a good idea to back up files in your Secure folder just like you do all
your other files. However, you should back up your Secure folder and all
its contents separate from your unsecure files, then keep the decrypted
backup files in a secure place. Make sure your smart card is inserted
during the backup to ensure files are decrypted properly.

English 15
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
8VLQJWKH6PDUW&DUG6HFXULW\0DQDJHU
Using the Smart Card Security Manager
Note HP recommends that you not change the default administrator settings in
the Smart Card Security Manager unless you are familiar with NT logon
practices.
At the desktop, access the Smart Card Security Manager by clicking Start,
Programs, HP Security System, Smart Card Security Manager.
Smart Card Options
To see the following options, click the Smart Card tab in the Smart Card
Security Manager.
Initialize a Smart Card
A smart card must be initialized before it can be used. This option is
activated only if the administrator settings in the Smart Card Security
Manager allow it. Refer to page 6 for instructions.
Change a Smart Card’s PIN
You can change your smart card’s PIN (Personal Identification Number).
The PIN must be exactly eight digits long and can contain only numbers.
To change the PIN:
1. Run the Smart Card Security Manager and click the Smart Card tab.
2. Click Change PIN.
3. Enter the old PIN, then the desired PIN (twice).
4. Click OK.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
8VLQJWKH6PDUW&DUG6HFXULW\0DQDJHU
16 English
Create a Recovery File
It is strongly recommended that you create a recovery file after creating a
new smart card or changing a smart card’s data. The recovery file will
allow you to recreate your smart card if it is lost or stolen. Refer to page
11 for instructions.
Restore a Smart Card
You can create a duplicate smart card from a recovery file. This is
especially useful if your card was lost or stolen, or if you simply want to
create a backup smart card, ready for use.
Before starting, you will need:
• Access to a computer that has the Smart Card Security System reader
and software installed.
• The floppy disk containing the recovery file.
• An uninitialized OmniBook smart card. You can’t use a disabled card.
Note If you use a smart card that is not blank, the original contents of the card
(such as logon name, password, and encryption key) will be deleted during
the recovery process. The card’s user name and PIN will not change.
To restore a smart card:
1. Click Start, Programs, HP Security System, Smart Card Security
Manager to run the Smart Card Security Manager.
2. For Windows NT, click the NT Logon tab, then click Options.
Change the “On card removal” setting to “Continue.”
For Windows 95/98, click the Win95/98 tab. Disable the option
“Launch screen saver on smart card removal.”
3. Click the Smart Card tab.
4. Insert the floppy disk containing the recovery file in the floppy drive.
5. Insert the smart card into the reader.
6. In the Recovery section, click Restore.

English 17
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
8VLQJWKH6PDUW&DUG6HFXULW\0DQDJHU
7. Ensure the correct recovery file name is selected.
8. Enter the recovery file’s password (the one you entered when you
created the recovery file) and click OK.
9. On the NT Logon or Win 95/98 tab, restore the card-removal setting
you changed above.
The original smart card contents will be restored to the new smart card.
BIOS Password Options
To see these options, click the BIOS Password tab in the Smart Card
Security Manager.
These options allow you to do the following:
• Enable or disable BIOS smart card security. This is a BIOS
administrator option. Note that disabling this option clears all BIOS
passwords.
• Change the BIOS administrator or user password stored in the BIOS.
• Store or change a BIOS password on a smart card. Note that changing
your card’s password will make it unable to unlock your computer.
• Change whether the smart card’s PIN must be entered to boot the
OmniBook. For ease of use, leave this option disabled. The PIN is still
required to start Windows NT.
See the online help for more information.
NT Logon Options
To see these options, click on the NT Logon tab in the Smart Card
Security Manager. This tab appears only for Windows NT.
These options allow you to add and remove Windows NT accounts from
your smart card. This means you can use your smart card to log on to
several different Windows NT accounts, as well as change the password
for any of these accounts.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
8VLQJWKH6PDUW&DUG6HFXULW\0DQDJHU
18 English
All other NT Logon options are disabled for the user and can be changed
only by the administrator.
Win 95/98 Options
To see these options, click the Win 95/98 tab in the Smart Card Security
Manager. This tab appears only for Windows 95 or 98.
These options allow you to do the following:
• Enable or disable the secure screen saver. The secure screen saver
provides smart card security whenever you remove the card and when
the screen saver activates.
• Enable or disable smart card security when undocking or when
resuming operation after the computer suspends.
See the online help for more information.
Encryption Options
To see these options, click the Encryption tab in the Smart Card Security
Manager.
These options allow you to do the following:
• Create a new encryption key. The new key cannot decrypt files created
with a different key.
• Specify when the Secure folder locks. You can make the Secure folder
lock as soon as the card is removed, or it can remain unlocked until
logoff.
See the online help for more information.

English 19
+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
'RFXPHQWDWLRQDQG+HOS
Documentation and Help
There are several sources of documentation and help for the HP Smart
Card Security System:
• The online help contains information about using and configuring the
Smart Card Security System.
The online help is installed on your OmniBook when you install the
Smart Card Security System.
You can also access the online help in the \DOC directory on the
Smart Card Security System CD.
• HP’s web site resources, including software and drivers, manuals,
FAQs (Frequently Asked Questions) and technical notes. There is also
information about HP’s Smart Card Ready program. Go to
http://www.hp.com/omnibook/security.

+3(QFU\SWLRQ6PDUW&DUG6HFXULW\6\VWHP8VHU¶V*XLGH
7URXEOHVKRRWLQJ
20 English
Troubleshooting
If you are experiencing any problems with your OmniBook, do not log off
or remove your smart card until the problem has been resolved.
Additional troubleshooting information is available in the online help.
3UREOHP ([SODQDWLRQ $FWLRQ
,ORVWP\VPDUW
FDUG
,I\RXDUHXVLQJ17\RXZLOOQRZEH
XQDEOHWRORJRQWR\RXU17DFFRXQWDQG
JDLQDFFHVVWR\RXU2PQL%RRN<RXZLOO
DOVREHXQDEOHWRUHDGWKHILOHVLQ\RXU
6HFXUHIROGHU
0DNHDQHZFDUGRQDQRWKHU2PQL%RRNZLWKD
6PDUW&DUG6HFXULW\6\VWHPXVLQJ\RXU
UHFRYHU\ILOHVHHSDJH
,I\RXFDQ¶WGRWKLVFRQWDFW\RXUV\VWHP
DGPLQLVWUDWRUWRUHJDLQDFFHVVXVLQJWKH
DGPLQLVWUDWRUFDUG,IWKHFRPSXWHUZLOOQRW
XQORFNFDOO+3IRUDVVLVWDQFHLQUHVWRULQJWKH
%,26SDVVZRUG7KHQPDNHDQHZFDUGXVLQJ
WKHUHFRYHU\ILOH,IQRUHFRYHU\ILOHLVDYDLODEOH
HQFU\SWHGGDWDLVQRWUHFRYHUDEOH
,I\RXDUHXVLQJ:LQGRZV \RXZLOO
EHXQDEOHWRUHDGWKHILOHVLQ\RXU6HFXUH
IROGHUDQGPD\QRWEHDEOHWRVWDUWWKH
FRPSXWHU
0DNHDQHZFDUGRQDQRWKHU2PQL%RRNZLWKD
6PDUW&DUG6HFXULW\6\VWHPXVLQJ\RXU
UHFRYHU\ILOHVHHSDJH
,IWKHFRPSXWHUZLOOQRWXQORFNXVHDQ
DGPLQLVWUDWRUFDUGRUFDOO+3IRUDVVLVWDQFHLQ
UHVWRULQJWKH%,26SDVVZRUG7KHQPDNHD
QHZFDUGXVLQJWKHUHFRYHU\ILOH,IQRUHFRYHU\
ILOHLVDYDLODEOHHQFU\SWHGGDWDLVQRW
UHFRYHUDEOH
,FDQQRWORJRQWR
P\17DFFRXQW
<RXDUHQRWXVLQJWKHFRUUHFWFDUG\RXU
VPDUWFDUGLVQRWLQVHUWHGFRUUHFWO\LQWKH
VPDUWFDUGUHDGHURUWKHUHDGHULVQRW
FRQQHFWHGFRUUHFWO\WRWKH2PQL%RRN
&KHFN\RXUVPDUWFDUG&KHFNWKDWWKHFDUGLV
FRUUHFWO\LQVHUWHGLQWKHUHDGHUDQGWKHUHDGHU
LVFRUUHFWO\LQVHUWHGLQWKH3&0&,$VORW