Security system and method for controlling access to computing resources

• US 10,469,456 B1
• Filed: 12/17/2015
• Issued: 11/05/2019
• Est. Priority Date: 12/19/2007
• Status: Active Grant

• Current Assignee: Proxense, LLC
• Original Assignee: Proxense, LLC
• Inventors: Giobbi, John J.
• Primary Examiner(s): Thiaw, Catherine
• Application Number:
  US14/973,565
• Time in Patent Office: 1,419 Days
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08

Abstract

A security system comprises a personal digital key (PDK), a reader and a computing device. The PDK is a portable, personal transceiver that includes a controller and one or more passwords or codes. The computing device includes a detection engine, vault storage and a set up module. The detection engine detect events relating to the access of any files and third-party systems by the computing device and receives information from the reader as to whether the PDK is present/linked. The detection engine controls whether a user is able to access any of the functionality provided by the computing device based upon whether the PDK is in communication with the reader or not. The present invention also includes a number of methods such as a method for initializing the security system, a method for setting up a computing device, and a method for controlling access to computing resources.

Claims

1. A system comprising:

a computing device including a first secured computing resource, the computing device controlling access to the first secured computing resource based on security set up data stored in a dedicated, encrypted portion of a memory of the computing device,

wherein the security set up data defines how to use security data to access the first secured computing resource,

wherein the security set up data is based on one or more administrator defined options that allow an administrator to define one or more security actions implemented for the first secured computing resource that differ from one or more security actions implemented for a second secured computing resource of the computing device, the one or more security actions consistently implemented for the first secured computing resource across users of the first secured computing resource,

wherein the security data used to access the first secured computing resource as defined by the security set up data for the first secured computing resource is stored on a personal digital key,

wherein the security data is automatically received by the computing device and used to control access to the first secured computing resource subsequent to wireless communication between the personal digital key and a reader, the reader communicatively coupled to the computing device,

wherein the one or more security actions implemented for the first secured computing resource include a biometric confirmation of a second user associated with the personal digital key, and

wherein the security data is automatically received subsequent to biometric authentication using a biometric reader at the personal digital key.

2. The system of claim 1, wherein the computing device terminates access to the first secured computing resource subsequent to the reader and the personal digital key no longer being within a range of one another.

3. The system of claim 1, wherein the computing device terminates access to the first secured computing resource subsequent to the reader and the personal digital key no longer being within a range of one another for a predetermined period of time.

4. The system of claim 1, wherein the one or more security actions implemented for the first secured computing resource or the second secured computing resource include automatically filling one or more of a user name and a password field of a login screen using a user name and password included in the security data.

5. The system of claim 1, wherein the personal digital key includes a memory for storing security information.

6. The system of claim 5, wherein the stored security information includes one or more of sign-on information, set up information, user names and passwords.

7. The system of claim 1, wherein the reader includes a transceiver for wirelessly communicating with the personal digital key and a USB connector for coupling to the computing device.

8. The system of claim 1, wherein the reader includes secure storage for storing back-up security information used to allow access to the computing device when the personal digital key is not in range.

9. The system of claim 1, wherein the security data is automatically received by the computing device subsequent to an event.

10. The system of claim 9, wherein the event includes one or more from a group of an attempt by the computing device to access a storage device, an attempt by the computing device to access a directory, an attempt by the computing device to access a file, a display of a login screen by the computing device, clearing a screen saver, launching a window, launching an application, and a time based trigger.

11. A method comprising:

receiving, by a computing device, security data used to access a first secured computing resource of the computing device as defined by security set up data for the first secured computing resource, the security data received automatically and subsequent to wireless communication between a personal digital key and a reader subsequent to biometric authentication using a biometric reader at the personal digital key, wherein the security data used to access the first secured computing resource, as defined by the security set up data for the first secured computing resource, is stored on the personal digital key;

determining security set up data defining how to use the security data to access the first secured computing resource of the computing device, the security set up data stored in a dedicated, encrypted portion of a memory of the computing device, the security set up data based on one or more administrator defined options that allow an administrator to define one or more security actions implemented for the first secured computing resource that differ from one or more security actions implemented for a second secured computing resource of the computing device, the one or more security actions consistently implemented for the first secured computing resource across users of the first secured computing resource and including a biometric confirmation of a user associated with the personal digital key; and

allowing access, by the computing device, to the first secured computing resource of the computing device based on the received security data and the security set up data for the first secured computing resource.

12. The method of claim 11 comprising:

terminating access to the first secured computing resource subsequent to the reader and the personal digital key no longer being within a range of one another, the reader communicatively coupled to the computing device.

13. The method of claim 12, wherein the computing device terminates access to the first secured computing resource subsequent to the reader and the personal digital key no longer being within a range of one another for a predetermined period of time.

14. The method of claim 12, wherein access to the first secured computing resource is allowed without the personal digital key based on back up security data stored by the reader.

15. The method of claim 11:

monitoring, with the computing device, for an event;

detecting, with the computing device, the event;

determining whether the personal digital key and the reader are within a range responsive to detecting the event; and

the security data used to access a secured computing resource of the computing device as defined by the security set up data for the secured computing resource is received responsive to detecting the event and determining that the personal digital key is within the range.

16. The method of claim 15 wherein the event includes one or more from a group of an attempt by the computing device to access a storage device, an attempt by the computing device to access a directory, an attempt by the computing device to access a file, a display of a login screen by the computing device, clearing a screen saver, launching a window, launching an application, and a time based trigger.

17. The method of claim 11 wherein allowing access to the first secured computing resource includes:

determining an action specified by the security set up data for accessing the first secured computing resource; and

determining that the action has successfully been performed based at least in part on the received security data.

18. The method of claim 11 wherein allowing access to the first secured computing resource includes:

automatically completing a sign-on screen by filling in fields using a user name and password, wherein the received security data includes the user name and password.