SECURITY SYSTEM AND METHOD FOR CONTROLLING ACCESS TO COMPUTING RESOURCES

• US 20090165123A1
• Filed: 12/19/2008
• Published: 06/25/2009
• Est. Priority Date: 12/19/2007
• Status: Active Grant

• Current Assignee: Proxense, LLC
• Original Assignee: Proxense, LLC
• Inventors: Giobbi, John J.
• Granted Patent: US 9,251,332 B2
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08

Abstract

A security system comprises a personal digital key (PDK), a reader and a computing device. The PDK is a portable, personal transceiver that includes a controller and one or more passwords or codes. The computing device includes a detection engine, vault storage and a set up module. The detection engine detect events relating to the access of any files and third-party systems by the computing device and receives information from the reader as to whether the PDK is present/linked. The detection engine controls whether a user is able to access any of the functionality provided by the computing device based upon whether the PDK is in communication with the reader or not. The present invention also includes a number of methods such as a method for initializing the security system, a method for setting up a computing device, and a method for controlling access to computing resources.

Claims

1. A system for securing computing resources, the system comprising:

a personal digital key adapted for wireless communication within a predefined range to establish a link and send and receive data;

a reader for automatically detecting the present of the personal digital key and establishing a link with the personal digital key, the reader having an input and an output and adapted for wireless communication with the personal digital key when the reader and the personal digital key are within the predefined range of each other, the reader automatically signally when it is linked to the personal digital key;

a computing device having computing resources, the computing device coupled to the input and the output of the reader for sending and receiving data;

the computing device including a security system for controlling access to the computing resources of the computing device, the security system controlled by a signal from the reader indicating whether the reader is linked to the personal digital key.

2. The system of claim 1 wherein the personal digital key includes a memory for storing security information.

3. The system of claim 1 wherein the security information includes sign-on information, set up information, user names and passwords.

4. The system of claim 1 wherein the reader includes a set up module for storing set up information utilized by the computing device to install the security system.

5. The system of claim 1 wherein the reader sends the security system to the computing device during an initialization stage.

6. The system of claim 1 wherein the reader includes a transceiver for wirelessly communicating with the personal digital key and a USB connector for coupling to the computing device.

7. The system of claim 1 wherein the reader includes secure storage for storing back-up passwords used to allow access to the computing device when the personal digital key is not in range.

8. The system for method of claim 1 wherein the security system includes a detection engine for detecting when a computing resource is accessed and controlling whether access will be permitted, the detection engine coupled to control the computing device.

9. The system for method of claim 1 wherein the security system includes vault storage for storing security set up data that specifies at least one security action for one of the computing resources, the vault storage accessible by a processor of the computing device.

10. The system for method of claim 1 wherein the security system includes a set up module for initializing and installing a detection engine and vault storage on the computing device, the set up module adapted for cooperation with the computing device.

11. A security system for controlling access to computing resources on a computing device, the security system comprising:

detection engine for detecting when one of the computing resources is accessed and controlling whether access will be permitted, the detection engine coupled to the computing device and the computing resources; and

vault storage for storing security set up data that specifies at least one security action for one of the computing resources, the vault storage coupled to and accessible by the detection engine.

12. The security system of claim 11 comprising a set up module for initializing and installing the detection engine and the vault storage on the computing device, the set up module adapted for cooperation with the computing device.

13. A method for controlling access to a computing device having computing resources, the method comprising:

monitoring for an event;

detecting the event;

determining whether a personal digital key is within a predefined range of the computing device;

allowing access to one of the computing resources if the personal digital key is within a predefined range of the computing device; and

preventing access to the one of the computing resources if the personal digital key is not within a predefined range of the computing device.

14. The method of claim 13 wherein the event is one from the group of any attempt by the computing device to access a storage device, to access a directory, to access a file, any time a login screen is displayed or any time based trigger.

15. The method of claim 13 wherein determining whether a personal digital key is within a predefined range of the computing device includes receive a control signal from a reader.

16. The method of claim 15 wherein determining whether a personal digital key is within a predefined range of the computing device includes determining whether the personal digital key is wirelessly linked to a reader coupled to the computing device.

17. The method of claim 13 wherein allowing access to one of the computing resources includes:

determining an item accessed;

retrieving an item set up record corresponding to the determined item; and

performing an action specified in the set up record.

18. The method of claim 17 wherein the action includes one from a group of clearing a screensaver, starting a screen saver, launching a window, closing a window, encrypting information, decrypting information, retrieving a password, storing a password or retrieving, entering and submitting login data.

19. The method of claim 13 wherein allowing access to one of the computing resources includes:

determining that an item accessed;

retrieving an item set up record corresponding to the determined item, the item set up record including a user name and password; and

automatically completing a sign-on screen by filling in fields using the user name and password.

20. The method of claim 19 wherein retrieving an item set up record includes communicating with a personal digital key to retrieve the user name and password from the personal digital key.

21. The method of claim 13 wherein allowing access to one of the computing resources includes:

determining whether a set up record exists for the one of the computing resources;

identifying a personal digital key;

receiving parameters for a set up record; and

creating a set up record including an identifier of the personal digital key and the received parameters.

22. The method of claim 13 comprising

determining that a personal digital key has moved within the predefined range of the computing device;

deactivating a duration timer;

retrieving entry rules associated with the PDK; and

executing the retrieved rules.

23. The method of claim 13 comprising:

determining that a personal digital key has moved outside the predefined range of the computing device;

retrieving exit rules associated with the PDK;

executing the retrieved exit rules

24. The method of claim 23 comprising:

determining time-based rules from the retrieved exit rules;

initializing a duration timer with the time based rules; and

wherein executing the retrieved exit rules delays until the duration timer has lapsed before executing the time-based rules