Security system for microcomputers

• US 4,757,533 A
• Filed: 09/11/1985
• Issued: 07/12/1988
• Est. Priority Date: 09/11/1985
• Status: Expired due to Fees

• Current Assignee: Software Security Incorporated
• Original Assignee: Computer Security Corporation
• Inventors: Allen, Michael J., Langlois, John
• Primary Examiner(s): Cangialosi, Salvatore
• Assistant Examiner(s): Lewis, Aaron J.
• Application Number:
  US06/774,821
• Time in Patent Office: 1,035 Days
• Field of Search: 178/22.08, 178/22.09, 364/200, 364/900, 380/23-25, 340/825.34, 235/379-382, 235/492
• US Class Current: 713/192
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A security system for a personal computer, in which hardware and software are combined to provide a tamper-proof manner of protecting user-access and file-access. The hardware component of the system is an expansion board for insertion into an expansion slot of the PC, and has a first EPROM chip containing four portions of machine code for initializing system function calls and for establishing the proper boot-processing of the PC; a second RAM chip serving as scratch pad memory; a third EEPROM chip storing passwords, audit trail log, protection and encryption system flags, and user-access rights; a fourth automatic encryption and decryption chip for files of the PC; and a fifth clock chip for the audit trail. The software component includes a batch file that runs a program in conjunction with the machine code on the EPROM of the expansion board ensuring access is gained only for valid users. The code on the EPROM monitors all DOS 21H file handling function calls, and initializes the 7CH interrupt vector for allowing the security system to access DOS and the files thereof. During boot processing, the 10H video interrupt handler is monitored to prevent circumventing the security system. Hard-disc format-protection is also provided by monitoring of the 13H interrupt function calls. Files may also be created that may not be copied.

Claims

1. A security system for protecting an IBM personal computer, or IBM-compatible personal comptuer, against unwanted access to the files thereof and unwanted access to the operating system thereof, comprising:

an expansion card for insertion into an expansion slot of the personal computer;

said expansion card comprising at least one memory means for storing machine code having a first portion for monitoring file interrupt function calls to the files of the personal computer;

first means for storing information thereon directed to the access rights of users of the personal computer and access rights to the files of the personal computer;

said at least one memory means having a second portion thereof for monitoring all video handler interrupt functions to ensure the security system cannot be overridden during boot processing; and

a third portion for allowing communication between exterior processes and the disc operating system of the personal computer through an available interrupt call of the system;

and second means for storing said exterior processes for access to said disc operating system via said third portion, whereby access to files are protected by a user-by-user basis, and on a file-by-file basis.

2. The security system according to claim 1, wherein said at least one memory means is an EPROM, and comprises a fourth portion thereof for monitoring all disc Input/Ouput System interrupts of BIOS in order to prevent accidental or unlawful formatting of hard disc of the personal computer.

3. The security system according to claim 1, wherein said available interrupt used by said third portion of said at least one memory means is the 7Ch interrupt vector.

4. The security system according to claim 1, wherein said first means for storing comprises an EEPROM, and said second means for storing comprises at least a diskette;

said second means for storing including a series of utility programs for communicating via said available interrupt.

5. The security system according to claim 1, wherein said first means for storing comprises password codes for the users able to gain access to the personal computer, and information as to the files that are accessible by each individual user.

6. The security system according to claim 5, wherein said information as to the files that are accessible by each individual user comprises a first code allowing only read access to a respective file or files on a user basis, a second code allowing both read and write access to a respective file or files on a user basis, and a third code for denying both read and write access to a respective file or files on a user basis.

7. The security system according to claim 6, wherein said information as to the files that are accessible further comprises a fourth code for denying access to a respective department of files on a user basis, a fifth code for allowing only read access to a respective department of files, and a sixth code for allowing both read and write access to a respective department of files.

8. The security system according to claim 1, wherein said expansion card further comprises an encryption chip for encrypting a chosen file, said second means for storing comprising means for initiating said encryption chip;

said first means for storing comprising an EEPROM having a first code thereof defining the encryption state of a respective file, a second code for allowing only read access to a respective file on a user basis, a third code for allowing read and write access to a respective file on a user basis, and a fourth code for denying total access to a respective file;

said EEPROM further comprising code for the passwords of valid users of the personal computer;

said second means for storing comprising means for changing each of said first, second, third, and fourth codes and said passwords codes via said available interrupt.

9. the security system according to claim 8, wherein said second means for storing further comprises means for automatically installing said expansion card with the disc operating system of the personal computer, said means for automatically installing comprising a batch file, and means for engaging the code of said first portion of said at least one memory means to monitor DOS input/output calls through the DOS file handling interrupt.

10. The security system according to claim 1, wherein said expansion card further comprises a clock chip and associated crystal for recording the date and time of all accesses to a respective file and for recording the date and time of user password inputs, so that an audit trail may be kept of all illegal and legal accesses to DOS and files thereof;

said first means for storing further comprising a section for recording thereon the date and time log of the audit trail provided by said clock chip;

said second means for storing comprising means for initiating said clock chip and storing said audit trail on said EEPROM.

11. The security system according to claim 10, wherein said second means for storing further comprises means for dumping the log of said audit trail from said EEPROM to a disc file, when said section for recording of said EEPROM becomes full.

12. A security system for protecting an IBM personal computer, or IBM-compatible personal computer, comprising:

an expansion board having a first memory;

said first memory comprising machine code for hooking up the operating system of the personal computer with the security system, said first memory having a first main interrupt handler section for monitoring 21H DOS function calls, a second interrupt handler section for allowing communication between exterior processes through an available function interrupt vector; and

a third section for boot process handling for initializing said first main interrupt handler section and said second interrupt handler section;

means for inputting and verifying the passwords of each user of the personal computer, said third section of said first memory chip causing said means for inputting and verifying to be executed during boot processing;

second memory mounted by said expansion board having a first portion for storing thereon the codes for said passwords, a second portion for storing thereon codes determinant of the access right each user has to a respective file, and the state of encryption of a respective file;

said second memory having a third portion for storing thereon an audit trail showing the date and time of accesses to the DOS and its files;

a clock chip and associated crystal mounted on said expansion board for providing the time and date of all logon attempts and all attempted accesses to the files;

means for recording the time and date audit trail from said clock chip onto said third portion of said second memory for every DOS and file access attempt; and

means for continually inputting information onto said first and second portions of said second memory, so that the status of each user and the state of each file may be altered;

said means for continually inputting information comprising means for preventing the use thereof by unauthorized person.

13. The security system according to claim 12, wherein said expansion board further comprises switch means for setting the memory addresses of the memory locations on said expansion board, and a comparator coupled to said switch means for enabling said expansion board.

14. The security system according to claim 12, wherein expansion board further comprises an automatic encryption chip coupled to the system time clock, and a flip-flop coupling said encryption chip to the system time clock for dividing down the clock pulses to a usable frequency, said encryption chip automatically encrypting a respective file so chosen;

and means for initializing said encryption chip so that all encryption of desired files will take place.

15. The security system according to claim 14, further comprising means for selectively choosing constant encryption of all protected files of DOS, and selectively choosing encryption of only selected files thereof on a user-by-user basis, said means for selectively choosing storing in said second portion of said second memory the relevant code thereof indicative of the state of encryption of a respective file.

16. The security system according to claim 15, wherein said expansion board further comprises a volatile ram chip for expanding the system memory available.

17. The security system according to claim 15, further comprising means for selecting between a plurality of encryption methods for encrypting a respective file, so that files may be encrypted in that encryption method desired, and so that the transmission of sensitive data may be accomplished without the correct decryption thereof at the receiving end.

18. The security system according to claim 12, wherein said second portion of said second memory further comprises a flag for preventing the copying of a respective file by any user of the personal computer.

19. A security system for guarding against unwanted user-access to a personal computer and access to the files thereof, comprising:

an expansion board for insertion into an expansion slot of the personal computer;

said expansion board comprising a read-only-memory having machine code thereon for initializing the security system with the operating system of the personal computer;

at least one of a nonvolatile ram chip and EEPROM chip for erasably storing thereon code indicative of the status of each user'"'"'s access rights to a respective file of the system of the personal computer, code indicative of the passwords for valid users of the system of the personal computer, and code indicative of the audit trail of at least one of selected accesses to the system of the personal computer and selected accesses to the files of the system;

a clock chip and associated crystal on said expansion board for logging the time and date of selected accesses to at least one of the operating system and selected files;

means for recording the audit trail log code on said at least one of said nonvolatile ram and EEPROM for subsequent insepction thereof by a supervisor;

means for initializing said clock chip with the operating system of the personal computer;

means for erasably encoding said at least one of a nonvolatile ram and EEPROM for recording thereon desired information regarding the state and stats of system flags; and

means for accessing the information stored on said at least one nonvolatile ram and EEPROM for the reading thereof by a supervisor.

20. The security system for as personal computer according to claim 19, further comprising an automatic encryption chip mounted on said expansion board for encrypting selected files, said expansion board comprising means coupling said encryption chip to the computer system clock;

and means for selectively choosing the state of encryption of the files of the computer system, said means for selectively choosing storing flags indicative of the state of the encryption of the respective files on said at least one nonvolatile ram and EEPROM.

21. The security system according to claim 20, wherein said read-only-memory comprises code for monitoring all file handling interrupt function calls, the code on said at least nonvolatile ram and EEPROM thereafter determining the allowance or disallowance of the respective function call;

said read-only-memory further comprising code for establishing communication between exterior processes and the at least one of nonvolatile ram and EEPROM through an available interrupt vector for changing system flags.

22. The security system according to claim 21, wherein said expansion board coprises switch means for setting the addresses of the memory chips on said expansion board, and means coupling said switch means to the channel bus interface of the computer for enabling said expansion board.

23. A method of protecting access to a personal computer and the files thereof, comprising:

inputting a code indiciative of the user seeking access to at least one file of the personal computer;

monitoring the file handling interrupt function calls of the operating system of the personal computer;

determining the status of the user with respect to the at least one file the access to which is sought by the user, said step of determining comprising determining if the user seeking access has read-only access to the at least one file, and read and write access to the at least one file;

peritting access to the at least one file if the user has access rights thereof congruent with the file handling interrupt function call initiated;

denying access to the at least one file if the user does not have access rights thereof that are not congruent with the file handling interrupt function call initiated;

initiating an available interrupt vector of the operating system of the personal computer by which to alter the status of each user with respective to each file when so desired and for determining the current states of the users and files and the status flags thereof for each user and file; and

monitoring all video handler interrupt function calls during the booting up process so that said step of monitoring the file handling interrupt function calls may be carried out and not circumvented.

24. The method according to claim 23, wherein each of said steps of permitting access and denying access comprises inserting a plurality of system flags determinant of the status of each user with respect to each file;

said step of inserting a plurality of system flags comprising initializing an available interrupt vector of the operating system of the personal computer, and inputting respective function calls therefor.

25. The method according to claim 24, further comprising validating user access-rights to the operating system of the personal computer during the booting up process.

26. The method according to claim 23, further comprising selectively encrypting newly-created files and currently-existing files so that they are not readable without the proper decryption thereof.

27. The method according to claim 26, wherein said step of selectively encrypting comprises having a central security administrator choose which files are to be encrypted;

said step of having a central security administrator choose comprising inputting system flags determinant of the state of encryption of each file onto memory.

28. The method according to claim 23, further comprising monitoring hard disc formatting by monitoring the hard disc formatting interrupt handler of the personal computer, and denying the formatting thereof for invalid users.

29. The method according to claim 23, further comprising the step of preventing the copying of a selected file by an invalid user seeking such copying.

30. The method according to claim 23, further comprising keeping an audit trail of at least one of:

all accesses to the operating system of the personal computer, and to at least some of the files thereof.

31. The method according to claim 27, wherein said step of selectively encrypting further comprises choosing a desired encryption method by which the selected files to-be-encrypted are encrypted.

32. A method of controlling access to the operating system of a personal computer and to the files thereof, comprising:

inserting an expansion board into an expansion slot of the personal computer;

initializing the components chips of the circuit board with respect to the operating system of the personal computer;

grouping the files of the personal computer according to files to-be-protected and files not-to-be protected;

further dividing the files to-be-protected according to file groups with each file-group having at least one file thereof, and according to departments with each department having at least one file-group thereof;

appointing access-rights to each of the file groups and departments of file-groups by individual user having access to the operating system of the personal computer, said step of appointing comprising assigning read access-rights only to a respective user and read and write access-rights to a respective user by file-group and by department;

said step of dividing the files into file-groups and departments comprising a first step of inputting onto an erasable non-volatile memory on the expansion board object code indicative of the grouping thereof;

said step of appointing access-rights comprising a second step of inputting onto an erasable non-volatile memory object code indicative of the status of each user with respect to each file-group and department;

electing which of the to-be-protected files and not-to-be protected files are to be encrypted;

choosing a desired encryption method for files to-be-encrypted; and

encrypting files to-be-encrypted with the desired encryption method from said step of choosing a desired encryption method for files to-be-encrypted, said step of encrypting comprising inputting object code from a encryption chip on said expansion board to the erasable nonvolatile memory on the expansion board.

33. The method according to claim 32, further comprising logging all access attempts to the operating system of the personal computer and access attempts to all protected files;

said step of logging comprising inputting object code onto the erasable nonvolatile memory from a clock chip on the expansion board.