Security access and monitoring system for personal computer

• US 5,377,269 A
• Filed: 10/29/1992
• Issued: 12/27/1994
• Est. Priority Date: 10/29/1992
• Status: Expired due to Fees

• Current Assignee: Intelligent Security Systems Incorporated
• Original Assignee: Intelligent Security Systems Incorporated
• Inventors: Baker, Robert, Schultz, George R., Heptig, John P.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US07/968,534
• Time in Patent Office: 789 Days
• Field of Search: 380/4, 380/23, 380/25, 380/49, 380/50, 235/380, 340/825.31, 340/825.34
• US Class Current: 726/20
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A system for controlling access to a computer. Memory-resident software logic cooperates with a remote electronic key device coupled to the computer'"'"'s processor, through the printer port, to disable the computer unless an authorized key is inserted in the key device. The logic is executed in the processor responsive to the computer'"'"'s system timer interrupt for continuous monitoring capability. Until a user inserts an authorized key, or upon removal of the key, the logic suspends operation of any application programs, the monitor is blanked and the mouse, keyboard and floppy disk drive are disabled. A record is stored in memory of authorized users and user audit information. Utility menu options are used to add or delete user keys, display access and usage records and to customize the number and selection of I/O devices to be disabled by the system.

Claims

1. A method for controlling user access to a computer having a processor, a system timer, a system memory, and at least one input/output (I/O) device connected to said processor, said processor being directed by interrupts for execution of interrupt services and said computer further including a key device connectable to said processor for removably coupling data to said processor indicating a user identification, said method comprising the steps of:

storing in said system memory a data file of at least one authorized user identification;

capturing a system timer interrupt;

connecting said key device to said processor;

responsive to said system timer interrupt, periodically reading said user identification from said key device and comparing said read user identification with said stored authorized user identification; and

disabling said at least one I/O device when said read user identification fails to match said stored authorized user identification.

2. The method of claim 1 wherein said user identification fails to match said stored authorized user identification when said key device is disconnected from said processor.

3. The method of claim 1 further comprising the computer-implemented step of:

storing said user identification in an audit trail data file of said system memory when said user identification fails to match said stored authorized user identification and said user identification data is coupled to said processor.

4. The method of claim 1 further comprising the computer-implemented step of storing said user identification in an audit trail data file of said system memory when said user identification matches said stored authorized user identification.

5. The method of claim 3 or 4 further comprising the computer-implemented step of storing in said audit trail data file the date and time of said coupling of said user identification data.

6. The method of claim 1 further comprising the computer-implemented steps of:

following said disabling of said at least one device and responsive to subsequent system timer interrupts, periodically reading said user identification from said key device and comparing said read user identification with said stored authorized user identification; and

enabling said at least one I/O device when said read user identification matches said stored authorized user identification.

7. The method of claim 1 wherein said step of reading occurs once for each period of nine system timer interrupts.

8. The method of claim 1 wherein said at least one I/O device comprises a keyboard, said method further comprising the computer-implemented steps of:

capturing a keyboard interrupt; and

responsive to said interrupt, immediately returning execution of said processor.

9. The method of claim 1 wherein said at least one I/O device comprises a floppy disk drive.

10. The method of claim 1 wherein said at least one I/O device comprises a monitor.

11. The method of claim 1 wherein said at least one I/O device comprises one or more of a mouse, monitor, keyboard, mass storage device and communications device.

12. The method of claim 1 wherein said at least one authorized user identification comprises up to 100 separate authorized user identifications.

13. The method of claim 1 further comprising the computer-implemented step of storing an authorized user identification in said system memory corresponding to said removably coupled data of a user identification.

14. The method of claim 1 wherein said system memory includes an interrupt vector table for storing interrupt request address entries used in directing said processor execution of interrupt services, said step of capturing a system timer interrupt further comprising the computer-implemented step of replacing the interrupt timer request address entry stored in said interrupt vector table with a new address entry corresponding to an interrupt service for performing said reading, comparing and disabling steps.

15. A method for controlling user access to a computer having a processor, a system memory, a mass storage device and a disk operating system for controlling execution of said processor, said disk operating system being loaded from said mass storage device to said system memory in an initialization procedure executed in said processor that includes execution of a system start-up batch file for loading terminate and stay resident utilities into said system memory, said computer further including a key device connectable to said processor for removably coupling data to said processor indicating a user identification, said method comprising the steps of:

storing in said system memory a data file of at least one authorized user identification;

connecting said key device to said processor;

reading said user identification data from said key device and comparing said read user identification data with said stored authorized user identification data during execution of said batch file loading procedure;

suspending said execution of said batch file loading procedure when said read user identification data fails to match said stored user identification data, thereby preventing loading of said terminate and stay resident utilities into said system memory; and

continuing said execution of said batch file loading procedure when said read user identification data matches said stored authorized user identification data, thereby permitting loading of said terminate and stay resident utilities and completion of said initialization procedure.

16. The method of claim 15 wherein said initialization procedure executed in said processor includes loading of installable device drivers into said system memory and said computer includes a keyboard connected to said processor, said method further comprising the computer-implemented step of capturing a keyboard interrupt during said loading of installable device drivers to disable said keyboard responsive to said interrupt.

17. The method of claim 15 wherein said mass storage device comprises a hard disk drive and said computer further includes a floppy disk drive coupled to said processor, further comprising the computer-implemented step of disabling said floppy disk drive as part of said initialization procedure to prevent circumvention of said disk operating system loading from said hard disk drive.

18. A method for controlling user access to a computer having a processor, a system timer, a system memory, and at least one input/output (I/O) device connected to said processor, said computer further including a key device connected to said processor for removably coupling data to said processor indicating a user identification, said method comprising the steps of:

storing in said system memory a data file of at least one authorized user identification, said at least one authorized user identification including at least one administrator identification;

a user connecting said key device to said processor;

periodically reading said user identification from said key device and comparing said read user identification with said stored,authorized user identification;

disabling said at least one device when said read user identification fails to match one of said at least one stored authorized user identification; and

selectively entering at least one utility menu option when said read user identification matches said at least one administrator identification.

19. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of viewing said at least one authorized user identification stored in said memory.

20. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of adding a new authorized user identification to said data file.

21. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of deleting an authorized user identification from said data file.

22. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of displaying a user identification corresponding to said coupled data.

23. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of storing selected interrupts in an interrupt request mask register of said processor, said interrupts corresponding to I/O devices to be disabled in said disabling step

24. The method of claim 18 further comprising the computer-implemented step of storing an access data file in said system memory of said user identifications read by said processor.

25. The method of claim 18 wherein said step of entering said at least one utility menu option comprises the computer-implemented step of viewing said user identifications stored in said access data file.

26. Apparatus for controlling user access to a computer, said computer having a processor, a system timer, a system memory and at least one input/output device connected to said processor, said processor being directed by interrupts for execution of interrupt services, said apparatus comprising:

an input/output port coupled to said processor;

key means including data terminals for connection to said input/output port for removably coupling data to said processor indicating a user identification;

a data file stored in said system memory indicating at least one authorized user identification;

logic stored in said system memory and executed in said processor for capturing a system timer interrupt;

security logic stored in said system memory and executed in said processor responsive to said system timer interrupt for periodically reading said user identification from said key means and comparing said read user identification with said stored authorized user identification; and

said security logic for disabling said at least one I/O device when said read user identification fails to match said stored authorized user identification.

27. The apparatus of claim 26 further comprising logic stored in said system memory and executed in said processor for storing in said system memory an access data file of said user identification and a system time, corresponding to each coupling of data by said key means to said processor.

28. The apparatus of claim 26 wherein said at least one input/output device of said computer includes a mass data storage device for coupling by a device controller to said processor and for transferring data to said system memory, said apparatus further comprising:

access circuitry connected between said mass data storage device and said controller for selectively disabling said transfer of data from said mass data storage device to said system memory responsive to said security logic.

29. The apparatus of claim 26 wherein said key means comprises:

at least one electronic key having a memory for storing said user identification, control logic connected to said key memory for reading data from said key memory and for writing data to said key memory, and an a connector including control lines coupled to said control logic and a data input/output coupled to said memory;

a jack for removably receiving said connector; and

a cable connecting said jack to said processor.

30. The apparatus of claim 29 wherein said computer includes an input/output port connected to said processor and said cable connects said jack to said port.

32. The apparatus of claim 26 wherein said at least one input/output device comprises a keyboard.

33. The apparatus of claim 26 wherein said at least one input/output device comprises a monitor.

34. The apparatus of claim 26 wherein said at least one input/output device comprises a mouse.

35. The apparatus of claim 26 wherein said at least one input/output device comprises a modem.

31. The apparatus of claimed 29 wherein said input/output port comprises a parallel printer port.

36. Apparatus for controlling user access to said computer having a processor, at least one input/output (I/O) port connected to said processor, a system timer, a system memory, a mass storage device coupled by a device controller to said processor for transferring data to said system memory and at least one I/O device connected to said processor, said processor being directed by interrupts for execution of interrupt services, said apparatus comprising:

A key device for removably coupling data to said processor indicating a user identification, said key device including at least one electronic key having means for providing said user identification data and a connector coupled to said data means, a jack for removably receiving said connector, and a cable connecting said jack to said processor through said I/O port;

a data file stored in said system memory indicating at least one authorized user identification;

logic stored in said system memory and executed in said processor for capturing a system timer interrupt;

security logic stored in said system memory and executed in said processor responsive to said system timer interrupt for periodically reading said user identification from said key means and comparing said read user identification with Said. stored authorized user identification;

said security logic for disabling said at least one I/O device when said read user identification fails to match said stored authorized user identification; and

access circuitry connected between said mass data storage device and said controller for selectively disabling said transfer of data from said mass data storage device to said system memory responsive to said security logic.

37. The apparatus of claim 36 further comprising logic stored in said system memory and executed in said processor for storing in said system memory an access data file of said user identification and a system time, corresponding to each coupling of data by said key device to said processor.

38. The apparatus of claim 36 wherein said input/output port comprises a parallel printer port.

39. The apparatus of claim 36 wherein said at least one input/output device comprises a keyboard.

40. The apparatus of claim 36 wherein said at least one input/output device comprises a monitor.