Enhanced security system for computing devices

• US 5,552,776 A
• Filed: 06/24/1994
• Issued: 09/03/1996
• Est. Priority Date: 09/23/1991
• Status: Expired due to Term

• Current Assignee: Z Microsystems Incorporated
• Original Assignee: Z Microsystems Incorporated
• Inventors: Szaroletta, William K., Madden, Thomas R., Wade, Jack
• Primary Examiner(s): Peng, John K.
• Assistant Examiner(s): HILL, ANDREW M
• Application Number:
  US08/265,517
• Time in Patent Office: 802 Days
• Field of Search: 340/825.31, 340/825.34, 340/825.56, 340/825.3, 340/309.15, 340/309.6, 340/310.08, 340/870.16, 340/870.17, 379/95, 379/102, 307/139, 235/382
• US Class Current: 340/5.74
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/81 by operating on the power supply, e.g. enabling or disabling power-on, sleep or resume operations
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data

Abstract

A security system for controlling access to computing devices. The security system provides selectively programmable access, monitored access, access privilege modifications and recorded access history for a computing device.

Claims

1. An apparatus for regulating use of and access to a particular portable computing device in association with other computing devices, at least some of the computing devices including the portable computing device having a unique identifier stored within the computing device and having means for providing the unique identifier to other computing devices, the apparatus including:

a. an electronic means, configured to be coupled to the portable computing device and at least one power supply, for selectively enabling at least portions of the portable computing device;

b. a memory for storing system parameters indicative of whether selected other computing devices and users are authorized to use and access the portable computing device;

c. a controller coupled to the electronic means for enabling at least portions of the portable computing device and receiving system parameters from the memory and causing the electronic means to enable the portions of the computing device if one of a permitted group of the other computing devices or a user is attempting to use the portable computing device, and the system parameters indicate that such other computing device or user is authorized to use the portable computing device.

2. The apparatus as set forth in claim 1 wherein the computing device is selected from the group consisting of microprocessors, data storage devices, central processing units, input/output buses, input/output controllers, read-only memories, random-access memories, EPROMS, and E² PROMS.

3. The apparatus as set forth in claim 1 wherein the computing device is a removable data storage drive.

4. The apparatus of claim 1, wherein the memory includes a history table for storing user definable records setting forth the usage history of the portable computing device.

5. The apparatus of claim 4, wherein the history table includes at least:

(a) a log of all individuals who have accessed, or attempted to access at least one of the computing devices;

(b) the time of each access, or attempt to access, at least one of the computing devices;

(c) the purpose of the access, or attempt to access, at least one of the computing devices;

(d) the project associated with the access, or attempt to access, at least one of the computing devices;

(e) the total number of attempts to access at least one of the computing devices; and

(f) the total number of successful accesses of at least one of the computing devices.

6. The apparatus of claim 5, wherein at least some of the other computing devices have a memory and the other computing device being used with the portable computing device stores the time when the portable computing device is being used with said other computing device.

7. The apparatus of claim 4, wherein the history table includes at least:

(a) a log of all individuals who have attempted to access at least one of the computing devices;

(b) the time of each attempt to access at least one of the computing devices;

(c) the purpose of each attempt to access at least one of the computing devices;

(d) the project associated with each attempt to access at least one of the computing devices;

(e) the total number of attempts to access at least one of the computing devices; and

(f) the total number of successful accesses of at least one of the computing devices.

8. The apparatus of claim 4, wherein the memory includes an options table for storing system parameters for each user, the parameters for each user including at least:

(a) a field for identifying the user as authorized;

(b) a field for storing a value indicating which data entries in the non-volatile memory can be displayed to the user;

(c) a field for storing a value indicating which data entries in the non-volatile memory can be altered by the user.

9. The apparatus of claim 1, wherein one of the parameters stored in the memory of the portable computing device is an identifier for the portable computing device and the other computing device receives said identifier from the portable computing device when it is being used with the portable computing device.

10. The apparatus of claim 1, further including a serial port, coupled to the controller, for transmitting serial data from the controller to at least one external device,

wherein the memory further includes a value indicating which data entries of the memory can be transmitted through the serial port.

11. The apparatus of claim 1, wherein the system parameters further include:

(a) at least one value indicating at least one type of data that causes the controller to cause the electronic means to couple a computing device to a power supply if an attempt is made to access such types of data from the computing device.

12. The apparatus of claim 11, wherein the system parameters further include:

(a) at least one value associated with at least one computing device, each such value indicating a maximum number of concurrent users that can use each associated computing device, such that attempts to use the at least one computing device by a number of users in excess of the maximum number result in the electronic means disabling the associated computing device if such attempts by those users in excess of the maximum number.

13. The apparatus of claim 12, wherein the system parameters further include:

(a) a value indicating types of data that, if transferred to at least one selected computing device, cause the controller to cause the electronic means to enable the computing device to such that the computing device accepts such data.

14. The apparatus of claim 13, wherein the system parameters further include:

(a) a value indicating types of data that, if transmitted to, or from, at least one selected computing device over a serial port, cause the controller to cause the electronic means to enable the computing device such that the computing device accepts, or outputs, such data.

15. The apparatus of claim 1, further including a real-time clock coupled to the controller indicating the time of day,

wherein the controller causes the electronic means to enable at least one of the computing devices to, and disable at least one computing device in response to the output of the real-time clock and the system parameters.

16. The apparatus of claim 1, wherein the memory further includes a password table for storing a password associated with at least one user, site, project, or computing device, which password is provided to the controller, and which password must be provided by a user, together with a value identifying the associated user, site, project, or computing device, to enable the controller to cause the electronic means to couple the associated computing device, or any computing devices to be accessed in conjunction with a site, project, or user associated with the password, to a power supply during attempt by the user to access such computing devices.

17. The apparatus of claim 1, wherein the memory further includes a password table for storing a password associated with at least one user, site, project, or computing device, which password is provided to the microprocessor, and which password must be provided by a user to disable the controller from causing the electronic means from disabling the associated computing device to be accessed in conjunction with a site, project, or user associated with the password, from at least one of the power supplies during attempts by the user to access such computing devices.

18. The apparatus of claim 1, wherein:

(a) the memory further includes an authorities table for storing;

(1) a list of authorized users;

(2) data block constraints associated with at least one of the listed authorized users;

(3) time block constraints associated with at least one of the listed authorized users;

or

(4) computing device access constraints associated with at least one of the listed authorized users;

(b) the controller reads the authorities table and causes the electronic means to enable the computing device to at least one of the power supplies only if;

(1) a user requests access to the computing device;

(2) the user is on the list of authorized users; and

(3) access of the at least one computing device does not violate any of the constraints associated with the user and the computing device.

19. The apparatus of claim 18, wherein the authorities table further includes operational codes that invoke user-defined algorithms in response to a user log-on.

20. The apparatus of claim 1, wherein the non-volatile memory further includes an action program table for storing information that determines how the system reacts to particular events and conditions, including at least:

a. an operations code field for storing opcodes associated with actions;

b. a user-defined A field; and

c. a user-defined B field.

21. The apparatus of claim 20, wherein the action program table further includes a description field for storing a description of the action associated with the opcode stored in the operations code field.

22. The apparatus of claim 1, wherein the non-volatile memory further includes a configuration table for storing a first unique device identification number which identifies the apparatus to other external devices, and for storing at least a second unique device identification number associated with each computing device that may be used in conjunction with the apparatus.

23. The apparatus of claim 22, wherein the configuration table further includes a preference sub-table for storing a list of device address identification number preferences listed in preferential order associated with devices accessing the system I/O bus.

24. The apparatus of claim 1, further including at least one sensor coupled to the controller, for determining environmental conditions and communication such conditions to the controller, beginning from the time the apparatus is shipped from the manufacturer, wherein the controller records the environmental condition in the memory.

25. The apparatus of claim 24, further including a real-time clock, coupled to the controller, for determining the relative time at which events occur and communicating the time to the controller,

wherein the time is associated with the environmental conditions and are recorded in the memory.

26. An apparatus for securing access to a computing device, including:

a. a docking base unit, including;

i. a first non-volatile memory for storing a first set of system parameters indicative of whether users are authorized to use and access particular computing devices; and

ii. first microprocessor, coupled to the first non-volatile memory, for;

(1) reading at least a portion of the first set of system parameters;

(2) determining whether an attempt to access a computing device is authorized; and

(3) outputting a signal when a user attempts to access a particular computing device which the user is authorized to access, such authorization being determined by the read first set of system parameters;

b. a removable computing device module removably coupled to the docking base unit, including;

i. a second non-volatile memory for storing a second set of system parameters;

ii. at least one computing device;

iii. electronic power controller, configured to be coupled to at least one of the computing devices and at least one power supply, for coupling at least one selected computing device to at least one selected power supply to allow an authorized user to access and use the at least one selected computing device; and

iv. a second microprocessor, coupled to the second non-volatile memory, and the electronic power controller, for;

(1) receiving at least a portion of the second set of system parameters from the second non-volatile memory;

(2) receiving the signal output by the first microprocessor; and

(3) transmitting signals to the electronic power control to cause the electronic power controller to couple at least one selected computing device to at least one selected power supply, if the second microprocessor determines that the user is authorized to use the computing device, and the first microprocessor has output a signal to the second microprocessor indicating that a user has attempted to access a computing device and is authorized to access the computing device.

27. An apparatus for monitoring use of a removable computing device in association With other computing devices, including:

(A) a docking base unit, including;

I. a first non-volatile memory for storing a first set of parameters including a unique identifier for the docking base unit; and

ii. a first microprocessor, coupled to the first non-volatile memory for;

(1) reading at least a portion of the first set of system parameters;

(2) determining which removable computing device is accessing the docking station; and

(3) providing a signal upon request regarding which particular portable computing device is accessing the docking station;

(b) the removable computing device module removably coupled to the docking base unit, including;

I. a second non-volatile memory for storing a second set of parameters including a unique identifier for the removable computing device;

ii. a second microprocessor, coupled to the second non-volatile memory and to the first microprocessor, for;

(1) receiving at least a portion of the second set of the parameters from the second non-volatile memory; and

(4) transmitting signals to the first microprocessor to cause the microprocessor electronic power controller to couple at least one selected computing device to at least one selected power supply, if the second microprocessor determines that the removable data storage module is authorized to interface with the docking base unit.

28. The apparatus of claim 27, wherein the computing device is a data storage unit.

29. The apparatus of claim 27, wherein at least one of the memories include a history table for storing user definable records setting forth the usage history of at least one computing device.

30. The apparatus of claim 29, wherein the history table includes:

(a) a log of all individuals who have accessed, or attempted to access, at least one of the computing devices;

(b) the time of each access, or attempt to access, at least one of the computing devices;

(c) the purpose of the access, or attempt to access, at least one of the computing devices;

(d) the project associated with the access, or attempt to access, at least one of the computing devices;

(e) the total number of attempts to access at least one of the computing devices; and

(f) the total number of successful accesses of at least one of the computing devices.

31. The apparatus of claim 27, wherein:

(a) the first controller transmits at least a portion of the first set of to the second controller; and

(b) the second controller cross-validates the received portion of the first set of parameters against a corresponding portion of the second set of system parameters read by the second controller, and allows the portable computing device to operate further only if the received portion of the first set of system parameters concur with the portion of the second set of system parameters read from the second memory by the second controller.

32. The apparatus of claim 31, wherein the first and second system parameters each include:

(a) at least one value indicating at least one type of data that causes the second controller to enable the portable computing device;

(b) at least one value associated with the portable computing device, each such value indicating a maximum number of concurrent users that can use the portable computing device, such that attempts to use the portable computing device by a number of users in excess of the maximum number result in disabling the portable computing device during such attempts by those users in excess of the maximum number;

(c) a value indicating types of data that, if transferred to the portable computing device, cause the controller to cause the portable computing device to accept such data; and

(d) a value indicating types of data that, if transmitted to, or from, a computing device over a serial port, cause the controller to cause the portable computing device to accept, or output, such data.

33. The apparatus of claim 27 wherein the computing device is selected from the group consisting of microprocessors, data storage devices, central processing units, input/output buses, input/output controllers, read-only memories, random-access memories, EPROMS, and E² PROMS.

34. The apparatus of claim 27, wherein the second controller receives the docking base unit identifier from the first controller and inhibits the portable computing device if the second controller determines that the portable computing device is not authorized to interface with the docking base unit.

35. The apparatus of claim 27, wherein whether the portable computing device is attached to the base docking unit can be determined from the signal from the first controller.