Apparatus and method for providing an authentication system

• US 5,844,497 A
• Filed: 11/07/1996
• Issued: 12/01/1998
• Est. Priority Date: 11/07/1996
• Status: Expired due to Term

• Current Assignee: Imprivata Incorporated
• Original Assignee: Litronix Incorporated
• Inventors: Gray, Robert J.
• Primary Examiner(s): Horabik, Michael
• Assistant Examiner(s): Beaulieu, Yonel
• Application Number:
  US08/744,363
• Time in Patent Office: 754 Days
• Field of Search: 340/825.34, 340/825.31, 235/379, 235/380, 235/382, 380/3, 380/4, 380/21, 380/23, 380/25, 380/52, 395/186, 395/187.01, 395/108.01, 395/491, 364/927.83, 364/928, 364/928.5
• US Class Current: 340/5.54
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

A method and apparatus for controlling access to at least one program on a computer by verifying data entered through a keyboard with data stored on a token such as a card, while isolating the entered data from the computer. The apparatus includes a verification device, external to the computer, which receives the card and a connector. When activated, the verification device isolates itself from the computer, and then receives the entered data and compared it with data stored on the card. The verification unit then generates a status signal indicative of the result of the comparison. The verification device is operable in a first mode wherein data provided to the verification unit via the keyboard is not provided to the computer. The verification device is also operable in a second mode, wherein at least one program on the computer is accessible via the keyboard when the data from the keyboard matches the data from the card. When operating in a third mode, communications is restricted to that between the verification device and the computer. The verification device operates in one of the three modes in accordance with commands from the computer.

Claims

1. A security verification apparatus for controlling access to at least one program on a computer by verifying data entered through a keyboard with data located on a card, comprising:

a verification device, external to and operable independently of the computer, having a port that provides a direct communication path to the keyboard and the computer, said verification device controlling communication between the keyboard and the computer via said port, said verification device communicating with the keyboard and the computer via said port, said verification device reads the data from the card and compares the data from the keyboard with the data from the card, said verification device being operable in a first mode wherein access to the computer via the keyboard is inhibited, said verification device being operable in a second mode, wherein the keyboard is coupled to the computer so that the at least one program on the computer is accessible via said keyboard when the data from the keyboard matches the data from the card; and

a connector, external to the computer, that couples the keyboard to said port of said verification device and that couples the port of said verification device to the computer, said connector providing a first data path between the keyboard and the computer, a second data path between the keyboard and the verification device, and a third data path between the computer and the verification device.

2. The apparatus of claim 1, wherein the verification device operates in the first mode when receiving the data from the keyboard and when comparing the data from the keyboard with the data from the card.

3. The apparatus of claim 1, wherein the verification device operates in the first mode in response to a first command from the computer.

4. The apparatus of claim 1, wherein the verification device operates in the second mode in response to a second command from the computer.

5. The apparatus of claim 1, wherein said verification device operates in a third mode in which said verification device is coupled to the computer and wherein access to the verification device from the keyboard is inhibited.

6. The apparatus of claim 4, wherein the verification device operates in the third mode in response to a third command from the computer.

7. The apparatus of claim 1, wherein the verification device comprises a light emitting diode which indicates the operation of said verification device in the first mode.

8. The apparatus of claim 1, wherein the verification device comprises:

a processor;

a card reader/ writer for reading data from and writing data to the card.

9. A method for assembling a system that controls access to at least one program running on a computer, comprising the steps of:

(a) providing a verification device external to and operable independently of the computer;

(b) providing a connector, external to the computer, having a first port, a second port and a third port; and

(c) connecting the first port to the computer, the second port to a keyboard and the third port to the verification device, so that the keyboard and the computer are coupled to the verification device;

(d) providing a first data path between the keyboard and the computer via said first port and said second port, a second data path between the keyboard and the verification device via said second port and said third port, and a third data path between the computer and the verification device via said first port and said third port.

10. The method of claim 9, further comprising the steps of:

(d) receiving data from the keyboard;

(e) reading data from a card;

(f) comparing the data from the keyboard to the data from the card;

(g) granting access to the at least one program on the computer if the data from the keyboard matches the data from the card; and

(h) otherwise denying access to the at least one program on the computer.

11. The method of claim 10, wherein in step (d), the computer is de-coupled from the keyboard.

12. The method of claim 10, wherein step (h) comprises the steps of:

(h.1) denying access to the at least one program on the computer if the data from the keyboard does not match the data from the card;

(h.2) recording the number of invalid attempts at obtaining access to the program on the computer; and

(h.3) disabling the card after the invalid attempts exceed a predetermined number.

13. The method of claim 9, wherein step (d) comprises the steps of:

(d.1) providing a signal by said verification device to indicate that said verification device is ready to receive data from the keyboard; and

(d.2) receiving the data from the keyboard.

14. The method of claim 10, wherein step (g) comprises the step of:

granting access to the at least one program on the computer if the data from the keyboard matches the data from the card by coupling the computer to the keyboard.

15. The method of claim 10, wherein step (h) comprises the step of:

denying access to the at least one program on the computer if the data from the keyboard does not match the data from the card by ensuring that the keyboard is de-coupled from the computer.

16. A system for verifying access authorization to at least one program on a computer, comprising:

a keyboard through which data is entered;

a card that contains verification data;

a verification device, external to and operable independently of the computer, having a port that provides a direct communication path to the keyboard and the computer, said verification device controlling communication between the keyboard and the computer via said port, said verification device communicating with the keyboard and the computer via said port, said verification device reads the data from the card and compares the data from the keyboard with the data from the card, said verification device being operable in a first mode wherein access to at least one program on the computer via the keyboard is inhibited, said verification device being operable in a second mode, wherein the keyboard is coupled to the computer so that the computer is accessible via said keyboard when the data from the keyboard matches the data from the card; and

a connector, external to the computer, that couples the keyboard to said port of said verification device and that couples the port of said verification device to the computer, said connector providing a first data path between the keyboard and the computer, a second data path between the keyboard and the verification device, and a third data path between the computer and the verification device.

17. The system of claim 16, wherein the verification device operates in the first mode when receiving the data from the keyboard.

18. The system of claim 16, wherein the verification device operates in the first mode in response to a first command from the computer.

19. The system of claim 16, wherein the verification device operates in the second mode in response to a second command from the computer.

20. The system of claim 16, wherein said verification device operates in a third mode in which said verification device is coupled to the computer and wherein access to the verification device from the keyboard is inhibited.