Apparatus and method for providing and authentication system

• US 6,367,017 B1
• Filed: 10/07/1998
• Issued: 04/02/2002
• Est. Priority Date: 11/07/1996
• Status: Expired due to Term

• Current Assignee: Imprivata Incorporated
• Original Assignee: Litronix Incorporated
• Inventors: Gray, Robert J.
• Primary Examiner(s): Hua, Ly V.
• Application Number:
  US09/167,856
• Time in Patent Office: 1,273 Days
• Field of Search: 713/200, 713/168, 340/825.34, 340/825.01, 340/825.31
• US Class Current: 726/9
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect

Abstract

The present invention is a method and apparatus for controlling access to at least one program on a processing system by verifying data entered through a keyboard, while isolating the entered data from the processing system. The apparatus comprises a memory and a processor coupled to the memory. A first data path is provided between the keyboard and the processing system; a second data path is provided between the keyboard and the processor; and a third data path is provided between the processing system and the processor. When activated, the processor is operable in a first mode wherein access to the processing system via the keyboard is inhibited when data entered via the keyboard does not match data stored on the card. The processor is operable in a second mode, wherein the keyboard is coupled to the processing system so that the at least one program on the processing system is accessible via the keyboard when the entered matches the data stored on the card. Various embodiments are disclosed.

Claims

1. A security verification apparatus for controlling access to at least one program on a processing system by verifying data entered through a keyboard with data stored on a card, comprising:

a memory;

a processor coupled to said memory;

a first data path between the keyboard and the processing system;

a second data path between the keyboard and the processor; and

a third data path between the processing system and the processor;

said processor being operable in a first mode wherein access to the processing system via the first data path is inhibited when data entered via the keyboard does not match data stored on the card, said processor being operable in a second mode, wherein the keyboard is coupled to the processing system so that the at least one program on the processing system is accessible via the second and third data paths when the entered data matches the data stored on the card.

2. The apparatus of claim 1, further comprising a card reader/writer that is coupled to the processor, said card reader/writer to read data from and write data to the card.

3. The apparatus of claim 1, wherein the processor operates in the first mode when receiving the data from the keyboard and when comparing the data from the keyboard with the data from the card.

4. The apparatus of claim 1, wherein said processor operates in the first mode in response to a first command from the computer.

5. The apparatus of claim 4, wherein processor operates in the second mode in response to a second command from the computer.

6. The apparatus of claim 1, wherein said processor operates in a third mode in which said processor is coupled to the processing system and wherein access to the processor from the keyboard is inhibited.

7. The apparatus of claim 5, wherein the processor operates in the third mode in response to a third command from the computer.

8. The apparatus of claim 1, wherein the processor compares the data from the keyboard to the data stored on the card to determine if there is a match.

9. The apparatus of claim 1, wherein the card comprises a processor that compares the data from the keyboard to the data stored on the card to determine if there is a match.

10. The apparatus of claim 1, further comprising an input/output controller coupled between the processor and the processing system, the input/output controller for controlling communications between the processor and the processing system.

14. The system of claim 1, wherein the second processor operates in the first mode in response to a first command from the first processor.

15. The system of claim 14, wherein the second processor operates in the second mode in response to a second command from the second processor.

17. The system of claim 15, wherein the second processor operates in the third mode in response to a third command from the first processor.

11. A security verification system for controlling access to at least one program on a processing system by verifying data entered through a keyboard with data stored on a card, comprising:

a processing system having a first memory and a first processor;

a second processor coupled to said processing system;

a first data path between the keyboard and the first processor;

a second data path between the keyboard and the second processor; and

a third data path between the first processor and the second processor;

said second processor being operable in a first mode wherein access to the processing system via the first data path is inhibited when data entered via the keyboard does not match data stored on the card, said second processor being operable in a second mode, wherein the keyboard is coupled to the processing system so that at least one program on the processing system is accessible via the second and third data paths when the entered matches the data stored on the card.

12. The system of claim 11, further comprising a card reader/writer that is coupled to the processor, said card reader/writer to read data from and write data to the card.

13. The system of claim 11, wherein the second processor operates in the first mode when receiving the data from the keyboard and when comparing the data from the keyboard with the data from the card.

16. The system of claim 11, wherein the second processor operates in a third mode in which the second processor is coupled to the first processor and wherein access to the second processor from the keyboard is inhibited.

18. The system of claim 11, wherein the second processor compares the data from the keyboard to the data stored on the card to determine if there is a match.

19. The system of claim 11, wherein the card comprises a third processor that compares the data from the keyboard to the data stored on the card to determine if there is a match.

20. The system of claim 11, further comprising an input/output controller coupled between the first and second processors, the input/output controller for controlling communications between the first and the second processors.

21. A method for controlling access to at least one program running on a processing system via a keyboard, comprising:

(a) providing a verification unit having a processor;

(b) providing a first data path between the keyboard and the processing system;

(c) providing a second data path between the keyboard and the processor;

(d) providing a third data path between the processing system and the processor;

(e) comparing data entered via the keyboard with data stored in the card;

(f) denying access to the processing system via the keyboard if data entered via the keyboard does not match data stored on the card; and

(g) granting access to at least one program on the processing system if data entered via said keyboard matches the data stored on the card.

22. The method of claim 21, wherein (f) comprises:

(f.1) denying access to the at least one program on the processing system if the data from the keyboard does not match the data from the card;

(f.2) recording the number of invalid attempts at obtaining access to the program on the computer; and

(f.3) disabling the card after the invalid attempts exceed a predetermine number.

23. The method of claim 21, wherein (e) comprises:

(e.1) receiving data from the keyboard;

(e.2) reading data from the card;

(e.3) comparing the data from the keyboard to the data from the card.

24. The method of claim 23, wherein in (e.1), the processing system is decoupled from the keyboard.

25. The method of claim 23, further comprising, prior to (e.1):

providing a signal by the processor to indicate that the processing system is decoupled from the keyboard and that the processor is ready to receive data from the keyboard.