Security guarantee method and system

• US 6,747,564 B1
• Filed: 06/28/2000
• Issued: 06/08/2004
• Est. Priority Date: 06/29/1999
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Isobe, Yoshiaki, Aoki, Masaji, Mimura, Masahiro, Seto, Yoichi
• Primary Examiner(s): Zimmerman, Brian
• Assistant Examiner(s): BROWN, VERNAL U
• Application Number:
  US09/604,918
• Time in Patent Office: 1,441 Days
• Field of Search: 340/825.6, 340/528, 340/539.11, 340/527, 340/5.52, 340/5.53, 340/5.7, 340/572.1, 340/572.2, 340/5.83, 340/5.8, 340/5.33, 340/5.54, 109/9, 713/200, 713/185, 713/186, 235/380, 235/382.5
• US Class Current: 340/5.52
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A security system wherein, when a staff enters a building, a smart card carried by the staff is verified, and staff information inclusive of a staff number and fingerprint information is read from the smart card and is stored temporarily in a temporary storage file. When the staff logs on to a terminal, the fingerprint of the staff is read by a fingerprint input device (LS) and verified with the fingerprint information of the temporary storage file for verification. When the staff leaves the building, the staff number is read from the smart card the staff carries, and the corresponding staff information is erased from the temporary storage file. Security of a security object inside a security zone can be improved.

Claims

1. A security system for permitting only an authorized person to conduct a security object action extending to a plurality of security zones, comprising:

a portable device issued for said authorized person, and storing verification information capable of verifying authenticity of said portable device and inherent information as information inherent to said authorized person of said portable device;

security zone security means for verifying authenticity of said portable device by using said verification information stored in said portable device carried by a person intending to enter a security zone, permitting admission of said person carrying said portable device, authenticity of which is so verified, into said security zone, and rejecting admission of said person carrying said portable device, authenticity of which is not verified, into said security zone;

storage means;

inherent information read means for reading said inherent information stored in said portable device from said portable device, authenticity of which is verified by said security zone security means, and storing said inherent information to said storage means;

inherent information input means for accepting, when a person having said portable device of verified authenticity intends to conduct said security object action in a first zone, the input of inherent information by said person;

security object action security means for permitting said security object action of said person as being the authentic person in said first zone when said inherent information accepted by said information input means coincides with said inherent information stored in said storage means, and rejecting said security object action of said person when said inherent information accepted by said information input means does not coincide with said inherent information stored in said storage means; and

leaving management means for gaining access to said portable device carried by said person leaving said first security zone, stipulating said inherent information stored in said storage means, and erasing said stipulated inherent information from said storage means.

2. A security system according to claim 1, wherein said leaving management means verifies authenticity of said portable device by using said verification information stored in said portable device carried by said person intending to leave said security zone, permitting said person carrying said portable device, authenticity of which is so verified, to leave said first security zone, and rejecting said person carrying said portable device, authenticity of which is not verified, to leave said first security zone.

3. A security system according to claim 2, wherein said inherent information as information inherent to an authentic person to whom said portable device is issued is biometric information of said authentic person.

4. A security system according to claim 1, wherein said security object action is utilization of a computer system installed inside said security zone, or admission into a specific zone inside said security zone.

16. A security system according to claim 1, wherein said inherent information read means permits said person to enter a computer room when said inherent information matches said information accepted by said inherent information input means.

5. A method of accomplishing security in a security system for permitting only an authentic person to conduct a security object action extending to a plurality of security zones, comprising the steps of:

issuing a portable device storing verification information capable of verifying authenticity of said portable device and inherent information as information inherent to an authentic user to whom said portable device is issued, to said authentic person;

verifying authenticity of said portable device by using said verification information stored in said portable device carried by a person intending to enter said security zone in a security system, permitting said user carrying said portable device, authenticity of which is so verified, to enter said security zone, and rejecting a person carrying said portable device, authenticity of which is not verified, to enter said security zone;

reading said inherent information stored in said portable device from said portable device, authenticity of which is verified, in said security system, and storing said inherent information inside said security system;

accepting, when a person having said portable device of verified authenticity intends to conduct said security object action in a first zone, the input of inherent information from said person;

permitting said security object action in said first zone by said person as being the authentic person when said inherent information accepted coincides with said inherent information stored in said security system, and rejecting said security object action by said person when said inherent information accepted by said information input means does not coincide with said inherent information stored in said security system; and

gaining access to said portable device carried by said person leaving said first security zone in said security system, stipulating said inherent information stored in said security system, and erasing said stipulated inherent information from inside said security system, in said security system.

6. A security system for permitting only an authentic person to conduct a security object action extending to a plurality of zones, comprising:

a portable device issued to said authentic person in common for a plurality of zones, and recording verification information capable of verifying authenticity of said portable device and inherent information as information inherent to said authentic user to whom said portable device is issued;

security zone security means for verifying authenticity of said portable device by using said verification information stored in said portable device carried by a person intending to enter a first security zone of a plurality of said zones, permitting said person carrying said portable device, authenticity of which is verified, to enter said first security zone of a plurality of said zones, and rejecting said person carrying said portable device, authenticity of which is not verified, to enter said first security zone of a plurality of zones;

storage means;

inherent information read means for reading said inherent information stored in said portable device from said portable device, authenticity of which is verified by said security zone security means, carried by said person entering said first security zone of a plurality of said zones, and storing said inherent information in said storage means;

information input means for accepting, when a person having said portable device of verified authenticity intends to conduct said security object action in a first zone, the input of inherent information from said person;

security object action security means for permitting said person as being the authentic person to conduct said security object action in said first zone when said inherent information accepted by said information input means coincides with said inherent information stored in said storage means, and rejecting said person to conduct said security object action when said inherent information accepted by said information input means does not coincide with said inherent information stored in said storage means; and

leaving management means for gaining access to said portable device carried by said person leaving said first security zone of a plurality of said zones, stipulating said inherent information stored in said storage means, and erasing said stipulated inherent information from said storage means.

9. A security system according to claim 6, wherein said inherent information as the information inherent to said authentic person to whom said portable device is issued is biometric information of said authentic person.

12. A security system according to claim 6, wherein said security object action is utilization of a computer system installed in a plurality of said zones.

7. A security system for permitting only an authentic person to conduct a security object action extending to a plurality of zones, comprising:

a portable device issued to an authentic person in common to a plurality of said zones, and recording verification information capable of verifying authenticity of said portable device and inherent information as information inherent to said authentic person to whom said portable device is issued;

inherent information read means for gaining access to said portable device carried by a person intending to enter a plurality of said zones and to conduct said security object action, verifying authenticity of said portable device by using said verification information stored, reading said inherent information stored in said portable device from said portable device of said person carrying said portable device authenticity of which is verified, and storing said inherent information to storage means;

inherent information input means for accepting, when a person having said portable device of verified authenticity intends to conduct said security object action in a first zone, the input of inherent information from said person;

security object action security means for permitting said person as being the authentic person to conduct said security object action in said first zone when said inherent information accepted by said input means coincides with said inherent information stored in said storage means, and rejecting said person to conduct said security object action when said inherent information accepted by said information input means does not coincide with said inherent information stored in said storage means; and

leaving management means for gaining access to said portable device carried by said person leaving said first zone of a plurality of zones, stipulating said inherent information stored in said inherent information storage means, and erasing said stipulated inherent information from said storage means.

10. A security system according to claim 7, wherein said inherent information as the information inherent to said authentic person to whom said portable device is issued is biometric information of said authentic person.

13. A security system according to claim 7, wherein said security object action is utilization of a computer system installed inside a plurality of said zones.

8. A security system for permitting only an authentic person to conduct a security object action extending to a plurality of zones, comprising:

a portable device issued to said authentic person in common to a plurality of said zones, and recording verification information capable of verifying authenticity of said portable device and inherent information as information inherent to said authentic person to whom said portable device is issued;

inherent information read means for verifying authenticity of said portable device by using said verification information stored in said portable device carried by a person intending to conduct said security object action in a plurality of said zones, reading said inherent information stored in said portable device from said portable device, authenticity of which is verified, and storing said inherent information to storage means;

inherent information input means for accepting, when a person having said portable device of verified authenticity intends to conduct said security object action in a first zone, the input of inherent information from said person; and

security object action security means for permitting said person as being the authentic person to conduct said security object action in said first zone when said inherent information accepted by said information input means coincides with said inherent information stored in said storage means, and rejecting said person to conduct said security object action when said inherent information accepted by said information input means does not coincide with said inherent information stored in said storage means.

11. A security system according to claim 8, wherein said inherent information as the information inherent to said authentic person to whom said portable device is issued is biometric information of said authentic person.

14. A security system according to claim 8, wherein said security object action is utilization of a computer system installed in a plurality of said zones.

15. A security system for permitting an authentic person to use a terminal or a computer room, comprising:

a portable device having a verification information issued to an authentic person;

verification means verifying said verification information by using said portable device carried by a person at an entrance of a building;

access means reading said verification information out of said portable device to store in said access means;

second verification means verifying said verification information by reading said verification information from said access means when said person intends to use a terminal or a computer room; and

erasing means erasing said verification information from said access means when said person leaves said building.

17. The security system according to claim 15, further comprising inherent information read means for reading inherent information stored in said portable device from said portable device, the inherent information being information inherent to said authentic user to whom said portable device is issued and authenticity of which is verified by said verification means.

18. The security system according to claim 17, further comprising inherent information input means for accepting, when a person having said portable device of verified authenticity intends to use a terminal or computer room, the input of inherent information by said person.

19. The security system according to claim 18, wherein said inherent information read means permits said person to enter a computer room when said inherent information matches said information accepted by said inherent information input means.

20. A security system according to claim 17, wherein said inherent information is biometric information of said authentic person.