Data processing system for application to access by accreditation

• US 6,988,210 B1
• Filed: 11/28/2000
• Issued: 01/17/2006
• Est. Priority Date: 12/17/1999
• Status: Expired due to Term

• Current Assignee: Assa Abloy AB
• Original Assignee: ActivCard Co.
• Inventors: Audebert, Yves
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US09/723,284
• Time in Patent Office: 1,876 Days
• Field of Search: 713/185, 713/201, 713/202, 713/200
• US Class Current: 726/9
• CPC Class Codes: G06F 21/109 by using specially-adapted hardware at the client
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06F 2221/2135 Metering

Abstract

This system for executing a program to which access by a user is controlled by credentials includes a terminal (T), first memory means (F) associated with said program for storing at least first credentials specific to said user, access control means for authorizing access to said program in response to a match between said first credentials and second credentials applied via said terminal, and a security device (PSD) personal to said user, associated with said terminal and including second memory means (M) for secure storage of said second credentials. The terminal (T) includes at least some of credentials management means (CMP) including means for reading said second credentials and transmitting them to said access control means in response to presentation of a request to access said program, and credentials updating means for selectively commanding the generation and loading into said first and second memory means (F, M) of new credentials replacing the credentials previously stored.

Claims

1. A data processing system for executing at least one program to which access by a user is controlled by the provision of credentials assigned to said user, said system including:

at least one terminal including data processing means for executing at least part of said program,

first memory means associated with said program for storing at least first credentials specific to said user, and

access control means for authorizing access to said program in response to an identified match between said first credentials stored in said first memory means and second credentials applied via said terminal to said program,

at least one security device personal to said user that is associated with said terminal and includes second memory means for secure storage of said second credentials,

said terminal including at least some of a credentials management means (CMP) that comprises;

reading and transmitting credentials means for reading said second credentials stored in said second memory means and transmitting the read second credentials to said access control means in response to presentation of a request to access said program,

credentials updating means for selectively activating the automatic generation by said terminal, and automatic loading into said first and second memory means by said terminal, of new credentials replacing said first and second credentials previously stored, and

an activator for activating automatically said credentials updating means each time a match of said first and second credentials has been identified.

2. A system according to claim 1, wherein said access control means authorize access to said program in response to the identified match of said first and second credentials.

3. A system according to claim 1, wherein:

said second memory means store a first identification code of said user,

said terminal includes interface means for applying a second identification code to said personal security device,

said personal security device comprises identification code validation means, and

access to said personal security device is authorized by said validation means in response to the identified match of said first and second identification codes.

4. A system according to claim 1, wherein said credentials updating means is designed for activating said automatic generation and said automatic loading of said new credentials without communicating said new credentials to said user.

5. A system according to claim 1, wherein said credentials management means are software means forming part of said program.

6. A system according to claim 5, wherein said credentials updating means is designed for activating said automatic generation and said automatic loading of said new credentials upon authorization of access by said access control means.

7. A system according to claim 6, wherein said credentials management means include:

dating means for dating and loading into at least one of said first and second memory means the date at which said credentials are generated, and

inhibitor means for authorizing generation of said new credentials by said credentials updating means only after a particular time has elapsed since the generation of said credentials stored in said first and second memory means.

8. A system according to claims 1, wherein said credentials management means are software means that are independent of said program.

9. A system according to claim 3, wherein:

said credentials management means are software means independent of said program, and

said credentials updating means is designed for activating said automatic generation and said automatic loading of said new credentials upon validation of said identification code by said validation means.

10. A system according to claim 9, wherein:

said credentials management means include dating means for dating and loading into at least one of said first and second memory means the date at which said credentials are generated, and

inhibitor means for authorizing generation of said new credentials by said credentials updating means only after a particular time has elapsed since the generation of said credentials stored in said first and second memory means.

11. A system according to claim 1, wherein said program is stored and executed wholly within said terminal for local execution.

12. A system according to claim 1, wherein:

said system includes at least one server and transmission means for transmitting data between said terminal and said server,

said program is stored and executed partly in said terminal and partly in said server, and

said first memory means are associated with said server.