System for and method of managing access to a system using combinations of user information

• US 9,449,186 B2
• Filed: 06/14/2012
• Issued: 09/20/2016
• Est. Priority Date: 03/04/2005
• Status: Active Grant

• Current Assignee: Encrypthentica Limited
• Original Assignee: Encrypthentica Limited
• Inventors: Carter, Ernst B.
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): HOLMES, ANGELA R
• Application Number:
  US13/523,441
• Publication Number:
  US 20120303965A1
• Time in Patent Office: 1,559 Days
• Field of Search: 726/21, 726/3, 713/183, 713/186, 713/202, 713/182, 707/749, 707/784, 707/786
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

The present invention is directed to systems for and methods of controlling access to computer systems. A method in accordance with the present invention comprises performing a test that includes comparing input responses to randomly selected questions with corresponding pre-determined responses to the questions and granting access to the system in the event the test is passed. A first condition of passing the test is that each input response matches a corresponding pre-determined response. Once passing the test, the user is granted permissions to access data based on his position. For example, a corporate director generally has greater permissions than an engineer. Preferably, the user'"'"'s permissions determine an encryption key and a decryption key that the user is able to use to access protected data.

Claims

1. A method of controlling access to a system comprising:

performing, on a computing device, a test that includes, during a user authentication stage, presenting to a user multiple randomly selected questions and receiving, for each of the randomly selected questions, a corresponding input response, and comparing each of the multiple input responses to a corresponding pre-determined response; and

granting access to the system in the event the test is passed, by providing a user with a key for encrypting data on the system, a key for decrypting data on the system, or both keys, wherein the keys correspond to a hierarchical position of the user in an entity owning the data, and data secured on the system at different hierarchical positions are accessed by answering a same number of the multiple randomly selected questions to complete the test.

2. The method of claim 1, wherein a first condition of passing the test is that each input response from the multiple input responses matches a corresponding one of the multiple pre-determined responses.

3. The method of claim 2, wherein a pre-determined response from the multiple pre-determined responses is a pre-determined correct answer that corresponds to a question from the multiple randomly selected questions.

4. The method of claim 2, wherein a pre-determined response from the multiple pre-determined responses is a pre-determined incorrect answer that corresponds to a question from the multiple randomly selected questions.

5. The method of claim 1, further comprising presenting the multiple randomly selected questions sequentially.

6. The method of claim 1, further comprising presenting the multiple randomly selected questions concurrently.

7. The method of claim 2, wherein a second condition of passing the test is entering the multiple input responses into the system in a pre-determined sequence different from the sequence that the multiple randomly selected questions are displayed during the test.

8. The method of claim 1, further comprising presenting questions and candidate responses in a multiple choice format.

9. The method of claim 1, wherein a first condition of passing the test is providing responses to only a pre-determined subset of the multiple randomly selected questions presented to the user during the test.

10. The method of claim 9, wherein the test is failed by selecting a question from the multiple randomly selected questions for which no corresponding pre-determined response is stored on the system.

11. The method of claim 8, further comprising presenting candidate responses that include both correct and incorrect answers to the multiple randomly selected questions.

12. The method of claim 1, wherein granting access to the system comprises decrypting non-authentication information on the system using a decryption key.

13. The method of claim 1, further comprising selecting a question from the multiple randomly selected questions for presentation based on a time that the question was last displayed.

14. The method of claim 1, further comprising selecting a question from the multiple randomly selected questions for presentation based on a number of times the question was displayed within a pre-determined time period.

35. The method of claim 1, wherein the system comprises protected data comprising encrypted data, and for a first user having a higher hierarchical position in the entity than a second user, the first user is able to access all protected data accessible by the second user, but the second user is not able to access all protected data accessible by the first user.

15. A method of controlling access to protected information on a system comprising:

selecting, on a computing device, a combination of randomly selected questions for presentation to a user;

determining access permissions for the user to the information using a vector that contains access permissions for multiple hierarchical classifications of users; and

granting the user access to the information based on both responses to the combination of questions and the access permissions, wherein a same number of responses to the randomly selected questions determine access permissions to protected information on the system corresponding to different hierarchical classifications.

16. The method of claim 15, wherein the classification corresponds to a membership of the user in one or more of a corporation, a division, a department, a group, and a project.

17. The method of claim 15, wherein the information on the system corresponds to any one or more of a disk partition, a file system, a portion of a database, a directory, an electronic folder, an electronic file, and a data object.

18. The method of claim 15, further comprising displaying the combination of questions using a user interface protocol.

19. The method of claim 18, wherein the user interface protocol comprises displaying candidate responses to the questions in a multiple choice format.

20. The method of claim 15, further comprising:

encrypting a response input by the user using an encryption key to generate an encrypted input response; and

granting access to the system in the event that the encrypted input response matches a corresponding encrypted system response.

21. The method of claim 20, wherein granting access to the system comprises decrypting the information on the system using a decryption key corresponding to the encryption key.

22. The method of claim 15, wherein granting access to the information on the system comprises determining permissions to the information corresponding to the classification.

23. The method of claim 15, wherein the classification has a hierarchical structure that corresponds to an organizational structure of an entity.

36. The method of claim 15, wherein granting the user access to the information comprises providing the user with a key for encrypting data on the system, a key for decrypting data on the system, or both keys, wherein the keys correspond to a hierarchical classification of the user in an entity.

24. A module for controlling access to a system comprising:

means for randomly selecting a combination of questions; and

means for granting access to the system in the event multiple user responses to the questions match corresponding multiple pre-determined responses to the questions, wherein granting access comprises providing a user with a key for encrypting data on the system, a key for decrypting data on the system, or both keys, the keys corresponding to a hierarchical position of the user in an entity, and a same number of responses to the randomly selected combination of questions determine access permissions for any hierarchical position in the entity.

25. The module of claim 24, further comprising means for presenting the combination of questions.

26. The module of claim 25, wherein the means for presenting displays the combination of questions sequentially.

27. The module of claim 25, wherein the means for presenting displays the combination of questions concurrently.

28. The module of claim 24, wherein the means for randomly selecting a combination of questions comprises a memory for storing information for tracking questions presented to a user.

37. The module of claim 24, wherein for a first user having a higher hierarchical position in the entity than a second user, the first user is able to access all encrypted data accessible by the second user, but the second user is not able to access all encrypted data accessible by the first user.

29. A module for controlling access to protected data on a system comprising:

a processor; and

a memory comprising;

a generator component for presenting a randomly selected combination of questions to a user for authenticating the user on the system; and

a grant component for granting access to the data based on permissions granted to the user and on responses of the user to the randomly selected combination of questions, wherein the permissions correspond to a hierarchical classification of the user in an entity owning the data, a same number of responses to the randomly selected combination of questions determine access to all protected data on the system, and for a first user having a higher hierarchical classification than a second user, the first user is able to access all protected data accessible by the second user but the second user is not able to access all protected data accessible by the first user.

30. The module of claim 29, wherein the classification of the user corresponds to any one or more of a corporation identifier, a division identifier, a business identifier, a department identifier, a group identifier, and a user identifier.

31. The module of claim 29, wherein granting access to the system comprises granting access to one of an encryption key, a decryption key, or both, for accessing non-authentication data on the system.

38. The module of claim 29, wherein the protected data comprises encrypted data, and granting access to the data comprises providing the user with a key for encrypting data on the system, a key for decrypting data on the system, or both keys, wherein the keys correspond to a hierarchical classification of the user in an entity.

32. A network of devices comprising:

one or more user devices; and

an access control circuit for granting access to protected data to multiple users using the user devices, wherein each user from the multiple users is granted access based on a position of the user in an organization, on a vector associating access permissions to the protected data for each of multiple hierarchical positions of users, and on multiple responses of the user to a combination of randomly selected questions, wherein a same number of responses to the randomly selected questions grant access to all protected data.

33. The network of devices of claim 32, wherein the protected data comprises any one or more of an encrypted disk partition, an encrypted file system, an encrypted portion of a database, an encrypted directory, an encrypted electronic folder, file, and an encrypted data object.

34. The network of claim 32, wherein the position of a user corresponds to a membership of a user in any one of a corporate unit, a division, a business unit, a department, a group, and a team.

39. The network of devices of claim 32, wherein granting access to protected data comprises providing a user with a key for encrypting data on the system, a key for decrypting data on the system, or both keys, wherein the keys correspond to a hierarchical position of the user in the organization, and for a first user having a higher hierarchical position in the organization than a second user, the first user is able to access all protected data accessible by the second user, but the second user is not able to access all protected data accessible by the first user.