Method, program and system for limiting I/O access of client

• US 20060206720A1
• Filed: 03/07/2006
• Published: 09/14/2006
• Est. Priority Date: 03/08/2005
• Status: Abandoned Application

• Current Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Okuda, Kunio, Harada, Hideki, Ueda, Taizoh, Moriya, Yukinobu, Ohmori, Takeshi
• Application Number:
  US11/369,558
• Publication Number:
  US 20060206720A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A method of limiting I/O access of a client to prevent data in a client connected to the system from being leaked and stolen, the method further canceling the limitation under a predetermined condition even if the client can not communicate with a server is provided. The method comprising the steps of locking I/O access of the client, determining whether the client is connectable to the server via a network, unlocking I/O access of the client in response to a determination of the client being connectable, by authenticating the client by the server, and unlocking I/O access of the client in response to the client not being connectable, by connecting a portable authentication device to the client to authenticate the client by the portable authentication device.

Claims

1. A method of limiting Input/Output (I/O) access of a client connected to a server via a network, the method comprising the steps of:

locking I/O access of a client;

determining whether said client is connectable to a server via a network;

in response to a determination of said client being connectable in said determining step, unlocking I/O access of said client in a first unlocking step by authenticating said client by said server; and

in response to a determination of said client not being connectable in said determining step, unlocking I/O access of said client in a second unlocking step by connecting a portable authentication device to said client to authenticate said client by said portable authentication device.

2. The method of limiting I/O access of the client according to claim 1, wherein:

in said first unlocking step, said client is authenticated by referencing a policy recorded in said client.

3. The method of limiting I/O access of the client according to claim 2, wherein:

in said first unlocking step, said client is authenticated by said policy referencing a group policy.

4. The method of limiting I/O access of the client according to claim 1, wherein:

in said first locking step, in response to said client being in standby mode, determining that said client is not active, and in response to determining that said client is not active, locking I/O access of said client.

5. The method of limiting 1/O access of the client according to claim 1, wherein:

in said first unlocking step, in response to a security inspection for said client being passed, authenticating said client to unlock I/O access of said client.

6. The method of limiting I/O access of the client according to claim 1, wherein:

in said second unlocking step, authenticating said client by a serial number of said client recorded in said portable authentication device to unlock I/O access of said client.

7. The method of limiting I/O access of the client according to claim 1, wherein:

in said second unlocking step, authenticating said client by a password for an account installed at said client and recorded in said portable authentication device to unlock I/O access of said client.

8. The method of limiting I/O access of the client according to claim 1, further comprising a step of:

recording an I/O access history in said portable authentication device.

9. The method of limiting I/O access of the client according to claim 8, further comprising a step of:

sending the recorded I/O access history to said server after said recording step.

10. The method of limiting I/O access of the client according to claim 8, wherein:

the I/O access history recorded in said portable authentication device is a utilization history of a USB port, keyboard, printer, network driver, CD, CD-R, DVD, MO and flexible disk file or an access history of a folder of said client.

11. The method of limiting I/O access of the client according to claim 1, wherein:

in said first unlocking step, after I/O access of said client is unlocked, said client name, the unlocked I/O access and unlocked date and time are recorded in said server.

12. The method of limiting I/O access of the client according to claim 1, wherein:

said portable authentication device is a USB key.

13. A computer-usable medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

locking I/O access of a client;

determining whether said client is connectable to a server via a network;

in response to a determination of said client being connectable in said determining step, unlocking I/O access of said client in a first unlocking step by authenticating said client by said server; and

in response to a determination of said client not being connectable in said determining step, unlocking I/O access of said client in a second unlocking step by connecting a portable authentication device to said client to authenticate said client by said portable authentication device.

14. The computer-usable medium of claim 13, wherein in said first unlocking step, said client is authenticated by referencing a policy recorded in said client.

15. A client control system for limiting I/O access of a client connected a server via a network, wherein:

said client comprises an I/O access locking unit for locking I/O access of said client, a communication unit for determining whether said client is connectable to said server via said network and accessing to said server in response to a determination of said client being connectable, and a first unlocking unit for unlocking I/O access of said client in response to a determination of said client not being connectable and in response to a determination of said portable authentication device being connected, by authenticating said client by said portable authentication device; and

said server comprises a second unlocking unit for unlocking I/O access of said client in response to the access from said client, by authenticating said client.

16. A client control system according to claim 15, wherein:

the I/O access history recorded in said portable authentication device is a utilization history of a USB port, printer, network driver, CD, CD-R, DVD, MO and flexible disk file or an access history of a folder of said client.

17. A client control system according to claim 15, wherein:

said portable authentication device is a USB key.