SYSTEMS, METHODS, AND COMPUTER READABLE MEDIA FOR COMPUTER SECURITY

• US 20090320125A1
• Filed: 05/08/2009
• Published: 12/24/2009
• Est. Priority Date: 05/08/2008
• Status: Abandoned Application

• Current Assignee: Eastman Chemical Company
• Original Assignee: Eastman Chemical Company
• Inventors: Pleasant, James Carroll JR., Dishner, Dustin Lynn
• Application Number:
  US12/437,841
• Publication Number:
  US 20090320125A1
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Embodiments of the present invention provide systems and methods that enhance the security various processes are provided, as well as machines, computer-readable media and processes that employ or allow employment of such systems.

Claims

1. A method for controlling user access to a process being executed on a machine while the machine is outputting data regarding the process, the method comprising:

receiving user authentication data regarding a user transmitted into the machine through physical interaction with one or more first input devices connected to the machine;

making an authentication determination within the machine regarding whether the user authentication data matches available user authentication records for any person or group of persons, wherein making the authentication determination comprises comparing the user authentication data with one or more user authentication records within the machine, available to the machine, or both;

if the authentication determination indicates that the user authentication data matches user authentication records for a person or group of persons, making an access determination within the machine, wherein the access determination comprises use of records regarding access rights regarding the person or group of persons within the machine, available to the machine, or both;

based on the outcome of the authentication determination, and, if made, the access determination, transforming or not transforming one or more second input devices connected to the machine such that such second input devices have access to the process.

2. The method of claim 1, wherein receiving the user authentication data, making the authentication determination, making the access determination, and transforming or not transforming one or more second input devices occur without interrupting the operation of the process or interrupting output of data regarding the process.

3. The method of claim 2, wherein the output of data regarding the process is viewable on a display device.

4. The method of claim 1, wherein at least one of the one or more first input devices comprises at least one of the one or more second input devices.

5. The method of claim 1, wherein the one or more first input devices are different devices from the one or more second input devices.

6. The method of claim 1, wherein the process is selected from financial services software, data management software, a video surveillance system, a document creation software application, an electronic mail service, an accounting or financial service software, or internet browser and a distributed control system software.

7. The method of claim 1, wherein the process is a distributed control system software.

8. The method of claim 1, wherein the authentication data comprises information selected from alphanumeric passwords, alphanumeric user identifications, data stored on one or more physical key devices, data stored on one or more electronic key devices, images of one or more fingerprints or thumbprints, images of an iris of one or more eye, images of one or more retina, images showing blood vessel patterns of one or more body parts, images of a geometry or appearance of one or more body parts, voice samples, signatures, handwriting samples, and combinations of two or more of the foregoing.

9. The method of claim 1, wherein the authentication data comprises information selected from alphanumeric passwords, alphanumeric user identifications, images of one or more fingerprints or thumbprints, and combinations of two or more of the foregoing.

10. The method of claim 1 wherein the method further comprises generating an event log recording information selected from all authentication data entered, all authentication determinations made, all access determinations made, all transformations of input devices to enabled status, all expirations of terminations transformed status, and combinations of two or more of any of the foregoing.

11. The method of claim 1, wherein the machine is a computer.

12. The method of claim 1, wherein;

the user authentication data is data identifying the user as an individual person rather than a member of a group;

the authentication records and the records regarding the access rights relate to individual persons rather than groups;

the authentication determination and the access determination relate to an individual person rather than a group.

13. The method of claim 1 further comprising:

receiving an emergency unlock request as a result of physical interaction with one or more first input devices; and

in response to the emergency unlock data input, transforming one or more second input devices connected to the machine such that such second input devices have access to the process.

14. The method of claim 13, further comprising:

receiving input directed to the process from the one or more second input devices;

making a determination as to whether the one or more second input devices have access to the process;

if the one or more second input devices are enabled to access the process, transmitting the input directed to the process to the process;

if the one or more second input devices are not enabled to access the process, making a determination of whether the emergency unlock function is activated;

if the emergency unlock function is activated, transmitting the input directed to the process to the process;

if the emergency unlock function is not activated, making a determination of whether the process is a software application that performs the method;

if the process is a software application that performs the method, transmitting the input directed to the process to the process;

if the one or more second input devices are not enabled to access the process, and the emergency unlock function is not activated, and the input is not directed to the process is a software application that performs the method, displaying an error message and declining to transmit the input directed to the process to the process.

29. Computer readable media capable of performing the method of claim 1.

30. A computer system performing the method of claim 1.

15. A method for controlling access to process controls for a process being executed on one or more process machines wherein the control machine is connecting to the one or more process machines in a manner that will allow the control machine to control the one or more process machines and wherein the control machine is outputting data regarding the process, the method comprising:

receiving user authentication data regarding a user transmitted into a control machine through physical interaction with one or more first input devices connected to the control machine;

making an authentication determination within the control machine regarding whether the user authentication data matches available user authentication records for any person or group of persons, wherein making the authentication determination comprises comparing the user authentication data with one or more user authentication records within the control machine, available to the control machine, or both;

if the authentication determination indicates that the user authentication data matches user authentication records for a person or group of persons, making an access determination within the control machine, wherein the access determination comprises use of records regarding access rights regarding the person or group of persons within the control machine, available to the control machine, or both;

based on the outcome of the authentication determination, and, if made, the access determination, transforming or not transforming one or more second input devices connected to the control machine such that such second input devices have access to the process.

16. The method of claim 15, wherein receiving the user authentication data, making the authentication determination, making the access determination, and transforming or not transforming one or more second input devices occur without interrupting the operation of the process or interrupting output of data regarding the process.

17. The method of claim 15, wherein the control machine is a computer.

18. A machine or group of machines comprising:

means to operate a process on the machine or group of machines;

means to receive user authentication data regarding a user transmitted into the machine or group of machines through physical interaction with one or more first input devices connected to the machine or group of machines;

means to make an authentication determination within the machine or group of machines whether the user authentication data matches available user authentication records for any person or group of persons, wherein making the authentication determination comprises comparing the user authentication data with one or more user authentication records within the machine or group of machines, available to the machine or group of machines, or both;

means to make an access determination within the machine or group of machines, if the authentication determination indicates that the user authentication data matches user authentication records for a person or group of persons, wherein the access determination comprises use of records regarding access rights regarding the person or group of persons within the machine or group of machines, available to the machine or group of machines, or both;

means to enable or not enable the one or more second input devices connected to the machine or group of machines to access the process, based on the outcome of the authentication determination.

19. The machine or group of machines of claim 18, further comprising the means to receive the user authentication data, to make the authentication determination, to make the access determination, and to transform or not transform one or more second input devices without interrupting the operation of the process or interrupting output of data regarding the process.

20. The machine or group of machines of claim 19, wherein the output of data regarding the process is viewable on a display device.

21. The machine or group of machines of claim 18 wherein the method further comprises a means to generate an event log recording information selected from all authentication data entered, all authentication determinations made, all access determinations made, all transformations of input devices to enabled status, all expirations of terminations transformed status, and combinations of two or more of any of the foregoing.

22. The machine or group of machines of claim 18, wherein the machine is a computer.

23. The machine or group of machines of claim 18, wherein;

the user authentication data is data identifying the user as an individual person rather than a member of a group;

the authentication records and the records regarding access rights relate to individual persons rather than groups; and

the authentication determination and the access determination relate to an individual person rather than a group.

24. The machine or group of machines of claim 18 further comprising:

means to receive an emergency unlock request input as a result of physical interaction with one or more first input devices; and

in response to the emergency unlock data input, means to transform one or more second input devices connected to the machine such that such second input devices have access to the process.

25. The machine or group of machines of claim 24, further comprising,

means to receive input directed to the process from the one or more second input devices;

means to make a determination as to whether the one or more second input devices have access to the process;

means to transmit the input directed to the process to the process if the one or more second input devices are enabled to access the process;

means make a determination of whether the emergency unlock function is activated if the one or more second input devices are not enabled to access the process;

means to transmit the input directed to the process to the process if the emergency unlock function is activated;

means to make a determination of whether the process is a software application that performs the method if the emergency unlock function is not activated;

means to transmit the input directed to the process to the process if the process is a software application that performs the method;

means to display an error message and to decline to transmit the input direct to the process the process if the one or more second input devices are not enabled to access the process, and the emergency unlock function is not activated, and the input is not directed to the process is a software application that performs the method.

26. A method for controlling user access to a process being executed on a machine while the machine is outputting data regarding the process, the method comprising:

receiving data directed to the process transmitted into the machine through physical interaction with one or more first input devices connected to the machine;

receiving user authentication data regarding a user transmitted into the machine through physical interaction with one or more second input devices connected to the machine;

making an authentication determination within the machine regarding whether the user authentication data matches available user authentication records for any person or group of persons, wherein making the authentication determination comprises comparing the user authentication data with one or more user authentication records within the machine, available to the machine, or both;

if the authentication determination indicates that the user authentication data matches user authentication records for a person or group of persons, making an access determination within the machine, wherein the access determination comprises use of records regarding access rights regarding the person or group of persons within the machine, available to the machine, or both;

based on the outcome of the authentication determination, and, if made, the access determination, transmitting or not transmitting the data directed to the process to the process.

27. The method of claim 26 wherein the method further comprises, depending the outcome of the authentication determination, and, if made, the access determination, transforming or not transforming one or more second input devices connected to the machine such that such second input devices have access to the process.

28. The method of claim 27, wherein receiving data directed to the process, receiving the user authentication data, making the authentication determination, making the access determination, and transforming or not transforming one or more second input devices occur without interrupting the operation of the process or interrupting output of data regarding the process.