METHOD, SYSTEM, AND APPARATUS FOR SECURELY OPERATING COMPUTER

• US 20140189857A1
• Filed: 12/30/2013
• Published: 07/03/2014
• Est. Priority Date: 12/31/2012
• Status: Abandoned Application

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Guo, Feng, Chen, Qiyan, Wang, Tianqing, Wan, Lintao, Yang, Ziye
• Application Number:
  US14/143,295
• Publication Number:
  US 20140189857A1
• Time in Patent Office: Days
• US Class Current: 726/20
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/54 Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users

Abstract

The present invention provides a method, system and apparatus for securely operating a computer. The method comprises: obtaining presence status of an authenticated user, the presence status indicating whether the authenticated user is present in the vicinity of the computer; and triggering security operation in response to that the presence status indicates the authenticated user is absent in the vicinity of the computer. By means of the method, current status of an authenticated user who has logged in can be easily learned, and in turn, corresponding security operation is performed; in addition, when a user is performing sensitive operation, it can be confirmed in real time whether the user is an authenticated user who previously logged in, so that security of operating the computer is improved.

Claims

1. A method for securely operating a computer, comprising:

obtaining presence status of an authenticated user, the presence status indicating whether the authenticated user is present in the vicinity of the computer; and

triggering security operation in response to that the presence status indicates the authenticated user is absent in the vicinity of the computer.

2. The method according to claim 1, wherein the presence status is obtained based on communication status between a RFID reader for the computer and a RFID tag for the user.

3. The method according to claim 1, wherein the obtaining presence status of an authenticated user further comprises:

after the authenticated user logs into the computer, subscribing to an event regarding presence status change of the authenticated user, thereby when the authenticated user leaves the computer, obtaining a message notified automatically and indicating the authenticated user is absent in the vicinity of the computer.

4. The method according to claim 1, wherein the method is triggered by the authenticated user'"'"'s sensitive operation.

5. The method according to claim 4, wherein the sensitive operation is performed on the computer.

6. The method according to claim 4, wherein the sensitive operation is performed by logging into another computer via the computer.

7. The method according to claim 4, wherein the sensitive operation comprises one or more of operation related to financial information, operation related to encrypted information, and operation related to system kernel information.

8. The method according to claim 1, wherein the security operation comprises one or more of locking screen, rejecting operation, blocking access, and notifying the authenticated user.

9. The method according to claim 2, wherein the RFID tag for the authenticated user is attached to the body and/or an accessory of the authenticated user.

10. A system for providing secure operation to a computer, comprising:

an identity tag disposed on an authenticated user, comprising a RFID tag;

a tag recognition module disposed on the computer, comprising a RFID reader, the tag recognition module generating and/or updating presence status of the authenticated user based on communication status between the RFID reader and the identity tag within the identity tag, the presence status indicating whether the authenticated user is present in the vicinity of computer; and

a security management module communicatively coupled to the tag recognition module, configured to trigger security operations in response to that the generated presence status of the authenticated user indicates the authenticated user is absent in the vicinity of the computer.

11. The system according to claim 10, further comprising:

an information maintenance module comprising a repository and configured to maintain the presence status generated by the tag recognition module.

12. The system according to claim 11, wherein the tag recognition module periodically updates the generated or updated presence status of the authenticated user to the information maintenance module via a message, and the message comprises one or more of the following relevant information:

an identity tag identification code, an IP address of the computer, a specific identity tag being present in the vicinity of the computer, and a specific identity tag leaving the computer.

13. The system according to claim 11, wherein after the authenticated user logs into the computer, the security management module subscribes to the information maintenance module for an event regarding presence status change of the authenticated user, so when the authenticated user leaves the computer, the security management module obtains a message automatically notified by the information maintenance module and indicating the authenticated user is absent in the vicinity of the computer.

14. The system according to claim 11, wherein the security management module being configured to trigger security operations in response to that the generated presence status of the authenticated user indicates the authenticated user is absent in the vicinity of the computer further comprises:

when the security management module detects the authenticated user'"'"'s sensitive operation, querying the information maintenance module about presence status of the authenticated user; and

in response to that the presence status of the authenticated user indicates the authenticated user is absent in the vicinity of the computer, triggering security operation.

15. The system according to claim 14, wherein the sensitive operation is performed on the computer, and the security management module is disposed on the computer.

16. The system according to claim 14, wherein the sensitive operation is performed by logging into another computer via the computer, and the security management module is disposed on said another computer.

17. The system according to claim 14, wherein the sensitive operation comprises one or more of operation related to financial information, operation related to encrypted information, and operation related to system kernel information.

18. The system according to claim 10, wherein the security operation comprises one or more of locking screen, rejecting operation, blocking access, and notifying the authenticated user.

19. The system according to claim 10, wherein the identity tag disposed on the authenticated user is attached to the body and/or an accessory of the authenticated user.

20. An apparatus for securely operating a computer, comprising:

a status obtaining module configured to obtain presence status of an authenticated user, the presence status indicating whether the authenticated user is present in the vicinity of the computer; and

a triggering module configured to trigger security operation in response to that the presence status indicates the authenticated user is absent in the vicinity of the computer.