Smart card enabled secure computing environment system

• US 7,861,091 B2
• Filed: 10/18/2002
• Issued: 12/28/2010
• Est. Priority Date: 02/28/2001
• Status: Expired due to Fees

• Current Assignee: O2 Micro International Limited (O2 Micro Incorporated)
• Original Assignee: O2 Micro International Limited (O2 Micro Incorporated)
• Inventors: Li, Miao, Kuo, Chih Jen, Luo, Wei
• Primary Examiner(s): PATEL, NIRAV B
• Application Number:
  US10/273,960
• Publication Number:
  US 20030088780A1
• Time in Patent Office: 2,993 Days
• Field of Search: 713182-186, 713/1, 726/2, 726/9, 726/16, 726/20, 726 27- 29, 705/65, 705/66, 705 41- 44, 709/225, 709/229, 709/219, 709/217, 455/410, 455/411, 235375-382, 711/115
• US Class Current: 713/185
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising

Abstract

A smart card enabled secure computing environment system locks the host computer system from user access and waits for a smart card to be inserted into an attached or co-resident smart card reader. When a smart card is inserted into the smart card reader, the invention asks the user to enter his smart card password which is compared to the password on the smart card. If the two passwords match, the invention looks up the user'"'"'s username in an access file of valid users and finds its associated access times and/or cumulative time limits in the access file. if the current time is within any of the valid access times and the user'"'"'s cumulative usage time is within the specified cumulative time limit, then access is granted and the system is unlocked. The invention periodically checks the current time while the user is using the computer. If a blocked time period is entered or a cumulative time limit is exceeded, the user is logged off the machine and the computer is locked from user access. If at any time the user'"'"'s smart card is removed from the smart card reader the invention will shut down all of the user'"'"'s programs and lock the system.

Claims

1. A process for controlling access to a host computer, said process comprising:

detecting that a transportable memory device is in communication with said host computer;

accessing a first password and a username from said transportable memory device;

accessing a second password entered by a user;

if said first password matches said second password, then;

(i) searching for said username on a stored list of valid users, (ii) retrieving access time intervals associated with said username, and (iii) granting host computer access to said user by unlocking said host computer if the current time is within any of said access time intervals associated with said username;

after said granting, logging said user into a session and permitting data to be transferred from said transportable memory device, wherein said data is encrypted using an encryption key that is resident on said transportable memory device and wherein said data comprises information used to configure said host computer system according to preferences specific to said user;

locking said host computer from user access if said transportable memory device is removed from said host computer;

detecting that said transportable memory device is again in communication with said host computer; and

with said transportable memory device again in communication with said host computer, restoring said session at the point at which said transportable memory device was previously removed and granting host computer access to said user by unlocking said host computer if the current time is within any of said access time intervals associated with said username.

2. The process of claim 1, wherein only a designated primary user is allowed to define said valid users and said access time intervals.

3. The process of claim 1, further comprising denying access to said user if the current time falls outside all of said access time intervals.

4. The process of claim 1, further comprising warning said user if the current time is approaching the end of an access time interval for said username;

wherein said warning is issued to said user at preset intervals.

5. The process of claim 1, further comprising:

determining that an access time interval for said username has ended; and

logging said user off said host computer and locking said host computer from user access.

6. The process of claim 5, further comprising shutting down all of said user'"'"'s running programs.

7. The process of claim 1, further comprising accessing a cumulative time limit defined for said username, wherein said granting also depends on whether cumulative usage time for said username is within said cumulative time limit and wherein said user is denied access if cumulative usage time for said username exceeds said cumulative time limit.

8. The process of claim 7, further comprising warning said user if cumulative usage time for said username is about to exceed said cumulative time limit;

wherein said warning is issued at preset intervals.

9. The process of claim 7, further comprising:

determining that a cumulative time limit for said username has been exceeded; and

logging said user off said host computer and locking said host computer from user access if said cumulative time limit is exceeded.

10. The process of claim 9, further comprising shutting down all of said user'"'"'s running programs if said cumulative time limit is exceeded.

21. The process of claim 1, wherein said transportable memory device is a smart card and wherein said detecting comprises detecting that a smart card has been inserted into a smart card reader connected to said host computer.

11. An apparatus for controlling access to a host computer, said apparatus comprising a memory storing instructions which, when executed by one or more processors, cause said one or more processors to perform a method comprising:

detecting that a transportable memory device is in communication with said host computer;

accessing a first password and a username from said transportable memory device;

accessing a second password entered by a user;

if said first password and said second password match, then;

(i) searching for said username on a stored list of valid usernames, ii) retrieving access time intervals associated with said username, and iii) granting host computer access to said user by unlocking said host computer if the current time is within any of said access time intervals associated with said username; and

after said granting, initiating a session and permitting data to be transferred from said transportable memory device, wherein said data is encrypted using an encryption key that is resident on said transportable memory device and wherein said data comprises information used to configure said host computer system according to preferences specific to said user;

locking said host computer from user access if said transportable memory device is removed from said host computer;

detecting that said transportable memory device is again in communication with said host computer; and

with said transportable memory device again in communication with said host computer, restoring said session at the point at which said transportable memory device was previously removed and granting host computer access to said user by unlocking said host computer if the current time is within any of said access time intervals associated with said username.

12. The apparatus of claim 11, wherein only a designated primary user is allowed to define said valid users and said access time intervals.

13. The apparatus of claim 11, wherein said user is denied access if the current time falls outside all of said access time intervals.

14. The apparatus of claim 11, wherein said user is warned if the current time is approaching the end of an access time interval for said username;

wherein said warning is issued to said user at preset intervals.

15. The apparatus of claim 11, wherein said user is logged off said host computer and said host computer is locked from user access if an access time interval for said username ends.

16. The apparatus of claim 15, wherein said all of said user'"'"'s running programs are shut down if said access time interval ends.

17. The apparatus of claim 11, wherein a cumulative time limit is defined for said username, and wherein access is granted to said user if cumulative usage time for said username is within said cumulative time limit and wherein access is denied to said user if cumulative usage time exceeds said cumulative time limit.

18. The apparatus of claim 17, wherein said user is warned if cumulative usage time for said username is about to exceed said cumulative time limit;

wherein said warning is issued at preset intervals.

19. The apparatus of claim 17, wherein said user is logged off said host computer and said host computer is locked from user access if said cumulative time limit is exceeded.

20. The apparatus of claim 19, wherein all of said user'"'"'s running programs are shut down if said cumulative time limit is exceeded.

22. The apparatus of claim 11, wherein said transportable memory device is a smart card.