AU2001291498B2

AU2001291498B2 - Computer-type peripherals

Info

Publication number: AU2001291498B2
Application number: AU2001291498A
Authority: AU
Inventors: Judith Venn; Stuart Bruce Venn
Original assignee: COMGEER Pty Ltd
Current assignee: COMGEER Pty Ltd
Priority date: 2000-09-27
Filing date: 2001-09-26
Publication date: 2004-12-02
Anticipated expiration: 2021-09-26
Also published as: AU9149801A

Description

WO 02/27460 PCT/AU01/01209 1 TITLE: COMPUTER-TYPE PERIPHERALS THIS INVENTION relates to peripherals for computers, work stations and similar. In particular, although in no way limiting, it is directed to a peripheral device which, when required, can be used to communicate with the processing capabilities of a computer to first establish that the current user of that device is an authenticated user prior to allowing access to computer resources. Such a capability of the present invention finds especial use when, inter alia, undertaking a financial transaction to enable a purchase of goods or services over a telecommunication medium, or whereby authentication of a user is required prior to undertaking any secure transaction. However, it will be appreciated that the invention is equally applicable to any transaction that requires reading and/or transmission of data stored on a machine-readable device.

The advertising of goods and services over media such as television and the Internet is now commonplace.

With television advertising, the public can often purchase the goods or services so-advertised over the telephone quoting details of a credit or debit card. Typically, the vendor draws the full payment from the bank account linked to the credit or debit card and then forwards the goods to the purchaser.

With the Internet now well known as an electronic medium and powerful communications tool the seamless system (World Wide Web) linking information on different computers, the general public can readily access the Internetfor a wide variety of purposes, including to order numerous consumer WO 02/27460 PCT/AU01/01209 2 goods and/or services online. Once again, payment for these goods and/or services is often by quoting details of a credit or debit card.

To engage in such a purchase, it is not necessary to be in physical possession of the credit or debit card. Before a sale is authorised over a telecommunication medium, all that is usually required is to cite the account number, name of the card holder and possibly a special code specific for that account (the so called Personal Identification Number (PIN). However, as PIN and account numbers are not dependent on any cross checking to ensure that the are being quoted over the telecommunication medium by the true proprietor of that PIN number and its associated credit card or bank account, this type of transaction is not too difficult to circumvent. Accordingly, people remain wary of undertaking such purchases, particularly over the Internet, for fear that their credit details will be downloaded by unauthorised parties who will then use those details fraudulently.

Similar security problems exist for business-to-business e-commerce, electronic ticketing and other activities which are now being promoted by the computer and Internet-based industries.

This disadvantage is partially reduced by payment of goods at their point of sale (EFTPOS)) as the purchaser must at least be in physical possession of the card. Further security can be offered by using a smart card whereby, for example, certain biometric data of the proprietor of the card is encoded on the card thus providing, if required, the mechanism for an additional verification that the purchaser is entitled to undertake that transaction with that card.

However, for purchases at locations away from commercial centres, such as for home-based shopping online, these EFTPOS-type facilities are generally not available.

WO 02/27460 PCT/AU01/01209 3 Even if a dedicated EFTPOS-type terminal could be supplied at an affordable cost for home-based online purchasers, the frequency of such transactions is still too low for the average person with a home computer to justify the purchase of such a dedicated terminal.

Nevertheless, there have been prior art deviceswhich appear to overcome the above disadvantages of home-based shopping online.

For example, one possible solution to this disadvantage is disclosed in US 5,550,561 which describes a cursor pointing device, typically a mouse, integrated with a card reader assembly. The appropriate financial data is first read from the card and the cursor device then transfers this data over a telecommunication medium to facilitate a purchase of goods or services.

However, this cursor pointing device appears to be dedicated solely to the entry of monetary information for a financial transaction to occur over a telecommunication medium and the user of such a device would thus have to switch to a conventional cursor pointing device for other operations of the computer. Having two distinct cursor pointing devices to be swapped periodically depending on the task to be performed is, at least, inconvenient and fails to resolve at least one of the afore-mentioned disadvantages, namely, that a separate dedicated device has still to be purchased for such financial transactions to be undertaken.

A second possible prior art solution is the mouse system which incorporates a smart card reader as described in US 6,055,592. A mouse is integrated with a card reader connected to a computer via an existing interface port on the computer. This system is not limited to the transfer of financial data as, essentially, a converter in the mouse system determines when to transmit WO 02/27460 PCT/AU01/01209 4 card data and when to transmit cursor position information. Thus, a single mouse can be used, in contrast to US 5,550,561 discussed above where two mice would be required. Further, US 6,055,592 envisages a procedure for granting access to a user of a computer system whereby access is granted to the user when the user is identified as an authorised user (from the information read from the card) and would deny access when the user fails to be identified as an authorised user of the system.

However, one major disadvantage of the system of US 6,055,592 is that, because it operates through the existing interface port of a computer, a change in the known mouse drivers would be required, even if the mouse system was only to be used for the conventional pointing operations separate from any reading of data from a magnetic strip or smart card or similar datacarrying medium.

Yet another possible prior art solution is disclosed in PCT/FR97/00991 whereby an electronic device is interposed between the keyboard and the CPU, the device verifying the authorisation access of the user and subsequently allowing or disallowing access to the CPU dependent on the authorisation outcome. However, once again, the disadvantage remains of using the existing interface port of the computer.

Further, these prior art systems only check any authentication data once.

After authentication has been approved, the approved operation can continue until the user physically terminates the operation. Therefore, once initial access has been gained, perhaps fraudulently, there is the opportunity for fraudulent activities to continue unabated.

PC IAU01/'01209 Received 18 July 2002 There thus remains a need for a cursor controlling device which can function as a pointing device compatible with existing drivers, but which is capable of independently reading data from a data-carrying medium and initiating certain actions based on the information thus-read, and which could periodically establish that the continued use of facilities thus accessed by the pointing device is authenticated.

Therefore, according to the present invention, there is provided a cursor control assembly for controlling grant of access to facilities of an electronic data processing unit, said electronic data processing unit of a type having a first communication means between said cursor control assembly and a first interface port of said electronic data processing unit whereby said first communication means is adapted to grant access to said facilities via at least one driver, characterised in that said cursor control assembly further includes: a reader assembly capable of reading a data-containing medium; and a second communication means between said reader assembly and a second interface port of said electronic data processing unit, said second communication means being independent of operation of said at least one driver and adapted to pass data read from said datacontaining medium to said electronic data processing unit; whereby, said cursor ,.control assembly and said electronic data processing unit are adapted such that, when required by a user of said electronic data processing unit, said reader assembly first reads said data-containing medium to determine whether said first communication means should grant said access to said facilities of said electronic data processing unit.

IPENJAU

WO 02/27460 PCT/AU01/01209 6 Preferably, said cursor control assembly is selected from a keyboard or a pointing device.

More preferably, said cursor control assembly is a pointing device.

Preferably, said pointing device is a pen, glidepad, trackball or mouse assembly.

More preferably, said pointing device is a mouse assembly.

Preferably, said data-containing medium is selected from a credit, debit or smart card, or other information carrying medium such as the iButtone.

As a first option, said cursor control assembly further includes a check means adapted to check that any currently authenticated user of said assembly is still operating said assembly.

As a second option, said cursor control assembly further includes a key pad, said key pad including numeric and other keys required to facilitate a financial or other transaction.

As a third option, said cursor control assembly further includes verification means whereby verification data is obtained from the person attempting to use said cursor control assembly and then compared against similar verification data held on said data-containing medium; and if the two sets of verification data match, verification of the authenticated user is deemed positive, WO 02/27460 PCT/AU01/01209 7 Preferably, said verification data is biometric data.

A preferred embodiment will now be described with reference to the accompanying drawings wherein: FIG. 1 is a top schematic perspective view of a cursor control assembly, in the form of a mouse, which is constructed in accordance with the present invention; and FIG. 2 is a bottom schematic perspective view of the mouse of FIG. 1.

Referring to the figures, the upper body of the mouse incorporates left (2) and right controlling buttons. The underside of the mouse incorporates a trackball The buttons and trackball are all well known features in the art for the conventional operation of the mouse movement being communicated to a computer via a first communication link connected to a first port (not illustrated) of the computer. A Blue Dot Receptor

TM

for an iButton®, as manufactured by Dallas Semiconductor Corporation, is incorporated into the upper body of the mouse between the two buttons On one side of the mouse is a third button This button is spring-biassed between two positions, to open and close an electrical circuit.

Recessed into the underside of the mouse is a numeric keypad The Blue Dot Receptor T M iButton® third button and keypad are adapted by any suitable means known in the art so that their activation can be communicated via a second communication link connected to a second port (not illustrated) of the computer. A rechargeable battery (not illustrated) may be incorporated into the appropriate circuitry to ensure adequate power is always available for the continued operation of the cursor control assembly.

WO 02/27460 PCT/AU01/01209 8 In use, the computer is powered up. Power is simultaneously applied to the first mouse port connected to the link and to the second port connected to the link On this initial power-up, the operation of the buttons and trackball are disabled. The computer then seeks data from an iButton®, the iButton® containing the necessary authentication data for the functions of the computer to be accessed. The authentication data can be any combination of username, password, biometric data, etc, as is well known in the art. The data thus read by the Blue Dot Receptor T M is communicated to the computer seeking that data. If authentication data is not present, or if invalid data is read, the operation of the buttons and trackball remain disabled. If valid data is obtained from the iButton®, all functions of the computer for which the user is authorised to access are enabled. The computer constantly monitors for the presence of the Blue Dot ReceptorTM(6) and/or an iButton®. If the Blue Dot ReceptorTM is removed or is not otherwise functioning, or if a valid iButton® is not present, a signal is communicated to the computer which disables all functions. Periodically, the computer sends a request to operate the third button If that third button is not operated within a specified period, it is concluded that an authenticated user is no longer present and all functions of the computer are disabled.

Once an authenticated user is logged on to the computer, other operations can be effected, for example, connection to the Internet. The usual password and other verification data necessary to access the Internet can be stored on an iButton®, as can the sequential keystrokes necessary to activate access to the Internet. Preferably, the software employed to access the Internet also establishes an electronic firewall preventing access to the local computer's hard drive by any other undesired remote computer system and the logon to the Internet can be made directly through the communication link any keystroke entries necessary being undertaken from either the keypad on WO 02/27460 PCT/AU01/01209 9 the mouse or from any sequential keystrokes deployed by reading of the iButton®, thus eliminating the need for any such information to be stored on the hard drive of the computer. Once again, if the Blue Dot Receptor TM is removed or is not otherwise functioning, or if a valid iButton®is not present, or if the button is not pressed within the specified period when requested, disconnection from the Internet occurs. Modifications to this software include the incorporation of an on-screen display of the available time purchased for access to the Internet. Once the available time has been exhausted, automatic disconnection to the Internet occurs. Yet another modification is the linking of the button and an iButton® such that, on pressing the button a pop-up menu appears which identifies the functions which are available to the particular authenticated user.

It will be appreciated that, as an alternative to the Blue Dot ReceptorTM/iButton® technology, any suitable credit, debit or smart card, with data on that card being encrypted or not, can be used with the present invention.

Irrespective of the data-carrying medium used, any suitable encryption technology known in the art can be used first to encrypt any un-encrypted data thus read from the medium before sending same to a remote location over a telecommunication medium, thus improving security of the transmitted data.

Further, the assembly can be hard wired to the computer or controlled remotely using, as an example, known infra red technology; or the assembly can be a combination of hard wired or remote control. Also, communication of the thus read data can be undertaken by wire or wireless transmissions.

Finally, the present invention can be incorporated into desktop, laptop or palmtop computers, or into WAP-enabled devices.

WO 02/27460 PCT/AU01/01209 The present invention thus provides a mechanism for a more secure operation of a computer.

A typical use for the present invention is for EFTPOS-type purchases to be undertaken remote from the more traditional commercial centres while still requiring the purchaser to be in physical possession of the credit, debit or smart card or other data-carrying medium, thus maintaining a level of security for the financial and other data that is necessarily transmitted over a telecommunication network for such purchases. In particular, it obviates the need to store such data on the hard drive of a computer and to transmit that data using the keyboard of that computer.

However, other uses are to be encompassed within its scope whenever some form of "verification" is required before the computer will function as requested, whether that be to initiate transfer of data over a telecommunication medium or to issue hard-copy information from the computer, etc.

It will also be appreciated by those skilled in the art that, although specific reference has been made to incorporate a reader assembly into a mouse, the reader assembly could also be incorporated into other peripherals such as the keyboard and visual display unit, or even into the casing of a computer.

Of course, other modifications and alterations could be made without departing from the inventive concept as defined in the following claims.

Claims

1. A cursor control assembly for controlling grant of access to facilities of an electronic data processing unit, said electronic data processing unit of a type having a first communication means between said cursor control assembly and a first interface port of said electronic data processing unit whereby said first communication means is adapted to grant access to said facilities via at least one driver, characterised in that said cursor control assembly further includes: a reader assembly capable of reading a data-containing medium; and a second communication means between said reader assembly and a second interface port of said electronic data processing unit, said second communication means being independent of operation of said at least one driver and adapted to pass data read from said data-containing medium to said electronic data processing unit; whereby, said cursor control assembly and said electronic data processing unit are adapted such that, when required by a user of said electronic data processing unit, said reader assembly first reads said data-containing medium to determine whether said first communication means should grant said access to said facilities of said electronic data processing unit.

2. A cursor control assembly as defined in Claim 1, wherein said cursor control assembly is selected from a keyboard or a pointing device. AMENDED SHET IPEA/AU WO 02/27460 PCT/AU01/01209 12

3. A cursor control assembly as defined in Claim 2, wherein said cursor control assembly is a pointing device.

4. A cursor control assembly as defined in Claim 3, wherein said pointing device is a pen, glidepad, trackball or mouse assembly.

5. A cursor control assembly as defined in Claim 4, wherein said pointing device is a mouse assembly.

6. A cursor control assembly as defined in any one of Claims 1 to wherein said data-containing medium is selected from a credit, debit or smart card, or an iButton®.

7. A cursor control assembly as defined in any one of Claims 1 to 6, wherein said cursor control assembly further includes a check means adapted to check that any currently authenticated user of said assembly is still operating said assembly.

8. A cursor control assembly as defined in any one of Claims 1 to 7, wherein, said cursor control assembly further includes a key pad, said key pad including numeric and other keys required to facilitate a financial or other transaction.

9. A cursor control assembly as defined in any one of Claims 1 to 8, wherein said cursor control assembly further includes verification means whereby verification data is obtained from a person attempting to use said cursor control assembly and then compared against similar verification data held on said data-containing medium. WO 02/27460 PCT/AU01/01209 A cursor control assembly as defined in Claim 9, wherein said verification data is biometric data.