AU648023B2 - Computer security system - Google Patents

Computer security system

Info

Publication number
AU648023B2
AU648023B2 AU54172/90A AU5417290A AU648023B2 AU 648023 B2 AU648023 B2 AU 648023B2 AU 54172/90 A AU54172/90 A AU 54172/90A AU 5417290 A AU5417290 A AU 5417290A AU 648023 B2 AU648023 B2 AU 648023B2
Authority
AU
Australia
Prior art keywords
computer
card reader
card
communications port
switching means
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
AU54172/90A
Other versions
AU5417290A (en
Inventor
Douglas Murray
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nighthawk Electronics Ltd
Original Assignee
Nighthawk Electronics Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nighthawk Electronics Ltd filed Critical Nighthawk Electronics Ltd
Publication of AU5417290A publication Critical patent/AU5417290A/en
Application granted granted Critical
Publication of AU648023B2 publication Critical patent/AU648023B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/34User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/08Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers from or to individual record carriers, e.g. punched card, memory card, integrated circuit [IC] card or smart card
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2211/00Indexing scheme relating to details of data-processing equipment not covered by groups G06F3/00 - G06F13/00
    • G06F2211/007Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Human Computer Interaction (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Hardware Redundancy (AREA)
  • Alarm Systems (AREA)

Description

COMPUTER SECURITY SYSTEM
This invention relates to a means of restricting access to computer files. The large amount of confidential data on files held by many computers and the expense involved in accessing outside data systems via a modem, makes it imperative to ensure that access to such data and systems is restricted to certain authorised users. At present one of the usual methods of restricting access involves entering a code via the keyboard. However, as the computer must contain a program which recognises the code, an expert can gain entry to the data files by calling up and then modifying the program. It is also possible to provide a mechanical lock system, but this is not a practical means of controlling a variety of levels of authorised access to given types of data or peripherals.
According to the present invention there is provided a security system for a computer having at least one communications port for connection to peripheral devices; the system having a card reader; switching means operable to connect the card reader to the communications port in response to a command including protected routines which generate said command to cause the switching means to connect the card reader to the communications port; and means for comparing data from a card read by the card reader with memorised authorisation data to enable or disable further operation of the protected routine.
Preferably, the switching means operates to connect the card reader and a peripheral device alternatively to a single communications port.
In a particularly preferred form, the switching means is comprised in an adapter package which includes a plug for connection into a communications port socket, a socket for receiving a peripheral device plug, and a cable connection to a stand-alone card reader. Preferably, said computer is an IBM personal computer (or compatible) having a hard disk drive, and the usual serial communication port.
The card reader is preferably a swipe reader, having two of the three standard outputs i.e. CLOCK negative logic and DATA negative logic. These two outputs connect to two inputs in the computer via the switching means. The inputs in the computer (which usually connect with two data set inputs) may thus be controlled by the switch means, which in turn is controlled by the software system.
The software system may be made up of various files e.g. a system file, an installation file and a utility file. These allow access to the computer when the card is used at various levels of security. The software system controls the switch means by setting output levels and monitoring input signals by polling the input signals and processing the changes as the card is swiped. It is possible to use interrupts instead of polling. The above system may be used with the usual communication port uses e.g. to modem, mouse or serial printer.
In order to ensure that the security software cannot be circumvented, access to floppy disc drives on the computer is preferably prevented. This may be achieved by inserting a circuit board between the computer's main system board and the floppy disc drive, to intercept the disc control signals and prevent access to the disc drive until a specified control sequence is received on the disc drive interface from the controlling software. This control sequence is arranged to be sent only once the user has been authenticated on the system. An embodiment of the invention will now be described by way of example, with reference to the accompanying drawings, in which: Fig. 1 is a perspective view of a computer system; Fig. 2 is a block diagram of the compyter system illustrating a card reader and adapter used in the system of the invention; and
Fig. 3 is a block diagram of the circuitry of the adapter.
The preferred embodiment makes use of an IBM PC (or compatible computer) 10 having a communications port socket 12 and a floppy disk drive 102, and a card reader 14. The card reader 14 is permanently wired by cable 19 to an adapter 16 which has a plug 18 for engagement in the communications port socket 12 and also has a similar socket 20 into which any desired peripheral device (not shown) may be connected.
The card reader 14 is a standard swipe reader meeting ISO 3554 track two standard; it requires 0 volt and 5 volt electrical supplies and its outputs are:-
1. CARD PRESENT negative logic.
2. CLOCK negative logic.
3. DATA negative logic. The way that data is retrieved in all systems employing such readers is that data is formed by the data signal being present or not during a 'clock' signal transition from high to low. Each transition is one bit and 5 bits equal one digit pjus parity, the lower 4 bits equal a binary coded decimal number. The 'card present1 signal signals the start and end of the card information.
The system described here uses only CLOCK and DATA signals.
In order to ensure that the security software cannot be circumvented, access to the floppy disc drive 102 in the computer is prevented by means of a circuit board 28 inserted between the computer's main system board 104 and the floppy disc drive 102, to intercept the disc control signals and prevent access to the disc drive until a specified control sequence is received on the disc drive interface from the controlling software. This control sequence is arranged to be sent only once the user has been authenticated on the system. For this purpose a single GAL chip is used on the circuit board to intercept the control signals and to decode the enable sequence. The GAL chip may include a security fuse to ensure that its contents cannot be read out. Once the enable or disable signal is received, the GAL does not respond to any further commands. This stops experimentation by potential hackers.
Referring to Fig. 3, the IBM PC or compatible serial communication port 12 (termed COM 1 to COM 4) has 3 outputs and 5 inputs which are used to connect to data set equipment. To allow the card CLOCK and DATA signals to connect to two inputs, the adapter 16 has an electronic switch 22 which is employed to disconnect two data set inputs and connect the two card signals. The switch 22 is activated by the PC setting two of its outputs to a level which is inconsistent with normal data set equipment, i.e. Request To Send (RTS) signal = OFF and Transmit (TX) signal = ON. This condition is sensed by switch logic 24 to operate switch 22, thus connecting the card signals to the inputs Carrier Detect (CD) and Clear To Send (CTS) . The 5 volt power requirement for the card reader 14 and the electronic switch 22 is derived from the output signal Data Terminal Ready (DTR) via a voltage regulator 26. The input signals for the card reader, CTS and CD, could be any input except Receive (RX) . It is the function of a software driver program SECURITY.SYS to activate the switch by setting the defined output levels and to monitor input signals by polling the input signals and processing the changes as the card is swiped. It is possible to use interrupts instead of polling. It will be appreciated that in normal use of the computer, the communications port operates normally with any peripheral device connected to the adapter socket 20. It is only when the software calls for a security verification by setting RTS = OFF and TX = ON that the peripheral is disconnected and the card reader 14 is connected. The card itself may contain a total of 40 digits. The first digit and the last two digits are start sentinel, end sentinel and check digit respectively, leaving 37 digits which the software driver passes to a CARD CHECK program. The digits are used to identify a particular user. Data is held on the computer to define the following items for each user:-
1. Card Number
2. Privilege Level Number 3. User Name
4. PUN requirement
5. Floppy drive access permission where the following definitions are used:
CARD NUMBER: Any time the CARD CHECK program is called, it will not allow the user to continue unless this number on the card matches an entry in a preprogrammed table of numbers. As the CARD CHECK program is called at •power up', only specified cards can enable the system to operate.
USER GROUP No: After 'power up• , PCs and compatibles are capable, through the AUTOEXEC.BAT file, of executing one application directly, without input from the user. The program CARD CHECK, when used in an AUTOEXEC.BAT file, return an ERROR LEVEL number equal to this number to the AUTOEXEC.BAT file. It is possible to process this number to execute one of 9999 applications directly from •power up' .
PRIVILEGE LEVEL NO: Its main function is to provide the
ACCESS LEVEL to a program/file which has been LOCKED using a utility program LOCK.COM. Programs/files which have been LOCKED are not usable
(even when copied) unless the DRIVER returns a PRIVILEGE LEVEL equal to or higher than that applied to the program/file when LOCKED. It is also used to restrict access to the user setup program.
PUN Requirement: This defines whether or not a PUN is required for this user. Using the card and a MACHINE KEY NUMBER (pre¬ programmed) , an algorithm produces a four digit PERSONAL USER NUMBER. The CARD CHECK program can ask the user to input this PUN and a comparison is made before returning to the application. This feature may also be a KEY to unLOCK programs/files which have this key applied when LOCKED.
The software module is installed in the computer memory at 'power up' through the CONFIG.SYS file and communicates with the card reader on 'power up' and on request by an application. The software may comprise a number of files, for example a system file; an installation file and various utility files. These may be made up and operate as follows:
System file SECURITY.SYS Installation file INSTALL.COM UUttiilliittyy ffiilleess CARD.COM CARD2.COM INCARD.COM PUNCARD.COM L0CK.COM UNLOCK.COM
SECURITY.SYS: This is a system file (DRIVER) which is loaded from the CONFIG.SYS file at 'power up' . This software accepts a request via a
DOS interrupt and returns card data to the calling program when the request has been executed. Valid requests are:- 1. Return card data from the last card input.
2. Return card data from a new valid card input.
3. Ask for PUN on the last card input and return card data if the PUN is valid.
4. Ask for the PUN on a new valid card input and return card data if both the card and PUN are valid.
5. As in request 4, but returns without checking the PUN and with the PUN appended to the card data.
(A valid card is defined as having the correct User Group ID.)
INSTALL. COM: This program allows the user to define the USER GROUP IDENTITY NUMBERS and insert them into the DRIVER prior to installing on the hard disk. It also allows the MACHINE KEY NUMBER to be input and also the facility to disable a PUN input at power up. A view facility allows the user to view details on a driver already installed on disc and to create PERSONAL USER NUMBERS relative to a MACHINE KEY NUMBER.
CARD . COM: A program which, when used in a batch file, will return an ERROR LEVEL number equal to that defined as the BATCH NUMBER on the last card input. CARD2.COM: As defined in CARD.COM but returns the PRIVILEGE LEVEL NUMBER as the ERROR LEVEL. INCARD.COM: A program which requires the input of a new card before returning an ERROR LEVEL as defined in CARD.COM. PUNCARD.COM: As defined in CARD.COM but requires the input and validation of a PERSONAL USER NUMBER before returning. LOCK.COM: This program will alter fILes with the extension .EXE or .COM making them usable in an environment without a 'PC
SECURITY.SYS1 system installed. In addition it tags the file with a PRIVILEGE
LEVEL number and KEY. The KEY the file with defines how to derive the user's PRIVILEGE LEVEL when the program is executed. Security level:
KEY 01 - from last card input
02 - from a new card input
03 - from last card when valid PUN input 04 - from a new card when valid PUN input The program will execute only when the user's security level is equal to or higher than that on the TAG. UNL0CK.COM: Restores locked files to their original form. Other file arrangements may be used. Detailed implementations of software for carrying the invention into effect will be readily apparent to those skilled in the art.
The invention thus allows a conventional computer to be modified in a simple manner to provide a system with a high degree of security which may operate in a versatile manner.

Claims (7)

1. A security system for a computer (10) having at least one communications port (12) for connection to peripheral devices, the security system comprising: a card reader (14); switching means (22) connected to the card reader and connectible to the communications port, the switching means being operable to connect the card reader to the communications port in response to a command including protected routines which generate said command to cause the switching means to connect the card reader to the communications port; and, means for comparing data from a card read by the card reader with authorisation data held in the computer, to enable or disable further operation of the protected routine.
2. A system according to claim 1, wherein the switching means (22) operates to connect the card reader and a peripheral device alternatively to a single communications port (12) .
3. A system according to claim 1 or claim 2, wherein the switching means (22) is provided in an adapter (16) which includes a plug (18) for connection to a communications port socket (12) , a socket (20) for receiving a peripheral device plug, and a cable connection (19) to the card reader.
4. A system according to any of claims 1 to 3, wherein the card reader is a swipe reader having two of the three standard outputs i.e. CLOCK negative logic and DATA negative logic, the two outputs connecting, in use, to two inputs in the computer via the switching means, whereby the inputs in the computer (which usually connect with two data set inputs) may be controlled by the switch means.
5. A system according to any of claims 1 to 4, wherein the means for comparing data from a card read by the card reader with authorisation data held in the computer, comprises software held, in use, in the computer.
6. A system according to any of claims 1 to 5, further including means (28) for preventing access to floppy disc drives on the computer, the means comprising a circuit board insertable between the computer's main system board (30) .and its floppy disc drive (32), to intercept the disc control signals and prevent access to the disc drive until a specified control sequence is received on the disc drive interface from the controlling software.
7. A computer system (10) having at least one communications port (12) for connection to peripheral devices, and including a security system according to any of claims 1 to 6.
AU54172/90A 1989-04-01 1990-03-30 Computer security system Ceased AU648023B2 (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
GB8907412A GB8907412D0 (en) 1989-04-01 1989-04-01 Means of restricting access to computer files
GB8907412 1989-04-01
PCT/GB1990/000478 WO1990012357A2 (en) 1989-04-01 1990-03-30 Computer security system

Publications (2)

Publication Number Publication Date
AU5417290A AU5417290A (en) 1990-11-05
AU648023B2 true AU648023B2 (en) 1994-04-14

Family

ID=10654345

Family Applications (1)

Application Number Title Priority Date Filing Date
AU54172/90A Ceased AU648023B2 (en) 1989-04-01 1990-03-30 Computer security system

Country Status (6)

Country Link
EP (1) EP0466763A1 (en)
JP (1) JPH04504322A (en)
AU (1) AU648023B2 (en)
CA (1) CA2050573A1 (en)
GB (1) GB8907412D0 (en)
WO (1) WO1990012357A2 (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5377269A (en) * 1992-10-29 1994-12-27 Intelligent Security Systems, Inc. Security access and monitoring system for personal computer
FR2723224B1 (en) * 1994-07-28 1996-09-06 Sgs Thomson Microelectronics MEMORY OR CHIP CARD READER SYSTEM
MXPA06007549A (en) 2004-01-06 2006-08-31 Thomson Licensing Secure porting of information from one device to another.

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1988003287A1 (en) * 1986-10-24 1988-05-05 Harcom Security Systems Corporation Computer security system
US4799153A (en) * 1984-12-14 1989-01-17 Telenet Communications Corporation Method and apparatus for enhancing security of communications in a packet-switched data communications system

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS63148360A (en) * 1986-12-12 1988-06-21 Canon Inc Protecting device
FR2618926B1 (en) * 1987-10-30 1990-06-08 Microphar MEMORY DEVICE FOR CONTROLLING THE USE OF SOFTWARE, OF THE KEY TYPE

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4799153A (en) * 1984-12-14 1989-01-17 Telenet Communications Corporation Method and apparatus for enhancing security of communications in a packet-switched data communications system
WO1988003287A1 (en) * 1986-10-24 1988-05-05 Harcom Security Systems Corporation Computer security system

Also Published As

Publication number Publication date
AU5417290A (en) 1990-11-05
JPH04504322A (en) 1992-07-30
WO1990012357A2 (en) 1990-10-18
CA2050573A1 (en) 1990-10-02
EP0466763A1 (en) 1992-01-22
WO1990012357A3 (en) 1990-11-15
GB8907412D0 (en) 1989-05-17

Similar Documents

Publication Publication Date Title
US5297200A (en) Computer security system
US6643783B2 (en) Multi-level secure computer with token-based access control
US6389542B1 (en) Multi-level secure computer with token-based access control
US7000249B2 (en) Pre-boot authentication system
US6351817B1 (en) Multi-level secure computer with token-based access control
US5854891A (en) Smart card reader having multiple data enabling storage compartments
US7797729B2 (en) Pre-boot authentication system
US5836010A (en) Personal computer using chip-in card to prevent unauthorized use
US6189099B1 (en) Notebook security system (NBS)
US5841868A (en) Trusted computer system
US6038320A (en) Computer security key
USRE41092E1 (en) Data security method and device for computer modules
US6957338B1 (en) Individual authentication system performing authentication in multiple steps
US6098171A (en) Personal computer ROM scan startup protection
US20060168653A1 (en) Personal network security token
WO1998007092A9 (en) Smart card reader having multiple data enabling storage compartments
US20070006290A1 (en) USB-compliant personal key
EP0692166A1 (en) Security access and monitoring system for personal computer
US6032256A (en) Power controlled computer security system and method
US6839776B2 (en) Authenticating peripherals based on a predetermined code
KR20000068989A (en) A method of making secure and controlling access to information from a computer platform having a microcomputer
AU648023B2 (en) Computer security system
US20030028812A1 (en) Computer security during power-on self test
KR20030049387A (en) Extended smart card system and the controlling method
WO1995024698A1 (en) A secure memory card