Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1998-10-07
2002-04-02
Hua, Ly V. (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C340S870030
Reexamination Certificate
active
06367017
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to information security devices, and more particularly to a method and apparatus of providing a secure authentication system utilizing a protected personal identification number (PIN) path. The present invention further relates to a method and apparatus of providing a secure authentication system using a protected personal identification data path.
2. Description of the Related Art
With the widespread use of computers, there is an increased need for controlling access to the computers and to the sensitive information stored within the computers. To provide additional security, cryptographic tokens, such as credit-card sized devices with built-in microprocessors and non-volatile memory are utilized in controlling access to computer systems. They are typically issued to a user with personalized information and private keying material and a personal access code, commonly known as a Personal Identification Number (“PIN”). The user must present a correct PIN to the card or to a device which reads the card, so as to unlock the card for operation. To compromise a card, a malicious user must be in physical possession of the card and also know the private PIN code. Since the PIN is typically entered directly into the computer, the security of such systems may still be compromised since the PIN may be captured by software specifically designed for the purpose.
One current approach to this problem is the use of an electro-mechanical device, or card reader, into which the user inserts the token. The device is, in turn, coupled to a computer. The user must enter his PIN directly into the card reader through a keypad mounted on the card reader. The card reader then verifies the PIN with the cryptographic key on the token. If the PIN is valid, a signal is sent to the computer, which authorizes access to the card's cryptographic information.
This approach however, present several disadvantages. First, the reader must provide the keypad, the keypad interface to the card reader's processor and the software for interpreting the user's entry. This feature adds to the complexity of the device and its cost. Secondly, a separate keyboard has to be used for accepting user input or commands to the computer. As a result, the user has to relocate from the keyboard to the keypad or vice versa. If repeated attempts at entering the PIN are required, such movement may prove distracting. The use of such a device is thus both awkward and expensive.
A second approach, as described in U.S. Pat. No. 5,406,624 (the “'624 patent”), involves the use of a security unit that is connected between a computer and keyboard. The security unit includes a processor which stores a number of security programs for operating the security unit, controlling attached peripherals and executing cryptographic algorithms. The security unit operates in one of two fundamental modes: a Transparent Mode in which data inputted from the keyboard to the security unit is transmitted to the computer, and a Special Handling Mode in which data entered from the keyboard is isolated from the computer so that the security unit assumes complete control of data provided via the keyboard. The Special Handling Mode in effect causes the security unit to replace the computer, executing security-related algorithms and in general, duplicating the operations of the computer in controlling the input, processing and displaying of information. The control means for selecting one of these modes involves downloading cryptographically signed software from the host computer and executing it within the security unit, or the use of a switch box connected between the security unit and the computer, which enables manual selection of the modes. In the '624 patent, security key operations are performed in the security unit. These security key operations include the verification of a program's signature, ciphering and deciphering of passwords and other like operations.
This second approach also presents several disadvantages. First, since the security and peripheral control programs executed by the security unit are of significant computational complexity, it requires a powerful processor and large amounts of memory to be effective. This processing requirement, and the control electronics for a variety of peripheral devices adds significant cost to the unit, placing it out of reach for a large number of potential users. Secondly, if the control means is implemented using down-loadable software, an additional security risk is incurred since this software comes from an external source, which could be intercepted and compromised. The '624 device attempts to guard against this risk by requiring such software to be accompanied by a signature. However, this in turn limits the usefulness of the device for those applications which do not have the proper signature, and which do not have the knowledge (or code) required to interface with the security unit's processing system. If the control means is implemented using a manual switch, the operator has to be constantly interrupted to attend to the selection of the two modes, and may often find himself committing errors which hinder the effectiveness and the security of the unit.
Accordingly, there is a need in the technology for a simple, elegant and cost-effective consumer-level method and apparatus of authenticating a password or personal identification number (PIN) independently from the computer, so that access control to one or more application programs running on the computer may be enforced, while minimizing the risk of capture of the password by unauthorized users and also minimizing the complexity of user operation.
BRIEF SUMMARY OF THE INVENTION
The present invention is a method and apparatus for controlling access to at least one program on a processing system by verifying data entered through a keyboard, while isolating the entered data from the processing system. The apparatus comprises a memory and a processor coupled to the memory. A first data path is provided between the keyboard and the processing system; a second data path is provided between the keyboard and the processor; and a third data path is provided between the processing system and the processor. When activated, the processor is operable in a first mode wherein access to the processing system via the keyboard is inhibited when data entered via the keyboard does not match data stored on the card. The processor is operable in a second mode, wherein the keyboard is coupled to the processing system so that the at least one program on the processing system is accessible via the keyboard when the entered matches the data stored on the card.
REFERENCES:
patent: 3609690 (1971-09-01), Nissman et al.
patent: 3764742 (1973-10-01), Abbott et al.
patent: 4295039 (1981-10-01), Stuckert
patent: 4376279 (1983-03-01), Perlman et al.
patent: 4501957 (1985-02-01), Perlman et al.
patent: 4598170 (1986-07-01), Poisenka et al.
patent: 4688020 (1987-08-01), Kuehneman et al.
patent: 4783798 (1988-11-01), Liebholz et al.
patent: 4797928 (1989-01-01), Dykes
patent: 4881263 (1989-11-01), Herbison et al.
patent: 4914696 (1990-04-01), Dudczak et al.
patent: 4924513 (1990-05-01), Herbison et al.
patent: 4942606 (1990-07-01), Kaiser et al.
patent: 4951249 (1990-08-01), McClung et al.
patent: 4965804 (1990-10-01), Trbovich et al.
patent: 4980913 (1990-12-01), Skret
patent: 4984272 (1991-01-01), McIlroy et al.
patent: 4995112 (1991-02-01), Aoyama
patent: 5001755 (1991-03-01), Skret
patent: 5018096 (1991-05-01), Aoyama
patent: 5048087 (1991-09-01), Trbovich et al.
patent: 5063596 (1991-11-01), Dyke
patent: 5065429 (1991-11-01), Lang
patent: 5093861 (1992-03-01), Graham
patent: 5097506 (1992-03-01), Kaiser, Jr. et al.
patent: 5204512 (1993-04-01), Ieki et al.
patent: 5212729 (1993-05-01), Schafer
patent: 5224166 (1993-06-01), Hartman
patent: 5233655 (1993-08-01), Shapiro
patent: 5297200 (1994-03-01), Murray
patent: 5313637 (1994-05-01), Rose
patent: 5327497 (1994-0
Hua Ly V.
Litronic Inc.
LandOfFree
Apparatus and method for providing and authentication system does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Apparatus and method for providing and authentication system, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Apparatus and method for providing and authentication system will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2874957