Logon authentication and security system and method

Details Logon authentication and security system and method Logon authentication and security system and method

1999-04-12

2003-04-01

Hua, Ly V. (Department: 2131)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

C713S152000

Reexamination Certificate

active

06542994

ABSTRACT:

MICROFICHE APPENDIX
This application includes a microfiche appendix having 5 sheets and 233 frames. A portion of the disclosure of this patent document contains material which is the subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
BACKGROUND OF THE INVENTION
1. Field of the Invention
The invention relates to personal computer software which requires the user to logon. More specifically, the field of the invention is that of security system software for authenticating users of a personal computer.
2. Description of the Related Art
Security for personal computers is becoming an issue of greater importance to computer users. Whether the objective is to prevent unauthorized access to network resources or to prevent alteration of data stored by the personal computer, known operating systems conventionally have a user logon screen which appears to the user as the first action of the operating system, prompting the user to enter a user name and password. In fact, many known operating systems perform many functions before the appearance of the logon screen. Although the logon screen appears to require both the user name and password, the operating system often does not require those items for security purposes. Rather, the user name and password are used to determine whether personalized software configuration settings or a default configuration are imposed, and often such a logon window may be augmented or replaced by other software. The conventional operating system expects that a logon user name and password logon file, even if no values were entered in the logon window, will be stored at a predetermined location and certain features of the operating system will not operate if the logon file does not exist.
FIG. 2
shows a prior art conventional operating system initialization process. Upon power on or re-booting, Start-up
200
proceeds directly to primary Registry process step
202
. In this step, the operating system is installed as the primary process in the Registry so that the operating system sequence commences. The Registry is used to maintain a list of the various processes which are concurrently executing on the computer. Conventionally, the operating system is entered as the “primary process” and has precedence over all the other processes in the multi-tasking environment. All other processes are secondary processes, and can be interrupted, terminated, or otherwise controlled by the primary process.
Logon Box step
204
involves presenting the user with authentication fields, such as for a user name and password, which the user may choose to by-pass. Logon Box step
204
also includes storing an authentication file, or a .pwl file, on the local disk storage to record the successful completion of the Logon Box process. In step
206
, the operating system checks the .pwl file, and if it exists proceeds to step
208
to run the operating system. If the .pwl file is not found, then further execution of the operating system is suspended until the next power on or re-boot.
However, one potential problem with such conventional systems is the possibility of the user, through operation of the keyboard or other input device, can circumvent the initial logon sequence to avoid security or authentication procedures. With some operating systems, for example the GINA (Graphical Identification aNd Authentication) of the Windows NT operating system of Microsoft Corporation, provide a security and authorization capability that prevents the user from escaping the security and authentication procedures. However, in other conventional operating systems, such as the Windows, Windows 95, and Windows 98 operating systems of Microsoft Corporation, the user may manipulate and avoid any security or authentication procedures by using the keyboard to break out of the initial start-up functions of the operating systems. This potential problem with such conventional, non-GINA operating systems diminishes the security and authentication procedures which may be relying on the logon sequence. For example, authentication may be provided by biometric devices like fingerprint or retina scan, or smart card or other authentication technology that expects that the logon sequence is inviolate.
In order to secure the computer system, the logon sequence must be uninterruptable to allow the completion of the authentication procedures, while returning basic operations over to the control of the operating system after the logon sequence. This imposes two significant problems for programming systems that can accomplish these disparate goals. First, the logon sequence must be protected to prevent the circumvention of the authentication system. Second, the authentication device and process must allow the operating system to continue unabated. Conventional systems include difficulties in one or both of these areas.
What is needed in the art is a software system which secures non-GINA operating systems so that authentication devices cannot be overridden or ignored during the logon sequence.
SUMMARY OF THE INVENTION
The present invention is a logon authentication system and method which provides integrity and security to the logon process for a personal computer or workstation. The invention provides a methodology that allows the authentication system to maintain control of the operations of the personal computer during the authentication procedure, and allow the unimpeded operation of the logon sequence after the operation of the authentication device so that the operating system may continue operation. The invention allows these operations without altering how a user works on the desktop, or the capacities of the underlying operating system or network.
The personal computer software includes a conventional operating system lacking a GINA type logon procedure. Within the software of the personal computer, the invention operates to install the authentication software as the primary provider program on the personal computer. As the primary provider program, the software of the invention can allow many types of authentication devices to operate without allowing any outside forces to interrupt the logon process. Then the software of the invention can return control to the conventional operating system with the logon file properly stored.
The present invention, in one form, relates to a method of authenticating the identity of a computer user for a computer. The computer has an operating system which includes a registry of processes and requires a secure acknowledgment of the user on the computer. A security process is established as the primary process of the registry previous to starting or restarting the computer operating system. An authentication procedure is enabled on the computer by the security process. The security process stores a secure user acknowledgment which is acceptable to the operating system. Finally, the computer operating system can begin execution.
The present invention, in another form, is a computer system including a computer system having an operating system, an authenticating device, and a security process. The computer includes a processor and memory capable of storing instructions and data. The operating system resides on the computer and includes a registry of processes and software preventing computer operations unless a user acknowledgment is present on the computer. The authenticating device ascertains the identity of the computer user. This security process resides on the computer, and has several components. The security process establishes itself as the primary process of the registry previous to starting or restarting the operating system, enables the authenticating device, and stores a user acknowledgment which is acceptable to the operating system.
Other aspects of the invention relating to masking off interrupts previous to enabling the authenticat

Affiliated with

Also associated with

Rating

Logon authentication and security system and method does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Logon authentication and security system and method, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Logon authentication and security system and method will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3108954