Integrated network security system - Patent Review 5237614

Claims

What is claimed is:

1. An integrated security system for a network having a server and at least one client comprising:

means for normally locking each client to restrict in a selected way use of the client itself and use of the client in gaining access to the network;

means at the client for receiving at least one coded input from a user;

means at the client for transmitting to the server signals which are a representation of at least a selected portion of the coded input;

means at the server for utilizing the received signal representation to authenticate the user, for retrieving unlock inputs for the user and, when the user has been authenticated, for sending to the client signals representative of the unlock inputs; and

means at the client for utilizing the unlock input signals to unlock the client.

2. A system as claimed in claim 1 including means at the client for saving a selected portion of the coded input, said means for transmitting transmitting signals which are a representation of the remaining portion of the coded input.

3. A system as claimed in claim 2 wherein the coded input from the user includes the current value of a dynamically varying non-predicatable number generated by a device in the possession of the user;

wherein signals indicative of a client ID are transmitted to the server with the representation signals; and

wherein the means to authenticate at the server includes means for using the client ID signals to retrieve appropriate representation signals for the user, and means for matching the retrieved representation signals with the transmitted representation signals to authenticate the user.

4. A system as claimed in claim 3 wherein the user has a PIN which is inputted into the device by the user and combined in a selected way in the device in producing the non-predictable number inputted by the user.

5. A system as claimed in claim 3 wherein the user has an alpha numeric PIN (AN-PIN), wherein the coded input from the user includes the AN-PIN, wherein a selected portion of both the non-predictable number and the AN-PIN are saved at the client, and wherein remaining portions of the non predictable number and the AN-PIN are combined in a predetermined way to produce the representation signals transmitted to the server.

6. A system as claimed in claim 2 wherein, when the client is locked, at least selected material stored at the client is stored in encrypted form, and wherein the unlock inputs sent to the client include a decryption key for said selected material.

7. A system as claimed in claim 6 wherein the server includes means for transmitting an encryption key to the client after user authentication; and

wherein the client includes means for utilizing the encryption key the next time the client is to be locked to encrypt said selected material.

8. A system as claimed in claim 7 wherein the means at the client for encrypting includes means for combining the transmitted encryption key from the server with at least a portion of the coded input saved at the client to product an encryption key for the selected material.

9. A system as claimed in claim 8 wherein the user has a device which generates a dynamically varying non predictable number which is unique to the user, the coded input from the user including the current non predictable number from the device.

10. A system as claimed in claim 9 wherein the device includes a user controlled means for generating a second non-predictable code for the user which may also form part of said coded input; and

wherein the client includes means for combining the second non-predictable code with the transmitted encryption key to product a longer encryption key for the selected material.

11. A system as claimed in claim 7 including means for running the encryption key, at least a portion of the stored coded input and selected non-secret data through a one-way function to obtain a longer encryption key.

12. A system as claimed in claim 2 including means for passing all of the coded input from the user through a one-way function, the transmitted representation signals including at least a sufficient portion of the output from the one-way function to assure that all of the coded input is correct when authentication occurs at the server.

13. A system as claimed in claim 1 including means for utilizing selected data, including at least a portion of the coded input from the user, to generate an encryption key, means for utilizing at least a portion of said encryption key for end-to end encryption of communications with the client, and means for utilizing at least a portion of the encryption key to encrypt at least selected material at the client when the client is locked.

14. A system as claimed in claim 13 wherein the portion of the encryption key utilized for end-to-end encryption and the portion utilized for encryption on client locking are not identical.

15. A system as claim in claim 1 including means at the client for running at least a portion of the coded input and selected non-secret data through a one-way function to obtain a value having more characters than the coded input, which value may be utilized as all or a portion of an encryption key.

16. A system as claimed in claim 1 wherein selected material required to operate a client is zeroized at the client when the client is locked and is transmitted in encrypted form to be stored at the server; and wherein the server includes means operative when the user has been authenticated for retransmitting the stored encrypted material to the client along with a decryption key.

17. A system as claimed in claim 1 including means responsive to selected conditions at the client for locking the client.

18. A system as claimed in claim 17 wherein one of said selected conditions is a discourteous disconnect of the client.

19. A system as claimed in claim 17 wherein one of said selected conditions is an end-of-session input from the user.

20. A system as claimed in claim 17 wherein one of said selected conditions is there being no activity by the user at the client for a selected time interval.

21. A system as claimed in claim 17 including means for storing a release code at the client, and means responsive to the release code for inhibiting the full locking of the client in response to a selected condition.

22. A system as claimed in claim 21 wherein said means for inhibiting permits the locking of the client from access to the network, but permits at least the selected continued use of the client.

23. A system as claimed in claim 21 wherein the client may generate or receive selected protected files, each of which contains a protection flag, and means responsive to the detection of a protection flag for preventing use of the protected file at the client after one of said selected conditions has occurred.

24. A system as claimed in claim 23 wherein said means for preventing use of the protected file includes means for removing or reducing the release code so that the client cannot access the file after a selected condition occurs.

25. A system as claimed in claim 23 wherein said means for preventing includes means for encrypting or zeroizing the protected file at the client when a selected condition occurs.

26. A system as claimed in claim 25 including means for indicating if the protected file may be written into at the client, and including means responsive to an indication that a protected file may be written into for transmitting the protected file to the server prior to zeroizing the file.

27. A method for providing integrated security on a network having a server and at least one client comprising the steps of:

normally locking each client to restrict in a selected way use of the client itself and use of the client in gaining access to the network;

receiving at the client at least one coded input from a user;

transmitting signals which are a representation of at least a selected portion of the coded input from the client to the server;

utilizing the received representation signals at the server to authenticate the user, to retrieve unlock inputs for the user and, when the user has been authenticated, to send the unlock inputs to the client; and

utilizing the unlock inputs at the client to unlock the client.

28. A method as claimed in claim 27 including the step performed at the client of saving a selected portion of the coded input, the representation signals transmuted during the transmitting step being of the remaining portion of the coded input.

29. A method as claimed in claim 28 wherein the coded input from the user includes the current value of a dynamically varying non-predictable number generated by a device in the possession of the user;

wherein signals indicative of a client ID are transmitted to the server with the representation signals; and

wherein the authenticating step at the server includes the steps of using the client ID signals to retrieve the appropriate representation signals for the user, and matching the retrieved representation signals with the transmitted representation signals to authenticate the user.

30. A method as claimed in claim 29 wherein the user has a PIN which is inputted into the device by the user and combined in a selected way in the device in producing the non-predictable number inputted by the user.

31. A method as claimed in claim 29 wherein the user has an alphanumeric PIN (AN-PIN), wherein the coded input from the user includes the AN-PIN, wherein a selected portion of both th