Security access and monitoring system for personal computer

What is claimed is:

1. A method for controlling user access to a computer having a processor, a system timer, a system memory, and at least one input/output (I/O) device connected to said processor, said processor being directed by interrupts for execution of interrupt services and said computer further including a key device connectable to said processor for removably coupling data to said processor indicating a user identification, said method comprising the steps of:

storing in said system memory a data file of at least one authorized user identification;

capturing a system timer interrupt;

connecting said key device to said processor;

responsive to said system timer interrupt, periodically reading said user identification from said key device and comparing said read user identification with said stored authorized user identification; and

disabling said at least one I/O device when said read user identification fails to match said stored authorized user identification.

2. The method of claim 1 wherein said user identification fails to match said stored authorized user identification when said key device is disconnected from said processor.

3. The method of claim 1 further comprising the computer-implemented step of:

storing said user identification in an audit trail data file of said system memory when said user identification fails to match said stored authorized user identification and said user identification data is coupled to said processor.

4. The method of claim 1 further comprising the computer-implemented step of storing said user identification in an audit trail data file of said system memory when said user identification matches said stored authorized user identification.

5. The method of claim 3 or 4 further comprising the computer-implemented step of storing in said audit trail data file the date and time of said coupling of said user identification data.

6. The method of claim 1 further comprising the computer-implemented steps of:

following said disabling of said at least one device and responsive to subsequent system timer interrupts, periodically reading said user identification from said key device and comparing said read user identification with said stored authorized user identification; and

enabling said at least one I/O device when said read user identification matches said stored authorized user identification.

7. The method of claim 1 wherein said step of reading occurs once for each period of nine system timer interrupts.

8. The method of claim 1 wherein said at least one I/O device comprises a keyboard, said method further comprising the computer-implemented steps of:

capturing a keyboard interrupt; and

responsive to said interrupt, immediately returning execution of said processor.

9. The method of claim 1 wherein said at least one I/O device comprises a floppy disk drive.

10. The method of claim 1 wherein said at least one I/O device comprises a monitor.

11. The method of claim 1 wherein said at least one I/O device comprises one or more of a mouse, monitor, keyboard, mass storage device and communications device.

12. The method of claim 1 wherein said at least one authorized user identification comprises up to 100 separate authorized user identifications.

13. The method of claim 1 further comprising the computer-implemented step of storing an authorized user identification in said system memory corresponding to said removably coupled data of a user identification.

14. The method of claim 1 wherein said system memory includes an interrupt vector table for storing interrupt request address entries used in directing said processor execution of interrupt services, said step of capturing a system timer interrupt further comprising the computer-implemented step of replacing the interrupt timer request address entry stored in said interrupt vector table with a new address entry corresponding to an interrupt service for performing said reading, comparing and disabling steps.

15. A method for controlling user access to a computer having a processor, a system memory, a mass storage device and a disk operating system for controlling execution of said processor, said disk operating system being loaded from said mass storage device to said system memory in an initialization procedure executed in said processor that includes execution of a system start-up batch file for loading terminate and stay resident utilities into said system memory, said computer further including a key device connectable to said processor for removably coupling data to said processor indicating a user identification, said method comprising the steps of:

storing in said system memory a data file of at least one authorized user identification;

connecting said key device to said processor;

reading said user identification data from said key device and comparing said read user identification data with said stored authorized user identification data during execution of said batch file loading procedure;

suspending said execution of said batch file loading procedure when said read user identification data fails to match said stored user identification data, thereby preventing loading of said terminate and stay resident utilities into said system memory; and

continuing said execution of said batch file loading procedure when said read user identification data matches said stored authorized user identification data, thereby permitting loading of said terminate and stay resident utilities and completion of said initialization procedure.

16. The method of claim 15 wherein said initialization procedure executed in said processor includes loading of installable device drivers into said system memory and said computer includes a keyboard connected to said processor, said method further comprising the computer-implemented step of capturing a keyboard interrupt during said loading of installable device drivers to disable said keyboard responsive to said interrupt.

17. The method of claim 15 wherein said mass storage device comprises a hard disk drive and said computer further includes a floppy disk drive coupled to said processor, further comprising the computer-implemented step of disabling said floppy disk drive as part of said initialization procedure to prevent circumvention of said disk operating system loading from said hard disk drive.

18. A method for controlling user access to a computer having a processor, a system timer, a system memory, and at least one input/output (I/O) device connected to said processor, said computer further including a key device connected to said processor for removably coupling data to said processor indicating a user identification, said method comprising the steps of:

storing in said system memory a data file of at least one authorized user identification, said at least one authorized user identification including at least one administrator identification;

a user connecting said key device to said processor;

periodically reading said user identification from said key device and comparing said read user identification with said stored,authorized user identification;

disabling said at least one device when said read user identification fails to match one of said at least one stored authorized user identification; and

selectively entering at least one utility menu option when said read user identification matches said at least one administrator identification.

19. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of viewing said at least one authorized user identification stored in said memory.

20. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of adding a new authorized user identification to said data file.

21. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of deleting an authorized user identification from said data file.

22. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of displaying a user identification corresponding to said coupled data.

23. The method of claim 18 wherein said step of entering at least one utility menu option comprises the computer-implemented step of storing selected interrupts in an interrupt request mask register of said processor, said interrupts corresponding to I/O devices to be disabled in said disabling step

24. The method of claim 18 further comprising the computer-implemented step of storing an access data file in said system memory of said user identifications read by said processor.

25. The method of claim 18 wherein said step of entering said at least one utility menu option comprises the computer-implemented step of viewing said user identifications stored in said access data file.

26. Apparatus for controlling user access to a computer, said computer having a processor, a system timer, a system memory and at least one input/output device connected to said processor, said processor being directed by interrupts for execution of interrupt services, said apparatus comprising:

an input/output port coupled to said processor;

key means including data terminals for connection to said input/output port for removably coupling data to said processor indicating a user identification;

a data file stored in said system memory indicating at least one authorized user identification;

logic stored in said system memory and executed in said processor for capturing a system timer interrupt;

security logic stored in said system memory and executed in said processor responsive to said system timer interrupt for periodically reading said user identification from said key means and comparing said read user identification with said stored authorized user identification; and

said security logic for disabling said at least one I/O device when said read user identification fails to match said stored authorized user identification.

27. The apparatus of claim 26 further comprising logic stored in said system memory and executed in said processor for storing in said system memory an access data file of said user identification and a system time, corresponding to each coupling of data by said key means to said processor.

28. The apparatus of claim 26 wherein said at least one input/output device of said computer includes a mass data storage device for coupling by a device controller to said processor and for transferring data to said system memory, said apparatus further comprising:

access circuitry connected between said mass data storage device and said controller for selectively disabling said transfer of data from said mass data storage device to said system memory responsive to said security logic.

29. The apparatus of claim 26 wherein said key means comprises:

at least one electronic key having a memory for storing said user identification, control logic connected to said key memory for reading data from said key memory and for writing data to said key memory, and an a connector including control lines coupled to said control logic and a data input/output coupled to said memory;

a jack for removably receiving said connector; and

a cable connecting said jack to said processor.

30. The apparatus of claim 29 wherein said computer includes an input/output port connected to said processor and said cable connects said jack to said port.

31. The apparatus of claimed 29 wherein said input/output port comprises a parallel printer port.

32. The apparatus of claim 26 wherein said at least one input/output device comprises a keyboard.

33. The apparatus of claim 26 wherein said at least one input/output device comprises a monitor.

34. The apparatus of claim 26 wherein said at least one input/output device comprises a mouse.

35. The apparatus of claim 26 wherein said at least one input/output device comprises a modem.

36. Apparatus for controlling user access to said computer having a processor, at least one input/output (I/O) port connected to said processor, a system timer, a system memory, a mass storage device coupled by a device controller to said processor for transferring data to said system memory and at least one I/O device connected to said processor, said processor being directed by interrupts for execution of interrupt services, said apparatus comprising:

A key device for removably coupling data to said processor indicating a user identification, said key device including at least one electronic key having means for providing said user identification data and a connector coupled to said data means, a jack for removably receiving said connector, and a cable connecting said jack to said processor through said I/O port;

a data file stored in said system memory indicating at least one authorized user identification;

logic stored in said system memory and executed in said processor for capturing a system timer interrupt;

security logic stored in said system memory and executed in said processor responsive to said system timer interrupt for periodically reading said user identification from said key means and comparing said read user identification with Said. stored authorized user identification;

said security logic for disabling said at least one I/O device when said read user identification fails to match said stored authorized user identification; and

access circuitry connected between said mass data storage device and said controller for selectively disabling said transfer of data from said mass data storage device to said system memory responsive to said security logic.

37. The apparatus of claim 36 further comprising logic stored in said system memory and executed in said processor for storing in said system memory an access data file of said user identification and a system time, corresponding to each coupling of data by said key device to said processor.

38. The apparatus of claim 36 wherein said input/output port comprises a parallel printer port.

39. The apparatus of claim 36 wherein said at least one input/output device comprises a keyboard.

40. The apparatus of claim 36 wherein said at least one input/output device comprises a monitor.

Description Submit all comments and votes

FIELD OF THE INVENTION

This invention relates generally to security systems for personal computers and particularly to a system which prevents unauthorized access to programs and data in a computer and which monitors computer access and usage.

BACKGROUND OF THE INVENTION

The use of security systems for personal computers is generally known in the art. For example, U.S. Pat. No. 4,951,249 discloses a computer security system which protects computer software from unauthorized access by requiring the user to supply a name and a password during the operating system loading procedure ("boot-up") of a personal computer (PC). This is accomplished by the insertion of a special card into an input/output expansion slot of the PC. During operating system loading of the PC, the basic input/output system (BIOS) scans memory addresses of the card for an identification code, which consists of a 55AA hex code. When this hex code is located, the BIOS instructions are vectored to that address and the instructions that follow that address are executed as part of the initialization routines of the system boot-up procedure.

The special card comprises a board with a read only memory (ROM) and an address decoder, and prevents system boot-up via the PC's floppy drive by intercepting the floppy drive interrupt, so that it appears to the processor that the PC does not have a floppy drive. The keyboard is also disabled by capturing the keyboard interrupt. As a result, the PC is forced to boot-up using the software on the card.

The foregoing PC security system, which utilizes a password board, is typical of many of the systems which are currently available. Password boards require a user's name and a password associated with that user's name. Only once a password board detects a valid user's name and password does it allow the PC to complete the boot-up routine. While password boards may be useful under some circumstances, they are inadequate in many respects.

For example, password boards provide security only during initialization of the PC; they provide no security for the system should the operator leave it unattended during the day. In addition, many PCs do not have an open architecture that allows additional circuit cards to be plugged into the system. Furthermore, as personal computers get smaller there are fewer slots available for upgrading the system with graphic, memory, and coprocessor boards.

Also, password board security systems are placed between the operating system and any application that the user may run. While this method is compatible with MS-DOS and PC-DOS, it is not always compatible with Windows or other higher level operating systems. As usage of these other operating systems becomes more widespread, the password board security systems are of increasingly limited utility.

An additional limitation of password board security systems is that such systems do not enable monitoring of access and usage of the PC. Such systems do not create a record of both authorized and unauthorized attempts to access the PC which can later be retrieved by the PC owner or administrator.

SUMMARY OF THE INVENTION

The foregoing problems are solved and a technical advance is achieved by a method and apparatus for controlling access to a computer in which memory-resident software logic cooperates with a remote electronic key device coupled to the computer's processor, through the parallel printer port, to disable the computer unless an authorized user identification key is inserted into the key device. According to a departure in the art, the memory resident software logic is executed in the computer processor responsive to the computer's system timer interrupt for continuous, real time monitoring capability, so that upon removal of the authorized user identification key, one or more computer I/O devices are disabled. Upon reinsertion of an authorized user identification key, the computer resumes operation without requiring reinitialization.

Operation of the memory-resident software logic is transparent to the computer user and to the application programs because it is installed as a terminate-and-stay-resident (TSR) utility during the batch loading procedure of the computer's disk operating system. The logic continuously monitors the .parallel printer port of the computer to detect the presence of an authorized user identification key. The key is a specialized electronic device containing encrypted data used to identify each unique computer user. Until a user inserts a key which the logic determines is authorized to access the computer, or upon removal of an authorized key, the logic automatically suspends the operation of the computer I/O devices and the execution of the application programs. Additionally, the computer's video monitor screen is blanked and the mouse, the keyboard and the floppy disk drive are disabled.

Operation of the computer remains suspended until the memory-resident logic detects an authorized electronic key coupled through the parallel printer port, at which time the screen is refreshed and the previously disabled devices are enabled. Furthermore, any user application programs which were in operation at the time the electronic key was removed resume operation from the point at which operation was previously suspended.

The security system of the invention further includes logic for monitoring access attempts and use of the computer. A record of the identity of authorized user's accessing the computer and computer usage time is stored in the computer's memory. A similar record is kept of unauthorized user access attempts.

The security system recognizes two types of authorized user identification keys, which are system administrator keys and normal user keys. In one embodiment, the system of the invention includes two administrator and up to ninety-eight user keys. The administrator Key makes available to the user several utility menu options, which are unavailable to normal users. The utility menu options include facilities to add or delete user keys, to display access and usage records and to customize the number and selection of I/O devices to be disabled by the system.

In another aspect, the security system of the invention includes a floppy disk access board which attaches to the connection between the computer's floppy disk drive and the floppy disk controller. The floppy disk access board is used to disable the floppy disk drive and is controlled by the memory-resident logic. The board has special utility during the initial loading ("cold boot-up") of the computer's disk operating system because when the floppy drive is disabled, the computer is forced to boot-up its operating system from the hard disk drive, where the memory-resident logic of the invention is permanently stored. This prevents circumvention of the access procedures by loading an independent operating system that does not contain the security logic from the floppy disk drive.

In a preferred embodiment, the system of the invention includes apparatus for controlling user access to a computer having a processor, a system timer, a system memory and at least one I/O device connected to the processor, the processor being directed by interrupts for execution of interrupt services. A key device is connected to the processor for removably coupling data to the processor indicating a user identification. The key device includes at least one electronic key having a memory for storing the user identification, control logic connected to the key memory for reading data from and writing data to the key memory, and a connector including control lines for coupled to the control logic, and a data I/O coupled to the memory. The key device further includes a jack for receiving the connector, and a cable connecting the jack to the parallel printer port of the computer. A data file of authorized user identifications is stored in the computer's memory . Software logic is stored in the system memory and executed in the processor of the computer for capturing a system timer interrupt. Security logic stored in the system memory is executed in the processor responsive to the system timer interrupt for reading the user identification from the key device and comparing the read identifications with the stored authorized user identifications. The logic disables at least one I/O device of the computer when the read identification fails to match the stored identification, thereby controlling access to the computer. Access circuitry connected between the computer's mass storage device and a controller is utilized to selectively disable the mass storage device, responsive to the security logic.

An important technical advantage achieved with the invention is the ability to suspend operation of a computer by removing the user identification key and then upon reinsertion of the key, continue operation without reinitializing the computer.

Another technical advantage achieved with the invention is ready adaptability of the system to commercially available personal computers. The key device of the system is connected to the parallel printer port without disabling the printer, and the system does not require the use of an expansion slot.

Another technical advantage achieved with the invention is the ability of the monitoring facilities to create an audit record of computer user identification and access time information.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1a is a perspective view of a personal computer (PC) incorporating the security and monitoring features of the present invention;

FIG. 1b is a functional block diagram of the PC of FIG. 1;

FIG. 1c is an enlarged and partially broken-away, perspective view of a floppy disk access board and other components of the PC of FIG. 1;

FIG. 2 is a flowchart illustrating logic of an initialization routine implemented in the PC of FIG. 1;

FIG. 3 is a functional block diagram showing the connections between an electronic key and a parallel printer port of the PC of FIG. 1;

FIG. 4 is a schematic diagram of a programmable array logic (PAL) circuit of a floppy disk access board of the PC of FIG. 1;

FIG. 5 is a timing diagram illustrating the timing relationship of selected signals of the PAL circuit of FIG. 4;

FIGS. 6a and 6b respectively illustrate a functional block diagram and a state diagram (or Mealy machine) of the floppy disk access board of the PC of FIG. 1;

FIGS. 7a-7d depict the source code and JEDEC fuse list used in programming the PAL circuit of FIG. 4;

FIG. 8 is a flowchart illustrating logic of a device driver routine (LOCK-IT.SYS) implemented in the PC of FIG. 1;

FIGS. 9a and 9b are flowcharts illustrating logic of an access prevention routine (FIRMLOC.EXE) implemented in the PC of FIG. 1;

FIG. 10a and 10b are flowcharts illustrating logic of a loader routine (BLOCKIT.EXE) for loading a memory resident security routine (MRSR) and for capturing a system timer interrupt, implemented in the PC of FIG. 1;

FIG. 11 is a flowchart illustrating logic of a memory resident Interrupt 2fh routine implemented in the PC of FIG. 1;

FIGS. 12a and 12b is a flowchart illustrating logic of a memory resident security routine(MRSR) implemented in the PC of FIG. 1; and

FIGS. 13a-13f illustrate selected menu screens of system utilities implemented in the PC of FIG. 1.

DESCRIPTION OF THE PREFERRED EMBODIMENT

FIGS. 1a and 1b illustrate a personal computer (PC) 10 which is modified in accordance with the invention to prevent unauthorized access to its data and programs and which incorporates features for controlling and monitoring computer usage. The reference numeral 12 designates generally a system of the present invention for providing these controlled access and monitoring functions. The system 12 includes an electronic key 14, a jack 16, a parallel printer port adapter 18 and a floppy disk access board 20 (FIG. 1b). Although not shown, it is understood that logic routines implemented by computer program instructions in the PC 10 also comprise part of the system 12.

The PC 10 includes a microprocessor 22, a floppy disk controller 24, a floppy disk drive 26, a hard disk controller 28, a hard disk drive 30, a system memory 31, and a video controller 32. An internal data bus 34 interconnects the foregoing components in a conventional manner. Peripheral devices connected to the PC 10 include a keyboard 35, a mouse 36 and a printer 38. Lines 40, 42 and 44 respectively connect the keyboard 35, mouse 36, and printer 38 to a port 46, a port 48 and a printer port 50, respectively. Bus lines 52, 54 and 56 respectively connect the ports 46, 48 and 50 to the microprocessor 32, A line 58 connects the video controller 32 to a monitor 60. All of the foregoing components are well known and therefore are not described in further detail.

As shown also in FIG, 1c, the floppy disk access board 20 of the system 12 is connected between the floppy disk controller 24 and the floppy disk drive 26. A floppy drive cable 27 extending from the controller 24 connects to a plug connector 20a of the access board 20 and a plug 26a of the drive 26 connects to a socket connector 20b of the access board 20. The board 20 prevents loading of the disk operating system (not shown) of the PC 10 from the drive 26 and causes such loading from the hard disk drive 30, thereby preventing circumvention of the access and monitoring features of the present invention.

While not shown, in an alternative embodiment, the floppy disk access board 20 may comprise part of the floppy disk cable 27 normally connecting the floppy disk drive 26 to the floppy disk controller 24. In this configuration, the board 20 may be installed in computers where internal space limitations prevent the floppy disk access board 20 from being attached directly to the floppy disk drive 26 via the connector 26a. The floppy disk access board 20 may then be placed wherever space inside the computer permits such placement.

The parallel printer port adaptor 18 connects the printer 38 through line 44 to the port 50 and also connects the jack 16 to the port 50 through a line 62. The jack 16 may be taped, glued, or otherwise affixed to a convenient location on the PC 10 as shown in FIG. 1a, or placed in another suitable location on or near the PC 10.

The jack 16 includes one or more slots 16a-16d for receiving the key 14. The multiple slots 16a-16d are identical, it being understood that only one slot is needed