Computer Communications Control

The present invention relates to access control within data processing environments and more particularly to access control apparatus whereby telephone "dial" and other electronic access into a computer is restricted to a predeterminable and physically controllable set of terminal apparatus.

In data processing environments (sometimes referred to as "systems"), control of access into the host computer is desirable, and often practically necessary, in order to ensure privacy of stored information, reduce risk of capricious or malicious manipulation, erasure or other damage of stored information, and also to reduce risk of theft of computing resources and assets, e.g., programs and "computer time". Heretofore, attempts have been made to control access into computers in data processing systems by means that restricted access to certain individuals (persons) who had been provided certain specific information, such as passwords. Although this type of approach of basing control on restriction of the number of persons who have password knowledge to achieve access is a reasonable and sometimes successful technique, it does not address problems of restricting the number of places from which access can be accomplished. And so it is that individuals with broad security knowledge and working capability for terminal and computer operation, such as systems programmers, are able to access into computer resources under improper or illegitimate circumstances, such as during late-hours from home-built terminals tapping into telecommunications facilities. And it is of course understood that as a practical matter, computer system security is a desirable ideal that may not be completely 100% attainable and even if nearly attainable, perhaps by highly sophisticated means, e.g., special cryptographic apparatus, the expense is still of major consideration. An important ingredient in the computer security problem is providing useful tight security with relatively low-cost, commercially producible and operable apparatus that is not unsatisfactorily vulnerable to circumvention or duplication by readily available means.

There has now been discovered a new means of protecting information in data processing environments.

An object of the invention is to provide new apparatus for restricting electronic access into a computer in a data processing system.

Other objects and benefits of the invention are apparent from the following description and accompanying drawing wherein:

FIG. 1 depicts a data processing system incorporating security apparatus of the invention; and

FIG. 2 portrays a schematic diagram for security locking apparatus of the invention.

The present invention contemplates electronic circuit apparatus for generally refusing electronic entry into the host computer of a computer-terminal data processing system and for subsequently providing an entry path only upon being furnished certain electronic information demonstrating a request for entry to be coming from a known terminal that is an authorized member of the system. The access control apparatus at the host site serves, and may be referred to, as a "lock", and yet, it has the advantage of being a lock in the negative sense of being a void that does not provide an entry path, and thus is not dependent on maintaining a barrier (which might be breakable). The access controller, functioning between the host and the modem link to a switched-carrier network, monitors incoming signals, requests replies, examines replies and discriminates among replies and then serves to activate disconnect circuitry and entry path circuitry according to propriety of replies. Also, the apparatus has reset circuitry for electronically returning to the normal wait state after communications are terminated. Upon detecting that a connection has been established over a carrier network, e.g., a telecommunications facility, the lock unit issues an enquiry sequence of bits to the remote end of the line and waits for a reply message. If no reply arrives within a predetermined time, the modem link is disconnected. And, in the event that a response is received and fails to qualify as a proper reply from a member terminal, the lock unit sends a signal to the host modem to disconnect the network link. And, alternatively, in the event of finding that a proper response has been received, thus demonstrating the source to be an authorized member terminal of the system, then the lock activates a transfer of subsequently received signals to the computer input position and also provides for transferring computer output signals to the linking modem, thus providing access with the member terminal. For recognition by the lock, member terminals are specially provided with response apparatus capable of transmitting specialized confidential code signals complying with a preset specialized sequence stored in a ROM (read only memory) in the locking apparatus--the controller. Thus, analogously, digital code signal keys are transmitted from member terminal to computer lock. And inasmuch as computer access can be restricted to only those terminals having corresponding key transmitters, access control can be facilitated by physically guarding against unauthorized operation of the keyed terminals. Yet, when the transfer path has been engaged by reception of the key signal sequence, then the lock and key units pass both control and data signals between terminal and computer without change, just as if both devices (lock and key) did not exist.

The key unit has memory and comparator circuitry for storing and examining security code information and responding to proper inquiries. ROM types are advantageous for safeguarding against tampering. However, where desired, Read/Write types, e.g., EPROM, can be used to enable accomplishing authorized changes, such as updating, by electronic control from a remote facility, possibly the host computer.

Turning now to the drawing, FIG. 1 depicts secured data processing system SDPS arranged for enabling telecommunication between host computer I and member terminal II through host access-control unit (or device) III, host modem IV, switced-carrier network V, terminal modem VI and terminal access-control device VII. Unit III is joined communicatively to computer I with multipin DTE (data transmitting element) connections 100A&B, and unit VII is joined to terminal II with DTE, connectors (110A&B), as shown in FIG. 1. Also, unit III is joined to modem IV with multipin DCE (data communication element) connectors 150A&B, and unit VII is joined to modem VI with multipin DCE connectors 160A&B; cables lead between connector pairs. The connectors can be commercially available standard types, e.g., RS-232.

FIG. 2 schematically depicts circuitry of access controller III with leads to pins of DCE connector 150A and DTE connector 100A. The signals which are to be used or altered are converted to appropriate representations by level converters 10, 11, 12, 13, 14, 15, 16 and 17 functioning in communication paths to and from central logic unit (CLU) 18 and connectors 100A and 150A. Essential charge storage elements in which are placed the representative sequence bit codes that correspond, in analogy, to the notches in a key and the pins in a lock, and control circuitry for directing output signals to connectors 100A and 150A, and also auxiliary circuits to visual indicators, e.g., colored lights 19, 20 and 21 via power buffers 22, 23 and 24 are contained in CLU 18. Commercially available microcomputers installed in the access controller can perform the functions required of the CLU component in access controllers of the invention. For example CLU 18 is an INTEL 8748 single-chip computer with oscillator crystal 25 for timing and I/O ports as indicated by P-numbers. Functioning of controller III can be manually overridden by operation of reset switch 26, which resets the controller to the normal wait state of holding alert for reception of signals indicating incoming request for entry into the computer.

In operation, messages dialed or otherwise addressed to the host are processed from carrier network V thru modem IV and transmitted to access controller III at pin 8 on DCE connector 150A. Thus, reception at the host controller of a signal via DCE150A pin 8 through level converter 16 indicates that a communication link has been established. A host enquiry sequence of bits is then sent from CLU 18 to DCE150A pin 2 via level converter 14. This sequence of bits is then transmitted over switched-carrier network V, with modulate/demodulate processing appropriately in modems IV and VI, to remotely located terminal II. The bit sequence is coded to elicit a response from controller VII but not from any standard terminal apparatus. Moreover, it is desirable that the enquiry sequence be sufficiently specialized to avoid triggering responses from any other known apparatus that may be in communication with the network.

After transmitting its enquiry sequence, the circuitry in CLU 18 switches to the receive state to monitor any incoming signals on DCE150A pin 3 via level converter 15. Any signals so received are then examined in comparison to an ROM built into CLU 18 to verify or deny the correctness of a bit sequence signaling proper response by terminal II.

For the present example, the bit sequence signals are in forms of predetermined but not necessarily fixed sequences of high and low voltage values occurring at predetermined but not necessarily fixed time intervals, e.g., sequences having 5 highs in the enquiry sequence and 31 highs in the response sequence at intervals varying in the range of 3.3 to 200 milliseconds. The memory is an MOS ROM in an INTEL 8748 microcomputer serving as CLU 18.

When a discrepancy occurs between response signals received and those expected in view of the memory stored in CLU 18, then a disconnect signal is issued by CLU 18 to DCE150A pin 30 via level converter 17. This disconnect signal shuts-off modem IV, e.g., applies a negative voltage to open a relay in the modem, thereby breaking the communications link and denying access to computer I.

Also, if no response is received within a predetermined wait period, e.g., 0.5 seconds, the disconnect signal breaks the communication link.

Alternatively, if the signal received in response is verified as proper, which occurs with proper correspondence to the code reply sequence stored in the CLU memory, then CLU 18 issues an "authorized link established" signal to DTE100A pin 8 via level converter 12. Subsequently, all signals thereafter received on DCE150A pin 3 are transferred to DTE100A pin 3 via CLU 18 and level converters 15 and 11. And also upon establishment of the authorized link, all computer output signals received on DTE100A pin 2 are transferred to DCE150A pin 2 via CLU 18 and level converters 10 and 14. In conjunction with this link establishment, CLU 18 provides visual indication of operational status by sending signals to light emitting diodes 19, 20 and 21 via power buffers 22, 23 and 24. Indicators 19, 20 and 21 show colors of red, yellow and green, thereby indicating status conditions of: (a) Non-secure; (b) Identity issued; and (c) Secure communication in progress.

For communication with the host, remote terminal II is joined to access control unit (accessor) VII with DTE connectors 110B and 110A having multiple pins numbered as on DTE connectors 100A and 100B. Accessor VII communicates with network V thru modem VI via DCE connectors 160A and 160B pins with numbers corresponding to pins on DCE150A and DCE150B. The remote accessor performs functions complementary to those of controller II and has corresponding components therefor, including a solid state microcomputer logic part referred to as CLU-TE (not shown). After sending a signal addressed to host computer I, and then upon detecting a signal on pin 8 of DCE160A, the logic component (CLU-TE) in the accessor switches into a receive state for monitoring signals on DCE160A pin 3. When, and provided that, the next received signals correspond to the host enquiry sequence, a duplicate of the stored reply sequence is sent in response by accessor VII. Then, as mentioned in describing operation of host controller III, reception of the proper reply from accessor VII results in issuance of an authorized-link-established signal to DTE100A pin 8 at the host site and, consequently, at both host and terminal sites the logic components switch so that signals received on DCE pin 3 are transferred to DTE pin 3 and signals received on DTE pin 2 are transferred to DCE pin 2, thereby providing two-way access for terminal and computer.

Similarly to the host controller, the accessor has light emitting diodes and power buffers for providing visual indications of status.

The present invention is particularly useful for avoiding establishment of undesirable electronic access into a host computer from an unauthorized terminal facility while yet providing for establishment of desired two-way communication between host and previously authorized terminal(s). Also, the invention is considered possibly useful for providing additional restricted "sign-on" capabilities.

Although the present invention has been described in conjunction with preferred embodiments, it is to be understood that modifications and variations may be resorted to without departing from the spirit and scope of the invention, as those skilled in the art will readily understand. Such modifications and variations are considered to be within the purview and scope of the invention and appended claims.