Secure Identification System

Present ways to secure use of circuits such as a computer workstation require overt actions on the part of the user, either entering a password, unlocking a machine physically, placing a token (e.g. a card, badge, button, etc.) in a reader connected to the system, or some similar operation. In environments where users frequently walk up to workstations, perform a brief transaction, and leave, any of these modes of operation is a substantial inconvenience. Where password entry is required, other people in the vicinity may be able to see what the user has typed and imitate it later. Password systems themselves are a substantial vulnerability because users are allowed to choose passwords, they typically choose weak (easy to guess) ones, and if they are assigned passwords, they are prone to write them down where they may be seen by others. Systems that avoid this problem by requiring a new password each time generally require users to carry either a special card or a list of passwords from which the user must determine the correct password to enter, another inconvenience. Further, once the act of identification is performed (e.g. the password is entered or token inserted), if the user leaves the workstation for any reason, another overt act is required to disable the workstation again: the user must log out, remove the token from the reader, etc., and, upon returning, repeat the identification process. Consequently, users frequently leave their workstations unattended after they have identified themselves, making the workstation vulnerable to abuse by others with physical access to it. Finally, all of these systems depend to some degree on installing special software and the software's correct functioning, which in turn depends on the software operating correctly and not being tampered with.

Accordingly, an object of the invention is to deter casual access to a circuit by unauthorized persons.

Another object is to do so passively and automatically, requiring no human intervention, and securing the circuits against wrongful access because of human error.

Another object is to deter casual access in work environments where centralized control of access, or continuous guarding against unauthorized access, is not possible.

Another object is to prevent spoofing of the circuit from casually obtained information, e.g. visual or aural information left carelessly insecure.

Another object is to prevent access to a circuit by any means simpler than direct physical altering of the circuit.

Another object is to permit the circuit to operate while externally accessible.

In accordance with these and other objects made apparent hereinafter, the invention concerns a system having a first circuit and a second circuit spatially mobile with respect to one another, and a third circuit having an input/output portion. The first and second circuits are in periodic communication with one another within a preselected spatial range, and the second circuit uses this communication to identify whether the first circuit is a preselected approved circuit. Upon failure to identify an approved circuit within a preselected time, the second circuit disables the input/output portion of the third circuit.

In so doing, the invention passively and automatically deters access to the third circuit (e.g. a computer workstation, or a decentralized collection of workstations) by anyone not in possession of a preselected approved circuit, deterring casual access to the third circuit, and does so without requiring any software specific to the third circuit (i.e. no security software on the computer). Because there are no visual user identification codes to key in before gaining access to the third circuit, the invention prevents spoofing the system because of human error, such as having left one's codes lying about where an unauthorized user could see them, or by having chosen weak passwords. Only physical intrusion into the second circuit would permit an unauthorized user to gain access, which is something that would be readily spotted and dealt with in most work areas. Because the invention necessarily disables only the input/output of the third circuit, the third circuit could still operate in isolation (e.g. running programs internally), saving lost work time.

These and other objects, features, and advantages are further understood from the following detailed description of particular embodiments of the invention. It is understood, however, that the invention is capable of extended application beyond the precise details of these embodiments. Changes and modifications can be made to the embodiments that do not affect the spirit of the invention, nor exceed its scope, as expressed in the appended claims. The embodiments are described with particular reference to the accompanying drawings, wherein:

FIG. 1 is a block diagram illustrating an embodiment of the invention.

FIG. 2 is a flow chart illustrating operation of the embodiment of FIG. 1.

FIG. 3 is a schematic drawing illustrating an embodiment of the invention adapted for use with a personal computer, computer workstation, and the like.

FIG. 4 is a plan view illustrating a circuit board which was for use as the above mentioned second circuit.

FIG. 5 is a plan view illustrating the layout of a token useable as the above mentioned first circuit.

With reference to the drawing figures, wherein like numbers indicate like parts throughout the several views, FIG. 1 shows a first circuit 12, a second circuit 18, and a third circuit 28, in which the first and second circuits are spatially distant from one another. First circuit 12, for convenience called the "agent," has a transponder 16 for communicating with transmitter/receiver 22 of second circuit 18, the latter called the "detector" for convenience. Transmitter 16 and 22 are disposed to permit communication between agent 16 and detector 18 over limited distances. The transmitters are illustrated in FIG. 1 as antennas internal to each of circuits 16 and 18, and they preferably are so in order to permit free relative movement between agent 16 and detector 18 within the range of transmitters 16, 18, although one could practice this embodiment with physical wires disposed between circuits 12 and 18 to permit communication, so long as the wires permitted relative movement between the two circuits.

Agent 12 and detector 18 preferably have respective processors to direct these circuits, and direct communications sent from these circuits, in a manner discussed below. The processors are preferably programmable externally to permit greater flexibility in the use of these circuits. Detector 18 communicates to third circuit 28, and via link 2,6 to electronic interlock 32. Communication line 30 permits circuit 28 to communicate to one or more external circuits 33, with arrows 31a and 31b indicating that the communication between circuits 28 and 33 may be bi-directional. Interlock 32 is disposed to selectably permit or block communication along line 30 and may also disconnect power from circuit 28. Data line 30 may, of course, be a plurality of wires, data links, multiplexed lines, etc.

In operation, agent 12 and detector 18 periodically communicate with one another via transmitters/receivers 16 and 18 when the two circuits are within each other's spatial range. Processor 20 of detector 18 uses this communication to authenticate agent 12, i.e. identify whether agent 12 is an approved circuit, which, for example, could indicate that agent 12 corresponds to an electronic device given an approved user of circuit 28 to identify the user to detector 18. Upon favorable identification by processor 20, detector 18 opens interlock 32 to permit external access to circuit 28 via line 30. If detector 18 cannot authenticate agent 16 as a valid circuit within a preselected time, or agent 16 is out of communication range for the preselected time, detector 18 signals interlock 32 via link 26 to shut off communication along line 30, isolating circuit 28 from external communication. If detector 18 still cannot identify presence of a valid circuit within a further preselected time, detector 18 can preferably send a signal to shut down circuit 28, typically by disconnecting its power.

FIG. 2 illustrates a preferred way to operate the system of FIG. 1. Initially, interlock 32 is set to isolate circuit 28 from communication line 30 and circuit 28 is shut down. Agent 12 sends an identification signal (34) which detector 36 receives and tests for authenticity (36). If not authentic, detector 36 takes no further action (38) and circuit 28 remains isolated and shut down. If authentic, however, detector 18 logs on the authenticated user (37) and turns on circuit 28 (39), and causes interlock 32 to enable external input/output (39) between circuits 28, 33. Thereafter, processor 20 uses its timer to wait a preselected time (42), called the polling period for convenience, after which it causes transmitter 22 to send out a polling signal (48). If transmitter 16 of agent 12 is within range, it receives the polling signal, which processor 14 recognizes and responds with a signal identifying agent 12 to detector 18. If detector 18 authenticates the signal as from the logged in user/circuit (50), it maintains input/output enabled (46) and waits another polling period (42), whereupon detector 18 sends another poll (48) and repeats steps 42, 46, etc. If, however, detector 18 does not authenticate the signal (50), such as would happen if a user carrying agent 12 moved out of range and someone were then to send a spoofing signal, or if detector 18 does not receive any signal (50), detector 18 determines how long it has been since receiving a valid response (52). If not longer than some preselected time in excess of the polling period, detector 18 continues to send polls (52, 42). If longer, detector 18 disables input/output 30 (58), but still continues to send poll signals (60, 62). This preselected time is preferably short, e.g. three consecutive passes through decisions 50, 52, preferably as counted by processor 20. If detector 18 receives a response from its polls which detector 18 authenticates (64), it enables input/output 30 again (40, 63), and proceeds as before. If not, detector 18 times the period since having received an authentic poll response and determines if this idle time exceeds a preset limit (66). Before exceeding this time limit, detector 18 continues to poll for valid users (60, 62, 64); after exceeding this limit, it shuts down circuit 28 (68), waits for a time (69), and then waits again for a valid user ID (71, 34).

The value of this scheme is illustrated by the embodiment of FIG. 3, in which the circuit 28 is a personal computer/work station (for simplicity, hereafter "computer"), and external circuit 33 is, collectively, keyboard 33.sub.k, computer mouse 33.sub.m, and monitor 33.sub.M ; and input/output link 30 is collectively the cables 30.sub.k, 30.sub.m, and 30.sub.M, which are the connections between computer 28 and, respectively, keyboard 33.sub.k, mouse 33.sub.m, and monitor 33.sub.M. These cables connect to detector 18 via a plurality of connectors 29, and, through detector 18, connect to computer 28. Internal to detector 18 is interlock 32 (not shown in FIG. 3), which permits detector 18 to mediate communications between circuits 28 and 33 as above described. Being internal, and detector 18 being physically attached to computer 28, ensures that once interlock 32 isolates computer 28 from input/output with peripherals 33.sub.k, 33.sub.m, 33.sub.M, one can access computer 28 only by valid use of agent 12, or by physically separating detector 18 from computer 28 and rewiring the peripherals to computer 28. This sort of intervention would be readily apparent in the sort of normal workplace where one would expect to find personal computers or workstations, and thus presence of detector 18 inherently deters unauthorized users from casually gaining access to computer 28. In this embodiment, agent 12 is shown as a small token which can be hand held, and put in a user's pocket or on key chain for convenience. Token 12 is located within range D over which it and detector 18 can effectively communicate, and in which token 12 can receive and respond to polls from detector 18.

In the embodiment of FIG. 3, the input/output devices which are disenabled by detector 18 are strictly those which the casual user would need for casual access to computer 28. In principle, one could also wholly isolate computer 28 which would also entail disconnecting computer 28's parallel and serial ports, and any other data ports which the computer may have. This, however, is not preferred because the invention seeks to secure computer 28 against wrongful access by the casual user. Doing more would likely disrupt work which a valid user would want continued in his absence, for example work which requires access to a data base in a central computer via an intranet, general access to the internet, access to e-mail, etc.

The polling time in the embodiment of FIG. 3 is preferably on the order of seconds in order to permit relatively rapid isolation of computer 28 upon, e.g., a user taking token 12 outside range D. The time thereafter in which detector 18 will keep computer 28 operating is preferably on the order of hours to permit a user to have longer absences from computer 28, e.g. lunch, without disturbing the user's work, which could be running on computer 28 despite its input/output being locked out. The idle time limit set in detector 18 preferably would be set to result in longer absences causing detector 18 to log out the user, freeing computer 28 for use by any other valid user. Absence of an authenticated polling response for several hours, such as one would expect occur after normal work hours, preferably would cause detector 18 to shut down power to computer 28. Of course, processor 20 will preferably permit these times to be configurable.

FIG. 4 shows an embodiment of the control portion of detector 18, in the form of a circuit board layout in the manner in the manner of detector 18 above described. Processor 20 can advantageously be a complex programmable logic device (CPLD), such as XILINX Corporation models 9536 or 9572. This particular model was chosen because of its commercial availability, ease in programming, and established track record. Connector 81 permits access to processor 20 for initial setup. Test header 82 permits direct external access to processor 20 for diagnostic testing. During operation, the voltages on the pins of header 82 are preferably monitored so that absence of an expected voltage can detect and alert users to physical tampering with detector 18. Connector 83 provides power to circuit board 18, and relays 70, 72, 74 connect monitor .sup.33 M to computer 28 responsive to commands from processor 20, the three relays corresponding to the red, green, and blue color feed needed by monitor 33.sub.M to synthesize monitor colors. Diodes 70', 72', and 74' are respectively associated with these relays, and prevent inductive spikes from any of the relays' coils from damaging processor 20. Relays 76 and 78, along with their associated diodes 76' and 78', similarly connect mouse data signal 33.sub.m and keyboard 33.sub.k to computer 28 under the command of processor 20. Preferably, power connector 83 feeds power to computer 28 also, so that a power failure to board 18 also will cause a power failure to computer 28, maintaining its security. Header 86 connects external transmitter/receiver 22 (not shown in FIG. 4) with the circuit board, and ultimately processor 20. Timers 555.sub.1, 555.sub.2, and 555.sub.3 each have associated RC networks R.sub.1 and C.sub.1, R.sub.2 and C.sub.2, and R.sub.3 and C.sub.3. In accordance with its programming, processor 20 sets the bias potential for each of the timers, and at selected times causes C.sub.1, C.sub.2, or C.sub.3 to charge. Thus, for example, at the beginning of a polling period, processor 20 causes capacitor C.sub.1 to charge, with the characteristic time constant proportional to R.sub.1 C.sub.1. As the potential across capacitor C.sub.1 rises, it eventually reaches the bias potential of timer 551.sub.1, which changes its output state, signalling processor 20, which subsequently reinitiates the cycle. In this manner, detector 18 generates a plurality of timing periods which are available to detector 18, e.g. the idle time period and time period to shutdown described above. These, together with the counter in processor 20, constitute the timer of detector 18. Circuits such as timers 555 are preferred for tracking times significantly longer than the polling period, because to do so using digital counters would be inordinately expensive. Capacitor 88 connects in parallel with the outputs of timers 555.sub.1, 555.sub.2, and 555.sub.3 to isolate processor 20 from transition voltage spikes. Resistor trim pots 90, 92 permit conventional fine tuning of the RC time constants.

FIG. 5 shows agent 12 in the form of a hand held token. Switch 122 permits disconnecting of power to agent 12 to conserve power. Buttons 120 permit a user to key information into processor 14 (not shown in FIG. 5), such as a PIN or other identification number necessary to start operation of the circuit. Token 12 may also be powered by solar cells 124 to reduce or eliminate the need to replace batteries. This could permit token 12 to be hermetically sealed, which would further reduce the likelihood of tampering.

In operation, a user taps buttons 120 to key in a code which identifies him to processor 14, and whereupon processor enables the circuit of token 12 to receive, and respond to, polls from detector 18. Token 12's response can be a fixed digital signal, but preferably is encrypted or otherwise varied in accordance with known IFF (identification friend or foe) techniques to protect against compromise of the system by spoofing and replay as happens frequently to cellular phones. Token 12 may also have separate buttons (not shown) by which a user can send a direct command to start or disconnect computer 28.

The invention has been described in what is considered to be the most practical and preferred embodiments. It is recognized, however, that obvious modifications to these embodiments may occur to those with skill in this art. Accordingly, the scope of the invention is to be discerned from reference to the appended claims, wherein: