Multi-level secure computer with token-based access control

[0002] This invention relates to computer security, and more particularly, to a multilevel computer security system and a method for controlling user access which allows a computer to be used in a multilevel security environment, but prevents access of data at a particular security level by a computer user authorized to access the computer at a lower level.

[0003] Prior art, multilevel computer systems include the separation of the elements that store or process data at each security level through user controlled means such as a mechanical switch or by physical removal of secure storage components such as the hard drives. The security of such computer systems is dependent on the user and not the user's assigned access privileges. It also leaves the data created, stored, or accessed by one user accessible to another unauthorized user. In addition, a switching mechanism that does not disable the operation of the storage and processing components that are not at the security level selected creates the potential for data transfer between security levels through a covert transmission channel. Such channels can only be disabled through the removal of power from components at security levels that are not in use thereby disabling the channel at the source.

[0004] A general object of the invention is a computer security system and a method for controlling computer access which allows use of a common computer and operating system for different security levels, but makes it impossible for an authorized user at one security level to access data at a security level for which he is not authorized.

[0005] According to the present invention, as embodied and broadly described herein, a multilevel computer security system is provided, comprising a core computer, a first security subsystem, a second security subsystem, a smart-card reader, a first electronically-activated switch for controlling the connection of power from the computer-power supply to either of the two security subsystems, and a first sensor switch for identifying and selecting the security level of the security subsystem to which power is to be connected. The core computer has, at a minimum, a central processor unit (CPU), random access memory (RAM), and a power supply. Any additional read-only memory devices such as a compact disk (CD) drive are included within the computer as are any data interfaces to a display system and keyboard. The central processor unit is coupled to and controls the operation of all of the devices and data interfaces within the core computer and the security subsystems that are used for data processing, data communications, and data storage. Each security subsystem is defined by at least a memory device, an activation indicator, and electronic communications devices that can include a modem, an encryptor, and a network interface card (NIC) that are all connected in parallel with respect to the power terminals for each device and the indicator.

[0006] The first security subsystem has a first memory device for storing data at a first security level, which, by definition, is a level with unrestricted access. The first security subsystem may further have a first modem which, when activated, is operating with the computer as the only means of telecommunications at a first security level. The first security subsystem may further have a first network-interface card, which, when activated, is operating with the computer as the only interface to an external network at the first security level. Any other computer memory devices such as a floppy disk drive that are used to read or write data at the first security level must also be included within the first security subsystem. When all of the first security subsystem devices are activated the power connection illuminates the activation indicator.

[0007] The second security subsystem has a removable-memory device which is the only means for storing data at a second security level. The second security subsystem may further have a second modem and encryptor which, when activated, is operating with the computer as the only means for encrypting telecommunications at a second security level. The second security subsystem may further have a second network-interface card, which, when activated, is operating with the computer as the only interface to an external network at the second security level. When all of the second security subsystem devices are activated, the power connection illuminate, the activation indicator.

[0008] The smart-card reader and its software determine if a compatible smart card is in the card reader at computer startup. If no smart card were present, then the computer operating system loads from the first security subsystem memory device which operates at the first security level. If a compatible smart card were in the card reader, then the smart-card reader prevents the loading of the computer operating system and begins processing the stored program in the smart card. The smart card has identification information stored within its memory. The smart-card information includes information on the smart card owner and the smart-card owner's allowed security access privileges. The smart-card reader interacts with the smart card and the identification information, and the computer user through the stored program in smart-card memory. The smart-card program grants or denies access to a restricted security subsystem such as the second security subsystem in accordance with the acceptance of the identification information entered into the reader by the computer user. In response to granting access to the second security subsystem, the smart-card reader generates an activation signal.

[0009] The first electronically-activated switch has a first contact connected to the first security subsystem, a second contact connected to the second security subsystem, and a common contact that is connected to the computer-power supply. The switch is activated through an electronic signal applied to an activation contact. If there were no activation signal, then the first electronically-activated switch is in a normally closed position in which the common contact is connected to the first contact. When an activation signal is received at the activation contact, then the first electronically-activated switch connects the common contact with the second contact position.

[0010] The first sensor switch is a mechanically-activated cam switch. This switch is closed by the correct insertion of the removable memory for the second security subsystem into the computer memory receptacle. The removable memory for the second security subsystem has a mechanical cam that is physically located and configured to contact and close the first sensor switch.

[0011] The first electronically-activated switch normally is set at the first contact position which is the normally closed position. In the first contact position, the computer operates only with the first security subsystem since it is connected to the computer-power supply through the common contact. The first security subsystem stores unrestricted data at a first security level and is accessible by default without using the smart card when the computer is started. The first security subsystem also can be accessed via the smart card by selecting the first security subsystem via the smart-card program. If a user selected the first security subsystem, then the smart-card program terminates and no activation signal is transmitted to the first electronically activated switch. This maintains the power connection to the first security subsystem and the operating system on the first memory device begins loading after termination of the smart card program.

[0012] When an owner of a smart card is granted access to the second security subsystem, then the first activation signal is outputted from the smart card. The first activation signal is connected to the activation contact of the first electronically-activated switch if the removable memory for the second security subsystem is correctly inserted in the memory receptacle. In response to the first activation signal, the first electronically activated switch disconnects the common contact from the first contact and connects the common contact with the second contact. In this second contact position, the computer operates only with the second security subsystem which is the only security subsystem connected to the computer-power supply.

[0013] The present invention also includes a multilevel computer security method, for use with a computer. The method comprises the steps for implementing high assurance data access control and secure data processing, data storage, and data communications for data at a first security level and data at a second security level within a common computer. The first step is to maintain physical separation of the data at a first security level from the data at a second security level by performing all data storage, data communications, and network communications at each level with devices dedicated to that level. The second step connects all of the dedicated devices for the first security level to a first power circuit so that they comprise a first security subsystem and all of the dedicated devices for the second security level to a second power circuit so that they comprise a second security subsystem. The third step utilizes an electronically-activated switch to switch the power from the computer-power supply from the first security subsystem to the second security subsystem in response to an activation signal. The fourth step utilizes a smart card reader to read a smart card if a smart card were in the smart-card reader when the computer is started. The fifth step includes the smart card reader interrupting the loading of the operating system from the first memory device in the first security subsystem if the smart-card were valid. The sixth step has the smart card reader comparing a users identification data with the data stored on the smart-card to validate the identity of the user and to then initiate the security level access control process from the program stored in the smart-card. The seventh step is for the smart card program to compare the users access request for access to data at the second security level with the stored access privileges on the smart-card and either grant or deny access. The eighth step has the smart-card reader generate an activation signal for the second security subsystem if access were granted or terminate the smart-card reader software and allow the operating system from the first memory device to load for default access to the unrestricted data in the first security subsystem. The ninth step transmits the activation signal for the second security subsystem to the electronically activated switch via a closed sensor switch and activate the second security subsystem. The tenth step is for the sensor switch to disable the transmission of the activation signal if the second security subsystem were not available, which will prevents the activation of the second security subsystem until it is properly installed and disable the default activation of the first security subsystem until the smart-card is removed.

[0014] Additional objects and advantages of the invention are set forth in part in the description which follows, and in part are obvious from the description, or may be learned by practice of the invention. The objects and advantages of the invention also may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims. These include physical implementations of the multilevel computer security method that can be easily applied to existing personal computers. This would allow an existing personal computer to be easily converted to a computer with multi-level security.

[0015] The accompanying drawing, which is incorporated in and constitutes a part of the specification, illustrates preferred embodiments of the invention, and together with the description serves to explain the principles of the invention.

[0016] FIG. 1 is a block diagram of the multilevel computer security system with two removable drives and one fixed drive serves to explain the principles of the invention.

[0017] Reference now is made in detail to the present preferred embodiments of the invention, examples of which are illustrated in the accompanying drawing.

[0018] As illustratively shown in FIG. 1, a multilevel computer security system is provided, comprising a core computer 55, a first security subsystem 51, a second security subsystem 52, a smart card reader 31, a first electronically-activated switch R1, and a first sensor switch S1. The core computer 55 typically has, as a minimum, a central processor unit (CPU), random access memory (RAM), and a power supply 20. Any additional read-only memory devices, such as a compact disk (CD) drive, are included within the computer as are any data interfaces to an external display and keyboard. The CPU is coupled to and controls the operation of all of the devices and data interfaces within the core computer and the security subsystems that are used for data processing, data communications, and data storage.

[0019] The core computer 55 also includes a power supply 20 and a tamper switch 21. The tamper switch 21 disconnects the power to the computer from power supply 20 if access to the computer were attempted through the dismantling of the computer case. The computer employs a disk operating system (DOS), Windows, UNIX, or other system, which are well-known in the art. Each security subsystem has its own disk operating system stored on its memory device. All of the devices in a security subsystem are linked through a parallel power connection to the computer-power supply via an electronically-activated switch, which might be embodied as a relay.

[0020] The first security subsystem 51 has a first memory device 24 for storing data at a first security level, which by definition is an unrestricted security level. The first security subsystem 51 may further have a first modem 25 for providing telecommunications for data at a first security level. A first network interface card 26 also may be included in the first security subsystem as a means to interface with an external data network with data at the first security level. Other memory elements used to read and write data at a first security level may be included in the first security subsystem 51, as required, such as a floppy disk drive 23. A first activation indicator 27 that may be embodied as a first light emitting diode (LED) may be included in the first security subsystem. The first LED indicates when power is switched to the devices within the first security subsystem through a connection to the computer-power supply via R1. The data and control coupling between the computer 55 and first memory device 24, first modem 25 and first network interface card 26 may be through a computer bus, such as PCI bus, SCSI bus, or other computer bus, as is well-known in the art.

[0021] The second security subsystem 52 has a second memory device 15 that is removable from the computer and is used for storing data at a second security level. The second security subsystem 52 may further have a second modem 16 for providing telecommunications for data at a second security level. An encryptor may be included in the second modem 16 for encrypting the data being transmitted by the second modem 16 at a second security level and decrypting the data being received by the second modem 16 at a second security level. The encryptor may also be used for encrypting data stored on the second memory device 15 at the end of a user session and decrypting the data stored on the second memory device 15 at the beginning of a user session.

[0022] A second network interface card 17 also may be included in the second security subsystem 52 as a means for interfacing with an external data network with data at a second security level. A second activation indicator 18 that may be embodied as a second LED may be included in the second security subsystem 52. The second LED indicates when power is switched to the devices within the second security subsystem 52 through a connection to the computer-power supply 20 via R1. The data and control coupling between the computer 55, second memory device 15, second modem 16, and second network interface card 17 may be through a computer bus, such as a PCI bus, SCSI bus, or other computer bus, as is well-known in the art.

[0023] The smart-card reader 31 and its software determine if a compatible smart-card 30 is in the smart-card reader 31 whenever the computer is powered on. If no card were present, then the computer operating system loads from the first memory device 24 in the first security subsystem 51 which operates at the first security level. If a compatible smart-card 30 were in the smart-card reader 31, then the smart-card reader software prevents the loading of the computer operating system and initializes the stored program in the smart-card 30.

[0024] The smart-card 30 has identification information about the card owner stored within its internal memory. This identification information can include the card owner's assigned personal identification number (PIN) or some biometrics. Biometrics are essentially a stored representation of a physical characteristic of the card owner such as a digitized finger print, retinal scan, or facial geometry. In addition to the identification information, the smart card 30 stores the card owner's security access privileges with respect to the allowed access to data at various security levels.

[0025] The smart-card reader 31 interacts with the smart card 30 and the stored identification information through the actions of the computer program stored within the smart card 30. The computer program first compares a users identification information as entered into the card reader 31 with the identification information stored in the smart card 30 for the card owner. If the information were identical, then the program allows the user to select one of the security levels authorized for use by the card owner. When the user selects an allowed security level the card reader 31 outputs a unique activation signal associated with the level selected. In response to permitting access to the second security subsystem 52, the smart-card reader 31 generates a first activation signal.

[0026] The first electronically-activated switch R1 has a first contact connected to the first security subsystem 51, a second contact connected to the second security subsystem 52, and a first common contact that is connected to the computer-power supply. The first electronically-activated switch R1 also has a first activation contact which is connected to the smart-card reader 31 via a first mechanically-activated-sensor switch. A mechanically-activated-sensor switch typically is a cam. If no activation signal were present at the first activation contact of the first electronically-activated switch R1, then the first electronically-activated switch is in a normally closed position and the first common contact is connected to the first contact. This causes the computer-power supply 20 to be connected to the first security subsystem 51 which is the default subsystem used for processing unrestricted data. All of the devices in the first security subsystem 51 are activated and the first activation indicator 27 is illuminated. When an activation signal is applied to the activation contact of the first electronically-activated switch R1, then the first common contact is connected to the second contact. This causes the power supply 20 to be disconnected from the first security subsystem 51 and connected to the second security subsystem 52. All of the devices in the second security system 52 are activated and the second activation indicator 18 are illuminated. Conversely all of the devices in the first security subsystem 51 are deactivated and the first activation indicator 27 will no longer be illuminated.

[0027] The mechanically-activated sensor switches, or cams, are a key element of the multilevel computer since they determine if the activation signal generated by the card reader should be transmitted to the electronically-activated switches. If the card reader 31 generated a first activation signal for the activation of the second security subsystem 52, then the signal is transmitted to the first electronically-activated switch R1 if the first sensor switch S1 were closed. Since the first sensor switch S1 closes if the second memory device 15 were in the memory receptacle, the second security subsystem 52 is activated if the second memory device 15 required for the storage of data at the second security level were installed properly in the memory receptacle. The installation of any other memory device does not close the first sensor switch S1 thereby preventing the activation of the second security subsystem 52 and maintaining the activation of the first security subsystem 51. It is the operation of the mechanically-activated sensor switches that ensures that the correct memory device is installed and activated so that the stored data at a given security level cannot be accessed or processed by devices and users at a different security level.

[0028] The multilevel computer security system may further comprise a third security subsystem 53, a second electronically-activated switch R2, and a second mechanically-activated sensor switch S2. The third security subsystem 53 has a third memory device 10 that is removable from the computer and is used for storing data at a third security level. The third security subsystem 53 may further have a third modem 11 for providing telecommunications for data at a third security level. An encryptor may be included in the third modem 11 for encrypting the data being transmitted by the third modem 11 at a third security level and decrypting the data being received by the third modem 11 at a third security level. The encryptor may also be used for encrypting data stored on the third memory device 10 at the end of a user session and decrypting the data stored on the third memory device 10 at the beginning of a user session. A third network interface card 12 may also be included in the third security subsystem as a means to interface with an external data network with data at a third security level. A third activation indicator 13 that may be embodied as a third LED may be included in the third security subsystem 53. The third LED indicates when power is switched to the devices within the third security subsystem 53 through a connection to the computer-power supply 20 via R2. The data and control coupling between the computer 55 and third memory device 10, third modem 11, and third network interface card 12 may be through a computer bus, such as a PCI bus, SCSI bus, or other computer bus, as is well-known in the art.

[0029] With the third security subsystem 53, when the smart-card reader 31 reads the smart card 30 with the identification information, the smart-card reader 31 interacts with the smart card 30 and the stored identification information via the internal program, as before. If the smart-card internal program granted access to the third security subsystem 53, then the smart-card reader 31 generates a second activation signal.

[0030] The second electronically-activated switch R2 has a third contact connected to the second security subsystem 52, a fourth contact connected to the third security subsystem 52, and a second common contact that is connected to the second contact of the first electronically activated switch R1. The second electronically-activated switch R2 also has a second activation contact which is directly connected to the smart-card reader 31. If there were no activation signal at the second activation contact of the second electronically-activated switch R2, then the switch is in a normally closed position and the second common contact is connected to the third contact of the second electronically activated switch R2. This causes the computerpower supply 20 to be connected to the first security subsystem 51. All of the devices in the first security subsystem 51 are activated and the first activation indicator 27 is illuminated.

[0031] When the second activation signal is applied to the second activation contact of the second electronically-activated switch R2, the second common contact is connected to the fourth contact of the second electronically-activated switch R2. This causes the third security subsystem 53 to be connected to the second contact of the first electronically-activated switch R1. If the second activation signal were successfully transmitted to R1 via the closed sensor switch S2, then the first common contact of the first electronically-activated switch RI is connected to second contact of the first electronically-activated switch R1. This causes the power supply 20 to connect to the third security subsystem 53 and disconnect from the first security subsystem. All of the devices in the third security system 53 then are activated and the third activation indicator 13 is illuminated. Conversely all of the devices in the first security subsystem 51 are deactivated and the first activation indicator 27 no longer is illuminated.

[0032] The mechanically-activated-sensor switches, cams, are again a key element of the multilevel computer since they determine if the second activation signal generated by the card reader 31 should be transmitted to the first electronically-activated switch R1. If the card reader 31 generates a second activation signal for the activation of the third security subsystem 53, the signal is transmitted to R1 if the second sensor switch S2 were closed. Since the second sensor switch S2 close if the third memory device 10 were in the memory receptacle, the third security subsystem 53 is activated if the third memory device 10 required for the storage of data at the third security level were installed. The closing of the second sensor switch S2 enables the second activation signal to switch both the first electronically-activated switch R1 and the second electronically-activated switch R2 to the second and fourth contact points, respectively. This enables the power supply 20 to be connected only to the third security subsystem 53. The installation of any other memory device does not close the second sensor switch S2 thereby preventing both the deactivation of the first security subsystem 51 and the activation of the third security subsystem 53. The operation of the second sensor switch S2 ensures that the correct memory device is installed and activated so that the stored data at the third security level cannot be accessed or processed by devices and users at a different security level.

[0033] It is evident from the above discussion that the multilevel computer security system may be extended to include a number of additional security subsystems for higher level data that can be selected and activated through the operation of the smart-card, smart card reader, and additional electronically-activated switches and mechanically-activated-sensor switches. Each additional security subsystem would include a removable-memory device, a modem with encryptor, a network interface card, and an activation indicator.

[0034] All of the devices in the additional security subsystems are under the control of the CPU 22 and are linked through a parallel power connection to the computer-power supply 20 via a combination of electronically-activated switches. The addition of one additional electronically-activated switch is required for each additional security subsystem. The electronically-activated switches are connected so that the normally open contact for the electronically-activated switch at security level n is connected to the normally closed contact for the electronically-activated switch at the next higher security level n+1 as is seen in FIG. 1 for the connection of R1 and R2. The normally closed contact for the electronically-activated switch at level n is also connected to the power circuit connecting the security subsystem devices at level n.

[0035] A security subsystem at level n has a unique activation signal that is generated by the card reader 31 in response to valid authorization for a user to access the data at security level n in that subsystem. The activation signal for the security subsystem at level n is directly connected to the activation contact of each one of the electronically-activated switches at levels above the first security level and below level n. In addition, the activation signal for the security subsystem at level n also is connected to the first electronically-activated switch R1 via the sensor switch that can only be closed by the correct insertion of memory device n in the memory receptacle. This ensures that the security subsystem will only be activated if the correct memory device for that subsystem is installed. The installation of any other memory will not activate the first electronically-activated switch R1 which will maintain the activation of the first security subsystem 51.

[0036] The present invention also includes a multilevel computer security method, for use with a computer. This method is based on creating electrically isolated security subsystems within a common computer such that: each subsystem includes devices for the secure storage, telecommunications, and networking of data at a given security level; each subsystem can be coupled with the computer CPU, RAM, and Read-Only Memory devices to comprise a complete computer system that can only access, store, and process data at one security level during any given time; only one subsystem can be activated at a given time with all others being electrically inactive; the subsystem at the lowest security level is automatically activated at computer startup unless a higher level subsystem is selected and authorized; the activation of each subsystem above the subsystem at the lowest security level requires a computer user to be identified and authorized access based on the user's security privileges; the security privileges of each user are defined for each restricted security subsystem in a password controlled smart-card token that is used for access control to each restricted subsystem; each subsystem has unique physical characteristics that are utilized along with the user identification and authorization to ensure that the correct subsystem has been activated; the selection of a different security level must be done after logging out of the current level and allowing the operating system to turn the computer off so that the computer RAM is cleared.

[0037] The method provides high assurance data access control and secure data processing, data storage, and data communications for data at a first security level and data at a second security level within a common computer 55 consisting of: a CPU; RAM; power supply 20; smart card 30; smart card reader 31; a first security subsystem 51 comprised of a first memory device 24, first modem 25, first NIC 26, and first activation indicator 27 connected to a first power circuit; a second security subsystem 52 comprised of second memory device 15, second modem and encryptor 16, second NIC 17 and second activation indicator connected to a second power circuit; a first electronically-activated switch R1; and a first mechanically-activated sensor switch S1.

[0038] Within the computer 55, the method comprises the steps of: utilizing the first security subsystem 51 to process and store the data at the first security level after loading the operating system from the first memory device 24 if there were no smart-card 30 in the smart-card reader 31; activating the smart-card reader software which deactivates the loading of the operating system from the first memory device 24 if a valid smart-card 30 were detected in the smart-card reader 31; having the smart-card reader 31 compare a users identification data with the data stored on the smart-card 30 to validate the identity of the user and to then initiate the security level access control process from the program stored in the smart-card 30; utilizing the smart-card program to compare the users access request for access to data at the second security level with the stored access privileges on the smart-card 30 and either grant or deny access; having the smart-card reader 31 generate an activation signal for the second security subsystem 52 if access is granted or terminate the smart-card reader software and allow the operating system from the first memory device 24 to load for default access to the unrestricted data in the first security subsystem 51; transmitting the activation signal for the second security subsystem 52 to the first electronically activated switch R1 via a closed first sensor switch S1 which activates the second security subsystem 52 by connecting the second power circuit to the power supply 20 and simultaneously deactivates the first security subsystem by disconnecting the first power circuit from the power supply 20; if the second memory device 15 were detected by the first sensor switch S1 as not being installed, the first sensor switch disables the transmission of the activation signal thus preventing the activation of the second security subsystem 51 and disables the default activation of the first security subsystem 51 until the smart-card 30 is removed from the smart-card reader 31.

[0039] In a more general sense, the method could be applied to a multilevel security process with n levels through the addition of steps for each level. A method for n levels would provide high assurance data access control and secure data processing, data storage, and data communications for data at a first security level and data at an n^thsecurity level within a common computer 55 consisting of: a CPU; RAM; power supply 20; smart card 30; smart card reader 31; a first security subsystem 51 comprised of a first memory device 24, first modem 25, first NIC 26, and first activation indicator 27 connected to a first power circuit; an n^thsecurity subsystem 52 comprised of n^thmemory device 15, n^thmodem and encryptor 16, n^thNIC 17 and n^thactivation indicator connected to a second power circuit; n−1 electronically-activated switches; and n−1 mechanically-activated sensor switches.

[0040] At the n^thsecurity level the method would comprise the steps of: utilizing the first security subsystem 51 to process and store the data at the first security level after loading the operating system from the first memory device 24 if there were no smart-card 30 in the smart-card reader 31; activating the smart-card reader software which deactivates the loading of the operating system from the first memory device 24 if a valid smart-card 30 were detected in the smart-card reader 31; having the smart-card reader 31 compare a users identification data with the data stored on the smart-card 30 to validate the identity of the user and to then initiate the security level access control process from the program stored in the smart-card 30; utilizing the smart-card program to compare the users access request for access to data at the n^thsecurity level with the stored access privileges on the smart-card 30 and either grant or deny access; having the smart-card reader 31 generate an activation signal for the n^thsecurity subsystem 52 if access were granted or terminate the smart-card reader software and allow the operating system from the first memory device 24 to load for default access to the unrestricted data in the first security subsystem 51; transmitting the activation signal for the n^thsecurity subsystem directly to all the electronically-activated switches at levels above the first security level and below level n and to R1 via a closed (n−1)^thsensor switch S(n−1) which activate the n^thsecurity subsystem by connecting the n^thpower circuit to the power supply 20 and simultaneously deactivates the first security subsystem by disconnecting the first power circuit from the power supply 20; if the n^thmemory device were detected by the (n−1)^thsensor switch S(n−1), the (n−1)^thsensor switch will disable the transmission of the activation signal thus preventing the activation of the n^thsecurity subsystem and disable the default activation of the first security subsystem until the smart-card 30 is removed from the smart card reader.

[0041] The present invention is based on a standard personal computer (PC) with multiple hard drives, modems, network interface cards (NICs), and LED indicators including one or more hard drives that are removable. Each hard drive, modem, NIC and LED are associated with a specific level of security access and are either powered on or off depending on the security level selected by an authorized user. Access to the drives, modems, and NICs is based on the assigned access rights of the user as defined on their smart card 30 and the level of security access selected by the user from within their assigned security access rights. The hard drive, modem, NIC, and LED at a given security level are directly connected such that power is either on or off to all depending on the level of security access selected. This also ensures that the LED provides a true indication as to what security level is active.

[0042] The authorization for a selected security level is granted or denied by the smart-card program which verifies the user PIN or biometric data. If this data were valid, then the program determines if the stored security rights allow access to the level selected. If access were granted an activation signal is generated by the card reader for the activation of the security subsystem at the selected security level. These activation signals are shown as S (secret) or C (confidential) in FIG. 1 to designate the level selected. There also is a mechanical interlock on the removable hard drives that automatically ensures that power is only applied to the drive, modem, and NIC at the security level selected by the operator. The interlock essentially is a cam switch, that is closed by a cam that is located and configured on the hard drive to contact and close the cam switch when the hard drive is inserted in the drive bay. The location and configuration of the cam on the drive is keyed to the security level of the hard drive and is aligned to close only the switch in the drive bay that is set for that level. As is seen from FIG. 1, only the combination of the proper cam switch and card reader output signal activates the correct hard drive, modem, NIC, and LED indicator.

[0043] The circuit shown in FIG. 1 also has several additional features that ensure that secure data received, sent, or stored within the computer is never at risk. Each of the security subsystems can send and receive data from a dial-up interface via an internal modem with the appropriate type of encryption for the level of security provided by the subsystem. If the security level corresponded to classified data, the encryption would be based on a Type I algorithm located on a classified modem. Such modems are controlled by the National Security Agency and are available from authorized manufacturers in a PCMCIA configuration for approved users only.

[0044] If the selected restriction level were below classified but above unclassified, then the modem would utilize a Type II encryption algorithm on the PCMCIA card that is available for public use within the United States. The encryption algorithms also are utilized to encrypt the data on the hard drives at the end of each user session. This protects the data on the hard drive regardless of whether the drive is removed for unauthorized use. In addition the removable hard drives are also locked within the computer by a hard drive latch 19 that physically prevents the drive from being removed while activated. The locking ensures that there is no vulnerability due to the possible removal of a drive during an on-going session while the data still is unencrypted. The computer also has a tamper switch 21 with a breakable link that disconnects all power to the computer if the computer is opened in an unauthorized manner.

[0045] The basic principle of this computer system is the utilization of secure smart card identification and authentication of the user in combination with a mechanical interlock mechanism to control access to different security levels of a computer through the controlled application of power to the appropriate hard drives, modems, and NICs. At start-up the computer initially accesses the smart-card reader 31 before loading the operating system in the default first memory device. The user then logs on through the insertion of their smart card 30 and the entry of a personal identification number via the keyboard or biometric data from a biometrics device such as a fingerprint reader. If the user selected the unrestricted mode of operation or were only authorized to use this mode based on the information on the smart card 30, then the operating system loads and none of the relays are activated since there are no signals out of the smart-card reader 31. In the unrestricted mode the user has access to all computer facilities including the unrestricted hard drive, modem, NIC, and any other memory devices used to read and write unclassified data such as a floppy disk drive.

[0046] The selection of higher levels of security requires the entry and verification of the user identification and access rights coupled with the sensing of the correct removable hard for the security level selected through the action of the cam switches. These switches are essential in ensuring that the correct drive and the associated modem, and NIC are enabled.

[0047] In addition, the selection of a new security level can only be implemented after logging out of the operating system for the previous level and allowing the computer to power off. This is necessary to avoid any crossover of data from one security level to another via the computer RAM which is cleared when power is removed. The RAM is the singular read-write memory device that is shared by all security subsystems. The implementation of this requirement is also built-in to the operation of most operating systems since logging off the operating system at any level will naturally result in a power down. Even if this were not so, the utilization of the card-reader 31 to access a new security level also requires the computer to be powered off and then restarted. This feature of the card-reader software is required so that all secure transactions with the smart-card are under the control of the smart-card reader software which is designed to be more secure than a disk operating system.

[0048] The computer can have multiple hard drives and a single drive bay or a bay for each removable hard drive. Either configuration will work with the circuitry shown in FIG. 1. In a single bay system, the bay is configured for switches that are keyed to each level of hard drive. For example, in FIG. 1 the insertion of a hard drive with a sensitive (S) security level would activate the cam switch for that level but would not activate the cam for any other level.

[0049] If the operator selected and was granted access to the S level, first electronically-activated switch R1 would be activated and power would be applied to the S level hard drive, modem, NIC, and LED. Conversely there would be no power on either the unrestricted or C level hard drives, modems, NICs, and LEDs nor on the floppy drive. If the operator selected and was granted access to the C level, the C level drive would need to be inserted into the drive bay. This would close the C level cam switch and leave the S level switch open. The closing of the C level switch would allow the C activation signal to activate first and second electronically-activated switches R1 and R2 which would only apply power to the classified hard drive, modem, NIC and LED.

[0050] The mechanical interlock also ensures that a mistake cannot be made by inserting a drive that is at a level that differs from what was selected and approved for the user via their smart card. If such a mistake were made the correct cam switch could not be closed and an activation signal could not be received at the first electronically-activated switch R1. This would disable power to any other security subsystem other than the unclassified system. Any mistake of this type with a drive at any security level would result in a default to unclassified operation. This condition would be seen immediately since the screen that appears with the loading of the operating system on the unclassified drive will indicate the restriction level in bold text. The operator also sees the illumination of the unclassified LED indicator 27.

[0051] The operating system on each hard drive presents a screen identifying its restriction level. Protection against having more than one hard drive, modem, and LED indicator powered is also prevented by the normally closed configuration of the first and second electronically-activated switches R1, R2 in FIG. 1. It is evident that if either the S or C security level were selected, then first electronically-activated switch R1 is activated and there can be no power to the unrestricted hard drive, modem, NIC, LED, or floppy drive which disables any possible crossover of secure data to the unrestricted part of the computer. In addition the coupling of the activation signal output from the card reader with the hard drive cam switches and the electronically-activated switches makes it impossible for more than one security subsystem to be powered at any given time.

[0052] The system shown in FIG. 1 also would operate with a computer that had separate bays for each removable hard drive. In such a system each bay would have one cam switch that was keyed to a specific level hard drive. The positioning of the cams on the drive and in the bays would be the same as on the single removable drive computer. This would ensure that a hard drive would be recognized at the correct level in either computer. Each bay would be clearly labeled to identify its level so that the operator would insert the correct drive. If the wrong drive were inserted in either or both drives neither drive would be activated and the system would operate only in the unrestricted mode as was described earlier.

[0053] There are implementations of the multilevel computer security method that are independent of the computer as a whole. These implementations describe a modification to an existing computer that would allow it to be easily converted to a multilevel computer with all or some of the security features described herein. Most of these implementations are based on the packaging of specific elements of the multilevel computer security method so that they could be easily provided within a kit that could be installed by a computer user with average expertise.

[0054] One implementation of a modification kit would involve the packaging of a complete security subsystem into a removable drive enclosure with the cam switches being mounted in the drive bay. In this implementation all of the security subsystem devices including the hard drive, modem, NIC, and LED activation indicator would be powered through a connection within the drive enclosure as is seen for the second security subsystem in FIG. 1.

[0055] A second removable drive enclosure would house the computer's card reader and a printed circuit card with an electronically-activated switch and an LED activation indicator and connector interfaces for a modem, NIC, and the existing computer internal hard and floppy drives. The LED activation indicator and connector interfaces are wired with a parallel power connection. The electronically-activated switch is equivalent to the first electronically-activated switch R1 and has its normally closed contact connected to the power connection in the second removable drive enclosure as is seen in FIG. 1.

[0056] The connector interfaces for the modem and NIC in the second removable drive enclosure are in the configuration of PCMCIA slots that support the installation of a modem and NIC within the enclosure or allow for a connection to an existing computer modem and NIC through a cable with a PCMCIA interface. The connection to the computers internal hard drive and floppy drive is via standard ribbon cables and connectors.

[0057] The card reader activation signals would be connected to the appropriate cam switch inputs located on the first removable drive bay. Similarly the cam switch outputs would be connected to the activation contact of the electronically-activated switch in the second removable drive bay as seen in FIG. 1. The normally open contact of the electronically activated switch would be connected to the power circuit in the first drive bay. All of these connections between the first and second drive bays would be implemented via a cable connected between the two bays. Finally, the power supply connection to the common contact of the electronically activated switch would be implemented via an internal power cable that would connect to the second drive bay.

[0058] From the description above it is evident that any modern personal computer with two spare drive bay slots could easily be converted to a multilevel security computer through the installation of a simple kit consisting of two drive bays. The installation would also require the connection of some new cables to the drive bays and the disconnection of several existing computer cables to the internal hard drive and floppy disk drive and possibly the internal modem and NIC.

[0059] It will be apparent to those skilled in the art that various modifications can be made to the multilevel computer security system and method of the instant invention without departing from the scope or spirit of the invention, and it is intended theat the present invention cover modifications and variations or the multilevel computer security system and method provided they come within the scope of the appended claims and their equivalents.