Methods and apparatus for controlling access to information processed a multi-user-accessible digital computer

In a computer system having data storage means for storing information, access control apparatus comprising:

• encryption means coupled to the data storage means of the computer system for encrypting information as it is stored in said data storage means, and for decrypting the data stored in said data storage means as it is retrieved from said data storage means;
• access enabling means, coupled to said encryption means, for enabling and disabling said encryption means;
• and
• a multiplicity of password issuing means for use by authorized users of the computer system for generating user password values, each said password issuing means including means for generating and issuing a user password value to be used by said access enabling means to determine whether a specified user is authorized to have access to information stored on said data storage means;
• said access enabling means including:
• user definition means for storing user information associated with each authorized user of said computer system,
• password generating means coupled to said user definition means for generating a password which is a function of the user information corresponding to a specified user of the computer system,
• password comparison means, coupled to said password generating means, for comparing a user password value with said generated password, and
• means for enabling said encryption means when said user password value matches said generated password;
• whereby access to the information stored on said data storage means is limited to authorized users having possession of one of said password issuing means.

In a multiuser computer system including a plurality of user interaction means for receiving and transmitting information to users of said computer system, and data storage means for storing information;

• access control apparatus comprising:
• user definition means for storing user information associated with each authorized user of said computer system, said user information including information designating portions of said data storage means associated with each authorized user;
• encryption means coupled to the data storage means of the computer system for encrypting information as it is stored in said data storage means, and for decrypting the data stored in said data storage means as it is retrieved from said data storage means;
• access enabling means, coupled to said encryption means, for enabling and disabling said encryption means;
• and
• a multiplicty of password issuing means for use by authorized users of the computer system for generating user password values, each said password issuing means including means for generating and issuing a user password value;
• said access enabling means including:
• password generating means coupled to said user definition means for generating a password which is a function of the user information corresponding to a specified user of the computer system,
• password comparison means, coupled to said password generating means, for comparing a user password value with said generated password, and
• means for enabling said encryption means when said user password value matches said generated password and the portion of said data storage means that the user is trying to access corresponds to the portion of said data storage means designated by said user definition means;
• whereby access to the information stored on said data storage means is limited to authorized users having possession of one of said password issuing means.

A method of controlling access to a data storage means in a multiuser computer system, the steps of the method comprising:

• providing encryption means coupled to the data storage means of the computer system for encrypting information as it is stored in said data storage means, and for decrypting the data stored in said data storage means as it is retrieved from said data storage means;
• receiving a user entered password value from a specified user of the computer system;
• generating a valid password value which is a function of the user information corresponding to said specified user of the computer system;
• comparing said user entered password value with said valid password value;
• enabling said encryption means when said user entered password value matches said valid password value;
• and
• disabling said encryption means when any one of a predefined set of terminating events occurs.

A method of controlling access to a data storage means in a multiuser computer system, the steps of the method comprising:

• storing user information associated with each authorized user of said computer system, said user information including information designating portions of the data storage means associated with each authorized user;
• providing encryption means coupled to the data storage means of the computer system for encrypting information using a specified cryptoalgorithm as it is stored in said data storage means, and for decrypting the data stored in said data storage means using a specified cryptoalgorithm as it is retrieved from said data storage means;
• receiving a user entered password value from a specified user of the computer system;
• generating a valid password value which is a function of the user information corresponding to said specified user of the computer system;
• comparing said user entered password value with said valid password value;
• when said user entered password value matches said valid password value and the portion of said data storage means that the user is trying to access corresponds to the portion of said data storage means designated by said user definition means, enabling said encryption means and specifying a cryptoalgorithm to be used by said encryption means corresponding to said specified user;
• whereby access to the information stored in said data storage means is limited to authorized users.