US 6,212,635 B1 · Network security system allowing access and modification to a security subsystem after initial installation when a master token is in place

Abstract

Apparatus and process are disclosed by which to disable a computer's access to all or a part of the computer's memory system or associated peripherals, so as to protect the computer from accidental or malicious damage of data files or programs that may result from the activity of computer users or computer viruses. This result is achieved by providing the authorized user with a token whereby the user can configure the security gateway to completely or partially disable the peripheral device without disrupting the operation of the computer or other peripherals. The principal hardware component of one embodiment of the invention is the security gateway which in a typical configuration simply adds new security functions to the programmable controllers that are typically used for an I/O controller or hard drive controller, although this is not always necessary. The process can just as easily be incorporated into a local network controller, a communications controller, or a main processor board for a system. The speed of the security gateway can be further enhanced by adding additional computational or encryption hardware to the chip sets used in said I/O or hard drive controllers.

Claims23

Dependent claims

A method for providing security for a computer comprised of a central processing unit, peripheral and file storage devices, at least one of which can be used as a token access device that can read and write files to removable storage media suitable for use as a token, a computer operating system, and a CPU independent security subsystem which includes a security control unit and programmable auxiliary memory, sad method comprising of the steps of:

(a) generating with said security control unit a security subsystem key pair comprised of a public key and a private key;
(b) storing said private key data in a memory location which is under the control of the said security subsystem;
(c) creating with said security -subsystem a key file encrypted with said public key and writing the key file to a master token by means of said token access device, such that said encrypted key file can only be decrypted and authenticated by the security subsystem using its corresponding private key;
(d) allowing access to said security subsystem after initial installation and setup by said computer operating system for installation and modification of security requirements only when said master token is placed into an appropriate file storage device and said encrypted key file has been authenticated by the security subsystem;
(e) denying file and peripheral device access requests by the central processing unit when the security requirements are not satisfied.

2 more elements

A computer security system for a computer having a CPU, a common bus carrying control logic signals, address signals, and data signals, and a computer operating system which comprises:

(a) means for providing a CPU independent security subsystem comprised of a control unit, programmable memory, a security program and general security parameters;
(b) means for attaching said security subsystem and a plurality of peripheral devices and file storage devices, with at least one of said file storage devices capable of reading and writing to removable media which will be used as a token read/write device, to said common bus;
(c) means for said security subsystem to generate at least one pair of keys comprising a private key and a public key and storing sad pair of keys in a restricted memory location residing on at least one of said file storage devices under the control of said security subsystem;
(d) means for said security subsystem to encrypt at least one key file using said public key and to write said encrypted key file by means of said token read/write device to a token comprised of removable storage media;
(e) means for requiring said security subsystem to deny access requests by said CPU to said peripheral and storage devices whenever said access requests violate said general security parameters;
and
(f) means for requiring said security subsystem to accept modifications of said general security parameters after initial installation and setup when said token is inserted into said token read/write device and said security subsystem has decrypted said encrypted key file using said private key and thereby verified the authenticity of said token.

4 more elements

Dependencies are inferred from the claim text.

Network security system allowing access and modification to a security subsystem after initial installation when a master token is in place

Life of this patent

Network security system allowing access and modification to a security subsystem after initial installation when a master token is in place

Life of this patent

Abstract

Claims23