Method and system for securing a computer network and personal identification device used therein for controlling access to network components

A security system for controlling access to a computer network at a network access point comprising a workstation, said system comprising:

• A. a personal digital identifier device comprising:
• (a) a wireless communications component comprising a transceiver;
• (b) a biometric acquisition component for obtaining a user's input biometric and producing a digital representation thereof;
• (c) a processor configured for communicating with said transceiver and said biometric component and operable for:
• (i) evaluating whether a template derived from said digital representation corresponds to a master template derived from a user's biometric digital representation previously produced by said biometric component and generating a matching signal when such a correspondence is determined;
• (ii) generating a private key to be held by said personal digital identifier device and a public key corresponding thereto and outputting said generated public key for transmission by said transceiver;
• (iii) producing a digital signature using said private key;
• and,
• (iv) verifying that an encrypted received message is from a security manager component using a public key for a private key associated with said security manager component;
• and,
• (d) secure storage containing said master template of a user's biometric, said generated private key and said public key for said private key associated with said security manager component,
• said personal digital identifier device being configured for producing, using said generated private key, a digitally signed challenge response message following said generating of said matching signal in response to a challenge received from said security manager component and for transmitting said response message, and said personal digital identifier device being configured to prevent transmission of any of said master template of a user's biometric and said private key;
• B. a base unit associated with said workstation and configured for initiating and maintaining wireless communications with said personal digital identifier device, said communications extending over an area defined by an envelope associated with said workstation, wherein, during a currently logged-in session of the user associated with the personal digital identifier device, a policy manager component directs the workstation to blank out the screen when a second personal digital identifier device is detected at a location within said envelope until such time as a user registered to said second personal digital identifier device is biometrically identified;
• and,
• C. a central server having access to network storage and utilizing said security manager component and said personal digital identifier device for authenticating said user, said network storage containing a public key corresponding to said private key generated by said personal digital identifier device.

A method for controlling access to a computer network in which workstations provide points of access to said network, said network including a central server communicating with said workstations and secure network storage, and a base unit configured for initiating and maintaining wireless communications with a portable personal digital identifier device carried or held by a user being associated with each said workstation, said wireless communications extending over an area defined by an envelope associated with said workstation, said method comprising the steps:

• (a) on registration of a first portable personal digital identifier device to a first user, within said first portable personal digital identifier device:
• receiving an input biometric of said user, producing a digital representation thereof, deriving from said digital representation a master template, securely maintaining said master template in storage, generating and securely maintaining in said storage a private key, generating a public key corresponding to said generated private key and providing said generated public key for storage in said network storage and receiving and storing in said storage a public key for a private key associated with a network security manager component;
• (b) transmitting a first signal from a base unit associated with one said workstation to said first personal digital identifier device and automatically transmitting from said first personal digital identifier device a response signal establishing communications between said base unit and said first personal digital identifier device in response to said first signal when said first personal digital identifier device is within said envelope;
• (c) receiving at said first personal digital identifier device a digitally signed challenge message ostensibly from said network security manager component and verifying within said first personal digital identifier device the origin of said challenge using said public key for said private key associated with said security manager component;
• (d) acquiring on said first portable personal digital identifier device an input biometric of said user, producing a digital representation thereof and deriving from said digital representation a biometric template;
• (e) evaluating within said first portable personal digital identifier device whether said biometric template corresponds to said master template and generating a matching signal when such a correspondence is determined;
• (f) producing within said first personal digital identifier device, using said generated private key, a digitally signed challenge response message following said generating of said matching signal in response to said challenge message and transmitting said response message to said security manager component to authenticate said first user;
• (g) permitting said authenticated first user to access said computer network through said workstation;
• and
• (h) during a currently logged-in session of the first user associated the first personal digital identifier device, directing the workstation to blank out the screen by a policy manager component when a second personal digital identifier device is detected at a location within said envelope until such time as a second user registered to said second personal digital identifier device is biometrically identified to have permission to view data of the currently logged-in session.