EP2005357A2 - Systèmes informatiques - Google Patents

Systèmes informatiques

Info

Publication number
EP2005357A2
EP2005357A2 EP07712860A EP07712860A EP2005357A2 EP 2005357 A2 EP2005357 A2 EP 2005357A2 EP 07712860 A EP07712860 A EP 07712860A EP 07712860 A EP07712860 A EP 07712860A EP 2005357 A2 EP2005357 A2 EP 2005357A2
Authority
EP
European Patent Office
Prior art keywords
server
code
station
data
client
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP07712860A
Other languages
German (de)
English (en)
Inventor
Michael Paul Whitlock
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to EP10006442A priority Critical patent/EP2239680A1/fr
Publication of EP2005357A2 publication Critical patent/EP2005357A2/fr
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources

Definitions

  • This disclosure relates to computer systems.
  • a computer system comprising: a data processor, and at least one data input station for use by at least one user for communication with the data processor; each said data input station having a station code associated therewith, and each said user having a user code required for logging into the system; each said data input station having an encryption engine adapted to combine and encrypt the station code and the user code when a said user logs into the system at a particular said station to provide an encrypted log-on signal, the data input station being coupled to transmit said encrypted log-on signal to the data processor; the data processor including a decryption engine, and an access controller, and including a memory storing a table of permitted combinations of station code and user code; the decryption engine being adapted to decrypt received encoded log-on signals and to configure said access controller to allow access from a particular data input station to and manipulation of data in said data processor only when the decrypted log-on signal corresponds to a permitted said combination.
  • the station code may consist of a Licence Number or, where a number of stations are covered by a single licence, of a Licence Number combined with a station identifier.
  • the Licence Number may be embedded in a device that may be fitted to an existing personal computer.
  • the said device may also include the encryption engine.
  • the said device may be arranged for coupling to a personal computer by an internal or external slot, including a USB connection.
  • the user code may be required to be manually input by use of a keyboard, or may be embedded in a device that may be carried by the user and arranged to be coupled by a user to the data input station, for example by a USB connection or via a card reader, or may comprise biometric or biometrically derived data.
  • the decryption engine and/or the memory may be embedded in a device that may be fitted to the data processor via an internal or external slot.
  • a networked computer system comprising: a network including: a server, and at least one client authorised for communication with said server, at which client data may be input into the system; each said client having a memory storing a table containing a plurality of code words, and an encryption engine adapted to encrypt said input data using code words from said table to provide packets of data to be transmitted via said network to the server, each said packet being encrypted using a said code word selected for that packet or for a train of said packets from said table; the server including a decryption engine adapted to decrypt data packages received by said server for processing by said server, and a memory storing a table containing a plurality of code words including all code words associated with all clients authorised for communication with said server, said decryption engine being adapted to identify from each data package received by said server whether the particular said package was encoded using a code word present in said table and to decrypt said package using the particular said code word.
  • code words are randomly or pseudo-randomly chosen from the client code word table.
  • the server includes an encryption engine so that any data transmitted from the server to a selected client is similarly encoded using a code word selected for each data package or for a train of said packages from a plurality of code words associated with the selected client and held in an encryption table by the server, the client having a corresponding decryption engine adapted to identify from each data package received by said server whether the particular said package was encoded using a code word associated with the particular client and present in a decryption table held by the client and to decrypt said package using the particular said code word.
  • the encryption engine (and the decryption engine, when present) and memory storing the respective said table(s) may be embedded in one or more devices that may be fitted to the client via external or internal slots.
  • the decryption engine of the server (and the server encryption engine, when present) and memory storing the respective table(s) may be embedded in one or more devices that may be fitted to the client via external or internal slots.
  • a networked computer system comprises a computer system according to the first aspect of this disclosure, the server comprising the data processor, and each client comprising a said data input station.
  • the server/data processor has one or more devices fitted thereto via external or internal slots, the device(s) embedding both the decryption engine and memory of the first aspect, and the decryption engine of the server (and the server encryption engine, when present) and memory storing the respective table(s) of the second aspect.
  • each client/data input station has one or more devices fitted thereto via external or internal slots, the said device(s) embedding both the decryption engine of the server (and the server encryption engine, when present) and memory storing the respective table(s), and a Licence Number combined with a station identifier and serving as serving as the station code for the said data input station.
  • Fig. 1 shows a generally schematic diagram illustrating an embodiment of computer system
  • Fig. 2 is a logic flow diagram schematically illustrating operation of the system of Fig. 1.
  • the illustrated embodiment of computer system comprises a network 1 connecting a server 2 to a plurality of clients 3, 4, 5....
  • the network may comprise a private network, for example an Ethernet, or a public network such as the Internet.
  • Each of the clients is arranged to serve as a data input station for inputting data to the system.
  • Each client includes an encryption engine 6 and a memory 7.
  • the encryption engine and the memory may be embedded in a device 8 that may be fitted to an existing client/data input station, for example to an internal PCI slot for a personal computer or to an external PC Card slot for a laptop.
  • Server 2 includes a decryption engine 9 and a memory 10, which may both be embedded in a device 11 that may be fitted to an internal or external slot of an existing server, preferably an internal slot, such as a high speed PCI slot. Another alternative is a USB slot. Multiple devices (cards) may be employed to balance the load, enabling a larger throughput.
  • Fig. 2 illustrates the logical steps involved in a log-on procedure.
  • An intending User seeks to log on to a selected client at step 12. This may be by manually inputting a conventional User Name and Password, as indicated in step 12 in Fig. 2.
  • each User may have their User Name and/or Password embedded in a device which must be connected to the client at step 12, for example by connection to a USB socket or by means of a card reader.
  • the User identifying data may be biometric data or biometrically derived data.
  • the client adds a Licence Number (for use of a system in accordance with the present invention) and a code identifying the specific client/data input station at step 13. These together define a station code.
  • the Licence Number, and optionally the station identifier may be embedded in device 8 in memory 7.
  • a Licence/program card when a Licence/program card is first fitted to a particular client device and the driver(s) loaded, the card stores in its memory an identifier derived from the client, for example the serial number of its motherboard. This has the added security that it prevents cards being moved from an authorised client to one that is not. Thereafter, as part of the User verification procedure, the client data stored on the card is checked against that same data in the client itself. Further steps are only permitted if they match.
  • a data packet comprising a user code identifying the User associated with the User Name and Password, or biometric data
  • the station code is passed to encryption engine 6 in step 14, where the data is encrypted.
  • the encryption engine passes the encrypted data to an outlet port 16 (Fig. 1), for example an Ethernet port, connected to network 1.
  • the station code could be any suitable code or unique number, for example the MAC address of the Ethernet card connecting the client to the network.
  • the server 2 picks up the data packet from network 1 at step 17.
  • Decryption engine 9 extracts the code word reference from the packet and decrypts the data on the basis of that code word in step 18. It does this by checking in memory 10 for a table of code words. If the particular code word is found in that Table it is employed for decrypting the packet to extract the User identifier (for example User Name and Password) and the client identifier (for example: Licence Number and the station identifier).
  • the decryption engine 9 is adapted to configure an access controller that effectively controls access to data in server 2, so that such access is denied unless the combination of identification data for the User and client (for example: User Name, Password, Licence Number and station identifier) is a permitted combination.
  • the combination is tested at step 19 to check whether it is a permitted combination. Such permitted combinations may be stored in memory 10. If the combination is not permitted, an error routine is initiated at step 20 and the submission of the non-permitted combination is logged. However, if the combination is permitted, the server 2 accepts the log-in as a valid log-in in step 21 and makes the network and the server available to the User concerned from client station 3 in step 22.
  • a User creates a request of network data, for example using a conventional keyboard. This causes code words to be selected from a table of code words in memory 7 and to be passed with the data to encryption engine 6 in step 24.
  • the data is encrypted by encryption engine 6 in step 25 so that each packet of data is encrypted with a code word chosen for that particular packet from the table of code words in memory 7.
  • a train of packets is encrypted using a single code word chosen for that train.
  • the code words may be randomly or pseudo-randomly chosen.
  • the encryption engine 6 passes the encrypted data to outlet port 16 connected to network 1.
  • the server 2 picks up the data packet from network 1 at step 27.
  • Decryption engine 9 extracts the code word reference from the packet and decrypts the data on the basis of that code word in step 28. It does this by checking in memory 10 for a table of code words. If the particular code word is found in that Table it is employed for decrypting the packet to extract the data.
  • the server 2 then processes the data request in step 29 and builds a reply data packet if appropriate. Details of the transaction are copied to a log file in step 30 and an extract of the log file is copied at step 31 to a secure server 32 (Fig. 1).
  • a particular code word is chosen from a table of code words in memory 10 in step 33 and passed to an encryption engine to encrypt the reply data package in step 34, using its particular code word.
  • a single code word may be selected for a train of packets.
  • the decryption engine 9 is arranged to serve as this encryption engine.
  • the encrypted data is passed, in step 35, to an outlet port 36 from server 2 to the network 1.
  • the data is then decrypted on reaching client 3.
  • a decryption engine extracts the code word reference from the packet and decrypts the data on the basis of that code word. It does this by checking in memory 7 for a table of code words. If the particular code word is found in that Table it is employed for decrypting the packet to extract the data.
  • the encryption engine 6 is arranged to serve as this decryption engine.
  • each individual data packet or train of packets in the described system has a particular code word chosen for that specific package, the system is very secure.
  • An attempt to use an embedded device containing the code words, but taken from another system or from another server or client, in an attempt to intercept and read data packets, will be frustrated, as the described system requires a permitted combination of User and client identifiers at log on, before access to the system can be obtained.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

La présente invention concerne un système informatique en réseau qui comprend un réseau comprenant un serveur et au moins un client autorisé à communiquer avec ce serveur, des données pouvant être entrées dans le système au niveau du client. Chaque client comprend une mémoire qui contient une table contenant une pluralité de mot-codes. Le client dispose également d'un moteur de cryptage conçu pour crypter les données entrées au moyen des mot-codes issus de la table afin de fournir des paquets de données à transmettre au serveur via le réseau. Chaque paquet est crypté au moyen d'un mot-code sélectionné pour ce paquet ou pour un train composé de paquets de ce type en provenance de la table. Le serveur comprend un moteur de décryptage conçu pour décrypter des paquets de données reçus par le serveur pour leur permettre d'être traités par celui-ci. Une table de mot-codes est enregistrée au niveau du serveur et contient tous les mot-codes associés à tous les clients autorisés à communiquer avec le serveur. Le moteur de décryptage identifie à partir de chaque paquet de données reçu par le serveur, si le paquet particulier a été codé au moyen d'un mot-code présent dans la table, et si c'est le cas, décrypte le paquet au moyen du mot-code. Chaque client comprend de préférence un poste d'entrée de données auquel est associé un code de poste, et chacun desdits utilisateurs du système a un code utilisateur qui lui est nécessaire pour ouvrir une session dans le système. Le moteur de cryptage de chaque client est conçu pour combiner et crypter le code de poste et le code utilisateur lorsqu'un utilisateur ouvre une session dans le système au niveau d'un poste particulier, afin de fournir un signal de session crypté. Le poste d'entrée de données transmet le signal de session crypté au serveur. Le moteur de cryptage du serveur est relié à un contrôleur d'accès et comprend une mémoire contenant une table de combinaisons permises de code de poste et code utilisateur. Le moteur de décryptage décrypte des signaux de session codés reçus et configure le contrôleur d'accès pour permettre l'accès depuis un poste d'entrée de données particulier, et la manipulation de données dans le processeur de données uniquement lorsque le signal de session décrypté correspond à une combinaison permise.
EP07712860A 2006-03-10 2007-03-08 Systèmes informatiques Ceased EP2005357A2 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP10006442A EP2239680A1 (fr) 2006-03-10 2007-03-08 Systèmes informatiques

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
GB0604887A GB2436670B (en) 2006-03-10 2006-03-10 Computer systems
PCT/GB2007/000809 WO2007104931A2 (fr) 2006-03-10 2007-03-08 Systèmes informatiques

Publications (1)

Publication Number Publication Date
EP2005357A2 true EP2005357A2 (fr) 2008-12-24

Family

ID=36241398

Family Applications (2)

Application Number Title Priority Date Filing Date
EP10006442A Withdrawn EP2239680A1 (fr) 2006-03-10 2007-03-08 Systèmes informatiques
EP07712860A Ceased EP2005357A2 (fr) 2006-03-10 2007-03-08 Systèmes informatiques

Family Applications Before (1)

Application Number Title Priority Date Filing Date
EP10006442A Withdrawn EP2239680A1 (fr) 2006-03-10 2007-03-08 Systèmes informatiques

Country Status (3)

Country Link
EP (2) EP2239680A1 (fr)
GB (1) GB2436670B (fr)
WO (1) WO2007104931A2 (fr)

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS63301350A (ja) * 1987-06-01 1988-12-08 Hitachi Ltd 端末装置からのホストコンピユ−タ情報不正アクセス防止方式
US5657388A (en) 1993-05-25 1997-08-12 Security Dynamics Technologies, Inc. Method and apparatus for utilizing a token for resource access
JP2001282736A (ja) * 2000-03-28 2001-10-12 Japan Aviation Electronics Industry Ltd 個人認証システム
CN1299222C (zh) * 2001-03-14 2007-02-07 诺基亚有限公司 存在管理的实现
JP3785640B2 (ja) * 2002-02-25 2006-06-14 ソニー株式会社 サービス提供装置及びサービス提供方法
JP2005085090A (ja) * 2003-09-10 2005-03-31 Konica Minolta Business Technologies Inc 遠隔処理装置
JP2005085154A (ja) * 2003-09-10 2005-03-31 Ricoh Co Ltd ネットワークシステムおよび端末装置
NO20050152D0 (no) * 2005-01-11 2005-01-11 Dnb Nor Bank Asa Fremgangsmate ved frembringelse av sikkerhetskode og programmbar anordning for denne

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
MENEZES: "Applied cryptography, Chapter 10, Identification and entity authentication", 1997, XP002262234 *

Also Published As

Publication number Publication date
GB2436670A (en) 2007-10-03
GB2436670B (en) 2010-12-22
EP2239680A1 (fr) 2010-10-13
GB0604887D0 (en) 2006-04-19
WO2007104931A3 (fr) 2007-11-15
WO2007104931A2 (fr) 2007-09-20

Similar Documents

Publication Publication Date Title
CN107563213B (zh) 一种防存储设备数据提取的安全保密控制装置
US20020087857A1 (en) Security system for high level transactions between devices
CN102521165B (zh) 安全优盘及其识别方法和装置
US9124930B2 (en) In-circuit security system and methods for controlling access to and use of sensitive data
US8572392B2 (en) Access authentication method, information processing unit, and computer product
CN101345619B (zh) 基于生物特征和移动密钥的电子数据保护方法及装置
US7926090B2 (en) Separate secure networks over a non-secure network
US8566952B1 (en) System and method for encrypting data and providing controlled access to encrypted data with limited additional access
US20070223685A1 (en) Secure system and method of providing same
CN1551003A (zh) 用于正在处理中的加密/解密usb数据的动态置换
US6981156B1 (en) Method, server system and device for making safe a communication network
US8181223B2 (en) Electronic apparatus conducting two-port authentication, method of authenticating and receiving job data, an recording medium containing job data authentication-reception program
US20120198538A1 (en) Multi-enclave token
CN101375259A (zh) 数据保全系统
WO2019234409A1 (fr) Clé électronique de chiffrement de données
CA2106574A1 (fr) Interface d'ordinateur sure
KR20100133953A (ko) 데이터를 안전하게 하는 시스템 및 방법
CN114546506B (zh) 嵌入式操作系统的授权方法及装置、设备和介质
CN101286987A (zh) 一种转移软件授权许可的方法
US20150121504A1 (en) Identification process of application of data storage and identification hardware with ic card
US20100058453A1 (en) Identification process of application of data storage and identification hardware with ic card
EP2239680A1 (fr) Systèmes informatiques
CN108809938A (zh) 一种密码设备的远程管控实现方法及系统
CN109753768A (zh) 一种web软件加密方法
CN100469012C (zh) 资料储存应用认证方法

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20081008

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC MT NL PL PT RO SE SI SK TR

17Q First examination report despatched

Effective date: 20090113

DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20100623