Control access to function of information device

A control system for controlling access to a protected function of an information device is disclosed. The control system includes a communication device configured to communicate with the information device entering an area. The control system also includes a database configured to store a relationship between the information device and a registered user. The control system further includes a control computer communicably coupled to the communication device. The control computer is configured to identify a user entering the area with the information device. The control computer is also configured to determine whether or not to permit access to the protected function based on the identified user and the registered user for the information device. The control computer is further configured to control the information device via the communication device so as to unlock or lock the protected function based on a result of determination whether or not to permit access.

BACKGROUND

The present invention, generally, relates to access control technique in the field of information security, more particularly, to control access to a function of an information device.

Data that contains information on individuals and/or confidential information is often stored in portable devices such as USB (Universal Serial Bus) flash memories, SD™ card, or the like.

SUMMARY

According to an embodiment of the present invention, there is provided a control system for controlling access to a protected function of an information device. The control system comprises a communication device, a database and a control computer communicably connected to the communication device. The communication device is configured to communicate with the information device entering an area. The database is configured to store a relationship between the information device and a registered user. The control computer is configured to identify a user entering the area with the information device. The control computer is also configured to determine whether or not to permit access to the protected function based on the identified user and the registered user for the information device. The control computer is further configured to control the information device via the communication device so as to unlock or lock the protected function based on a result of determination whether or not to permit access.

According to other embodiment of the present invention, there is provided a method for controlling access to a protected function of an information device by a control computer. The control computer identifies a user entering an area with the information device. The control computer also receives an identifier from the information device entering the area by a communication device that is communicably connected to the control computer. The control computer further determines whether or not to permit access to the protected function based on the identified user and a registered user in relation to the identifier. Further the control computer transmits a control signal to the information device by the communication device so as to unlock or lock the protected function based on a result of determination whether or not to permit access.

Control computers and computer program products relating to one or more aspects of the present invention are also described and claimed herein.

According to further other embodiment of the present invention, there is provided an information device. The information device comprises a communication device configured to communicate with a control computer in entering an area. The information device also comprises a protected module, to which access is controlled by the control computer. The information device further comprises a control module configured to block access to the protected module if the protected module is locked. The information device further comprises an interface for accessing the protected module via the control module. The control module is further configured to send an identifier used to identify the information device to the control computer by the communication device. The control module is also configured to receive a control signal from the control computer by the communication device. The control module is further configured to unlock or lock the protected module in response to receiving the control signal.

DETAILED DESCRIPTION

Now, the present invention will be described using particular embodiments, and the embodiments described hereafter are understood to be only referred as examples and are not intended to limit the scope of the present invention.

One or more embodiments according to the present invention are directed to control systems, methods, control computers and computer program products for controlling access to a protected function of an information device, as well as the information devices.

Sensitive information, such as information requiring management of secrets may suffer from a risk of leakage if a portable device holding the sensitive information is handed to an unauthorized party. Data encryptions and access restrictions, typically, can be used to protect the sensitive information stored in the information device. However, once the information device is handed to the unauthorized party, there is a chance that the unauthorized party attempts to break a password or a key since there is a procedure by which an authorized owner user can access to the protected data regardless of place. The unauthorized party may analyze the stored data read from the information device by using any known tools on general purpose computers such as personal computers. Thus, it is difficult to eliminate the risk of the leakage of the information via the information devices.

Herein disclosed is technology capable of reducing a risk of leakage of information via information devices, including an information device capable of reducing a risk of leakage of information.

In one or more embodiments according to the present invention, there is provided a novel access control system and a corresponding novel access control method for controlling access to a protected function of an information device. In a particular embodiment, the protected function is a secured storage region to which access is restricted by the novel access control system.

The novel access control system includes a communication device configured to communicate with an information device entering a predetermined area. In a particular embodiment, an information device entering a safety section or exiting from the safety section by passing through the predetermined area is subjected to communication. In a particular embodiment, the communication device is a wireless communication device such as RFID (radio frequency identifier) transceiver (or reader). The novel access control system further includes a database configured to store a relationship between the information devices and registered users. The novel access control system also includes a control computer communicably connected to the communication device. The control computer may include the database or may be in communication with the database on other computer.

The control computer is configured to identify a user entering the predetermined area with the information device. In a particular embodiment, a user entering the safety section or a user exiting from the safety section by passing through the predetermined area is subjected to identification. The identification may be performed by using an identification badge assigned to each owner user who is allowed to access to the protected function of the information device. Alternatively, the identification may be performed by using other identification information such as a biometric feature presented by the owner user.

The control computer is further configured to determine whether or not to permit access to the protected function based on the identified user and the registered user for the information device. The control computer is further configured to control the information device via the communication device so as to unlock or lock the protected function based on a result of the determination.

Now, referring to the series ofFIGS. 1-6, there are shown an access control system and method for controlling access to a protected function of an information device as well as the information device in the access control system according to an exemplary embodiment of the present invention.

Referring toFIG. 1, there is shown an overview of the access control system100. InFIG. 1, an installed environment of the access control system100is depicted. In a describing embodiment, targets for access control by the access control system100are information devices150, each of which has a protected function to which access is restricted. Hereinafter, the information device150is referred as a secured device and the protected function of the secured device150is referred as a device secured function.

As shown inFIG. 1, there may be mainly four sections that include a secured room102, an entrance room104, an outside106and a control room108. The secured room102is a place in which selective restriction of physical access is established. Thus, a certain level of physical security is ensured in the secured room102. The secured room102corresponds to a predetermined section in the describing embodiment. The control room108is a place where a control server120for controlling access to the device secured function of the secured device150is provided. In the describing embodiment, the control server120may be further configured to selectively restrict physical access of peoples to the secured room102. The outside106is a place just outside the secured room102.

The entrance room104is an area located between the secured room102and the outside106. In the describing embodiment, a person who wants to enter the secured room102and a person who wants to exit from the secured room102are requested to enter the entrance room104and pass through a corresponding gate in the entrance room104.

In the entrance room104, there may be provided an entrance gate110through which a person who wants to enter the secured room102is requested to pass. There may be provided also an exit gate112through which a person who wants to exit from the secured room102is requested to pass. Each gate110,112is equipped with a RFID transceiver (RFID TX/RX)126,124as a communication device, which connects to the control server120in the control room108via an appropriate wired and/or wireless network.

The control server120is a control computer configured to identify a user entering the entrance room104together with the secured device150. In the describing embodiment, identification of the user is performed by using an ID (identification) badge130assigned to an owner user of the secured device150, who is allowed to use the secured device150. In the describing embodiment, the secured device150and the ID badge130have a RFID transponder function that can responds to a request from the RFID transceivers126,124. Relationships between the secured devices150and the registered users such as owner users of the secured devices150are stored in a device and owner database (Hereinafter, the term “database” may be simply abbreviated to “DB”)122that may be connected to the control server120. Such relationship may be registered prior to the identification by appropriate methods.

A user entering the secured room102by passing through the entrance gate110in the entrance room104is subjected to the identification. Also, a user exiting from the secured room102by passing through the exit gate112in the entrance room104is subjected to the identification.

The RFID transceiver126for the entrance gate110is configured to communicate with the secured device150and the ID badge130entering the secured room102through the entrance gate110together. The RFID transceiver128for the exit gate112is configured to communicate with the secured device150and the ID badge130exiting from the secured room102through the exit gate112together. In the describing embodiment, communication range of the RFID transceiver126,128in the gate110,112may correspond to an area where the secured device150enters in order to communicate with the RFID transceiver126,128.

The control server120is further configured to determine whether or not to permit access to the device secured function of the secured device150based on the identified user and information stored in the device and owner DB122. The control server120is further configured to transmit a control signal by the RFID transceiver126,128to control the secured device150such that the device secured function of the secured device150is unlocked or locked based on a result of the determination.

Generally, the secured device150is inactive while it resides the outside106of the secured room102. However, as shown inFIG. 1, the device secured function of the secured device150athat enters the secured room102with the ID badge130athrough the entrance gate110is controlled to be unlocked (i.e. activated) in response to determining that the access is to be permitted in entering the secured room102. Consistency of the secured device150and the owner user may be automatically confirmed in response to the owner user passing the entrance room104with the secured device150.

In contrast, the device secured function of the information device150bthat exits from the secured room102through the exit gate112is controlled to be locked (i.e. de-activated). Thus, when the owner user leaves the secured room102, the secured device150may be automatically de-activated and the device secured function becomes inaccessible.

In a preferable embodiment, the access control system100further includes another RFID transceiver (RFID TX/RX)124in the secured room102in communication with the control server120. The RFID transceiver124is a transmit device configured to transmit a confirmation signal while the secured device150is staying in the secured room102, under control of the control server120. The confirmation signal is transmitted from the RFID transceiver124so as to extend an effective time during which access to the device secured function of the secured device150is permitted.

Thus, by polling the confirmation signal more frequently than the period of the effective time, the effective time would not expire as long as the secured device150stays in the secured room102. On the other hand, if the secured device150exists to the outside106from the secured room102without being de-activated by accident, the effective time would expire soon or later and the device secured function would become inaccessible.

In further preferable embodiment, the RFID transceiver124is further configured to terminate the confirmation signal for the secured device150related to an owner user who exits from the secured room102, in response to detecting the exit of the owner user. Thus, if the owner user forgets to take the secured device150when he/she exits from the secured room102, the effective time of the secured device150left behind the secured room102would expire soon or later.

In a preferable embodiment, the access control system100may further include an alarm device129in communication with the control server120. The control server120may alarm by using the alarm device129based on a result of the determination. Under control of the control server120, the alarm device129is configured to alarm if the secured device150exits from the secured room102by passing through the entrance room104even though the owner user of the secured device150is staying in the secured room102in order to notify that someone takes out the secured device150by mistake for example. The alarm device129is also configured to alarm if the owner user exits from the secured room102even though the secured device150related to the owner user is staying in the secured room102in order to notify misplace of the secured device150.

The installed environment shown inFIG. 1is only an example for appropriate environment. The entrance room104is clearly separated from the secured room102and the outside106in the above description. Also the entrance gate110and the exit gate112are described to be separately provided.

However, these are not intended to suggest any limitation. In other embodiment, merely an entrance or a door may be located between the secured room102and the outside106in place of the separated entrance room104. In other embodiment, there may be provided single entrance and exit gate through which both persons who want to enter or exit from the secured room102are requested to pass. In other embodiment, the entrance may be merely a passage without any gate that is used to control flow of people, and the users and the secured devices150entering a predetermined area, which may corresponds to a communication range of the RFID transceiver126,128, is subjected to the identification and the communication.

Also in the describing embodiment, the ID badge is used for the identification. However, this is only an example for possible design and not intended to suggest any limitation. In other embodiment, the identification may be performed by using other identification information such as a biometric feature presented by the owner user.

Further in the describing embodiment, there is merely single secured room102. However, in the other embodiment, there may be a plurality of predetermined safety sections where access to the device secured function of the secured device150is allowable. In this embodiment, a set including the RFID transceivers124,126,128is provided in each safety section among the plurality of the safety sections. The device and owner DB122may be further configured to store relationship between the secured device150and an allowable section where access to the device secured function of the corresponding secured device150is allowable. Access to the device secured function is denied if the secured device150is not in the corresponding allowable section.

Referring now toFIG. 2, a schematic of an example of a control server120is shown. The control server120is only one example of a suitable control computer and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the invention described herein. Regardless, the control server120is capable of being implemented and/or performing any of the functionality set forth herein.

The control server120may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types.

As shown inFIG. 2, the control server120is shown in the form of a general-purpose computing device. The components of the control server120may include, but are not limited to, one or more processors (or processing units)12and a memory14operatively coupled to the processors12by a bus26including a memory bus or memory controller, and a processor or local bus using any of a variety of bus architectures.

The control server120typically includes a variety of computer system readable media. Such media may be any available media that is accessible by the control server120, and it includes both volatile and non-volatile media, removable and non-removable media.

The memory14can include computer system readable media in the form of volatile memory, such as random access memory (RAM). The control server120may further include other removable/non-removable, volatile/non-volatile computer system storage media. By way of example only, the storage device16can be provided for reading from and writing to a non-removable, non-volatile magnetic media. Although not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a “floppy disk”), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM or other optical media can be provided. In such instances, each can be connected to bus by one or more data media interfaces. As will be further depicted and described below, the storage device16may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the invention.

Program/utility, having a set (at least one) of program modules, may be stored in the storage device16by way of example, and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data or some combination thereof, may include an implementation of a networking environment. Program modules generally carry out the functions and/or methodologies of embodiments of the invention as described herein.

The control server120may also communicate with one or more peripherals such as a input device20such as keyboard, a pointing device, etc.; a display22; one or more devices that enable a user to interact with the control server120; and/or any devices (e.g., network card, modem, etc.) that enable the control server120to communicate with one or more other devices. Still yet, the control server120can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via the network adapter18. As depicted, the network adapter18communicates with the other components of the control server120via bus26. Also the control server120can communicate with RFID transceivers124,126,128and an alarm device129through one or more networks via the I/O interface24. It should be understood that although not shown, other hardware and/or software components could be used in conjunction with the control server120. Examples, include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

Referring now toFIG. 3, a schematic of an example of a secured device150is shown. The secured device150shown inFIG. 3is only an example of a suitable information device. Regardless, the secured device150is capable of being implemented and/or performing any of the functionality set forth herein. In the describing embodiment, the secured device150may include a lock control module52, a device basic function54, an external interface56, a device secured function58, an RFID transponder60, a counter62and a storage module64.

The lock control module52is a control module configured to control access to the device secured function58. The device basic function54is a function module for providing a certain functionality of the secured device150, to which access is not restricted. In a particular embodiment, the device basic function54is a normal storage region on the secured device150. A host computer to which the secured device150is connected can access the device basic function54without any restriction.

The external interface56is an interface for accessing the device basic function54and the device secured function58via the lock control module52. The lock control module52is configured to block access to the device secured function58if the device secured function58is locked. The lock control module52is configured to pass access to the device secured function58if the device secured function58is unlocked.

In contrast to the device basic function54, the device secured function58is a protected function module to which access is controlled by the control server120. In a particular embodiment, the device secured function58is a secured storage region on the secured device150. A host computer to which the secured device150is connected can access the device secured function58merely if the device secured function58is unlocked.

The lock and the unlock of the device secured function58are controlled by the lock control module52cooperating with the RFID transponder60, the counter62and the storage module64.

The RFID transponder60is a communication device configured to communicate with the control server120when the secured device150enters the gate110,112. The RFID transponder60can respond to a request from the RFID transceivers124,126,128shown inFIG. 1.

The counter62is configured to count down an effective time during which access to the device secured function58is permitted, after the information device is powered. The counter62may be refreshed by the lock control module52in response to receiving the confirmation signal transmitted from the RFID transceiver124inFIG. 1by the RFID transponder60while the secured device150is staying in the secured room102. After activation, the effective time of the secured device150would not expire as long as the secured device150stays in the secured room102. However, if the secured device150exits from the secured room102without de-activation at the exit gate112by accident, the effective time would expire soon or later.

The storage module64is configured store a secured key for accessing to the device secured function58and a device identifier used to identify the secured device150in the access control system100.

The lock control module52performs entrance and exit handling protocols in relation to the device secured function58. The lock control module52is configured to send the identifier stored in the storage module64by the RFID transponder60in response to a request transmitted from the control server120via the RFID transceiver126,128. The lock control module52is configured to receive the control signal from the control server120by the RFID transponder60.

The lock control module52is configured to unlock or lock the device secured function58in response to receiving the control signal transmitted from the control server120. The control signal may be a device activation signal by which the device secured function58is unlocked or a device de-activation signal by which the device secured function58is locked.

In a preferably embodiment, the lock control module52may perform further a device operation protocol for maintaining activation of the secured device150. The lock control module52may be further configured to refresh the counter62in response to receiving the confirmation signal transmitted from the RFID transceiver124while the secured device150is staying in the secured room102.

Power for the entrance and exit handlings and device operation protocols may be covered by electromagnetic wave transmitted from the RFID transceiver126,128or by any battery device equipped therein.

As shown inFIG. 3, the secured device150includes one or more modules52-64to provide various features and functions. These modules may be implemented in hardware, software or firmware executable on hardware, or a combination thereof. However, in a preferable embodiment, these modules52-64can be implemented in hardware such as a chip or discrete circuit. It should be understood that although not shown, other hardware and/or software components could be used in conjunction with the secured device150. In a describing embodiment, the secured device150may be, but not limited to, implemented as a portable storage device such as a USB flash memories. However, in other embodiments, the secured device150may be implemented as any device that includes a protected functionality, which may include smartphones, tablet computers, laptop computers, hand-held computers, stick computers, and so on.

Referring toFIG. 4, an entrance handling protocol between the control server120, the secured device150and the ID badge130in the access control system100is shown. As shown inFIG. 4, process for the entrance handling protocol begins at step S101in which the control server120transmits a device inquiry by the RFID transceiver126equipped in the entrance gate110. The device inquiry may be periodically transmitted by the RFID transceiver126. Alternatively, the device inquiry may be transmitted by the RFID transceiver126in response to detecting that someone enters the entrance gate110by any known sensor such as a motion detector.

In response to receiving the device inquiry from the control server120by the RFID transponder60, the secured device150just passing the entrance gate110responds a device acknowledgement (in the drawings “acknowledgement” may be referred as “ack”) by the RFID transponder60at step S102. If the control server120receives the device acknowledgement for the device inquiry, the control server120further sends a device ID request to the secured device150by the RFID transceiver126at step S103.

In response to receiving the device ID request from the control server120, the secured device150responds own device ID stored in the storage module64by the RFID transponder60at step S104. If the control server120receives the device ID as a response for the device ID request, the control server120refers owner's ID corresponding to the received device ID from the device and owner DB122at step S105. Then, the control server120transmits a badge ID request by the RFID transceiver126at step S106.

In response to receiving the badge ID request from the control server120, the ID badge130just passing the entrance gate110responds the own badge ID at step S107. If the control server120receives the badge ID as a response for the badge ID request, the control server120identifies a user just passing the entrance gate110by using the received badge ID and compares the identified badge ID with the owner information corresponding to the received device ID at step S108. In a preferable embodiment, the control server120may authenticate the user by using the badge ID with user authentication information in the device and owner DB122or other external user information database.

If the control server120determines that the identified badge ID is matched with the owner's ID of the secured device150entering with the badge ID in the step S108, then the control server120transmits a device activation signal, preferably with a device ID newly generated by the control server120at step S109.

In a preferable embodiment, the control server120generates a new device ID used to identify the secured device150and sends the new device ID to the secured device150via the RFID transceiver126. The device ID may be updated every time when the secured device150goes in the secured room102and merely the control server120can know the latest device ID in this embodiment. Therefore, even though duplication of the secured device150is possible, the duplication may become meaningless after the authorized owner enters the secured room102appropriately. Also in other preferable embodiment, the device activation signal may be encrypted by appropriate technique on the basis of the device ID in order to prevent the signal from eavesdropping and/or duplicating.

In response to receiving the device activation signal from the control server120, the secured device150activates itself so as to unlock the device secured function58by the lock control module52, and preferably sets the new device ID in the storage module64in order to send the new device ID for a next time. Then, the secured device150responds an acknowledgement to the control server120at Step S111. If the control server120receives the acknowledgement for the device activation signal, the control server120passes the user by opening the entrance gate110at step S112, for instance. In the preferable embodiment, the newly generated device ID may be overridden into the device and owner DB122.

If the control server120determines that the identified badge ID is not matched with the owner's ID in the step S108(NO), the process proceeds to step S113and ends the protocol. In this case, the secured device150would not be unlocked since unauthorized pair of the secured device150and the ID badge130enters the entrance gate110together.

Referring toFIG. 5, a device operation protocol executed by the secured device150in the access control system100is shown. As shown inFIG. 5, process for the operation protocol begins at step S200in response to the secured device150being powered on for instance. At step S201the secured device150initiates the counter62for counting the effective time. At step S202, the secured device150determines whether the counter62expires or not.

If the secured device150determines that the counter62does not expire in step S202(NO), the process branches to step S203. At step203, the secured device150further determines whether an incoming signal is presented or not. If the secured device150determines that the incoming signal is not presented at step203(NO), then the process loops back to step S202in order to wait for the incoming signal.

If the secured device150determines that the incoming signal is presented in step S203(YES), the process branches to step S204. In a particular embodiment, the device inquiry may be periodically transmitted by the RFID transceiver124for the secured device staying in the secured room102. At step S204, the secured device150receives the device inquiry transmitted from the RFID transceiver124. At step S205, the secured device150responds a device acknowledgement for the device inquiry.

The RFID transceiver124may transmit a device counter reset signal as confirmation signal in the describing embodiment, if the control server120confirms that the secured device150is staying in the secured room102using the device inquiry. At step S206, the secured device150receives the device counter reset signal from the RFID transceiver124. At step S207, the secured device150resets and restarts the counter62, and the process loops back to step S202in order to wait for expiration.

If the secured device150determines that the counter62expires in step S202(YES), the process proceeds to step S208. At step208, the secured device150deactivates the device secured function58by the lock control module52, and the process ends at step S209.

According to the device operation protocol shown inFIG. 5, the counter62counts down the effective time while the secured device150is operating. The control server120causes the counter reset with appropriate intervals. A situation where the counter reset does not take place means that the secured device150is not staying in the secured room102. Thus, the effective time would expire soon or later and the device secured function58of the secured device150would become inaccessible.

On the other hand, by repeating the reset of the counter62, it is confirmed that the secured device150is staying in the secured room102. The effective time would not expire as long as the secured device150is staying in the secured room102.

Referring toFIG. 6, an exit handling protocol between the control server120, the secured device150and the ID badge130in the access control system100is shown. As shown inFIG. 6, process for the exit handling protocol begins at step S301in which the control server120transmits a device inquiry by the RFID transceiver128equipped in the exit gate112. The device inquiry may also be transmitted periodically or in response to detecting that someone enters the exit gate112by any known sensor.

In response to receiving the device inquiry from the control server120, the secured device150just passing the exit gate112responds a device acknowledgement by the RFID transponder60at step S302. If the control server120receives the device acknowledgement for the device inquiry, the control server120further sends a device ID request to the secured device150by the RFID transceiver128at step S303.

In response to receiving the device ID request from the control server120, the secured device150responds own device ID stored in the storage module64by the RFID transponder60at step S304. If the control server120receives the device ID, the control server120refers owner's ID corresponding to the received device ID from the device and owner DB122at step S305. Then, the control server120transmits a badge ID request by the RFID transceiver128at step S306.

In response to receiving the badge ID request from the control server120, the ID badge130just passing the exit gate112responds own badge ID at step S307. If the control server120receives the badge ID, the control server120identifies a user just passing the exit gate112with the ID badge130and the secured device150and compares the identified badge ID with the owner information corresponding to the device ID at step S308.

In a preferable embodiment, the control server120may also authenticate the user by using the badge ID with the device and owner DB122or other external user authentication information. If the identified badge ID is matched with the owner's ID of the secured device150in step S308, then the control server120transmits a device de-activation signal, preferably with a device ID newly generated by the control server120at step S309. In a preferable embodiment, the control server120generates a new device ID used to identify the secured device150and sends the new device ID to the secured device150via the RFID transceiver128as similar as the entrance handling protocol.

In response to receiving the de-activation signal from the control server120, the secured device150de-activates itself so as to lock the device secured function58by the lock control module52, and preferably sets the new device ID in the storage module64in order to send the new device ID for a next time. Then, the secured device150responds an acknowledgement to the control server120at step S311. Since the device ID may be updated every time when the secured device150goes out of the secured room102and merely the control server120can know the latest device ID in this embodiment, the duplication of the secured device150may become meaningless after the authorized user exits the secured room102appropriately.

If the control server120receives the acknowledgement for the de-activation signal, the control server passes the user by opening the exit gate112at step S312, for instance. In the preferable embodiment, the newly generated device ID may be overridden into the device and owner DB122.

If the control server120determines the identified badge ID is not matched with the owner's ID in step S308(NO), the process proceeds to step S313to put a security alarm of the alarm device129into action. In this case, the secured device150would be locked and the alarm notifies that unauthorized pair of the secured device150and the ID badge130exits the exit gate112together.

In accordance with the entrance handling, exit handling and device operation protocols according to the exemplary embodiment of the present invention, following cases can be supposed.

When any person other than the owner user enters the secured room102with the secured device150, the secured device150would not be activated since inconsistency between the badge ID and the device ID is detected.

When any person other than the owner user leaves the secured room102with the secured device150, the secured device150would be de-activated and the security alarm may be alerted since inconsistency between the badge ID and the device ID is detected or exit of solely the secured device150from the secured room102is detected.

When the owner user leaves the secured room102without carrying the secured device150, alarm may be alerted and the control server120may terminate the device inquiry (confirmation signal) by the RFID transceiver124since exit of solely the owner user from the secured room102is detected and the corresponding secured device150is left behind the secured room102. The secured device150would cause the counter62to expire and be automatically de-activated.

When the secured device150enters the secured room102without passing through the entrance gate110, access to the device secured function58would be denied since the secured device150is not activated at the entrance room104in proper manner.

When the secured device150exits from the secured room102without passing through the exit gate112, the secured device150may keep activation for a short amount of time, however, the counter62would expire soon or later so as to make the secured device150inactive in response to being powered on since the counter62is not subjected to the polling of the confirmation signal.

When power supply for the access control system100is terminated by accident, the secured device150would cause the counter62to expire and be automatically de-activated. Thus, even though a host computer to which the secured device150is connected has a battery, access to the device secured function58would be prevented.

In the above describing embodiment, the device and owner DB122is configured to store the relationship between the secured device150and the owner user paired with the secured device150, and the device secured function58is unlocked merely if the authorized pair is entered the secured room102together. However, this is only an example of applicable rules for activation of the secured device150.

In one or more embodiments according to the present invention, there are several applicable rules for activation/de-activation of the secured device150. Referring toFIG. 7, four applicable rules for activation/de-activation of the secured device150are shown.

In one embodiment, the registered user in the device and owner DB122may include a plurality of necessary owners, and access to the device secured function58is denied if any one of the necessary owners is out of the secured room102.FIG. 7Adescribes a condition that includes a logical conjunction (i.e. AND operation) of the owners. InFIG. 7, a badge marked by a gray circle represents an owner's ID badge. A badge with a dash line represents the ID badge that is absent. As shown inFIG. 7A, to activate the secured device150all of the necessary owners are requested to exist in the secured room102. If anyone is absent, the secured device150becomes inactive. In this embodiment, it is preferable that the secured device150can be activated in the secured room102without passing through the entrance gate110.

In other embodiment, the registered user may include a plurality of owners, and access to the device secured function58is permitted if any one of the owners is staying in the secured room102.FIG. 7Bshows a condition that includes a logical disjunction of the owners (i.e. OR operation). As shown inFIG. 7B, the secured device150is activated in the presence of any one of the owners registered for the secured device150. The secured device150becomes inactive merely if everyone is absent.

In further other embodiments, the registered user in the device and owner DB122may include one or more white-listed or black-listed users, in order to prevent shoulder surfing.

In one embodiment, the registered user may include one or more white-listed users, and access to the device secured function58is denied if any user other than the one or more white-listed users is staying in the secured room102.FIG. 7Cdescribes a condition that includes a whitelist of users. A badge filled by gray represents a non-white-listed user' badge. As shown inFIG. 7C, the secured device150is de-activated if a person who is not listed in the whitelist exists in the secured room102even though the owner exists in the secured room102.

In other embodiment, the registered user may include one or more black-listed users, and access to the device secured function58is denied if any one of the one or more black-listed users is staying in the secured room102.FIG. 7Ddescribes a condition that includes a blacklist of users. A badge filled by black represents a black-listed user' badge. As shown inFIG. 7D, the secured device150is de-activated if a person who is listed in the blacklist exists in the secured room102even though the owner exists in the secured room102.

The access control system, method for controlling access to the device secured function of the secured device and the secured device shown inFIGS. 1-6have following advantages:

The secured device150is automatically activated or de-activated in response to the secured device150and its owner passing the gate110,112. Any additional action to activate the secured device150is not required. The secured device150would be activated merely if the authorized pair of the secured device150and the owner passes through the gate110,112. The secured device150would not be activated when another person carrying the secured device150enters the secured room102.

The secured device150does not become active unless it resides in the secured room102with the owner. Thus, any third party could not use the secured device150outside of the secured room102. In the preferable embodiment, a new device ID is distributed in response to enter or exit from the secured room102. Accordingly, the secured device150that is exited from the secured room102without passing through the exit gate112would not be activated for next time or later. For another advantage, the history of the entrance and exit of the secured device150and the owner user can be recorded.

According to one or more embodiment of the present invention, there is provided a way for direct activating or de-activating the device secured function58of the secured device150, without interposing any computer, in response to only the authorized owner passing through the predetermined area with the secured device150. In the access control system100and method shown inFIGS. 1-7, inadvertent disclosures, exposures or leakage of the sensitive information to unauthorized parties or entities can be preferably prevented.

Computer Program Implementation

The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below, if any, are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of one or more aspects of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed.