Abstract:
A proximity based computer access system is provided. According to the invention, a local key associated with a workstation wirelessly communicates with a local key which is associated with a user. If the user, and remote key, are outside of a preset radius of the workstation, access to the workstation is disabled. Accordingly, a workstation is secured from unauthorized access when an authorized user is not nearby. The present invention allows organizations to efficiently secure sensitive data from unauthorized access while reducing the requirements of users to manually enable and disable access to the sensitive data through the workstation.

Description:
FIELD OF THE INVENTION 
     The present invention relates generally to software and data access, and more particularly, to a wireless proximity detection system which enables or disables software and data access. 
     BACKGROUND OF THE INVENTION 
     Software and data security are important considerations for many companies and individuals. Typically, in order to help insure that a user at a computer is an authorized user, a user account is required to access the computer. As is well known, a user logs in to the computer using the user account by entering user identification information and a password. This type of system is effective so long as the user logs out of the computer when leaving it unattended. However, if a user leaves the computer terminal unattended, an unauthorized user may use the computer and access the software or data. This unauthorized user may misappropriate information from the computer. Accordingly, it would be advantageous to have a device which automatically disables access to sensitive software and data when an authorized user leaves a computer unattended. Furthermore, such a password system has the additional possibility of an unauthorized user misappropriating the password. In such a case, even if the authorized user has logged out of the computer, the unauthorized user may use the misappropriated password to gain access to the system. Thus, it would also be advantageous to provide a system which limits access to software and data to situations where the authorized user is in close proximity to the computer. 
     In addition to passwords being required to access a system, another method of limiting access to a computer is through a special piece of hardware or “dongle.” The dongle is a special piece of hardware that connects to the serial or parallel port of a computer. The software running on the computer sends a random number to the dongle. The dongle performs a secret computation and returns a result. The software makes a like computation and compares the results of the two computations. If the results match, the software continues to run. If the results do not match, the software does not run. Such a device is useful in helping to limit the misappropriation of passwords since the dongle is required to enable access to the software or data on a computer. However, similar to the situation described above where a user may leave a terminal unattended while logged in, a user may leave a terminal unattended with the dongle attached, thus opening up the possibility of unauthorized access. Thus, it would be advantageous for such a device to automatically disable when a user leaves a terminal while the dongle is attached. 
     Another method for limiting access to a computer is through card access to the computer. In such a system, the computer has an associated card reader, and user has a card which may be inserted into the card reader. The computer will not allow access to at least some data unless an authorized card is inserted into the card reader. The user typically wears the card around their neck, and in many cases are required to wear the card around their neck. Accordingly, when the user leaves the immediate vicinity of the computer, they must remove the card from the card reader, thus disabling access to restricted data through the computer. While such a system is effective in limiting access to restricted data, it can be very inconvenient for a user. The user must place the card into the reader, which requires removing it from around their neck, which may result in the user inadvertently leaving the card in the reader. In some cases, the user may have some type of retractable cable which connects to the card, and thus does not need to remove the card their person. However, when working at a computer it can be uncomfortable and inconvenient to have a card extending from the user to the computer. Accordingly, it would be advantageous to have a device which automatically disables access to restricted data when a user leaves a terminal which does not require the user to perform physical steps to enable and disable access. 
     Further adding to the possibility of unauthorized access is the increasing reliance on mobile devices such as laptop computers. These devices may be used in areas away from relatively secure areas of an individual&#39;s home or a company&#39;s building. When such a device is used in areas which are relatively insecure, such as an airport or a train, the number of potential unauthorized users increases, thus increasing the possibility that an unauthorized user will use the mobile device to access the software and data. Furthermore, such mobile devices are much more susceptible to theft. Thus, even if used in a relatively secure area, the device may be stolen and removed to another location relatively easily. If a dongle is used with the device, the dongle may also be taken if left attached to the device. This further increases the potential for unauthorized users to access the system. Accordingly, it would be advantageous to insure that a mobile device is secure, and that data and software stored on the device are less susceptible to access by unauthorized users. Furthermore, as mentioned above, it would be advantageous to have such a system which would automatically place the computer in a more secure state when an unauthorized user is not within a certain distance from the computer. Such a system would help insure that the data and software located on the computer are not accessible by an unauthorized user. 
     SUMMARY OF THE INVENTION 
     The present invention is directed to solving these and other problems and disadvantages of the prior art. According to the present invention, a computer system includes a local key which is operable to communicate wirelessly with a remote key that is associated with a user of a computer system. If the remote key (and thus the user) is within a preset radius of the computer system, the local key enables access to the computer system. If the remote key (and thus the user) is not within the preset radius, the local key acts to disable access to the computer system. Accordingly, access to the computer system is automatically disabled when a user of the system leaves the area of the computing system. 
     In accordance with an embodiment of the present invention, a computer requests a user to log into the computer. After receiving the login information, the computer verifies that the user is an authorized user based on the login information. The computer requests authentication, through wireless communication with a remote key associated with the user. When authentication from the remote key is received, access to the computer is granted, and when authentication from the remote key is not received, access to the computer is denied. The computer may wait for a predetermined time period, and repeat the authentication request. If the user, and associated remote key leave the area of the computer, access to the computer is disabled. In one embodiment, the computer requests authentication from the remote key at one minute time intervals. 
     In one embodiment, the local key is a dongle which is associated with the computer system. In this embodiment, the dongle includes a wireless transceiver for wirelessly communicating with the remote key. In one embodiment, the computer system communicates a random number to the dongle. The dongle receives the random number, and transmits an authentication request to the remote key. If the remote key responds to the authentication request, the dongle performs a calculation on the random number and communicates the result to the computer system. The computer system performs a predefined computation on the random number to obtain a calculated number, and compares the computed number to the number received from the dongle. Access to the computer is enabled when the computed number matches the number received from the dongle. In one embodiment, the remote key includes a transponder operable to return the response to the authentication request. In another embodiment, the remote key includes a transceiver operable to return the response to the authentication request. In yet another embodiment, the remote key and local key communicate using Bluetooth wireless protocol. In still another embodiment, the remote key includes a keypad and is operable to require a user to enter a password prior to returning a response to an authentication request. 
     In accordance with an embodiment of the present invention, an apparatus is provided for controlling access to a computer. According to such an embodiment of the present invention, a local key is operably connected to the computer, which is operable to enable access to data accessible by the computer. A remote key is operable to wirelessly communicate with the local key, such that when the remote key is outside of a predefined radius, the local key disables access to the data, and when the remote key is within the predefined radius the local key enables access to the data. In one embodiment, the remote key includes a wireless transceiver operable to receive transmissions from and send transmissions to the local key, a processor in communication with the wireless transceiver, and a memory portion in communication with the processor. The computer, in one embodiment, is operably connected to a network which contains the data. The local key, in one embodiment, includes a wireless transceiver which is operable to communicate with the remote key, the wireless transceiver having a transmission radius which corresponds to the predefined radius. In another embodiment, the remote key includes a transponder and the local key includes a wireless transceiver, the wireless transceiver being operable to communicate with the transponder when the transponder is within the predefined radius. 
     The local key may comprise a dongle operatively connected to the computer, according to one embodiment. The dongle is adapted to connect to one of a parallel port, a serial port, and a universal serial bus port, and communicate with the computer through the connection. In yet another embodiment, the remote key is included in an identification badge which is associated with a user of the computer. 
     In accordance with another embodiment of the present invention, a method is provided for controlling access to a computer. According to such an embodiment of the present invention, a computer requests login information from a user. The computer verifies that proper login information is received, and determines whether an authorization signal is received at a wireless proximity detector. When the authorization signal is received, the computer enables access to a user, and when the authorization signal is not received at the wireless proximity detector, the computer disables access to the user. The computer, in one embodiment, waits a predetermined time interval and again determines whether the authorization signal is received at the wireless proximity detector, and enables or disables access to the user based on whether the authorization signal is received. In one embodiment, the predetermined time interval is one minute. The authorization signal is associated with a base transmitter in an embodiment of the present invention. 
     These and other advantages and features of the invention will become apparent from the following description of the invention taken together with the drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a diagrammatic representation of a workstation and a user with a remote key within a preset radius of the workstation, according to an embodiment of the present invention; 
         FIG. 2  is a diagrammatic representation of a workstation and a user with a remote key outside of a preset radius of the workstation, according to an embodiment of the present invention; 
         FIG. 3  is a block diagram representation of a local key according to an embodiment of the present invention; 
         FIG. 4  is a block diagram representation of a remote key according to an embodiment of the present invention; 
         FIG. 5  is a flow chart illustration of the operational steps performed by a workstation in an embodiment of the present invention; 
         FIG. 6  is a flow chart illustration of the operational steps performed by a local key in an embodiment of the present invention; and 
         FIG. 7  is a diagrammatic illustration of a building having a base transmitter operable to enable computer access to mobile devices which are within a preset radius of the base transmitter, according to an embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION 
     Referring to  FIGS. 1 and 2 , a wireless proximity detection system  100  of one embodiment of the present invention is described. The wireless proximity detection system  100  includes a workstation  104  which has a wireless proximity detector  108 . The wireless proximity detector  108  includes an antenna  112 , which transmits detection signals. The wireless proximity detector  108  transmits the detection signals using a low power transceiver, which is capable of transmitting and receiving signals within a predefined circumference  116 . A first user  120  has a first remote key  124  which is capable of transmitting a signal to the wireless proximity detector  108  in response to a signal received at the first remote key  124  from the wireless proximity detector  108 . In the illustration of  FIG. 1 , the first user  120  is inside the predefined circumference  116 , and thus the first remote key  124  receives the signal from the wireless proximity detector  108 , and sends a return signal to the wireless proximity detector  108 . Upon detection of the return signal, the wireless proximity detector  108  enables the workstation  104  to allow access to the first user  120 . In the illustration of  FIG. 2 , the first user  120  is outside of the predefined circumference  116 . In this case, the first remote key  124  does not receive the signal from the wireless proximity detector  108 , and thus does not generate and send a return signal. The wireless proximity detector  108  then discontinues allowing access to the workstation  104  if access had already been granted, or continues to deny access to the workstation  104  if access had not been granted. The operational steps for the wireless proximity detector  108  and the remote key  124  will be described in more detail below. The predefined circumference  116  may be any range of distances from the workstation desired, with the signal strength capable of being transmitted by the wireless proximity detector  108  and the remote key  124  selected according to the desired range. In one embodiment, the predefined circumference is selected to be approximately ten feet. The workstation  104 , in one embodiment, is simply a desktop computer type workstation. The workstation  104 , in other embodiments, may be a laptop computer, a kiosk, or any other type of equipment containing sensitive information, or through which sensitive information may be accessed. The wireless proximity detector  104  may be any appropriate piece of hardware associated with the workstation  104 , and in one embodiment is a dongle which connects to a port on the workstation. The dongle contains a short range transceiver which is capable of sending and receiving radio signals. It will be understood that the wireless proximity detector  108  may also be integrated into the workstation  104 , such as a hardware card which may be inserted into a port on a main board of the workstation, or integrated with other hardware components within the workstation. The remote key  124  includes a transmitter portion, and an antenna  128 . The remote key  124 , and wireless proximity detector  108  will be described in more detail below. 
     In one embodiment, illustrated in  FIG. 3 , a dongle  150  serves as the wireless proximity detector. The dongle  150  includes a port  154  which is used to connect to an associated port on a workstation. The port  154  may be adapted to be connected to a parallel port, a serial port, or any other type of port which may be available for data transfer on the workstation, including a universal serial bus (USB) port. The dongle  150  includes a processing portion  158  which performs processing functions. The processing portion  158  is in communication with a memory  162 , which contains program instructions and any other information required to operate the dongle and wireless proximity detector. The memory  162  may be any form of appropriate memory, including hard wired read only memory (ROM), electronically erasable programmable read only memory (EEPROM or flash memory), and magnetic media. The dongle  150  also includes a transceiver  166  capable of transmitting and receiving wireless signals via an antenna  170 . The transceiver  166  communicates with the processing portion  158 , and operates based on instructions received from the processing portion  158 . It will be understood that the processing portion  158 , memory  162 , and transceiver  166  may all be integrated into a single integrated circuit. Likewise, the processing portion  158 , memory, and transceiver  166  may be discrete components located on a printed circuit board, with the printed circuit board also including a printed antenna portion which may be used as the antenna  170 . 
     In this embodiment, the dongle  150  is attached to an appropriate port on the workstation. The workstation includes software which requires a dongle  150  to operate. The software sends a random number to the dongle  150 . The dongle  150  performs a secret computation and returns the result. The software makes a like computation and compares the results of the two computations. If the results match, the software continues to run. If the results do not match, the software does not run. In this embodiment, the dongle  150  transmits periodic signals to a remote key using the transceiver  166 . If the dongle  150  does not receive an appropriate return signal from the remote key, the dongle  150  does not return the correct result to the software running on the workstation, thus disabling the software. In this embodiment, the dongle  150  may be used with existing access software which may be installed on the workstation which required a dongle to enable access to the workstation. Thus, the wireless proximity detection of this embodiment is operable to function on an existing installed base of workstations and associated software. The dongle and associated remote key may simply be installed into an existing system. Alternatively, the workstation may include software which operates with the dongle, and does not include the computational component. Furthermore, in one embodiment, the random number is transmitted from the dongle to the remote key. The remote key performs the calculation on the random number and returns the result to the dongle, which passes this result on to the workstation, which enables or disables access based on the result. 
     With reference now to  FIG. 4 , a block diagram illustration of a remote key  200  of one embodiment of the present invention is described. The remote key  200  may be in a number of forms, and may be included, for example, in an employee&#39;s identification badge or card. The remote key  200  includes an antenna  204 , a detector/modulator  208 , a processor  212 , and a memory  216 . The remote key  200  in this embodiment also includes a battery  220 , which is used as a power source for the remote key. The antenna  204  operates to pick up a signal from the wireless proximity detector which is received at the detector/modulator  208 . The detector/modulator  208  demodulates the signal received at the antenna  204  and provides the information contained in the signal to the processor  212 . The processor  212  receives the information and prepares information to include in a return signal. 
     The information to be included in the return signal, in one embodiment, is an identification string which is contained in the memory  216 . The processor  212  provides this information to the detector/modulator  208 , which modulates the information onto a radio signal and transmits the return signal using the antenna  204 . In one embodiment, the remote key  200  and the wireless proximity detector  150  of  FIG. 3  communicate using a wireless protocol such as Bluetooth™ wireless communications. While the remote key  200  illustrated in  FIG. 4  includes a battery  220 , other embodiments exist which do not require battery power at the remote key, such as a transponder. The transponder, as is known in the art, uses energy transmitted in the received signal to power circuitry in the remote key and transmit a return signal. Such transponders have common usage in, for example, identification badges which are used to restrict access to offices or buildings. Communication protocols for such transponders are well known and several standard protocols exist for such devices, including ISO International Standards 14443 and 15693. 
     In another embodiment, the remote key also has a keypad, which allows for entry of a password into the remote key. The remote key may require the password to be entered at predetermined time intervals. For example, if a user entered a password into the remote key, and did not log out of the remote key, the key would automatically log the user out after the predetermined time period. The predetermined time period may be any arbitrary time period, and in one embodiment is eight hours. In this manner, the remote key is made more secure, since if it is lost or stolen even when a user is logged in, access will be restricted after the predetermined time period. Thus, if a pirate attempted to steal a laptop and the remote access key, access to sensitive information in the laptop would be limited to the time remaining in the predetermined time period. The remote key may also expire after a certain period of time. For example, the remote key may be valid for one year, with the expiration date being transmitted with the return signal. If the wireless proximity detector received the return signal which indicated that the remote key had expired, the wireless proximity detector would operate to restrict access to the workstation. Furthermore, the expiration of the remote key may correspond to an expiration of a license associated with particular software associated with the workstation. In this manner, a software distributor may control the licensing and use of software. 
     With reference now to  FIG. 5 , a flow chart illustration of the operational steps performed by the workstation in one embodiment are now described. Initially, as noted at block  250 , the workstation verifies that the user has properly logged into the workstation. If there is not a proper login, access is denied to the workstation, as noted by block  254 . If the user is properly logged in, the workstation determines if a dongle is present, as noted by block  258 . If a dongle is not present, access is denied to the workstation according to block  254 . If a dongle is present, the workstation generates a random number, as noted by block  262 . The random number is sent to the dongle, as indicated by block  266 . The workstation, at block  270 , receives a response from the dongle. The workstation then performs a predetermined computation on the random number, which corresponds to the computation performed by the dongle, as noted by block  274 . At block  278 , the workstation determines if the results returned from the dongle match the results of the computation performed by the workstation. If the results do not match, access to the workstation is denied, as noted by block  254 . If the results do match, access is granted to the workstation, according to block  282 . The workstation then, at block  286 , waits for a predetermined time period, and repeats the operations associated with blocks  250  through  282 . In one embodiment, the predetermined time period is one minute, although other time periods may be used including time periods which are shorter than one minute, and time periods which are longer than one minute. 
     Referring now to  FIG. 6 , the operational steps performed by the wireless proximity detector of one embodiment are now described. Initially, as noted by block  300 , the wireless proximity detector receives a number from the workstation. The wireless proximity detector transmits a signal to the remote key, as indicated at block  304 . The wireless proximity detector, at block  308 , determines if an appropriate response has been received from the remote key within a predetermined time period. In one embodiment, the wireless proximity detector determines if an appropriate response is received from the remote key by comparing an identification string from the remote key with an authorized identification code, or list of authorized identification codes, which is stored in the wireless proximity detector. If an appropriate response is not received from the remote key, the wireless proximity detector takes no further action, as noted by block  312 . If an appropriate response is received from the remote key, the wireless proximity detector performs a predetermined computation on the number received from the workstation, as noted by block  316 . The wireless proximity detector, at block  320 , sends this result to the workstation, and the operation is done as indicated by block  312 . 
     With reference now to  FIG. 7 , another embodiment of the present invention is now described. In this embodiment, a building  400  contains a transmitter  404 . In the example of  FIG. 7 , there is also a first mobile device  408 , and a second mobile device  412  in the building. The first mobile device  408  includes a wireless proximity detector  416 , and the second mobile device  412  contains a wireless proximity detector  420 . The transmitter  404  transmits signals periodically, with the transmitted signals having a range illustrated by the circumference  424  from the transmitter  404 . The first mobile device  408  is within the circumference  424 , thus wireless proximity detector  416  receives the transmitted signal, and allows a user of the first mobile device to access software and/or data which would be restricted if the first mobile device had not received the signal from the transmitter  404 . In the example of  FIG. 7 , the second mobile device  412  is not within the circumference  424 , and thus the wireless proximity detector  420  would not receive the transmitted signal and access to software and/or data on the second mobile device would be restricted. In this manner, a company may allow users of mobile devices, such as laptop computers, to travel outside of the company facility with the mobile devices, and not have access to sensitive software or data. Thus, when a user is in the company facility, their mobile workstation receives the signal from the transmitter, and allows access to data and/or software. 
     The foregoing discussion of the invention has been presented for purposes of illustration and description. Further, the description is not intended to limit the invention to the form disclosed herein. Consequently, variations and modifications commensurate with the above teachings, within the skill and knowledge of the relevant art, or within the scope of the present invention. The embodiments described hereinabove are further intended to explain the best mode presently known of practicing the invention and to enable others skilled in the art to utilize the invention in such or other embodiments and with various modifications required by their particular application or use of the invention. It is intended that the appended claims be construed to included the alternative embodiments to the extent permitted by the prior art.