Abstract:
The present invention provides a method for preventing unauthorized access to the computer system, and more particularly, provides a method for preventing unauthorized access to the computer system by using the one-time password. The one-time password is produced by a one-time password generator, and decrypted and verified by the computer logon system, and is used to log on the computer system. The present invention increases the security of the computer system, and protects the computer system from unauthorized access and use in a cost-effective way.

Description:
FIELD OF THE INVENTION 
     The present invention relates to a method for preventing unauthorized access to the computer system, and more particularly, to a method for preventing unauthorized access to the computer system by using one-time password. 
     BACKGROUND OF THE INVENTION 
     In recent years, with dramatic advances in information technologies, the computer is involved in daily life, working, and learning as a useful tool consequentially. However, sometimes the computer is accessed by malicious people through unauthorized means, which may cause incalculable loss. Preventing unauthorized access to the computer system becomes an important problem on computer information security. 
     To resolve this problem, a user name and password combination is often used to protect the computer system from being intruded by unauthorized users. But the password assigned by users tends to be too simple, and can be cracked easily. Once it is figured out by malicious people, the password protection will lose its effect. 
     The two-factor authentication that uses the hardware, such as an identity authentication key or a smart card, in combination with a password or biometrics for higher security is also applied in logging on the computer system. Obviously, the security is increased in this way. When a user is to log on the system, a hardware device that has been registered with this computer is required, as well as the user name and password combination. 
     The unauthorized users who can crack the password of a valid user are blocked in this way. 
     The above two methods are intended for the normal situation. However, the hardware device of the two-factor authentication does not work under Windows safe mode, because its driver cannot be found under this mode. The malicious people may seize this vulnerability to log on the system to get the confidential information. Moreover, the hardware device is possibly not cost-effective for most of the ordinary users. 
     SUMMARY OF THE INVENTION 
     The present invention overcomes the above defects of existing protection methods, and provides a method for preventing unauthorized access to the computer system by using one-time password, which can be used to protect the computer system in a reliable and effective way. 
     The technical solution of the method of the present invention is: 
     A method for preventing unauthorized access to the computer system by using one-time password, i.e. a user who is to log on the computer system must enter a one-time password, which is produced by a one-time password generator; the one-time password generator comprises a random number generation unit, a compression unit, and an encryption unit; and a user number (UN) or system number (SN), valid start date (D), valid start time (T), and/or valid use duration (T 0 ) entered by the user, along with a random number (R) produced by the random number generation unit are compressed with the compression unit and encrypted with the encryption unit to create the cipher text to gain a one-time password (OTP). 
     The computer logon system comprises a registration module, a decryption module, a verification module, and a monitoring module; the registration module is used to write the parameter information of the application of the computer logon system of the present invention to the registry; the decryption module is used to decrypt the entered one-time password to the plain text; the verification module is used to verify if the plain text matches with a value in the password database; and the monitoring module is used to monitor the valid period of the usage of the one-time password. 
     Once the one-time password has been entered into the computer logon system, the decryption module will decrypt and decompress it to generate the original UN or SN, valid start date (D), valid start time (T), and/or valid use duration (T 0 ). The verification module will then verify if the information is proper. After the user has logged on the system successfully, the monitoring module will monitor the use period of the password. 
     For the instance of registering with the SN, the logon system will first invoke the native database to verify if the one-time password has ever been used before. After a successful logon, the one-time password will be encrypted and saved to the system database by the logon system. 
     Usage of the one-time password involved in the present invention is restricted to valid duration or counts, that is to say, even if malicious people gain the password, they can hardly use it to log on the computer system. This method is a complement to the existing protection system which now cannot protect the computer system under Windows safe mode. Using the one-time password is a reliable and cost-effective way to protect the computer system. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present invention may be further understood from the following description in conjunction with the appended drawings. In the drawings: 
         FIG. 1  is a principle diagram of the present invention; 
         FIG. 2  is a working principle diagram of the one-time password generator of the present invention; 
         FIG. 3  is a workflow diagram of logging on the computer system by using the one-time password with limitation of the duration of the present invention; 
         FIG. 4  is a workflow diagram of logging on the computer system by using the one-time password with limitation of the counts of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
     The preferred embodiments are provided with the appended drawings. 
     The First Embodiment 
     The first embodiment makes use of the duration as a limit condition to implement the present invention. 
     If a user is logging on the computer system, the user must use a one-time password generated by the one-time password generator. The generator is installed on a computer that is administrated by the administrator. The user needs to provide user information to the administrator, and the administrator uses the one-time password generator with the information to produce the one-time password. Referring to  FIG. 2 , this is the working principle diagram of the one-time password generator. The one-time password generator will prompt the user to input the following information:
         1) Unique User Number (UN), which can be assigned to the user by software distributor, or can be assigned to each employee by the administrator of intranet;   2) Valid Start Date (D), which is defaulted to the current date or can be customized, and indicates the valid date when the one-time logon password takes effect;   3) Valid Start Time (T), which is defaulted to the current time or can be customized, and indicates the valid time when the one-time logon password takes effect;   4) Valid Use Duration (T 0 ), which is a number of hours, and indicates the length of the period from the time the user uses the one-time password to log on the computer system until the time the password is invalidated.       

     First, the random number generation unit  103  generates a random number (R), then the compression unit  102  compresses the user number (UN), valid start date (D), valid start time (T), and/or valid use duration (T 0 ) entered by the user  101 , along with the random number. The compressed information (CI) is encrypted by the encryption unit  104  using a certain encryption algorithm to produce a one-time password (OTP), where the encryption algorithm used by encryption unit  104  is a publicly known symmetric-key encryption algorithm, such as DES. The one-time password has higher security strength, and it is a very random character string and is hard to crack, because it is generated from a unique user number, valid start date, valid start time, and/or valid use duration plus a random number. In addition, if the user  101  has registered the UN with the logon protection system on more than one computer, the user  101  can use the one-time password to log on these computers within its period of validity. So it is very convenient for the user to use. 
     Once a user has obtained a one-time password, the user can use it on the computer where he has registered his UN. Referring to  FIG. 3 , this is the workflow of the foregoing preferred embodiment. First, enter the logon interface, as shown in Step  201 . When prompted, the user enters the one-time password derived from the one-time password generator, as shown in Step  202 . The system starts the decryption module to decrypt the one-time password, as shown in Step  203 . The decryption module will first decrypt the password with the same key as used by the one-time password generator, and then decompress it to gain the same information as the user entered in the one-time password generator, such as the user number (UN), valid start date (D), valid start time (T), and/or valid use duration (T 0 ). Subsequently, the verification module verifies if the one-time password is valid. The verification module first verifies if the UN is the same as the registered UN, as shown in Step  204 . If not, the user will be prompted that the logon has failed, as shown in Step  206 . Otherwise, the system will go to judge if the current time is later than the valid start time, as shown in Step  205 . If not, the user will also be prompted that the logon has failed, as shown in Step  206 . Otherwise, the system will record the valid start time (T) and valid use duration (T 0 ), as shown in Step  207 . Next, the user will enter the operating system, as shown in Step  208 . The monitoring module then starts up to monitor if the time accumulation the user operates with the one-time password has exceed the range of valid use duration, as shown in Step  209 . The user actual use time (T 1 ) is calculated by summing up the periods of time during which the user has logged on the computer system with the one-time password, as shown in Step  210 . Thereby, the system can judge if the valid use duration (T 0 ) is greater than the actual use time (T 1 ), as shown in Step  211 . If yes, the user can keep logging on the computer system, as shown in Step  212 . Otherwise, the system will prompt the user that the valid use duration has expired and lock the operating system immediately, as shown in Step  213 . 
     The Second Embodiment 
     The second embodiment makes use of the counts of usage as a limit condition to implement the present invention. 
     Like the previous embodiment, the user first must request a one-time password produced by the one-time password generator from the administrator. Referring to  FIG. 2 , this is the working principle diagram of the one-time password generator. The one-time password generator will prompt the user to input the following information:
         1) Unique System Number (SN), which is entered when installing the logon protection system of the present invention;   2) Valid Start Date (D), which is defaulted to the current date or can be customized, and indicates the valid date when the one-time logon password takes effect;   3) Valid Start Time (T), which is defaulted to the current time or can be customized, and indicates the valid time when the one-time logon password takes effect;   4) Valid Use Duration (T 0 ), which is a number of hours, and indicates the length of the period from the time the user uses the one-time password to log on the computer system until the time the password is invalidated.       

     After the user has entered the required information, and the random number generation unit  103  has produced a random number (R), the compression unit  102  will compress the SN, valid start date (D), valid start time (T) and/or valid use duration (T 0 ), along with the random number (R). The encryption unit  104  then will encrypt the compressed information to the cipher text, which is the one-time password (OTP). This one-time password is derived from the SN and is applicable to the only computer with the SN, because the SN is unique in general. 
     Once a user has obtained a one-time password, the user can use it on the appropriate computer. Referring to  FIG. 4 , this is the workflow of the foregoing preferred embodiment. First, enter the logon interface, as shown in Step  301 . When prompted, the user enters the one-time password derived from the one-time password generator, as shown in Step  302 . The system invokes the native system database to verify if the one-time password has ever been used before, as shown in Step  303 . If yes, the user will be prompted that the logon has failed, as shown in Step  307 . Otherwise, the decryption module will start up to decrypt the one-time password, as shown in Step  304 . The decryption module will first decrypt the one-time password with the same key as used in the one-time password generator, and then decompress it to gain the same information as the user entered in the one-time password generator, such as the SN, valid start date (D), valid start time (T) and/or valid use duration (T 0 ). Subsequently, the verification module verifies if the one-time password is valid. As shown in Step  305 , the verification module verifies if the decrypted SN is the same as the registered SN. If not, the user will also be prompted that the logon has failed, as shown in Step  307 . Otherwise, the system will verify if the current time is later than the valid start time (T), as shown in Step  306 . If not, the system will also prompt the user that the logon has failed, as shown in Step  307 . Otherwise, the system will record the valid start time (T) and/or valid use duration (T 0 ), as shown in Step  308 . Next, the user will enter the operating system, as shown in Step  309 . Then the one-time password will be encrypted and saved to the system database, as shown in Step  310 . The monitoring module then starts up to monitor if the time accumulation the user operates with the one-time password has exceeded the range of valid use duration, as shown in Step  311 . The user actual use time (T 1 ) is calculated by summing up the periods of time during which the user has logged on the computer system with the one-time password, as shown in Step  312 . Thereby, the system can judge if the length of the valid use duration (T 0 ) is greater than the actual use time (T 1 ), as shown in Step  313 . If yes, the user can keep logging on the computer system, as shown in Step  314 . Otherwise, the system will prompt the user that the valid use duration has expired and lock the operating system immediately, as shown in Step  315 .