International Business Machines Corporation

Lenovo (Singapore) Pte. Ltd.

Palmer E Newman

Richard Alan Dayan

David Carroll Challener

Dennis L Moeller

John W Blackledge, Jr

Kenneth J Zubay

Joseph P McGovern

Matthew T Mittelstedt

JoAnna B Yoder

Kimthanh D Le

Richard Allen Kelley

David Lee Randall

Grant L Clarke, Jr

Lisa A Ruotolo

Dave L Randall

Patrick E McCourt

A system and method of providing increased security of a personal computer through the use of its operating system and initialization. The invention provides a security profile which indicates the level of authorization which the user has and the security exposure which a user will be permitted, which combines with a stored log of attempts to access the personal computer through the use of the password and the results of each attempt to provide a system where unsuccessful attempts will turn off the system. The system also includes a plurality of access levels so that some functions in the computer may be denied to a user but permitted to a system administrator. The access log also may include a record of physical security attacks or attempt, such as removing the covers of a personal computer. The system and method of the present invention have the advantage that, as a result of maintaining information on access attempt and other security information, a security profile may be established and criteria imposed on the user which will improve the security of the personal computer.

Method and system for improved computer security utilizing dynamically variable security profile

A method for providing security to a computer on a computer network is disclosed. When a network-supplied privileged-access password (PAP) is encountered during a system boot-up operation of the computer, the network-supplied PAP is compared with a system-installed PAP. The network-supplied PAP is stored in a first location of a non-volatile memory of the computer, and the system-installed PAP is stored in a second location of the non-volatile memory of the computer. The system-installed PAP is previously entered to the computer via a keyboard of the computer. If the network-supplied PAP does not match the system-installed PAP, a tamper evident mechanism within the computer is set. Otherwise, if the network-supplied PAP matches the system-installed PAP, the boot-up operation continues to be performed. After the boot-up operation has been completed, configuration of the computer is allowed to be performed remotely over the computer network.

Method for providing security to a computer on a computer network

A method and system is provided for improved electronic voting. The system optionally allows paper type ballots to be utilized. A plurality of cryptographic routines are utilized in a distributed data processing system to maximize the privacy of both the voter's identity and the content of completed ballots. An authentication server is utilized to interact with a voter to issue electronic ballots and receive completed electronic ballots in a manner which determines the authenticity of the identification of the voter, while maintaining the content of the completed ballot confidential. The distributed data processing system further includes a results server which tabulates the content of completed ballots in a manner which maintains the identity of the voters associated with the particular ballots confidential. The distributed data processing system may further include a journal server which records completed ballots, in a manner which facilitates the challenge of ineligible votes and the correction of erroneous votes.

Method and system for secure computer moderated voting

A computer-input stylus which provides thickness control when utilized in conjunction with a computer-implemented software-based drawing application. The input stylus includes a cylindrical body in a conical tip. A color display within the stylus is utilized to illuminate the conical tip with a color indicative of a currently selected color within the software-based drawing application, providing visual color feedback. Thickness selection is accomplished utilizing a thickness selection input actuator mounted to the cylindrical body of the input stylus. The thickness selection input actuator is utilized to vary the thickness of application of a selected color or pattern, while physically varying the thickness of the conical tip of the input stylus, in a manner analogous to utilizing a thicker tip brush.

Computer input stylus and thickness control system

A security system for computers defines a control zone using radiation, preferably at radio frequency, having a distinctive characteristic, such as a particular frequency. The zone may be established, for example, at a door exit or other limited passage to a secured area. Computer systems are provided with receivers that detect the distinctive characteristic and responsively produce an alarm signal which triggers security logic. The security logic cooperates with the start-up logic of the computer and disables start-up so that the computer becomes inoperative. In a more complex variation, the radiation triggers a device in the computer that in turn sends out a serial number signal. A receiver located near the control zone applies the serial number to a table look up computer that triggers an emergency signal if a match to an authorized list of serial numbers does not occur. The emergency signal activates a transmitter that sends out a radiation signal with a second distinctive characteristic. A second receiver in the computer then responds to the radiation with the second characteristic to trigger the security logic to render the computer inoperative.

Wireless proximity detector security feature

A computer-input stylus which provides texture control when utilized in conjunction with a computer-implemented software-based drawing application. The input stylus includes a cylindrical body in a conical tip. A color display within the stylus is utilized to illuminate the conical tip with a color indicative of a currently selected color within the software-based drawing application, providing visual color feedback. Texture selection is accomplished utilizing a texture selection input actuator mounted to the cylindrical body of the input stylus. The texture selection input actuator, such as a trackpoint device, is utilized to vary the texture of a selected color or pattern.

Computer input stylus and texture control system

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. The present invention protects a trusted personal computer system against a probing attack, in which an unauthorized user would attempt to overcome the security feature elements of the personal computer system by inserting some form of probe into an opening provided in the system enclosure for other, legitimate, purposes such as cooling air flow or removable media insertion. A plurality of security feature elements are mounted within the enclosure for selective activation to secure and non-secure states and are disposed at locations inaccessible to any unauthorized user of the personal computer system attempting to affect the operation of any one of the security feature elements by insertion of a probe through an opening.

Trusted personal computer system with limited accessibility

A personal computer system has security features enabling control over access to data retained in such system. The system cooperates with a transmitter of radiation having a predefined characteristic. A radiation detector within the system detects such radiation and produces an alarm signal when detection fails or is lost. The alarm signal is retained and triggers security logic cooperating with power-on-sequence logic to prevent the system from becoming operative. It is preferred to also provide an erasable memory element that when switched to an active state stores a privileged-access password. Logic is provided to cooperate with such element and override the security logic when the correct password is input to the system. As an added security feature the transmitter may be deactivated if an intrusion is detected at the site to shut down all systems responding to the radiation in the security zone.

Wireless proximity containment security

A personal computer system is described, having security features enabling control over access to data retained in such a system. The system has a normally closed enclosure, at least one erasable memory element for selective activation to active and inactive states and for receiving and storing a privileged access password when in the active state, an option switch operatively connected with the erasable memory element for setting the erasable memory element to the active and inactive states, a tamper detection switch operatively connected with the erasable memory element for detecting opening of the enclosure, and a system processor operatively connected with the erasable memory element for controlling access to at least certain levels of data stored within the system by distinguishing between entry and non-entry of any stored privileged access password. In addition, switch means are provided for monitoring unauthorized movement of the system together with means for rendering the movement monitoring switch enabled or disabled. When the movement monitoring switch detects movement of the system while the switch is enabled and when the tamper detection switch detects opening of the enclosure, power-up of the system is prevented until the privileged access password (or a power-on password) is successfully entered into the system by a user.

Securing trusted personal computer system against unauthorized movement

A personal computer system is described, having security features enabling control over access to data retained in such a system. The system has a normally closed enclosure, at least one erasable memory element for selective activation to active and inactive states and for receiving and storing a privileged access password when in the active state, an option switch operatively connected with the erasable memory element for setting the erasable memory element to the active and inactive states, a tamper detection switch operatively connected with the erasable memory element for detecting opening of the enclosure, and a system processor operatively connected with the erasable memory element for controlling access to at least certain levels of data stored within the system by distinguishing between entry and non-entry of any stored privileged access password and between detection and non-detection of opening of the enclosure by the tamper detection switch. In addition, an inactivity monitor is provided for measuring the time period between successive uses of the system and for determining whether or not the measured time period exceeds a specified inactivity period. A utility is provided for rendering the monitor enabled. When the enabled monitor determines that the measured time exceeds the specified time, power-up of the system is prevented until the privileged access password (or a power-on password) is successfully entered into the system by a user.

Inactivity monitor for trusted personal computer system

An operating system definition file (ODF) is provided for each operating system stored in a computer system. Each ODF contains a list of keywords that define the operating environment for the particular operating system. During setup, a set configuration program reads each ODF and produces a master record that specifies an ordering of non-system memory regions across all of the operating systems that coexist in the computer system, allowing non-system memory allocations to be made to regions that meet all operating system needs. A merge matrix is used to merge records from the ODFs into a common array allowing the records to be searched to find optimum non-system memory allocations. A memory address space topology table is also built by the set configuration program for use by the operating system during initialization and during allocation of memory.

Personal computer having operating system definition file for

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. The features here described include a prioritized initial loading program for enabling initial loading of an operating system from a selected one of a plurality of sources, the prioritized initial loading program normally designating an interpreter program as a final option default in the event of failure of access to an operating system from any other one of the plurality of sources; a security utility program for enabling a designated user to (a) selectively modify the initial loading program by specifying the number and priority order of the plurality of sources and (b) selectively modify the initial loading program by deleting the interpreter program from the plurality of sources; a master cryptographic key for use in encrypting and decrypting data processed by the system CPU; and a second security utility program for enabling a designated user to modify the master cryptographic key.

Trusted personal computer system with management control over initial

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. In particular, a personal computer system in accordance with this invention has a normally closed enclosure, at least one erasable memory element for selective activation to active and inactive states and for receiving and storing a privileged access password when in the active state, an option switch operatively connected with the erasable memory element for setting the erasable memory element to the active and inactive states, a tamper detection switch operatively connected with the erasable memory element for detecting opening of the enclosure and for invalidating any privileged access password stored in the erasable memory element in response to any switching of the tamper switch, and a system processor operatively connected with the erasable memory element for controlling access to at least certain levels of data stored within the system by distinguishing between the active and inactive states of the memory element and between entry and non-entry of any stored privileged access password. In the presently preferred form of the invention, two non-volatile erasable memory elements are provided, one an EEPROM and the other battery backed CMOS RAM.

Personal computer system with security features and method

This invention relates to personal computer systems and, more particularly, to such a system having security features enabling control over access to data retained in such a system. This invention contemplates protecting a personal computer system which has the capability of becoming a secure system from being placed into that condition by an attack on an unsecured machine. Additionally, in a network environment, it is important to maintaining network security that any given particular system be uniquely identified to the network, in order to guard against the substitution of an insecure 'alternate' which would open the network to attack through an insecure system. This invention contemplates provision for such identification in a secure manner.

Trusted personal computer system with identification

A method and medialess personal computer system workstation (or LAN station as herein defined) adaptable for securing the system against attack on a secured network with which the LAN station is associated. A flag bit is set in system memory during a power on self test to indicate whether access may be had to certain security features of the system, and a procedure is described by which access to a network stored configuration setting program may be gained in order to install, change or remove a password used for securing the LAN station while avoiding passing the critical password data through the network.

Growing community of inventors

Boca Raton, FL, United States of America

Palmer E Newman