WO2001063383A1

WO2001063383A1 - Method for providing authorized access to personal computer data resources

Info

Publication number: WO2001063383A1
Application number: PCT/BY2000/000002
Authority: WO
Inventors: Valentin Alexandrovich Mischenko; Andrei Evgenievich Vatutin
Original assignee: Mischenko Valentin Alexandrovi; Andrei Evgenievich Vatutin
Priority date: 2000-02-24
Filing date: 2000-02-24
Publication date: 2001-08-30
Also published as: AU2000227873A1

Abstract

According to the method for providing authorized access to personal computer data resources, a user selects a password in the form of the fragment of a text of a large length. The selected fragment is transformed into a key for encoding of the used data resource. The data is stored in the memory in the encoded form. The method provides a long key for encoding of the used resource and ensures easy memorizing of a long password on bases of associative features.

Description

METHOD FOR PROVIDING AUTHORIZED ACCESS TO PERSONAL COMPUTER DATA RESOURCES

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to means for providing authorized access to personal computer data resources. The invention may be used for protection of personal computer data from unauthorized access.

2. Description of the Prior Art

Various means for protection from unauthorized access are known in the prior art. Generally, unauthorized access is disallowed by means of a specially selected password. As a rule, such a password must be stored in the nonvolatile memory, and may be either read out or collated by a hacker or another unfair person.

Different means are used to protect from the password selection, such as limitation of selection attempts and indication of unauthorized access (US patent 5,475,755), or cyclic change of passwords by means of pseudorandom generation (US patent 5,812,764).

In such systems, a password or a list of passwords is stored in the computer memory and may be read out by unauthorized person.

Advantage is also taken of the system for protection from unauthorized access, which uses an external password recorded on any carrier, e.g. on a diskette, or of a combination of such methods (US patent 5,949,882). In all cases a password is compared with the data stored in the memory. However, an external password may be lost, copied or stolen. Moreover, an access to the resource may be got bypassing the locking systems, and the information may be read out. In this situation, a more safe protection is provided by transforming or encoding the proper resource. In this case, the resource is stored openly in the encoded form and the access to it may be obtained by decoding the stored resource. (US patent 5636281 ). The protection of the kind may also use an external key, but it is not always usable. Therefore, they often use passwords composed of words or phrase abbreviations.

Frequently, for the sake of easy memorizing they use a short text or associative passwords, which are also easily matched or peeped, in particular when working in a public office.

Thus, a plurality of all available password variants in practice is limited to a small set of symbols corresponding to the symbols of a common language, which is even more limited by the fact that the choice is always associated with a person selecting a password.

An ideal password for protection is the password, the length of which is equal to the length of the protected data array or even exceeds its length. The password of the kind allows to encode the resource to be protected without using any repeated features, making thereby practically impossible any unauthorized encoding. At the same time, long passwords are difficult to memorize and easy to make a mistake. An example of the attempt to agree the contradiction between the requirement of having a long key and the advantage of easy memorizing of a password, may serve the CryptoMania software created in OAO " InfoTeKS" ("Safe protection for the information in files!", By Alexander Kalfa, Computer Press, March 1999".

This software provides for generating a long licensed password for the software purchaser. The user introduces his password, which is composed of a part of words of the associative phrase that is known only to the user. However, a licensed password may be accessible to several users, or it may be stolen. Moreover, a personal password may be matched as well, whereas a probability of selection may be substantially limited due to the fact that a keyboard comprises a limited number of symbols, and groups of symbols constitute parts of words.

SUMMARY OF THE INVENTION

The invention is aimed at solving a problem of the need to have a long password for providing a higher level of protection and a problem of difficulty of memorizing of a long password, as well as a problem of storing a password in the computer memory.

The problems are solved in the following way. The known method for providing protection of personal data resources takes advantage of a password and transformation of the resource by using as a password a fragment of an associative array (notional text) selected by a user. In this case, the selected fragment is transferred into the main memory and is used as an initiating sequence of symbols, which is transformed according to the encoding algorithm including randomization with chaining up to obtaining a password of a preset length (greater then or equal to the length of the secured resource). Thereafter, the initial resource is encoded by the obtained password and is stored in the encoded form, and the initial resource, the password and the selected fragment are deleted from the computer memory.

In order to prevent a possibility of selection or guessing the part of the selected fragment, the algorithm of transforming of the selected fragment into an encoding password may include randomizing or hashing with chaining.

In this case the algorithm of transforming of the password may be stored either in the nonvolatile memory or on a separate carrier, which may also serve as an additional access password.

Preferably, a notional text of a large length should be used for an associative array. This may be a text generally used in the work, a help, a reference book, etc. In this case, it is desirable that the content or/and the structure of the text was well known to the user.

A real image or a styling one with solitary elements, desktop, homepage, etc. may also be used for the associative array.

Preferably, to provide protection of a resource from unauthorized access they use a notional text of a rather large length that is greater than or equal to the length of the resource to be protected.

It is mostly preferable that the password for encoding the resource was stored in the volatile memory. Unlike other systems for protection from unauthorized access, according to the proposed method, the password for encoding of the resource is deleted from the memory after the resource was encoded.

The following method for providing access to the personal resource of computer data means that takes advantage of a password and restoring of a resource transformed according to the afore described method, is characterized in that the same fragment of the associated array is selected as a password, the selected fragment is transferred to the nonvolatile memory and is used as an initial sequence of symbols, which is transformed under the preset encoding algorithm up to obtaining a password of a preset length (greater than or equal to the length of the initial text), thereafter the stored resource is decoded with the help of the obtained password and the restored resource is used.

In this case is used the same algorithm of transforming the selected fragment into the encoding password including randomization with chaining.

The method is also characterized in that the password for decoding (restoring) the resource is stored in the volatile memory.

The password for encoding/restoring the resource is deleted from the

volatile memory after the resource was restored.

According to one embodiment of the invention the password for encoding/restoring the resource is deleted from the volatile memory after restoring the resource, and the selected fragment is stored in the volatile memory.

For the sake of safe operation the restored resource is stored in the nonvolatile memory, and after termination of work it should be deleted from the memory, or it should be transformed. This is determined by the passive or active mode of use of the resource.

For some purposes of application, the restored resource may be stored in the memory within a preset period of time.

In case of active usage of the protected resource, the said resource may be changed in the course of operation, therefore after termination of work with the resource, which was restored and changed during operation, the renewed resource is transformed (encoded) by the stored password, thereafter the password and the restored array are deleted.

When in the process of operation the restored resource is changed, then after termination of work with the restored resource, the resulting (changed) resource is transformed (encoded) by the stored password, thereafter the password and the initial array are deleted, and the anew- encoded resource is stored.

According to one of the embodiments, if the password was deleted after restoring the resource, then after termination of work with the restored resource a password is generated anew, and the resource modified in the course of operation is transformed (encoded), thereafter the password and the resource modified in the process of operation are deleted, while the encoded resource is stored.

Under the resource to be protected one should understand a specific array of information, a software or data, which are considered confidential, and therefore are to be protected. The resource of that kind is stored in a special region of the computer memory and may be transformed or transferred. The resource may also be a database or a specific text or file with a software, image, etc.

DESCRIPTION OF THE PREFERRED EMBODIMENT

In the most preferable embodiment the method is carried out in the following way.

Under the choice of the user, for an initial array for setting a password is used any notional text or a group of texts available for free access and/or exchange at least in the reading mode. This may be a text of any work, an article, an instruction, a help, a reference book, etc. The text should be enough long and multiform, so that one was able to select a notional fragment of the required length. The text and the fragment from the text used as a password is selected by the user on the principle that the entire text was enough familiar for the user and the selected fragment had an associative meaning. As an initial data for forming a password one may use a visual and/or notional image of the beginning and of the end of the fragment.

In this case a password is not the numbers of pages, lines and symbols but rather the total content oτ the fragment. The user should memorize neither the whole password, nor its length, etc. The user should only remember the location of the source (a file name and a path to the file) and the notional and/or visual content of the password. In this case the selected fragment may be also represented as a password or a password phrase. Not furnished at time of publication

Not furnished at time of publication

Claims

1. A method for providing protection for a personal resource of computer means, the said method using a password and transformation of a resource, characterized in that as a password is used at least one fragment of the associative array selected by the user, the selected fragment is transferred into the buffer memory and is used as an initiating sequence of symbols that is transformed according to the pre-set algorithm of transformation till obtaining a key of a pre-set length that is greater than or equal to the size of the resource to be protected, thereafter the initial resource is encoded by the resulting key and is stored in the encoded form, and the initial resource, the key and the selected fragment are deleted from the computer memory.

2. The method according to Claim 1 , characterized in that the algorithm of transformation of the selected fragment into the encoded key comprises randomizing with chaining.

3. The method according to Claim 1 , characterized in that, as an associative array used is a notional text of a large length.

4. The method according to Claim 1 , characterized in that as an associative array used is a realistic image or a styling image with detailed elements.

5. The method according to Claim 1 , characterized in that as an associative array used is a notional text of a large length that is comparable with the size of the resource to be protected.

6. The method according to Claims 1-4, characterized in that the key for encoding the resource is stored in the volatile memory.

7. The method according to claims 1-4, characterized in that the key for encoding of the resource is deleted from the memory after the resource is encoded.

8. A method for providing access to the personal resource of computer means, the said method using a password and restoring of the resource transformed according to claim 1 , characterized in that as a password is selected the same fragment of the associative array, the selected array is transferred into the buffer memory and is used as an initial sequence of symbols that is transformed according to the pre-set algorithm of transformation up to obtaining a key of the pre-set length that is greater than or equal to the size of the resource to be protected, thereafter the stored resource is decoded by the resulting key, and the restored resource is used.

9. The method according to claim 1 , characterized in that the algorithm of transformation of the selected fragment into the encoding key comprises randomizing with chaining.

10. The method according to claim 8, characterized in that the key, transformed from a fragment for encoding the resource, is stored in the volatile memory.

11. The method according to claim 8, characterized in that the key for encoding/restoring the resource is deleted from the volatile memory after the resource is restored.

12. The method according to claim 8, characterized in that the key for encoding/restoring the resource is deleted from the volatile memory after the resource is restored and the selected fragment is stored in the volatile memory.

13. The method according to claim 8, characterized in that the restored resource is stored in the volatile memory.

14. The method according to claim 8, characterized in that the restored resource is stored in the volatile memory within a specified time period.

15. The method according to claims 8 and 9, characterized in that after termination of work with the restored resource, the said restored resource is transformed (encoded) by the stored key, thereafter the key and the restored array are deleted.

16. The method according to claims 8 and 9, characterized in that after termination of work with the resource, the said resulting 'esource is transformed (encoded) by the stored key, thereafter the key and the restored array are deleted.

17. The method according to claims 8 and 9, characterized in that after termination of work with the resource, the said resulting resource is transformed (encoded) by the generated key, thereafter the key and the working array are deleted.