초록 ▼

A system is disclosed for controlling intelligible access to secured files by means of a user-memorized password in combination with a user-associated passport record. The passport record takes on two forms, one when it is physically secured within the workstation and a different second form when th

A system is disclosed for controlling intelligible access to secured files by means of a user-memorized password in combination with a user-associated passport record. The passport record takes on two forms, one when it is physically secured within the workstation and a different second form when the passport record is in-transit. Log-in privileges are granted after a presented passport record passes a number of tests including digital signature authentication, and the ability to extract two different encrypted keys from the passport record. The in-transit record does not carry one of those two keys.

대표청구항 ▼

[ What is claimed is:] [1.] A machine-readable memory [650] for operable use by a machine system [FIGS. 1,6] that maintains confidential digital information [113,643] generally in encrypted form [109,656] while allowing for intelligible access to such confidential information by users who are author

[ What is claimed is:] [1.] A machine-readable memory [650] for operable use by a machine system [FIGS. 1,6] that maintains confidential digital information [113,643] generally in encrypted form [109,656] while allowing for intelligible access to such confidential information by users who are authorized for access by a combination of a user-associated password [101] and a user-associated passport [150], said machine-readable memory storing for each of an associated one or more authorized users, a passport data structure [150/170] comprising:(a) a first field [156/176] storing a first secured-by-encryption key [KS(0/1)*], where said first secured key is covered by a first covering signal [PW*] derived from a valid password [PW,101] of the passport-associated user;(b) a second field [155/175] storing a second secured-by-encryption key [PriUK*], where said second secured key is covered by a plaintext version [KS(0/1)] of the first secured key; and(c) a third field [154/174],(c.1) where said third field stores a third secured-by-encryption key [PriWK1*] that is different from the first secured key in situations where the machine-readable memory is physically-secured [100] within said machine system,(c.2) where said third field [174] is blank or is filled with irrelevant information in situations where the machine-readable memory is not physically-secured within said machine system, and(d) where said machine system requires local presence of a physically-secured, in-system version of the associated passport data structure [150] and a verified local uncovering from said in-system version of the associated passport data structure of the secured keys in the second and third fields [154,155] before the machine system locally grants to a requesting user, intelligible access to corresponding confidential information.