United States Patent [19J
`Lang
`
`[11] Patent Number:
`[45] Date of Patent:
`
`5,065,429
`Nov. 12, 1991
`
`[76]
`
`[54] METHOD AND APPARATUS FOR
`PROTECTING MATERIAL ON STORAGE
`MEDIA
`Inventor: Gerald S. Lang, 812 Downs Dr.,
`Silver Spring, Md. 20904
`[21] Appl. No.: 626,409
`[22] Filed:
`Oct. 14, 1990
`
`[ 63]
`
`Related U.S. Application Data
`Continuation of Ser. No. 358,263, May 30, 1990, aban(cid:173)
`doned, which is a continuation-in-part of Ser. No.
`331,800, Apr. 3, 1989, abandoned.
`Int. CI.s ............................................... H04K 1/00
`[51]
`[52] U.S. CI •.......................................... 380/25; 380/4;
`380/23
`[58] Field of Search ................... 380/4, 23, 24, 25, 49,
`380/50; 364/246.6, 246.9, 969, 969.3, 969.4
`References Cited
`U.S. PA TENT DOCUMENTS
`
`[56]
`
`4,349,695 9/1982 Morgan et al. ....................... 380/25
`4,471,163 9/1984 Donald et al. ........................ 380/25
`4,599,489 6/1986 Cargile .................................. 380/25
`4,652,990 3/1987 Pailen et al. .......................... 380/25
`4,677,434 6/1987 Fascenda .............................. 380/23
`4,713,753 12/1987 Boebert et al. ....................... 380/25
`4,731,841 3/1988 Rosen et al. .......................... 380/23
`4,740,890 4/1988 Tobin ...................................... 380/4
`4,747,139 5/1988 Tagfe ...................................... 380/4
`4,785,361 11/1988 Brotby .................................... 380/4
`4, 799,258 11/1989 Davies ................................... 380/23
`4,862,501 8/1989 Kamitake et al. .................... 380/50
`4,864,616 9/1989 Pond et al. ............................ 380/25
`4,888,798 12/1989 Earnest ................................... 380/4
`
`4,930,073 5/1990 Cina, Jr ................................. 380/23
`4,941,175 7/1990 Enescu et al. .......................... 380/4
`6,590,470 5/1986 Koenig .................................. 380/49
`
`Primary Examiner-Thomas H. Tarcza
`Assistant Examiner-Tod Swann
`Attorney, Agent, or Firm-Hoffman, Wasson & Gitler
`ABSTRACT
`[57]
`A method and apparatus for granting selected access to
`material such as data and databases, messages and other
`textual information, graphs, tables, maps, facsimiles
`(FAX) of all manner of transmitted materials, audio
`such as speech and music, video, images, and photo(cid:173)
`graphs, provided on storage media utilizing information
`encoded in the storage media. The storage media are
`included in one or more reading devices associated with
`a computer. A storage accessing device, such as a smart
`card, is used in conjuction with the computer to deter(cid:173)
`mine whether access to a particular user to specific
`storage media is granted. The storage media can be
`sub-divided into a plurality of logical zones and access
`to all or a portion of the material on the storage media
`is granted based upon the logical zones to which the
`user is allowed access. Infonnation provided on the
`storage media would include an index table listing the
`security identification code, the logical zones to which
`a particular user is assigned as well as a personal secu(cid:173)
`rity key used in conjunction with a personal· security
`key provided in the smart card. The interaction be(cid:173)
`tween the user's personal accessing device and the index
`table provided on the storage media detennine if access
`is granted as well as access privileges accorded to the
`user.
`
`24 Claims, 4 Drawing Sheets
`
`SECURITY
`IDENTIFICATION CODE
`. . . . - - - - " ' - - - -
`SYSTEM
`ZONE
`ACCESS
`IDENTIFICATION
`LOGICAL ZONES CODES
`CODES
`1,9,26
`01
`
`000:000
`
`PERSONAL
`SECURITY
`KEYS
`
`1,9,26,911
`
`02
`
`33
`
`27
`
`017°144
`
`.
`.
`
`000,000
`
`02iu2
`
`000,000
`'
`006104
`
`10, 11
`
`33
`
`000010
`
`10,11,19
`
`34
`
`46,47,48,54
`
`11
`
`I
`I
`
`000011
`
`.
`
`550,000
`
`I
`
`550003
`
`300,000
`'
`3081156
`
`xx xx .
`xx'xx
`xx:xx
`I xxxx
`.
`xxxx
`xx' xx
`. I
`xx xx
`xx xx
`.
`xx xx
`xx'xx
`xx xx
`xx'xx
`
`I
`
`I
`
`~
`
`~
`
`M.
`
`~
`
`'•
`
`IPR2017-00430
`UNIFIED EX1010
`
`

`

`HUMAN
`READER
`
`14 ........... X---
`
`;~
`,
`
`12,
`
`PERSONAL [
`ACCESSING
`DEVICE
`
`FIG. 1
`
`18
`
`20
`
`0
`
`22
`
`22
`
`COMPUTER
`KEYBOARD
`
`AUTOMATIC
`READER
`WITH
`KEYPAD
`
`COMPUTER
`OR
`INFORMATION
`PROCESSING
`DEVICE
`
`STORAGE
`MEDIUM
`READER
`
`©
`
`---
`
`STORAGE
`MEDIUM
`READER
`
`®
`
`10/
`
`18
`
`~ •
`00
`•
`"'C
`~
`"""'"
`
`('D = """'"
`
`z
`0
`~
`""""
`~
`""""
`\C
`\C
`""""
`
`00
`
`=-ti>
`.....
`ti>
`"""" 0
`......
`.fl>
`
`UI
`.,.
`0
`~
`UI
`.,.
`~
`N
`\0
`
`

`

`U.S. Patent
`U.S. Patent
`
`Nov. 12, 1991
`Nov. 12, 1991
`
`Sheet 2 of 4
`Sheet 2 of 4
`
`5,065,429
`5,065,429
`
`Zu.. ~~ Oo GJ[j
`C") GG
`~~ G G
`[j[J
`
`C\I
`
`~ rt
`
`w
`
`- :
`
`c
`u
`
`

`

`INPUT
`PERSONAL
`IDENTIFICATION
`CODE INTO
`PERSONAL
`ACCESSING
`DEVICE ( PAD)
`
`FIG.3
`
`I
`
`PERSONAL
`ACCESSING DEVICE
`DISPLAYS SECURITY
`IDENTIFICATION
`CODE (SIC)
`
`SIC ENTERED I
`
`INTO COMPUTER
`
`I
`
`COMPUTER VERIFIES
`BONAFIDE SIC
`ENTRY
`
`RESPONSE TO
`RANDOM NUMBER IS
`ENTERED INTO
`COMPUTER
`
`RESPONSES ARE
`COMPARED
`
`l
`
`ACCESS TO
`LOGICAL ZONES IS
`GRANTED IF
`RESPONSES MATCH
`
`I
`
`-..
`
`COMPUTER
`RETRIEVES
`SECURITY KEY
`PAIRED TO SIC
`I
`COMPUTER
`GENERATES AND
`DISPLAYS RANDOM
`NUMBER
`I
`RANDOM NUMBER
`IS INTRODUCED TO PAD
`AS A CHALLENGE
`CODE
`
`I
`
`ALGORITHM IN PAD
`AND COMPUTER
`OPERATE ON RANDOM
`NUMBER
`
`DOM NUMBER IS
`DISPLAYED ON PAD
`
`RESPONSE TO RAN· -l
`
`~ •
`7J'J.
`•
`'"'C
`~
`t"'t-
`=
`n>
`t"'t-
`
`z
`0
`~
`lo-&
`~N
`lo-&
`\0
`\0
`lo-&
`
`rJ1
`
`=-tD
`....
`tD
`w
`0 .....
`.J:o.
`
`(JI
`-..
`
`0 °' (JI
`
`-..
`~
`N
`\0
`
`

`

`U.S. Patent
`
`Nov. 12, 1991
`
`Sheet 4 of 4
`
`5,065,429
`
`FIG .. 4
`STORAGE MEDIUM
`INDEX TABLE
`
`ZONE
`ACCESS
`LOGICAL ZONES CODES
`1,9,26
`01
`
`SECURITY
`IDENTIFICATION CODE
`
`SYSTEM
`IDENTIFICATION
`CODES
`000000
`•
`087144
`
`I
`
`I
`
`.
`
`I
`
`PERSONAL
`SECURITY
`KEYS
`xx xx
`•
`•
`xx xx
`xx xx
`..
`xx xx
`xx xx
`xx xx
`xx xx
`xx xx
`xx xx
`•
`xx xx
`xx xx
`•
`•
`I xx xx
`
`I
`I
`
`I
`I
`I
`
`I
`I
`I
`
`I
`I
`
`1,9,26,99
`
`02
`
`000000
`•
`029142
`
`33
`
`10,11
`
`10,11,99
`
`46,47 ,48,54
`
`-
`36
`
`27
`
`33
`
`34
`
`81
`
`32
`
`000000
`
`006104
`
`I
`I
`I
`
`000010
`•
`000018
`
`I
`I
`
`550000
`•
`I
`I
`550003
`
`300000
`3081156
`
`I
`I
`
`34
`
`38
`
`

`

`1
`
`5,065,429
`
`2
`only a limited portion of the material provided on the
`storage media. This is important since only a single
`master print of any entire file may be manufactured and
`distributed to various personnel with limited access of
`5 material granted to each of the personnel. If limiting
`access was not possible, various storage devices and
`quite possibly many more storage devices, must be man(cid:173)
`ufactured and given to each of the personnel, based
`upon the section of the material to which each individ-
`10 ual has been granted access.
`Similarly, no device was discovered in which the
`storage media, provided with software program infor(cid:173)
`mation thereon, is used to allow access to only a portion
`of the program information, or one or more programs
`from a plurality of programs.
`
`METHOD AND APPARATUS FOR PROTECTING
`MATERIAL ON STORAGE MEDIA
`
`This is a continuation of copending application Ser.
`No. 07/358,263 filed on May 30, 1990 now abandoned
`which is a continuation -in-part of 331,800 filed Apr. 3,
`1989 now also abandoned.
`
`BACKGROUND OF THE INVENTION
`In the approximately 45 years since the development
`of the first crude computer, our society has seen a vir(cid:173)
`tual explosion of information storage as well as informa(cid:173)
`tion processing machines. With the advent of the per(cid:173)
`sonal computer, this information explosion has perme- 15
`ated virtually every facet of our daily lives. In the busi(cid:173)
`ness community, personal computers are used to store
`and process a large amount of material which was pre(cid:173)
`viously maintained in paper files. Similarly, many
`homes now include a personal computer for the storage 20
`of personal data as well as the processing of other types
`of information.
`During the infancy of the computer industry, when
`only very large companies or the government were able
`to afford to purchase and maintain relatively large 25
`mainframe computers provided with bulky storage me(cid:173)
`dia, security for access to this storage media was gener(cid:173)
`ally maintained by limiting access to the area in which
`the computer was stored as well as access to the com(cid:173)
`puter itself. Typically, an authorized user was issued 30
`either a computer password or security card allowing
`access to the computer and any files included in the
`storage media utilized with the company. In other
`words, the person attempting to gain access to the com(cid:173)
`puter must possess the knowledge and/or the tools of 35
`the authorized user. However, used .in the context of
`today's smaller personal computers and the utilization
`of relatively small, portable storage media, this type of
`security program has proven to be inadequate. For
`example, if the password or security card would be 40
`stolen from the authorized personnel, computer access
`to an authorized person would be granted. Addition(cid:173)
`ally, since the storage media is relatively small in size
`and, due to the need for allowing access to the material
`provided on this storage media to various authorized 45
`personnel remote from one another, it is important that
`a system be developed in which the storage media can
`be sent to various locations without the security of the
`material on the media being compromised.
`In this context, several methods have been developed 50
`for protecting access to software programs stored on
`storage media such as read-only-memory (ROM). Ex(cid:173)
`amples of these devices are discussed in U.S. Pat. Nos.
`4,757,468 issued to Domenik et al and 4,740,890 issued
`to William. Both of these patents describe apparatuses 55
`for protecting software programs which will be distrib(cid:173)
`uted on a magnetic disk or similar storage media. Verifi(cid:173)
`cation routines provided directly on the storage media
`are utilized to protect access to the entire program.
`However, no device has been developed in which stor- 60
`age media itself is utilized to protect non-program infor(cid:173)
`mation, such as textual material, data, graphs, or other
`digitally stored material. Furthermore, since various
`personnel may be granted access to only selective mate(cid:173)
`rial which would be on the storage disk, the scenarios 65
`described with respect to the Domenik et al and Wil(cid:173)
`liam patents would not be applicable to an instance in
`which various personnel would be granted access to
`
`SUMMARY OF THE INVENTION
`The deficiencies of the prior art are overcome by the
`present invention which is directed to a method and
`system for granting complete or limited access to infor(cid:173)
`mation stored in a storage medium or media utilizing
`information physically stored in the storage medium or
`media. The particular storage medium or media are
`included in an appropriate reader which is connected to
`a standard personal computer, minicomputer, or a main(cid:173)
`frame computer having a means for entering personal
`and system access data therein, such as a keyboard. The
`storage medium can be any permanent or erasable item
`such as an optical disk, a CD ROM, a WORM, a floppy
`disk, a disk pack, a smart card, an integrated circuit
`card, an optical card, as well as special items such as a
`BERNOULLI box disk, or any other type of storage
`medium. However, for simplicity sake, we shall de(cid:173)
`scribe the present invention with respect to a CD ROM
`storage medium. Additionally, a storage accessing de(cid:173)
`vice (used interchangeably herein with the following
`terms- personal accessing device and smart card) pro(cid:173)
`vided with an encrypted or non-encrypted personal
`security key as well as personal identification code is
`included to allow an individual access to the storage
`medium or media. Furthermore, for ease of understand(cid:173)
`ing the present invention, we shall describe the storage
`accessing device with respect to a SMART card that
`does not require an electronic, optical, capacitive or
`magnetic reader to receive or transmit personal and
`system data.
`Initially, when the CD ROM is mastered, the infor(cid:173)
`mation storage portion of the CD ROM is broken up
`according to a predetermined classification ·system and
`stored in various logical zones, each of which contains
`a discrete set of databases or other material therein.
`There may be one or more logical zones recorded on
`the CD ROM. Users, based on theii- need to know, as
`well as the sensitivity of the material to be stored on the
`CD ROM, are accorded access privileges that corre(cid:173)
`spond to previously designated logical zones. Based on
`an organization's or person's storage classification sys(cid:173)
`tem, material are categorized and stored in the corre(cid:173)
`sponding logical zones when the CD ROM is manufac(cid:173)
`tured. Therefore, for each user being granted access
`privileges, a determination is made as to which logical
`zones each particular user would be allowed access.
`Based upon this determination, each user is assigned a
`particular zone access code (ZAC) which is translated
`into corresponding logical zones using an index table
`stored in the CD ROM. At the same time, paired to the
`ZAC, is a list of authorized system identification codes,
`each with its assigned unique personal security key
`
`

`

`5,065,429
`
`3
`(SK). Each authorized user is assigned a ZAC and a
`unique system identification code. For extremely secure
`applications, the intended user's biometric coded infor(cid:173)
`mation can be paired with the personal security key.
`The ZAC, the system identification code, the personal
`security key code, plus the possible use of biometric
`coded information, as well as the logical zones assigned
`to the ZAC for each user or class of user, is included on
`the CD ROM in the form of an index table when it is
`manufactured.
`When an individual wishes to gain access to the CD
`ROM, the user would correctly enter his particular
`personal identification code in the aforementioned
`smart card which would then display both the ZAC as
`well as the system identification code in either en- 15
`crypted or non-encrypted form. Th_e user, utilizing a
`keyboard, would enter this code into the computer
`which then compares the decrypted or encrypted codes
`obtained from both the smart card and CD ROM and if
`a match is obtained, would then verify that this particu- 20
`Jar system ID code is proper and that material this
`accessor seeks access to is stored on the storage medium
`or media. The computer then retrieves the paired per(cid:173)
`sonal security key (SK). The computer would then
`generate a random number which is displayed upon its 25
`screen to serve as a challenge to the personal accessing
`device (smart card). The user would input this random
`number into the smart card via its keypad. The smart
`card as well as the computer are provided with a partic(cid:173)
`ular encryption/decryption algorithm (alternately a 30
`security microprocessor chip). Both the computer and
`the smart card would simultaneously compute a re(cid:173)
`sponse to the challenge code (random number) and this
`response is displayed on the smart card screen. This
`displayed response is then entered into the computer 35
`through its keyboard to determine .whether there is a
`match. If a match is shown to have occurred, the com(cid:173)
`puter will then display all the logical zones and material
`names therein to which access privileges have been
`granted and allow the user access to these logical zones 40
`provided in the storage media.
`Further, the system then releases the system security
`key (SSK) which is transferred to the information pro(cid:173)
`cessing device's volatile random access memory
`(RAM) or to the security microprocessor chip board 45
`installed in the information processing device. The sys(cid:173)
`tem security key is used to decrypt all the encrypted
`material transferred from the CD ROM. The informa(cid:173)
`tion processing device's copy of the system security key
`is destroyed when the information processing device 50
`loses its power or if said device concludes its CD ROM
`activities and is then used for other applications. Each
`CD ROM has its own system security key recorded on
`it which would be retrieved by the information process(cid:173)
`ing device for use during search and retrieval activities 55
`when authorized user access is established.
`The CD ROM search and retrieval program can be
`stored either on items such as floppy disks to be used at
`the time of CD ROM operation, on the information
`processing device's permanent memory, or on the CD 60
`ROM.
`If a type of contact or contactless smart card is used
`which requires a non-human reader, the operation is
`very similar to the activities described above. The per(cid:173)
`sonal identification code can be entered via the com- 65
`puter keyboard or via a keypad on the card reader. The
`entry of the correct personal identification code enables
`the smart card to start transmission and the paired ZAC
`
`4
`and system identification codes which are stored in the
`smart card microcomputer's EPROM or EEPROM are
`transmitted to the computer. Based on the transmitted
`ZAC, the index table on the storage media is searched
`5 to determine if there is a match. If the corresponding
`ZAC is not stored in the index table of the storage
`medium or media, a message is displayed on the com(cid:173)
`puter screen that access will not be granted. If there is
`a match of the ZAC's, then the associated system identi-
`10 fication codes stored on the storage medium or media
`are accessed until an exact match is found. If no match
`is found, the accessor will not be granted access. If an
`exact match is found, the personal security key paired
`with the user's system identification code is retrieved by
`the computer and is used to operate upon a randomly
`computer generated number. At the same time, the
`random number is also transmitted to the smart card
`reader which inputs the number to the smart card. The
`authorized user's smart card has both an identical en(cid:173)
`cryption/ decryption algorithm or microprocessor chip
`and personal security key to that of the information
`processing device and the CD ROM. The smart card
`operates on the random number using its internally
`stored personal security key and transmits the result
`through the card reader to the computer (information
`processing device). The information processing device
`uses an encryption/decryption algorithm or micro(cid:173)
`processor chip to compare the results of both operations
`upon the random number. If a match occurs, the acces(cid:173)
`sor's authorized status is ascertained and the predeter(cid:173)
`mined access privileges are granted.
`With respect to software program application, while
`prior art devices include verification routines provided
`on the storage media to protect access to the entire
`program, no prior art device, however, limits access to
`only a portion of this program, or access to one pro-
`gram from two or more stored programs. Additionally,
`access can be provided to one or more programs from a
`plurality of programs. To prevent unauthorized access,
`the storage accessing device can be programmed to
`permit only one download or a specific number of
`downloads of the portion of the program or one or
`more programs from a plurality of programs on the
`media allowed access by the user.
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`These and. other advantages of the objects of the
`invention can be understood from the following de(cid:173)
`tailed description of a preferred embodiment of the
`invention described in conjunction with the drawings
`wherein:
`FIG. 1 is a block diagram of the system of the present
`invention;
`FIG. 2 is a diagram of a typical personal· accessing
`device;
`FIG. 3 is a flow diagram of a method of granting
`access to the storage media based upon the present
`invention; and
`FIG. 4 is a diagram showing a single entry in the
`index table of a storage medium.
`
`DETAILED DESCRIPTION OF THE
`DRAWINGS
`The present invention is directed to a method and
`apparatus for granting access to information such as
`data and databases, messages and other textual informa(cid:173)
`tion, graphs, tables, maps, facsimiles (FAX) of all man(cid:173)
`ner of transmitted materials, audio such as speec~ and
`
`

`

`5,065,429
`
`5
`music, video, images, photographs, or the like ,provided
`on a storage medium or media such as a CD ROM or
`the like. Contrary to most methods and devices for
`allowing access to the material provided on a storage
`medium or media, wherein access is granted to a com- 5
`puter included a storage media file, the present inven(cid:173)
`tion grants access to the storage media itself or a portion
`thereof based upon an indexed table included directly
`on the storage medium or media. The storage media,
`hereinafter a CD ROM, can be, if desired, divided into 10
`a plurality of logical zones. Based upon a user's need to
`know, access can be granted to all of the logical zones
`or a particular combination oflogical zones. Based upon
`these logical zones, the user is assigned a zone access
`code, along with a system identification code, and a 15
`personal security key. For a more secure system, bio(cid:173)
`metric coded information can also be assigned as part of
`the personal identifier. This information for each of the
`users is stored on the CD ROM along with the transla(cid:173)
`tion of each zone access code into its .corresponding 20
`logical zone(s). Additionally, each of the users is as(cid:173)
`signed a personal identification code for use with the
`smart card to corroborate the user's identity and there(cid:173)
`after enable the smart card to initiate the challenge(cid:173)
`response dialogue with the storage medium or media. 25
`Once all of the relevant information is directly pro(cid:173)
`vided for a user within the CD ROM as well as a per(cid:173)
`sonal accessing device such as a smart card, a user can
`gain access utilizing the system 10 illustrated with re(cid:173)
`spect to FIG. 1. As shown therein, access to the storage 30
`media CD ROM is provided utilizing a personal access(cid:173)
`ing device 12. This device 12 can be various configura(cid:173)
`tions of devices. As a smart card, it can be of types of
`smart card which would automatically interface with an
`automatic reader 16 connected to a computer or infor- 35
`mation processing device 20, or through the interven(cid:173)
`tion of a human reader 14 with a keyboard 18. The
`computer or information processing device would run
`the gamut from microcomputers, minicomputers to
`mainframe computers. For illustrative purposes only, 40
`we shall discuss the present invention with respect to a
`smart card 24 shown in FIG. 2 with a keypad and light
`crystal display. An ON/OFF key 26 of the smart card
`24 is depressed and the smart card is turned on. Addi(cid:173)
`tionally, it is noted that the smart card may use an en- 45
`cryption/decryption algorithm or microprocessor chip
`or any other encryption device if a security key device
`is employed with the CD ROM. Once the smart card is
`turned on and the correct personal identification code is
`entered into the smart card, and the CD ROM is in- 50
`serted into a storage media reader 22, the challenge(cid:173)
`response process is ready to begin.
`Initially, the user would input a four digit or charac(cid:173)
`ter personal identification code (PIC) into the smart
`card 24. It is noted that the exact number of digits of the 55
`PIC is not important and could consist of alphanumeric
`characters. The integrated circuit or microprocessor
`chip provided in the smart card contains the system
`identification code that will let the computer or infor(cid:173)
`mation processing device know the identity of the au- 60
`thorized user. Typical system identification codes 34 are
`shown in the illustrative storage medium index table
`with respect to FIG. 4. Although the authorized user's
`security identification code consists of a two-digit zone
`access code, and a six-digit system identification code, 65
`the exact number of digits employed, as well as the use
`of alphanumerics can be modified based upon system
`needs and preference. The code is displayed at 30 of the
`
`6
`smart card. Once the security identification code is
`displayed on the smart card 24, the accessor enters it
`into the computer or information processing device 20
`via keyboard 18. At this point, the corresponding zone
`access code is searched for in the index table to find out
`if the storage medium or media contains stored material
`for that zone's access privileges. If the corresponding
`zone access code is missing from the storage medium or
`media index table, then a message will be displayed on
`the computer or information processing device screen
`20 indicating that access is denied. If the zone access
`codes match, then the computer or information process(cid:173)
`ing device verifies that the accessor may have privileges
`to material stored on the CD ROM(s) and will look up
`the paired personal security key 38 stored on the CD
`ROM. To ensure that the security aspect of the present
`invention is as inclusive as possible, the personal secu(cid:173)
`rity key can be encrypted directly in the CD ROM. The
`zone access code 32 corresponds to the particular logi(cid:173)
`cal zones assigned to one or more authorized users. For
`example, as shown in FIG. 4, a zone access code of 33
`corresponds to the logical zone 36 portion of the index
`table indicating that logical zones 10 and 11 will be
`allowed access. Any one of the logical zones on the CD
`ROM can contain one or more databases or other mate(cid:173)
`rial. Therefore, as shown, any one of the zone access
`codes can be assigned to a user, who in turn, can be
`assigned an individualized system identification code
`associated with that zone access code from the total of
`up to 1,000,000 unique code numbers available. Cer(cid:173)
`tainly, if more user codes are required, alphanumeric
`characters can be used or the number of characters of
`the system identification codes 34 can be increased.
`A special logical zone can be set aside to control the
`downloading of data from the storage medium or me(cid:173)
`dia. As shown in FIG. 4, the zone access code 32 value
`of 01 corresponds to logical zone access privileges 1, 9,
`26. Zone access code 02 gives authorized users access to
`the same three logical zones of 1, 9 and 26, but the
`addition of logical zone 99 enables the authorized user
`to download the stored material. Without logical zone
`99 privileges, an authorized user could not perform
`downloading.
`Once the zone access code and system identification
`code are entered and accessed and matches confirmed,
`the personal security key code paired with this system
`identification code is utilized to verify the proper identi(cid:173)
`fication of the accessor.
`A random number generator provid.ed within the
`computer or information processing device 20 gener(cid:173)
`ates a random number, such as a four-digit number
`which is displayed by the computer or information
`processing device and serves as a challenge to the smart
`card 24. The user depresses the challenge key 38 and
`enters the random number into a smart card 24 using the
`keypad 28 and then depresses the enter key 40. An
`identical encryption/decryption algorithm or micro(cid:173)
`processor chip and personal security key provided in
`both the computer or information processing device 20
`as well as the smart card 24 performs an operation on
`the random number. The response to the challenge by
`the smart card is displayed and this number is entered
`into the keyboard 18. The computer or information
`processing device then compares this result with the
`result that it generated utilizing the CD ROM transmit(cid:173)
`ted personal security key which is paired to the system
`identification code. If these two results are identical,
`access to the particular logical zones corresponding to
`
`

`

`5,065,429
`
`60
`
`7
`the zone access code 32 would be allowed to that partic(cid:173)
`ular user.
`This type of accessing system would allow the CD
`ROM to be circulated among a number of authorized
`users; allowing each user access potentially to all or 5
`only a discrete portion of the information included in
`the CD ROM, according to each person's access privi(cid:173)
`leges.
`The CD ROM or any type of storage media which is
`utilized would operate in conjunction with retrieval 10
`software stored in a number of ways such as on the CD
`ROM or on the computer or information processing
`device non-volatile memory. If it is stored on floppy
`disks or other reusable media, such as the computer's
`hard disk, it can be updated as necessary to detect and 15
`deactivate outdated, duplicated or lost personal access(cid:173)
`ing devices, such as smart cards, which are presented
`for system access. An added feature could be that if a
`reported lost smart card 12 was used to gain access, and
`the computer or information processing device 20 de- 20
`termined it was a lost smart card, a "killer" challenge
`code could be displayed, which when entered into the
`smart card would deactivate the device.
`As illustrated in FIG. 1, an automatic reader 16 can
`be employed instead of manually inputting the informa- 25
`tion onto the smart card 12 or the computer keyboard
`by the human reader. In this instance, the smart card 12
`and the computer or information processing device 20
`would after the correct personal identification code is
`given, engage in its dialogue automatically to determine 30
`whether access by the accessor would be allowed.
`While the invention has been illustrated in some de(cid:173)
`tail, according to the preferred embodiments shown in
`the accompanying drawings, there is no intention to
`limit the invention to such detail. On the contrary, it is 35
`intended to cover all modification, alterations and
`equivalents falling with the spirit and scope of the ap(cid:173)
`pended claims.
`What is claimed is:
`1. A security system for granting user access to digi- 40
`tized materials provided on a storage medium or media,
`said system comprising:
`a computer system including at least one computer
`and a display screen,
`a storage medium subdivided into a plurality of man- 45
`agement control, program and user logical zones,
`each of said logical zones provided with particular
`material therein, said storage medium directly pro(cid:173)
`vided thereon with an access management control
`means for indicating which of said user logical 50
`zone on zones the user will be allowed to access
`based upon accessing information provided to the
`system by the user, said access management control
`means provided in said storage medium at a loca(cid:173)
`tion remote from, and non-contiguous with, said 55
`user logical zones;
`a reader or drive for reading the digitized material
`provided in said plurality of logical zones as well as
`said access management control means of said stor-
`age medium;
`a personal accessing device containing a security
`identification code, to enable said personal access(cid:173)
`ing device to be in communication with said com(cid:173)
`puter system for transmitting said security identifi-
`cation code to said computer system;
`wherein, said security identification code is compared
`to said access management control means provided
`on said storage medium to determine the particular
`
`65
`
`8
`user logical zone or zones to which the user is
`allowed access utilizing said display screen of said
`computer system.
`2. The security system in accordance with claim 1,
`wherein said personal accessing device is initiated by a
`correct personal identification code entered by the user.
`3. The security system in accordance with claim 1
`wherein said access management control means and
`said personal accessing device are further provided
`with a particular personal security key code associated
`with said security identification code for each autho(cid:173)
`rized user, and said computer system is further provided
`with a random number generator, both said computer
`system or alternately said storage medium and said
`personal accessing device furth~r provided with identi(cid:173)
`cal or cooperating encryption decryption algorithm for
`utilizing a number generated by said random number
`generator for determining whether user access is
`granted to one or more particular logical zones associ(cid:173)
`ated with the user's security identification code.
`4. The security system in accordance with claim 3
`wherein