Computer security is fast becoming an important issue. With the proliferation of computers and computer networks into all aspects of business and daily life—financial, medical, education, government, and communications—the concern over secure file access and data communications is growing. One method of preventing unauthorized access to files is by using encryption and cipher techniques. These techniques convert data into other forms of data in a fashion that is reversible. Once encrypted, the data is unintelligible unless first decrypted. RSA, DES and CAST are known encryption techniques, which are currently believed to provide sufficient security for computer communications and files.
Each of these encryption techniques uses a cipher key. Such a key is crucial to the encryption/decryption process. Anyone with a correct key can access information that has previously been encrypted using that key. The entry of the key from the keyboard is impractical since a user must remember such a key for entry and as such is liable to be discovered by an individual desiring access to existing encrypted files.
Further, there is great concern over communication of keys within commercial and governmental offices. It is common for users to inform others of their keys or to transfer their keys to others for use during holidays, sick days, or even as a reminder of the key should the user forget. Also, keys are often written down at the workstation in case a user should forget. Such written passwords undermine the security of many systems.
In DES encryption, the key is a numerical value, for example 56 bits in length. Such a key can be used to encrypt and subsequently to decrypt data. The security of the data once encrypted is sufficient that the key is required to access the data in an intelligible form. Thus the security of the data is related to the security of the key.
Some encryption systems use keys stored on the same device as the encrypted files. This is akin to storing a lock and its key in the same location. A knowledgeable user gaining access to the device could locate the key and access the data. Other encryption systems use keys stored on portable cards. Such a key is accessed via a password entered at the keyboard. Other users can take such a portable card and such a password can be discovered. The portable card is equally subject to transfer between employees and improper storage—at a user's desk.
A security access system that provides substantially secure access and does not require a password or access code is a biometric identification system. A biometric identification system accepts unique biometric information from a user and identifies the user by matching the information against information belonging to registered users of the system.
Unfortunately, a device specifically designed to gain access to a system secured through biometric information is plausible. Such a device connects to a personal computer in a same fashion as a contact-imaging device but does not require provision of biometric information. Some forms of infiltrating biometric systems include a record-play back attack wherein biometric information is intercepted, recorded, and then played back at a later time; repeat pattern sending, wherein patterns are sent to the biometric identification system until an authorization occurs; etc. It would be advantageous to restrict the use of third party contact imaging systems with a security identification system in order to improve security.
Typically, data or information is secured on a hard drive by using an encryption key to encrypt data and decryption key to restore the data. Thus, providing a password to the system activates the encryption/decryption key that allows encryption or decryption of the data. A major concern exists when considering a security system based upon such system; the key and the encrypted data are stored on the same hard drive. As such, knowing a user's password give access to the encrypted data.