GB2310750A

GB2310750A - Security system for networked computers

Info

Publication number: GB2310750A
Application number: GB9604217A
Authority: GB
Inventors: Christopher John Purchase
Original assignee: Individual
Current assignee: Individual
Priority date: 1996-02-28
Filing date: 1996-02-28
Publication date: 1997-09-03
Also published as: GB9604217D0

Abstract

A scheme to effect the security of computers that are connected together to form a network wherein, the appropriate items of hardware having initially been placed in an operational state rather than being switched off, the status of selected computers that are connected to the network are monitored. Various messages relating to the status of the selected computers are passed via the network. One or more actions, such as summoning human assistance, may be taken automatically when conditions occur that may indicate that one or more of the computers, or their components, are subject to theft, unauthorised modification, or both. The constituent parts of the security scheme may be implemented on different computers in the network. Similarly, the constituent parts of the security scheme may be duplicated on different computers in the network.

Description

SECURITY SCHEME FOR NETWORKED COMPUTERS This invention relates to a scheme to effect the security of computers that are connected together in a network.

Computers are increasingly becoming the target of thieves. Both complete computers and their component parts are regularly stolen. Often, computers are specifically designed to make addition and removal of their component parts easy. Once component parts have been stolen, even if they are subsequently recovered, return to the righfful owner is difficult because some component parts bear no serial number.

Furthermore, even if the component parts are seriaWnumbered, those serial numbers are seldom recorded by the owner. Therefore it is preferable to guard against theft.

Another increasing threat to computers is the making, often by legitimate users, of unauthorised modifications. Such modifications may include the removal or addition of component parts; this may be indicative of undesirable events, including the installation of unauthorised software. Therefore, particularly in a commercial environment, the person who is ultimately responsible for the computer will wish to know of such modifications.

Current measures to secure computers and their component parts against theft and unauthorised modification concentrate on two main areas. Firstly, various steps may be taken to protect the location containing the computers, such as: locks; alarm systerns; TV surveillance; and human guards. Secondly, the computers and their component parts may be protected in various ways, such as: physically attaching the computer to an item of furniture, or the fabric of the building; impeding access to the intemal components of the computer; or fitting an alarm to the computer.

According to the present invention there is provided a scheme to effect the security of computers that are connected together to form a network. Prerequisite to the operation of the scheme is that appropriate items of hardware are initially placed in an operational state, rather than being switched off. The scheme then operates by: monitoring regularly the status of selected computers that are connected to the network; passing, via the network, various messages relating to the status of those computers; and taking automatic action when particular conditions occur.

The essential features of the present invention are that a network of computers monitor each other and initiate actions when one or more of them are under threat.

A specific embodiment of the invention will now be described by way of example.

For this example there is a preexisting computer network, comprising hardware and software. The hardware includes: the computers to be protected; the network interface in each computer; and the communications that connect those network interfaces together. These communications may include cables, optical fibres, radio links, and telecommunications links. The software includes a protocol and one or more network operating systems, which together allow the invention to pass messages between its component parts.

In this embodiment the invention is described in four parts: the Look-out, the Monitor, the Filter and the Alarm. The parts pass various messages to each other. Each part runs on a computer that is connected to the network. The four parts may each run on a separate computer, or two or more parts may run on the same computer. When any two parts that need to communicate via messages run on different computers, those messages are passed between them via the network.

The Look-out is a program which runs on each computer that has been selected for protection. The Look-out determines various information about the hardware of the computer on which it is running, such as: quantity of memory installed; number and type of peripherals present; type and speed of prooessor. The Look-out periodically sends a Monitor Message containing status information to the Monitor.

The Monitor receives Monitor Messages from each Look-out, and sends Filter Messages to the Filter. The first time a Monitor Message is received from a particular Look-out, the Monitor records the contents and sends a Filter Message to the Filter.

Each time a subsequent Monitor Message is received from a particular Look-out, the Monitor compares it with the corresponding preceding message. Provided there has been no change in status, the Monitor notes the arrival of the message but takes no further action. However, if the message represents a change in status, the Monitor again records the message contents and passes a Filter Message to the Filter.

In respect of each Look-out from which it has received a Monitor Message, the Monitor periodically checks for receipt of a subsequent message and, if no such message has been received, a Filter Message is sent to the Filter.

The Filter receives Filter Messages from the Monitor and, according to pre-set and adjustable rules, sends Alarm Messages to the Alarm. Conditions under which an Alarm Message would be sent could include some or all of: a Look-out detected a change in the quantity of memory installed in a computer; a Look-out detected a change to a computer's peripheral hardware; a Monitor reported no message received from a previously active Look-out.

The Alarm receives Alarm Messages from the Filter. According to pre-set and adjustable rules, and depending on the hardware installed in the computer on which it is running, the Alarm takes actions that could include some or all of writing messages to a log-file; printing information; sounding an alarm; making a telephone call to one or more pre-determined numbers, and delivering an appropriate message.

Optionally, and for additional security, the functions of the Monitor, the Filter and the Alarm may be duplicated on one or more computers in the network. Optionally, and for additional security, any computer that is fulfilling the function of Monitor, Filter or Alarm may also function as a Look-out. Optionally, and for additional security, receipt of some or all of the Monitor, Filter and Alarm messages may be acknowledged.

Claims

1. A scheme to effect the security of computers that are connected together to form a network wherein, the appropriate items of hardware having initially been placed in an operational state rather than being switched off, the status of selected computers that are connected to the network are regularly monitored. The passing, via the network, of various messages relating to the status of the selected computers. The automatic taking of one or more actions when conditions occur that may indicate that one or more of the computers are subject to theft, unauthorised modification, or both. The automatic taking of one or more actions when conditions occur that may indicate that one or more component parts of one or more of the computers are subject to theft, unauthorised modification, or both.

2. A scheme as claimed in Claim 1 wherein one or more parts of the security scheme are implemented on different computers in the network.

3. A scheme as claimed in Claim 1 and Claim 2 wherein one or more parts of the security scheme are duplicated on different computers in the network.

4. A scheme to effect the security of computers substantially as described herein.