Controlling access to a protected network

What is this patent about?

’103 is related to the field of network security and enterprise access control. Specifically, it addresses the vulnerabilities of traditional username and password systems by leveraging secondary hardware devices and biometric verification to manage how users log into workstations connected to a protected network.

The underlying idea behind ’103 is to decouple the authentication process from the workstation itself by using a separate, trusted communication device—such as an office telephone—as the primary security gateway. By shifting the authentication load to a device with consistent hardware specifications, the system avoids the security risks associated with varying microphone quality on different computers, enabling more reliable voice biometric verification.

The claims of ’103 focus on a multi-stage authentication sequence initiated by a dedicated hardware trigger. The process requires a network access control module to first identify a specific communication device via a unique identifier sent upon pressing a dedicated log-on button, then authenticate the human user through that device, and finally inject log-on credentials directly into the workstation’s log-on interface via a separate secure channel.

In practice, the system functions as a hardware-based gatekeeper where the user never needs to manually enter or even know their network password. When a user presses the log-on button on their desk phone, the server verifies the phone's identity and prompts the user for a voice sample or an answer to a challenge question. Once the server confirms the user's identity, it establishes a secure communication channel with the computer to automatically populate the log-on fields, effectively bypassing the need for manual keyboard entry.

This approach differentiates itself from prior solutions by eliminating the workstation as a point of failure for biometric capture. By using the PBX infrastructure or a dedicated telephone network for the initial handshake, the invention ensures that sensitive credentials are only transmitted to the computer after out-of-band authentication is complete. This creates a high-assurance environment where stolen passwords or compromised workstation peripherals are insufficient to gain unauthorized network access.