Laptop computers get smaller, lighter and more powerful each year. But along with the ability to take work on the road, the machines bring security concerns because thieves find them all too easy to walk off with. This is particularly worrisome when the contents of the computer are confidential or a matter of national security. Now a new approach to computer encryption could help protect the files of stolen laptops.

The technique, developed by Mark D. Corner and Brian D. Noble of the University of Michigan College of Engineering, is dubbed Zero-Interaction Authentication, or ZIA. It requires two pieces of hardware: the laptop and a so-called authentication token that communicates with the computer via a wireless link. As long as the token, which can be built into a wearable accessory such as a watch, is within range of the computer, the computer's systems function normally. But once the computer is separated from the token, its files automatically become encrypted. "When a user walks away from his laptop to get a cup of coffee, it will sense that he is leaving and begin securing the computer," Noble says. "As he returns, as soon as the user comes within radio range, the computer will begin unlocking the computer so that it is ready to resume work when the user sits down." In preliminary tests, files became scrambled within five seconds of the user's departure and could be unscrambled just six seconds after the worker returned. And although ZIA is as yet only a prototype, it does not appear to slow the computer down significantly more than current protection schemes do.

ZIA utilizes common encryption procedures but its design eliminates the need for the computer's owner to input a decryption key, in the form of a password. Many current systems require entry of the password at regular intervals or after the computer has gone to sleep or been idle. If a machine is stolen with the key intact (or if a user has disabled the security system because he finds it annoying) all of its files are vulnerable. According to the scientists, who will discuss their security solution at next month's Association of Computing Machinery MobiCom 2002 conference, "ZIA is the first system to provide encrypted filing services that defend against physical attack while imposing negligible usability and performance burdens on a trusted user."