US20100299729A1 - Server Computer Issued Credential Authentication - Google Patents
Server Computer Issued Credential Authentication Download PDFInfo
- Publication number
- US20100299729A1 US20100299729A1 US12/764,523 US76452310A US2010299729A1 US 20100299729 A1 US20100299729 A1 US 20100299729A1 US 76452310 A US76452310 A US 76452310A US 2010299729 A1 US2010299729 A1 US 2010299729A1
- Authority
- US
- United States
- Prior art keywords
- computer
- credential
- response
- challenge
- valid
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/33—User authentication using certificates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2129—Authenticate client device independently of the user
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
Definitions
- the present invention generally relates to computer network security and more particularly to a system and method for providing a limited credential for authenticating access to network resources.
- a user In order to access network resources, a user enters identification and password information into a client computer that is transmitted to a server computer over a computer network for authentication. In turn, the server computer authenticates the client computer using the password and identification information, thereby allowing access to network resources. If the connection with the server computer is terminated, the user must re-enter the identification and password information into the client computer in order to re-authenticate and reconnect with the server computer. The user must re-enter the information because the password is not stored on the client computer for security reasons.
- a “credential” can be issued to the client computer for facilitating the reconnect procedure.
- the credential is data that is used to prove the identity of the subject.
- the credential is used by the client computer to authenticate the client computer to the server computer such that the user does not need to re-enter or store on the client computer the password information. There is no need for the client computer to transmit the identification and password information to the server computer if the client computer has the credential because the credential ensures with a high degree of reliability that the client computer should have access.
- the credential is generated by a trusted third party (TTP) such as the type used with the Kerberos system.
- TTP issues the credential that allows the client computer to authenticate itself to the server computer.
- the credential may be time limited and encrypted by the TTP using a symmetric algorithm and decrypted/verified by the server computer using the same.
- the TTP is used for a large aggregation of machines and contains all of the keys used for authentication by both users and machines.
- TTP TTP-Time to Browse Ratio
- it requires significant infrastructure and is a separate entity that must be configured. Furthermore, the configuration information must be present on all of the server computers. Therefore, in order to implement a change, all of the machines (i.e. client and server computers), as well as the TTP, must be re-configured.
- Another drawback of the TTP is that it is a high value target because it contains all of the keys used for authentication.
- PGP Ticket Another type of authentication mechanism is pretty good privacy (PGP Ticket).
- a TTP e.g., server administrator
- a credential issued to the client computer is time limited and digitally signed by the TTP using commonly known public key technology.
- the credential is interpreted/verified by the server computer.
- a drawback with PGP Ticket is that the security and verifiability of the TTP's public key is weak. Furthermore, a change to the TTP's key requires revoking all of the old keys and updating all of the server computers and client computers with new keys. Additionally, if the TTP's key is compromised, then all of the server computers that rely on that key are also compromised.
- a method for authenticating computers comprises a first computer (e.g., a server computer) issuing a credential to a second computer (e.g., a client computer).
- a first computer e.g., a server computer
- the second computer attempts to authenticate with the first computer
- the second computer generates a first challenge and transmits the credential and the first challenge to the first computer.
- the first computer determines whether the credential is valid and computes a first response to the first challenge.
- the first computer generates a second challenge.
- the first computer transmits the first response and the second challenge to the second computer.
- the second computer determines whether the first response is valid.
- the second computer also computes a second response to the second challenge.
- the second computer transmits the second response to the first computer which then determines whether the second response is valid in order to authenticate the second computer and establish a connection.
- the credential may be encrypted before issuing it to the second computer and transmitting it from the second computer to the first computer.
- the first challenge, the first response, the second challenge, and the second response may be encrypted before transmission.
- Each of the first challenges and responses, as well as the second challenges and responses, are decrypted upon receipt by the first or second computers.
- the second challenge may be a random number such as a nonce generated by the first computer.
- the second computer computes a second response to the first computer challenge by performing a predetermined function on the random number.
- the first computer determines whether the second response is valid by performing the predetermined function on the random number and comparing the result to the second response.
- the predetermined function may be a hash function.
- the first challenge may be a random number such as a nonce.
- the first computer computes a first response to the first challenge by performing a predetermined function on the random number.
- the second computer determines whether the first response is valid by performing the predetermined function on the random number and comparing the result to the first response.
- the credential may be issued with an expiration time. Once the expiration time has been reached, the credential is no longer valid.
- a computer-readable medium containing a program with instructions to execute the authentication between a first computer and a second computer.
- the instructions issue a credential from the first computer to the second computer.
- the credential and a first challenge are transmitted from the second computer to the first computer when the second computer is to be authenticated.
- the first computer determines whether the credential is valid and computes a response to the first challenge.
- the first computer generates a second challenge that is transmitted to the second computer with the first response.
- the second computer determines whether the first response is valid and computes a second response to the second challenge.
- the second response is transmitted to the first computer and the first computer determines whether the second response is valid in order to authenticate the second computer.
- a system for authenticating computers has a first computer and a second computer in communication with each other.
- the first and second computers are configured to execute instructions which authenticate the second computer.
- the first computer issues a credential to the second computer.
- the second computer transmits the credential along with a first challenge to the first computer.
- the first computer is configured to determine whether the credential is valid and computes a first response to the first challenge.
- the first computer generates and transmits a second challenge and the first response to the second computer which verifies the first response and generates a second response.
- the second response is transmitted from the second computer to the first computer in order to authenticate the second computer.
- FIG. 1 is a network diagram
- FIG. 2 is a flowchart illustrating how a reconnect credential is used by a server computer to authenticate a client computer;
- FIG. 3 is a flowchart illustrating how a reconnect credential is issued by the server computer
- FIGS. 4-6 are flowcharts illustrating how a client computer uses the reconnect credential to authenticate with the server computer.
- FIG. 7 is a flowchart illustrating how a reconnect credential is reissued to a client computer.
- 2-7 for issuing and reconnecting with an authentication credential can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer based system, processor containing system, or other system that can fetch the instructions from a computer-readable medium, apparatus, or device and execute the instructions.
- a “computer-readable medium” can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
- the computer-readable medium can be, for example but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non exhaustive list) of the computer readable-medium can include the following: an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read only memory (CDROM).
- RAM random access memory
- ROM read only memory
- EPROM or Flash memory erasable programmable read only memory
- CDROM portable compact disc read only memory
- FIG. 1 illustrates client computers 12 a , 12 b , 12 c connected to a network 18 .
- Server computers 14 a , 14 b , and 14 c are also connected to the network 18 .
- the client computer 12 transmits user identification and password information to the desired server 14 .
- the server computer 14 uses this information to authenticate the client computer 12 and establish a connection.
- FIG. 2 is a flowchart showing how the reconnect credential is used is shown.
- the server computer 14 issues a credential.
- a credential Referring to FIG. 3 , one embodiment of a method of initially issuing the credential from the server computer 14 to the client computer 12 is shown.
- the client computer 12 already has an agreed upon initial session key (k 1 ), while the server computer 14 has a long term server key (ks) and the initial session key (k 1 ).
- the client computer sends the initial timestamp (t 1 ) encrypted using the initial session key (k 1 ) to the server computer 14 .
- the server computer chooses security parameters and an expiration time (exp) for the credential.
- the security parameters include a hash seed (s), and a maximum number of times (m) to run a hash function.
- the server computer 14 calculates a time interval (t 3 ) that is the time interval between the clock of the server computer 14 and initial timestamp (t 1 ).
- Information that uniquely identifies the session (sessioninfo) is generated in step 308 by the server computer 14 in order to distinguish the session from other sessions.
- the server computer 14 generates a credential (cred) for the client computer 12 in step 310 .
- the credential proves the identity of the client computer 12 .
- the credential (cred) is generated using the long term server key (ks) and the seed (s), the maximum number of times (m) to run the hash function, the expiration time (exp), the time interval (t 3 ), and username (user/domain) information to uniquely determine the client computer 12 . It will be recognized by those of ordinary skill in the art that there may be other methods of generating the credential in order to prove the identity of the client computer 12 .
- step 312 the server computer 14 transmits the session information (sessioninfo), seed (s), maximum times (m) to run the hash function, the expiration time (exp), and the credential (cred) encrypted by the initial session key (k 1 ) to the client computer 12 in order to issue the credential.
- sessioninfo session information
- seed seed
- m maximum times
- exp expiration time
- cred cred
- the credential received by the client computer 12 is used to re-establish a seamless connection with the server computer 14 .
- the connection between the server computer 14 and the client computer 12 is terminated in step 204 .
- the connection may be lost by unexpected session termination.
- the client computer 12 transmits the credential to the server computer 14 in step 206 .
- step 208 the process of authenticating the client computer 12 and server computer 14 with the credential issued from step 202 is performed. Once the authentication is complete, the connection is reestablished in step 210 .
- step 208 the method from step 208 for authenticating the client computer 12 and the server computer 14 with the credential issued in step 202 is shown.
- the client computer 12 has the credential (cred), seed (s), and maximum number of times (m) to perform the hash function.
- the client computer 12 chooses the number of times (n) to run the hash function.
- the client computer 12 chooses a client computer challenge such as a random number (client_nonce) for security purposes.
- the client computer 12 then signs the data using a hashed message authentication code (HMAC) and hashed seed (s) data in step 404 .
- HMAC hashed message authentication code
- the data to be signed is the credential (cred), the client computer's random number (client_nonce), the number of times (n) to run the hash function, the timestamp (t 2 ) and the seed (s) data hashed n and (n ⁇ 1) times.
- the data signed by the HMAC is then transmitted from the client computer 12 to the server computer 14 in step 406 .
- step 408 the server computer 14 checks the signatures and decrypts the credential (cred) using the long term server key (ks). If the decrypt fails, then the process exits in step 410 . If the decrypt does not fail, then in step 412 , the server computer 14 retrieves the seed (s), the maximum number of times (m) to perform the hash function, the expiration time of the credential (exp), and the time interval (t 3 ).
- the server computer 14 hashes the credential (cred) and determines if the credential (cred) is in a revocation list in step 414 . If the hashed credential (cred) is in the revocation list, then the credential (cred) is not valid and the process exits in step 416 . However, if the hashed credential (cred) is not in the revocation list, then the process proceeds to step 418 where the server computer 14 checks to see if the expiration time (exp) of the credential (cred) has been exceeded. If the time has been exceeded then the credential (cred) is not valid and the process exits in step 420 .
- the server computer 14 checks to see if the expiration time (exp) of the credential (cred) has been exceeded. If the time has been exceeded then the credential (cred) is not valid and the process exits in step 420 .
- step 418 the server computer 14 determines whether the maximum number of times (m) to perform the hash function is greater than or equal to the number of times (n) to perform the hash function. If m is not greater than or equal to n then the process exits in step 420 . Furthermore, the server computer 14 validates HMAC(s) and the user/domain in step 418 . If either one of these values is invalid, then the process exits in step 420 .
- the server computer 14 performs two separate hashes. It hashes the seed (s) data n number of times ((s)H(n)) and n ⁇ 1 times ((s)H(n ⁇ 1)) in step 422 . In step 424 , the server computer 14 compares the values of (s)H(n) and (s)H(n ⁇ 1) found in step 422 with the values decrypted in step 408 . If the values do not match, then the process exits in step 426 .
- step 428 the server computer 14 decrypts and hashes the client_nonce to generate a server computer response.
- the server computer 14 then chooses a server computer challenge such as a random number (server_nonce) in step 430 .
- server computer 14 adds the hashed credential (cred) to the revocation list so that it cannot be used again.
- step 434 the server computer 14 encrypts and transmits the server_nonce chosen in step 430 , the hashed client_nonce from step 428 using as a key the seed data (s) hashed n ⁇ 1 times.
- step 502 the client computer 12 receives the message containing the server_nonce, the hashed client_nonce, encrypted using the seed data (s) hashed n ⁇ 1 times as the key, transmitted by the server computer 14 in step 434 .
- step 504 the client computer 12 decrypts the message received in step 502 .
- step 506 the client computer 12 verifies the hashed client_nonce by comparing it with the known value. If the values do not match, then the process exits in step 508 .
- the client computer 12 can be assured that the server computer 14 is authentic because it successfully hashed the client_nonce.
- the client computer 12 hashes the server_nonce received from step 502 to generate a client computer response.
- the client computer 12 transmits the hashed server_nonce encrypted with the seed (s) hashed n ⁇ 1 times to the server computer 12 in step 512 .
- the server computer 14 receives the message from step 512 and decrypts the message in step 604 .
- the server computer 14 verifies the hashed server_nonce by comparing it to a known value in step 608 . If the server_nonce does not match the value generated earlier by the server computer 14 , then the process exits in step 609 . However, if the server_nonce is verified, then both the server computer 14 and the client computer 12 are authenticated to each other and a connection can be established in step 610 .
- the credential expires before being used by the client computer 12 .
- the credential includes an expiration time (exp) after which the credential cannot be used. If the credential is not used before the expiration time, the credential is invalid. Therefore, it is necessary to re-issue a valid credential to the client computer 12 before the end of the expiration time. Any reasonable rule can be used to determine when to reissue a credential prior to or after its expiration. As seen in FIG. 2 , the credential is about to expire in step 212 . Accordingly, in step 214 , the server computer 14 re-issues the credential to the client computer 12 .
- the client computer 12 has the credential (cred), seed (s) data, and initial session key (k 1 ).
- the server computer 14 has the long term server key (ks), the initial session key (k 1 ), and the unique name to identify the session (sessioninfo).
- the client computer 12 transmits the credential (cred) and the new timestamp (t 1 ) encrypted by the initial session key (k 1 ) to the server computer 14 .
- the server computer 14 receives and decrypts the message from the client computer 12 in step 704 .
- the server computer 14 determines if the credential (cred) has expired in step 706 . If the time limit for the credential has expired, then the process exits in step 708 . If the time limit has not expired, then the process proceeds to step 710 where both the client computer 12 and the server computer 14 compute a new session key (k 1 ′) that is equal to the hash of the credential (cred) and the seed (s). The server computer 14 creates a new credential (cred′) in step 712 with a new seed (s′), new expiration time (exp′) and new time interval (t 3 ′). The server computer 14 places the old credential (cred) on the revocation list of invalid credentials in step 714 .
- the server computer 14 transmits the new credential (cred′), new seed (s′), new maximum times (m′) to perform the hash function, the new expiration time (exp′), and the session information (sessioninfo) to the client computer 12 in step 716 .
- the message from the server computer 14 to the client computer 12 is encrypted using the new session key (k 1 ′).
- the client computer 12 decrypts the message using the new session key (k 1 ′) to retrieve the new credential and values.
- the long term server key (ks) can be changed.
- the server computer 14 In order to change the long term server key (ks), the server computer 14 generates a cutoff date (cutoff_date) that is later than or equal to the expiration date (exp).
- the server computer 14 generates a new long term server key (ks′).
- the cutoff date (cutoff_date), the original long term server key (ks), and the new long term server key (ks′) are stored at the server computer 14 .
- the server computer 14 When attempting to decrypt a credential, the server computer 14 first uses the original long term server key (ks) and if that fails then uses the new long term server key (ks′). New credentials are issued using the new long term server key (ks′).
- the long term server key (ks) should be set to the new long term server key (ks′) because all of the old credentials issued using the long term server key (ks) have expired. Also, once the cutoff date has passed, the revocation list of invalid credentials can be purged and the server computer 14 can issue a new long term server key using the method just described.
- the reconnect authentication method described above provides security against common attacks. For example, because the client computer 12 and the server computer 14 transmit encrypted client_nonce and server_nonce which require the knowledge of the seed (s), the ability to stage a Man-in-the-Middle (MitM) attack where an attacker intercepts and possibly alters data traveling along the network is decreased.
- the method also provides security against reply attacks where an attacker bugs the network data and reuses it when needed because the messages between the client computer 12 and the server computer 14 include a timestamp which prevent reuse at another time. Reflection attacks where an attacker re-transmits a message created by a user and obtains a right of access are thwarted by using chained nonces and having the user information (user/domain) in the credential.
- reflection attacks are reduced by having each message between the client computer 12 and server computer 14 be non-symmetric and using a unique long term server key (ks).
- the chained nonces also provide against interleaved attacks where an attacker disguises oneself under a different identity during communication.
- a chosen text attack where an attacker tampers with the message and attacks the cryptography algorithm itself is reduced by not using the long term server computer key (ks) to encrypt any data that is obtained from the client computer 12 .
- forced delay attacks where an attacker intercepts the data in the protocol to use later are reduced by using timestamps and an expiration time for the credential, as well as using a revocation list.
- the authentication between the server computer 14 and the client computer 12 may be a single challenge whereby the client computer 12 does not need to retransmit any more information to the server computer 14 after sending the credential and challenge.
- the presently disclosed embodiments are considered in all respects to be illustrative and not restrictive.
- the scope of the invention is indicated by the appended claims, rather than the foregoing description, and all changes that come within the meaning and range of equivalents thereof are intended to be embraced.
Abstract
Methods and systems for authenticating computers is disclosed. The methods and system include issue a credential from a first computer to a second computer. When the second computer authenticates to the first computer, the second computer transmits the credential and a first challenge to the first computer. The first computer determines whether the credential is valid, computes a first response to the first challenge, and generates a second challenge. The first computer transmits the first response and the second challenge to the second computer. The second computer determines whether the first response is valid and computes a second response to the second challenge. The second computer transmits the second response to the first computer in order to verify and authenticate the computers.
Description
- This application is a continuation of application Ser. No. 10/743,796, filed Dec. 24, 2003.
- The present invention generally relates to computer network security and more particularly to a system and method for providing a limited credential for authenticating access to network resources.
- In order to access network resources, a user enters identification and password information into a client computer that is transmitted to a server computer over a computer network for authentication. In turn, the server computer authenticates the client computer using the password and identification information, thereby allowing access to network resources. If the connection with the server computer is terminated, the user must re-enter the identification and password information into the client computer in order to re-authenticate and reconnect with the server computer. The user must re-enter the information because the password is not stored on the client computer for security reasons.
- A “credential” can be issued to the client computer for facilitating the reconnect procedure. The credential is data that is used to prove the identity of the subject. In this instance, the credential is used by the client computer to authenticate the client computer to the server computer such that the user does not need to re-enter or store on the client computer the password information. There is no need for the client computer to transmit the identification and password information to the server computer if the client computer has the credential because the credential ensures with a high degree of reliability that the client computer should have access.
- The credential is generated by a trusted third party (TTP) such as the type used with the Kerberos system. The TTP issues the credential that allows the client computer to authenticate itself to the server computer. The credential may be time limited and encrypted by the TTP using a symmetric algorithm and decrypted/verified by the server computer using the same. The TTP is used for a large aggregation of machines and contains all of the keys used for authentication by both users and machines.
- A drawback with the TTP is that it requires significant infrastructure and is a separate entity that must be configured. Furthermore, the configuration information must be present on all of the server computers. Therefore, in order to implement a change, all of the machines (i.e. client and server computers), as well as the TTP, must be re-configured. Another drawback of the TTP is that it is a high value target because it contains all of the keys used for authentication.
- Another type of authentication mechanism is pretty good privacy (PGP Ticket). A TTP (e.g., server administrator) issues a credential to a client computer that allows the server computer to authenticate the client computer. The credential issued to the client computer is time limited and digitally signed by the TTP using commonly known public key technology. The credential is interpreted/verified by the server computer.
- A drawback with PGP Ticket is that the security and verifiability of the TTP's public key is weak. Furthermore, a change to the TTP's key requires revoking all of the old keys and updating all of the server computers and client computers with new keys. Additionally, if the TTP's key is compromised, then all of the server computers that rely on that key are also compromised.
- In accordance with the present invention there is provided a method for authenticating computers. The method comprises a first computer (e.g., a server computer) issuing a credential to a second computer (e.g., a client computer). When the second computer attempts to authenticate with the first computer, the second computer generates a first challenge and transmits the credential and the first challenge to the first computer. The first computer determines whether the credential is valid and computes a first response to the first challenge. Additionally, the first computer generates a second challenge. The first computer transmits the first response and the second challenge to the second computer. In order to authenticate the first computer, the second computer determines whether the first response is valid. The second computer also computes a second response to the second challenge. The second computer transmits the second response to the first computer which then determines whether the second response is valid in order to authenticate the second computer and establish a connection.
- The credential may be encrypted before issuing it to the second computer and transmitting it from the second computer to the first computer. Similarly, the first challenge, the first response, the second challenge, and the second response may be encrypted before transmission. Each of the first challenges and responses, as well as the second challenges and responses, are decrypted upon receipt by the first or second computers.
- The second challenge may be a random number such as a nonce generated by the first computer. The second computer computes a second response to the first computer challenge by performing a predetermined function on the random number. The first computer determines whether the second response is valid by performing the predetermined function on the random number and comparing the result to the second response. The predetermined function may be a hash function.
- Similarly, the first challenge may be a random number such as a nonce. The first computer computes a first response to the first challenge by performing a predetermined function on the random number. The second computer determines whether the first response is valid by performing the predetermined function on the random number and comparing the result to the first response.
- The credential may be issued with an expiration time. Once the expiration time has been reached, the credential is no longer valid.
- In accordance with the present invention, there is provided a computer-readable medium containing a program with instructions to execute the authentication between a first computer and a second computer. The instructions issue a credential from the first computer to the second computer. The credential and a first challenge are transmitted from the second computer to the first computer when the second computer is to be authenticated. The first computer determines whether the credential is valid and computes a response to the first challenge. Furthermore, the first computer generates a second challenge that is transmitted to the second computer with the first response. The second computer determines whether the first response is valid and computes a second response to the second challenge. The second response is transmitted to the first computer and the first computer determines whether the second response is valid in order to authenticate the second computer.
- A system for authenticating computers has a first computer and a second computer in communication with each other. The first and second computers are configured to execute instructions which authenticate the second computer. Specifically, the first computer issues a credential to the second computer. In order to be authenticated, the second computer transmits the credential along with a first challenge to the first computer. The first computer is configured to determine whether the credential is valid and computes a first response to the first challenge. The first computer generates and transmits a second challenge and the first response to the second computer which verifies the first response and generates a second response. The second response is transmitted from the second computer to the first computer in order to authenticate the second computer.
- These, as well as other features of the present invention, will become more apparent upon reference to the drawings wherein:
-
FIG. 1 is a network diagram; -
FIG. 2 is a flowchart illustrating how a reconnect credential is used by a server computer to authenticate a client computer; -
FIG. 3 is a flowchart illustrating how a reconnect credential is issued by the server computer; -
FIGS. 4-6 are flowcharts illustrating how a client computer uses the reconnect credential to authenticate with the server computer; and -
FIG. 7 is a flowchart illustrating how a reconnect credential is reissued to a client computer. - Various aspects will now be described in connection with exemplary embodiments, including certain aspects described in terms of sequences of actions that can be performed by elements of a computer system. For example, it will be recognized that in each of the embodiments, the various actions can be performed by specialized circuits, circuitry (e.g., discrete and/or integrated logic gates interconnected to perform a specialized function), program instructions executed by one or more processors, or by any combination. Thus, the various aspects can be embodied in many different forms, and all such forms are contemplated to be within the scope of what is described. The instructions of a computer program as illustrated in
FIGS. 2-7 for issuing and reconnecting with an authentication credential can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer based system, processor containing system, or other system that can fetch the instructions from a computer-readable medium, apparatus, or device and execute the instructions. - As used herein, a “computer-readable medium” can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non exhaustive list) of the computer readable-medium can include the following: an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read only memory (CDROM).
- Referring now to the drawings wherein the showings are for purposes of illustrating preferred embodiments of the present invention only, and not for purposes of limiting the same,
FIG. 1 illustratesclient computers network 18.Server computers network 18. In order for a client computer 12 to access a server computer 14, the client computer 12 transmits user identification and password information to the desired server 14. The server computer 14 uses this information to authenticate the client computer 12 and establish a connection. -
FIG. 2 is a flowchart showing how the reconnect credential is used is shown. Instep 202, the server computer 14 issues a credential. Referring toFIG. 3 , one embodiment of a method of initially issuing the credential from the server computer 14 to the client computer 12 is shown. The client computer 12 already has an agreed upon initial session key (k1), while the server computer 14 has a long term server key (ks) and the initial session key (k1). Instep 302, the client computer sends the initial timestamp (t1) encrypted using the initial session key (k1) to the server computer 14. Instep 304, the server computer chooses security parameters and an expiration time (exp) for the credential. In the illustrated embodiment, the security parameters include a hash seed (s), and a maximum number of times (m) to run a hash function. Instep 306, the server computer 14 calculates a time interval (t3) that is the time interval between the clock of the server computer 14 and initial timestamp (t1). Information that uniquely identifies the session (sessioninfo) is generated instep 308 by the server computer 14 in order to distinguish the session from other sessions. - The server computer 14 generates a credential (cred) for the client computer 12 in step 310. As previously discussed, the credential proves the identity of the client computer 12. For the embodiment shown in
FIG. 3 , the credential (cred) is generated using the long term server key (ks) and the seed (s), the maximum number of times (m) to run the hash function, the expiration time (exp), the time interval (t3), and username (user/domain) information to uniquely determine the client computer 12. It will be recognized by those of ordinary skill in the art that there may be other methods of generating the credential in order to prove the identity of the client computer 12. Instep 312, the server computer 14 transmits the session information (sessioninfo), seed (s), maximum times (m) to run the hash function, the expiration time (exp), and the credential (cred) encrypted by the initial session key (k1) to the client computer 12 in order to issue the credential. - The credential received by the client computer 12 is used to re-establish a seamless connection with the server computer 14. In the reconnect procedure shown in
FIG. 2 , the connection between the server computer 14 and the client computer 12 is terminated instep 204. The connection may be lost by unexpected session termination. In order to reconnect, the client computer 12 transmits the credential to the server computer 14 instep 206. Instep 208, the process of authenticating the client computer 12 and server computer 14 with the credential issued fromstep 202 is performed. Once the authentication is complete, the connection is reestablished instep 210. - Referring to
FIGS. 4A-4B , the method fromstep 208 for authenticating the client computer 12 and the server computer 14 with the credential issued instep 202 is shown. The client computer 12 has the credential (cred), seed (s), and maximum number of times (m) to perform the hash function. Instep 402, the client computer 12 chooses the number of times (n) to run the hash function. Also, the client computer 12 chooses a client computer challenge such as a random number (client_nonce) for security purposes. The client computer 12 then signs the data using a hashed message authentication code (HMAC) and hashed seed (s) data instep 404. The data to be signed is the credential (cred), the client computer's random number (client_nonce), the number of times (n) to run the hash function, the timestamp (t2) and the seed (s) data hashed n and (n−1) times. The data signed by the HMAC is then transmitted from the client computer 12 to the server computer 14 instep 406. - In
step 408, the server computer 14 checks the signatures and decrypts the credential (cred) using the long term server key (ks). If the decrypt fails, then the process exits instep 410. If the decrypt does not fail, then instep 412, the server computer 14 retrieves the seed (s), the maximum number of times (m) to perform the hash function, the expiration time of the credential (exp), and the time interval (t3). - The server computer 14 hashes the credential (cred) and determines if the credential (cred) is in a revocation list in
step 414. If the hashed credential (cred) is in the revocation list, then the credential (cred) is not valid and the process exits instep 416. However, if the hashed credential (cred) is not in the revocation list, then the process proceeds to step 418 where the server computer 14 checks to see if the expiration time (exp) of the credential (cred) has been exceeded. If the time has been exceeded then the credential (cred) is not valid and the process exits instep 420. Furthermore, instep 418, the server computer 14 determines whether the maximum number of times (m) to perform the hash function is greater than or equal to the number of times (n) to perform the hash function. If m is not greater than or equal to n then the process exits instep 420. Furthermore, the server computer 14 validates HMAC(s) and the user/domain instep 418. If either one of these values is invalid, then the process exits instep 420. - The server computer 14 performs two separate hashes. It hashes the seed (s) data n number of times ((s)H(n)) and n−1 times ((s)H(n−1)) in
step 422. Instep 424, the server computer 14 compares the values of (s)H(n) and (s)H(n−1) found instep 422 with the values decrypted instep 408. If the values do not match, then the process exits instep 426. - Next, in
step 428, the server computer 14 decrypts and hashes the client_nonce to generate a server computer response. The server computer 14 then chooses a server computer challenge such as a random number (server_nonce) instep 430. Instep 432, the server computer 14 adds the hashed credential (cred) to the revocation list so that it cannot be used again. In order to continue authentication of the credential, instep 434 the server computer 14 encrypts and transmits the server_nonce chosen instep 430, the hashed client_nonce fromstep 428 using as a key the seed data (s) hashed n−1 times. - Referring to
FIG. 5 , the process of authenticating the client computer 12 is continued. Specifically, instep 502, the client computer 12 receives the message containing the server_nonce, the hashed client_nonce, encrypted using the seed data (s) hashed n−1 times as the key, transmitted by the server computer 14 instep 434. Instep 504, the client computer 12 decrypts the message received instep 502. Next, instep 506, the client computer 12 verifies the hashed client_nonce by comparing it with the known value. If the values do not match, then the process exits instep 508. However, if the values do match, then the client computer 12 can be assured that the server computer 14 is authentic because it successfully hashed the client_nonce. Instep 510, the client computer 12 hashes the server_nonce received fromstep 502 to generate a client computer response. In order to verify to the server computer 14 that the client computer 12 has successfully received the message, the client computer 12 transmits the hashed server_nonce encrypted with the seed (s) hashed n−1 times to the server computer 12 instep 512. - Referring to
FIG. 6 , the server computer 14 receives the message fromstep 512 and decrypts the message instep 604. The server computer 14 verifies the hashed server_nonce by comparing it to a known value instep 608. If the server_nonce does not match the value generated earlier by the server computer 14, then the process exits instep 609. However, if the server_nonce is verified, then both the server computer 14 and the client computer 12 are authenticated to each other and a connection can be established instep 610. - It is possible that the credential expires before being used by the client computer 12. As previously discussed, the credential includes an expiration time (exp) after which the credential cannot be used. If the credential is not used before the expiration time, the credential is invalid. Therefore, it is necessary to re-issue a valid credential to the client computer 12 before the end of the expiration time. Any reasonable rule can be used to determine when to reissue a credential prior to or after its expiration. As seen in
FIG. 2 , the credential is about to expire instep 212. Accordingly, instep 214, the server computer 14 re-issues the credential to the client computer 12. - Referring to
FIG. 7 , one embodiment of a method for reissuing the credential is shown while the client computer 12 is still connected to the server computer 14. The client computer 12 has the credential (cred), seed (s) data, and initial session key (k1). The server computer 14 has the long term server key (ks), the initial session key (k1), and the unique name to identify the session (sessioninfo). Instep 702, the client computer 12 transmits the credential (cred) and the new timestamp (t1) encrypted by the initial session key (k1) to the server computer 14. The server computer 14 receives and decrypts the message from the client computer 12 instep 704. Next, the server computer 14 determines if the credential (cred) has expired instep 706. If the time limit for the credential has expired, then the process exits instep 708. If the time limit has not expired, then the process proceeds to step 710 where both the client computer 12 and the server computer 14 compute a new session key (k1′) that is equal to the hash of the credential (cred) and the seed (s). The server computer 14 creates a new credential (cred′) instep 712 with a new seed (s′), new expiration time (exp′) and new time interval (t3′). The server computer 14 places the old credential (cred) on the revocation list of invalid credentials in step 714. Once the old credential (cred) is on the revocation list, then the server computer 14 transmits the new credential (cred′), new seed (s′), new maximum times (m′) to perform the hash function, the new expiration time (exp′), and the session information (sessioninfo) to the client computer 12 instep 716. The message from the server computer 14 to the client computer 12 is encrypted using the new session key (k1′). Instep 718, the client computer 12 decrypts the message using the new session key (k1′) to retrieve the new credential and values. - In order to provide added security, the long term server key (ks) can be changed. In order to change the long term server key (ks), the server computer 14 generates a cutoff date (cutoff_date) that is later than or equal to the expiration date (exp). Next, the server computer 14 generates a new long term server key (ks′). The cutoff date (cutoff_date), the original long term server key (ks), and the new long term server key (ks′) are stored at the server computer 14. When attempting to decrypt a credential, the server computer 14 first uses the original long term server key (ks) and if that fails then uses the new long term server key (ks′). New credentials are issued using the new long term server key (ks′). When the cutoff date (cutoff_date) has passed, then the long term server key (ks) should be set to the new long term server key (ks′) because all of the old credentials issued using the long term server key (ks) have expired. Also, once the cutoff date has passed, the revocation list of invalid credentials can be purged and the server computer 14 can issue a new long term server key using the method just described.
- The reconnect authentication method described above provides security against common attacks. For example, because the client computer 12 and the server computer 14 transmit encrypted client_nonce and server_nonce which require the knowledge of the seed (s), the ability to stage a Man-in-the-Middle (MitM) attack where an attacker intercepts and possibly alters data traveling along the network is decreased. The method also provides security against reply attacks where an attacker bugs the network data and reuses it when needed because the messages between the client computer 12 and the server computer 14 include a timestamp which prevent reuse at another time. Reflection attacks where an attacker re-transmits a message created by a user and obtains a right of access are thwarted by using chained nonces and having the user information (user/domain) in the credential. Furthermore, reflection attacks are reduced by having each message between the client computer 12 and server computer 14 be non-symmetric and using a unique long term server key (ks). The chained nonces also provide against interleaved attacks where an attacker disguises oneself under a different identity during communication. A chosen text attack where an attacker tampers with the message and attacks the cryptography algorithm itself is reduced by not using the long term server computer key (ks) to encrypt any data that is obtained from the client computer 12. Finally, forced delay attacks where an attacker intercepts the data in the protocol to use later are reduced by using timestamps and an expiration time for the credential, as well as using a revocation list.
- It will be appreciated by those of ordinary skill in the art that the concepts and techniques described here can be embodied in various specific forms without departing from the essential characteristics thereof. For example, the authentication between the server computer 14 and the client computer 12 may be a single challenge whereby the client computer 12 does not need to retransmit any more information to the server computer 14 after sending the credential and challenge. The presently disclosed embodiments are considered in all respects to be illustrative and not restrictive. The scope of the invention is indicated by the appended claims, rather than the foregoing description, and all changes that come within the meaning and range of equivalents thereof are intended to be embraced.
Claims (20)
1. A method for authenticating a computer, the method comprising the following steps:
issuing a credential from a first computer to a second computer;
transmitting said credential and a computer challenge from the second computer to the first computer when the second computer is to be authenticated;
transmitting a response to said computer challenge from said first computer to said second computer; and
verifying said response with said second computer in order to authenticate and verify said computers.
2. The method of claim 1 , wherein the challenge is a random number generated by the second computer and the first computer computes the response to the challenge by performing a predetermined function on the random number.
3. The method of claim 2 , wherein the second computer determines whether the first computer response is valid by performing the predetermined function on the random number and comparing the result to the response.
4. The method of claim 3 , wherein the predetermined function is a hash function.
5. The method of claim 1 , wherein the second computer establishes a connection with the first computer when the response is valid.
6. The method of claim 1 , wherein the first computer issues a credential with a time limit and the first computer determines whether the credential transmitted from the second computer is valid by determining the expiration time of the credential.
7. A system for authenticating a computer, the system comprising:
a first computer; and
a second computer in communication with the first computer;
wherein the first computer and the second computer are configured to execute the following instructions:
issue a credential from the first computer to the second computer;
transmit the credential and a challenge from the second computer to the first computer when the second computer is to be authenticated;
transmit a response to the challenge from the first computer to the second computer; and
verify the response with the second computer in order to authenticate and verify the computers.
8. The system of claim 7 , wherein the second computer is configured to generate a challenge that is a random number and the first computer is configured to generate a response to the challenge by performing a predetermined function on the random number.
9. The system of claim 8 , wherein the second computer is configured to determine whether the response is valid by performing the predetermined function on the random number and comparing the result to the response.
10. The system of claim 9 , wherein the predetermined function is a hash function.
11. The system of claim 7 , wherein the second computer establishes a connection with the first computer when the response is valid.
12. The system of claim 7 , wherein the first computer issues a credential with a time limit and the first computer determines whether the credential transmitted from the second computer is valid by determining the expiration time of the credential.
13. A computer-readable medium containing a program with instructions that execute the following procedure:
issue a credential from a first computer to a second computer;
generate a first challenge with the second computer;
transmit the credential and the first challenge from the second computer to the first computer;
determine with the first computer whether the credential is valid;
compute a first response to the first challenge and generate a second challenge with the first computer;
transmit the first response and the second challenge from the first computer to the second computer;
determine with the second computer whether the first response is valid to verify the first computer;
compute a second response to the second challenge with the second computer;
transmit the second response from the second computer to the first computer; and
determine with the first computer whether the second response is valid to verify and authenticate the computers.
14. The computer-readable medium of claim 13 having instructions for the second computer to encrypt the credential before transmitting the credential to the first computer.
15. The computer-readable medium of claim 13 having instructions for the second computer to generate the first challenge that is a random number and the first computer computes a first response to the first challenge by performing a predetermined function on the random number.
16. The computer-readable medium of claim 15 , wherein the second computer determines whether the first response is valid by performing the predetermined function on the random number and comparing the result to the first response.
17. The computer-readable medium of claim 16 , wherein the predetermined function is a hash function.
18. The computer-readable medium of claim 13 having instructions for the first computer to generate a second challenge that is a random number and the second computer computes a second response to the second challenge by performing a predetermined function on the random number.
19. The computer-readable medium of claim 18 , wherein the first computer determines whether the second response is valid by performing the predetermined function on the random number and comparing the result to the second response.
20. The computer-readable medium of claim 19 , wherein the predetermined function is a hash function.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/764,523 US20100299729A1 (en) | 2003-12-24 | 2010-04-21 | Server Computer Issued Credential Authentication |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/743,796 US7735120B2 (en) | 2003-12-24 | 2003-12-24 | Server computer issued credential authentication |
US12/764,523 US20100299729A1 (en) | 2003-12-24 | 2010-04-21 | Server Computer Issued Credential Authentication |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/743,796 Continuation US7735120B2 (en) | 2003-12-24 | 2003-12-24 | Server computer issued credential authentication |
Publications (1)
Publication Number | Publication Date |
---|---|
US20100299729A1 true US20100299729A1 (en) | 2010-11-25 |
Family
ID=34911201
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/743,796 Expired - Fee Related US7735120B2 (en) | 2003-12-24 | 2003-12-24 | Server computer issued credential authentication |
US12/764,523 Abandoned US20100299729A1 (en) | 2003-12-24 | 2010-04-21 | Server Computer Issued Credential Authentication |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/743,796 Expired - Fee Related US7735120B2 (en) | 2003-12-24 | 2003-12-24 | Server computer issued credential authentication |
Country Status (1)
Country | Link |
---|---|
US (2) | US7735120B2 (en) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20120166801A1 (en) * | 2010-12-23 | 2012-06-28 | Electronics And Telecommunications Research Institute | Mutual authentication system and method for mobile terminals |
US9355233B1 (en) * | 2014-01-27 | 2016-05-31 | Sprint Communications Company L.P. | Password reset using hash functions |
US9379896B1 (en) * | 2011-10-24 | 2016-06-28 | Google Inc. | Compromised password mitigation |
US9954867B1 (en) * | 2015-12-15 | 2018-04-24 | Amazon Technologies, Inc. | Verification of credential reset |
US11050741B2 (en) * | 2015-09-21 | 2021-06-29 | American Express Travel Related Services Company, Inc. | Applying a function to a password to determine an expected response |
Families Citing this family (36)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7099663B2 (en) | 2001-05-31 | 2006-08-29 | Qualcomm Inc. | Safe application distribution and execution in a wireless environment |
KR20050007830A (en) * | 2003-07-11 | 2005-01-21 | 삼성전자주식회사 | Method for Domain Authentication for exchanging contents between devices |
US7937759B2 (en) * | 2003-10-02 | 2011-05-03 | Auburn University | System and method for protecting communication devices from denial of service attacks |
US7774841B2 (en) | 2003-10-02 | 2010-08-10 | Aubum University | System and method for protecting network resources from denial of service attacks |
US7735120B2 (en) * | 2003-12-24 | 2010-06-08 | Apple Inc. | Server computer issued credential authentication |
JP4139382B2 (en) * | 2004-12-28 | 2008-08-27 | インターナショナル・ビジネス・マシーンズ・コーポレーション | Device for authenticating ownership of product / service, method for authenticating ownership of product / service, and program for authenticating ownership of product / service |
US8831189B2 (en) * | 2006-06-12 | 2014-09-09 | Microsoft Corporation | Device authentication techniques |
US20080141352A1 (en) * | 2006-12-11 | 2008-06-12 | Motorola, Inc. | Secure password distribution to a client device of a network |
US7975312B2 (en) | 2007-01-08 | 2011-07-05 | Apple Inc. | Token passing technique for media playback devices |
US8943560B2 (en) * | 2008-05-28 | 2015-01-27 | Microsoft Corporation | Techniques to provision and manage a digital telephone to authenticate with a network |
US7877503B2 (en) * | 2008-07-02 | 2011-01-25 | Verizon Patent And Licensing Inc. | Method and system for an intercept chain of custody protocol |
US8370920B2 (en) * | 2009-10-28 | 2013-02-05 | Aunigma Network Security Corp. | System and method for providing unified transport and security protocols |
US8731197B2 (en) * | 2010-03-09 | 2014-05-20 | Ebay Inc. | Secure randomized input |
US8839357B2 (en) | 2010-12-22 | 2014-09-16 | Canon U.S.A., Inc. | Method, system, and computer-readable storage medium for authenticating a computing device |
US8769288B2 (en) * | 2011-04-22 | 2014-07-01 | Alcatel Lucent | Discovery of security associations |
US8635373B1 (en) * | 2012-09-22 | 2014-01-21 | Nest Labs, Inc. | Subscription-Notification mechanisms for synchronization of distributed states |
US9363261B2 (en) * | 2013-05-02 | 2016-06-07 | Sync-N-Scale, Llc | Synchronous timestamp computer authentication system and method |
US8984602B1 (en) * | 2013-06-28 | 2015-03-17 | Emc Corporation | Protected resource access control utilizing credentials based on message authentication codes and hash chain values |
US10021069B1 (en) | 2015-04-02 | 2018-07-10 | Aunigma Network Security Corp. | Real time dynamic client access control |
US10021170B2 (en) * | 2015-05-29 | 2018-07-10 | Pure Storage, Inc. | Managing a storage array using client-side services |
WO2017127757A1 (en) * | 2016-01-20 | 2017-07-27 | FHOOSH, Inc. | Systems and methods for secure storage and management of credentials and encryption keys |
US10771478B2 (en) * | 2016-02-18 | 2020-09-08 | Comcast Cable Communications, Llc | Security monitoring at operating system kernel level |
FR3076417A1 (en) * | 2017-12-28 | 2019-07-05 | Orange | METHOD OF ACCESS AND METHOD OF CONTROLLING NODE ACCESS TO A NETWORK BASED ON A TEST |
US11522713B2 (en) | 2018-03-27 | 2022-12-06 | Workday, Inc. | Digital credentials for secondary factor authentication |
US11770261B2 (en) | 2018-03-27 | 2023-09-26 | Workday, Inc. | Digital credentials for user device authentication |
US11627000B2 (en) | 2018-03-27 | 2023-04-11 | Workday, Inc. | Digital credentials for employee badging |
US11792180B2 (en) | 2018-03-27 | 2023-10-17 | Workday, Inc. | Digital credentials for visitor network access |
US11019053B2 (en) | 2018-03-27 | 2021-05-25 | Workday, Inc. | Requesting credentials |
US11716320B2 (en) | 2018-03-27 | 2023-08-01 | Workday, Inc. | Digital credentials for primary factor authentication |
US11792181B2 (en) | 2018-03-27 | 2023-10-17 | Workday, Inc. | Digital credentials as guest check-in for physical building access |
US11698979B2 (en) | 2018-03-27 | 2023-07-11 | Workday, Inc. | Digital credentials for access to sensitive data |
US11700117B2 (en) | 2018-03-27 | 2023-07-11 | Workday, Inc. | System for credential storage and verification |
US11641278B2 (en) | 2018-03-27 | 2023-05-02 | Workday, Inc. | Digital credential authentication |
US11683177B2 (en) | 2018-03-27 | 2023-06-20 | Workday, Inc. | Digital credentials for location aware check in |
US11531783B2 (en) | 2018-03-27 | 2022-12-20 | Workday, Inc. | Digital credentials for step-up authentication |
US11115224B1 (en) * | 2018-06-05 | 2021-09-07 | Amazon Technologies, Inc. | Access control system |
Citations (50)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5751812A (en) * | 1996-08-27 | 1998-05-12 | Bell Communications Research, Inc. | Re-initialization of an iterated hash function secure password system over an insecure network connection |
US5764890A (en) * | 1994-12-13 | 1998-06-09 | Microsoft Corporation | Method and system for adding a secure network server to an existing computer network |
US5872917A (en) * | 1995-06-07 | 1999-02-16 | America Online, Inc. | Authentication using random challenges |
US6173400B1 (en) * | 1998-07-31 | 2001-01-09 | Sun Microsystems, Inc. | Methods and systems for establishing a shared secret using an authentication token |
US20020002678A1 (en) * | 1998-08-14 | 2002-01-03 | Stanley T. Chow | Internet authentication technology |
US20020012433A1 (en) * | 2000-03-31 | 2002-01-31 | Nokia Corporation | Authentication in a packet data network |
US20020016777A1 (en) * | 2000-03-07 | 2002-02-07 | International Business Machines Corporation | Automated trust negotiation |
US20020024943A1 (en) * | 2000-08-22 | 2002-02-28 | Mehmet Karaul | Internet protocol based wireless call processing |
US20020078352A1 (en) * | 2000-12-15 | 2002-06-20 | International Business Machines Corporation | Secure communication by modification of security codes |
US20020120760A1 (en) * | 2000-05-26 | 2002-08-29 | Gur Kimchi | Communications protocol |
US20020167946A1 (en) * | 2001-03-20 | 2002-11-14 | Worldcom, Inc. | Selective feature blocking in a communications network |
US20030018887A1 (en) * | 2001-07-17 | 2003-01-23 | Dan Fishman | Method for providing user-apparent consistency in a wireless device |
US6535980B1 (en) * | 1999-06-21 | 2003-03-18 | International Business Machines Corporation | Keyless encryption of messages using challenge response |
US20030058839A1 (en) * | 2001-09-27 | 2003-03-27 | Samsung Electronics Co., Ltd. | Soft switch using distributed firewalls for load sharing voice-over-IP traffic in an IP network |
US20030061512A1 (en) * | 2001-09-27 | 2003-03-27 | International Business Machines Corporation | Method and system for a single-sign-on mechanism within application service provider (ASP) aggregation |
US20030093680A1 (en) * | 2001-11-13 | 2003-05-15 | International Business Machines Corporation | Methods, apparatus and computer programs performing a mutual challenge-response authentication protocol using operating system capabilities |
US6587680B1 (en) * | 1999-11-23 | 2003-07-01 | Nokia Corporation | Transfer of security association during a mobile terminal handover |
US20030163733A1 (en) * | 2002-02-28 | 2003-08-28 | Ericsson Telefon Ab L M | System, method and apparatus for federated single sign-on services |
US6615264B1 (en) * | 1999-04-09 | 2003-09-02 | Sun Microsystems, Inc. | Method and apparatus for remotely administered authentication and access control |
US20030166397A1 (en) * | 2002-03-04 | 2003-09-04 | Microsoft Corporation | Mobile authentication system with reduced authentication delay |
US20030177187A1 (en) * | 2000-11-27 | 2003-09-18 | Butterfly.Net. Inc. | Computing grid for massively multi-player online games and other multi-user immersive persistent-state and session-based applications |
US20030182551A1 (en) * | 2002-03-25 | 2003-09-25 | Frantz Christopher J. | Method for a single sign-on |
US20030188195A1 (en) * | 2002-04-01 | 2003-10-02 | Abdo Nadim Y. | Automatic re-authentication |
US20030212892A1 (en) * | 2002-05-09 | 2003-11-13 | Canon Kabushiki Kaisha | Public key certification issuing apparatus |
US20040003241A1 (en) * | 2002-06-27 | 2004-01-01 | Nokia, Inc. | Authentication of remotely originating network messages |
US20040068572A1 (en) * | 2002-10-04 | 2004-04-08 | Zhixue Wu | Methods and systems for communicating over a client-server network |
US20040078571A1 (en) * | 2000-12-27 | 2004-04-22 | Henry Haverinen | Authentication in data communication |
US20040107286A1 (en) * | 1998-10-30 | 2004-06-03 | Science Applications International Corporation | Method for establishing secure communication link between computers of virtual private network without user entering any cryptographic information |
US20050033987A1 (en) * | 2003-08-08 | 2005-02-10 | Zheng Yan | System and method to establish and maintain conditional trust by stating signal of distrust |
US20050050328A1 (en) * | 2003-09-02 | 2005-03-03 | Authenture, Inc. | Key generation method for communication session encryption and authentication system |
US20050071677A1 (en) * | 2003-09-30 | 2005-03-31 | Rahul Khanna | Method to authenticate clients and hosts to provide secure network boot |
US20050120213A1 (en) * | 2003-12-01 | 2005-06-02 | Cisco Technology, Inc. | System and method for provisioning and authenticating via a network |
US20050138355A1 (en) * | 2003-12-19 | 2005-06-23 | Lidong Chen | System, method and devices for authentication in a wireless local area network (WLAN) |
US20050198489A1 (en) * | 2003-12-24 | 2005-09-08 | Apple Computer, Inc. | Server computer issued credential authentication |
US6973482B2 (en) * | 2001-10-01 | 2005-12-06 | Microsoft Corporation | Remote assistance |
US7016343B1 (en) * | 2001-12-28 | 2006-03-21 | Cisco Technology, Inc. | PSTN call routing control features applied to a VoIP |
US7024695B1 (en) * | 1999-12-30 | 2006-04-04 | Intel Corporation | Method and apparatus for secure remote system management |
US7031945B1 (en) * | 2000-07-24 | 2006-04-18 | Donner Irah H | System and method for reallocating and/or upgrading and/or rewarding tickets, other event admittance means, goods and/or services |
US7069439B1 (en) * | 1999-03-05 | 2006-06-27 | Hewlett-Packard Development Company, L.P. | Computing apparatus and methods using secure authentication arrangements |
US7085805B1 (en) * | 2000-07-07 | 2006-08-01 | Sun Microsystems, Inc. | Remote device management in grouped server environment |
US7085840B2 (en) * | 2001-10-29 | 2006-08-01 | Sun Microsystems, Inc. | Enhanced quality of identification in a data communications network |
US7155607B2 (en) * | 2002-02-21 | 2006-12-26 | Matsushita Electric Industrial Co., Ltd. | Method for authentication between apparatuses using challenge and response system |
US20060291455A1 (en) * | 2001-05-16 | 2006-12-28 | Eyal Katz | Access to plmn networks for non-plmn devices, and to issues arising in interfaces in general between plmn and non-plmn networks |
US7171555B1 (en) * | 2003-05-29 | 2007-01-30 | Cisco Technology, Inc. | Method and apparatus for communicating credential information within a network device authentication conversation |
US7290288B2 (en) * | 1997-06-11 | 2007-10-30 | Prism Technologies, L.L.C. | Method and system for controlling access, by an authentication server, to protected computer resources provided via an internet protocol network |
US7334126B1 (en) * | 1999-12-30 | 2008-02-19 | At&T Corp. | Method and apparatus for secure remote access to an internal web server |
US7363500B2 (en) * | 2002-12-03 | 2008-04-22 | Juniper Networks, Inc. | Tunneled authentication protocol for preventing man-in-the-middle attacks |
US7370350B1 (en) * | 2002-06-27 | 2008-05-06 | Cisco Technology, Inc. | Method and apparatus for re-authenticating computing devices |
US7395435B2 (en) * | 2002-09-20 | 2008-07-01 | Atmel Corporation | Secure memory device for smart cards |
US7480939B1 (en) * | 2000-04-28 | 2009-01-20 | 3Com Corporation | Enhancement to authentication protocol that uses a key lease |
-
2003
- 2003-12-24 US US10/743,796 patent/US7735120B2/en not_active Expired - Fee Related
-
2010
- 2010-04-21 US US12/764,523 patent/US20100299729A1/en not_active Abandoned
Patent Citations (53)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5764890A (en) * | 1994-12-13 | 1998-06-09 | Microsoft Corporation | Method and system for adding a secure network server to an existing computer network |
US5872917A (en) * | 1995-06-07 | 1999-02-16 | America Online, Inc. | Authentication using random challenges |
US5751812A (en) * | 1996-08-27 | 1998-05-12 | Bell Communications Research, Inc. | Re-initialization of an iterated hash function secure password system over an insecure network connection |
US7290288B2 (en) * | 1997-06-11 | 2007-10-30 | Prism Technologies, L.L.C. | Method and system for controlling access, by an authentication server, to protected computer resources provided via an internet protocol network |
US6173400B1 (en) * | 1998-07-31 | 2001-01-09 | Sun Microsystems, Inc. | Methods and systems for establishing a shared secret using an authentication token |
US20020002678A1 (en) * | 1998-08-14 | 2002-01-03 | Stanley T. Chow | Internet authentication technology |
US20040107286A1 (en) * | 1998-10-30 | 2004-06-03 | Science Applications International Corporation | Method for establishing secure communication link between computers of virtual private network without user entering any cryptographic information |
US7069439B1 (en) * | 1999-03-05 | 2006-06-27 | Hewlett-Packard Development Company, L.P. | Computing apparatus and methods using secure authentication arrangements |
US6615264B1 (en) * | 1999-04-09 | 2003-09-02 | Sun Microsystems, Inc. | Method and apparatus for remotely administered authentication and access control |
US6535980B1 (en) * | 1999-06-21 | 2003-03-18 | International Business Machines Corporation | Keyless encryption of messages using challenge response |
US6587680B1 (en) * | 1999-11-23 | 2003-07-01 | Nokia Corporation | Transfer of security association during a mobile terminal handover |
US7024695B1 (en) * | 1999-12-30 | 2006-04-04 | Intel Corporation | Method and apparatus for secure remote system management |
US7334126B1 (en) * | 1999-12-30 | 2008-02-19 | At&T Corp. | Method and apparatus for secure remote access to an internal web server |
US20020016777A1 (en) * | 2000-03-07 | 2002-02-07 | International Business Machines Corporation | Automated trust negotiation |
US20020012433A1 (en) * | 2000-03-31 | 2002-01-31 | Nokia Corporation | Authentication in a packet data network |
US7480939B1 (en) * | 2000-04-28 | 2009-01-20 | 3Com Corporation | Enhancement to authentication protocol that uses a key lease |
US20020120760A1 (en) * | 2000-05-26 | 2002-08-29 | Gur Kimchi | Communications protocol |
US7085805B1 (en) * | 2000-07-07 | 2006-08-01 | Sun Microsystems, Inc. | Remote device management in grouped server environment |
US7031945B1 (en) * | 2000-07-24 | 2006-04-18 | Donner Irah H | System and method for reallocating and/or upgrading and/or rewarding tickets, other event admittance means, goods and/or services |
US7085260B2 (en) * | 2000-08-22 | 2006-08-01 | Lucent Technologies Inc. | Internet protocol based wireless call processing |
US20020024943A1 (en) * | 2000-08-22 | 2002-02-28 | Mehmet Karaul | Internet protocol based wireless call processing |
US20030177187A1 (en) * | 2000-11-27 | 2003-09-18 | Butterfly.Net. Inc. | Computing grid for massively multi-player online games and other multi-user immersive persistent-state and session-based applications |
US20020078352A1 (en) * | 2000-12-15 | 2002-06-20 | International Business Machines Corporation | Secure communication by modification of security codes |
US20040078571A1 (en) * | 2000-12-27 | 2004-04-22 | Henry Haverinen | Authentication in data communication |
US20020167946A1 (en) * | 2001-03-20 | 2002-11-14 | Worldcom, Inc. | Selective feature blocking in a communications network |
US20060291455A1 (en) * | 2001-05-16 | 2006-12-28 | Eyal Katz | Access to plmn networks for non-plmn devices, and to issues arising in interfaces in general between plmn and non-plmn networks |
US20030018887A1 (en) * | 2001-07-17 | 2003-01-23 | Dan Fishman | Method for providing user-apparent consistency in a wireless device |
US20030058839A1 (en) * | 2001-09-27 | 2003-03-27 | Samsung Electronics Co., Ltd. | Soft switch using distributed firewalls for load sharing voice-over-IP traffic in an IP network |
US20030061512A1 (en) * | 2001-09-27 | 2003-03-27 | International Business Machines Corporation | Method and system for a single-sign-on mechanism within application service provider (ASP) aggregation |
US7072332B2 (en) * | 2001-09-27 | 2006-07-04 | Samsung Electronics Co., Ltd. | Soft switch using distributed firewalls for load sharing voice-over-IP traffic in an IP network |
US6973482B2 (en) * | 2001-10-01 | 2005-12-06 | Microsoft Corporation | Remote assistance |
US7085840B2 (en) * | 2001-10-29 | 2006-08-01 | Sun Microsystems, Inc. | Enhanced quality of identification in a data communications network |
US20030093680A1 (en) * | 2001-11-13 | 2003-05-15 | International Business Machines Corporation | Methods, apparatus and computer programs performing a mutual challenge-response authentication protocol using operating system capabilities |
US7016343B1 (en) * | 2001-12-28 | 2006-03-21 | Cisco Technology, Inc. | PSTN call routing control features applied to a VoIP |
US7155607B2 (en) * | 2002-02-21 | 2006-12-26 | Matsushita Electric Industrial Co., Ltd. | Method for authentication between apparatuses using challenge and response system |
US20030163733A1 (en) * | 2002-02-28 | 2003-08-28 | Ericsson Telefon Ab L M | System, method and apparatus for federated single sign-on services |
US20030166397A1 (en) * | 2002-03-04 | 2003-09-04 | Microsoft Corporation | Mobile authentication system with reduced authentication delay |
US6947725B2 (en) * | 2002-03-04 | 2005-09-20 | Microsoft Corporation | Mobile authentication system with reduced authentication delay |
US20030182551A1 (en) * | 2002-03-25 | 2003-09-25 | Frantz Christopher J. | Method for a single sign-on |
US20030188195A1 (en) * | 2002-04-01 | 2003-10-02 | Abdo Nadim Y. | Automatic re-authentication |
US20030212892A1 (en) * | 2002-05-09 | 2003-11-13 | Canon Kabushiki Kaisha | Public key certification issuing apparatus |
US20040003241A1 (en) * | 2002-06-27 | 2004-01-01 | Nokia, Inc. | Authentication of remotely originating network messages |
US7370350B1 (en) * | 2002-06-27 | 2008-05-06 | Cisco Technology, Inc. | Method and apparatus for re-authenticating computing devices |
US7395435B2 (en) * | 2002-09-20 | 2008-07-01 | Atmel Corporation | Secure memory device for smart cards |
US20040068572A1 (en) * | 2002-10-04 | 2004-04-08 | Zhixue Wu | Methods and systems for communicating over a client-server network |
US7363500B2 (en) * | 2002-12-03 | 2008-04-22 | Juniper Networks, Inc. | Tunneled authentication protocol for preventing man-in-the-middle attacks |
US7171555B1 (en) * | 2003-05-29 | 2007-01-30 | Cisco Technology, Inc. | Method and apparatus for communicating credential information within a network device authentication conversation |
US20050033987A1 (en) * | 2003-08-08 | 2005-02-10 | Zheng Yan | System and method to establish and maintain conditional trust by stating signal of distrust |
US20050050328A1 (en) * | 2003-09-02 | 2005-03-03 | Authenture, Inc. | Key generation method for communication session encryption and authentication system |
US20050071677A1 (en) * | 2003-09-30 | 2005-03-31 | Rahul Khanna | Method to authenticate clients and hosts to provide secure network boot |
US20050120213A1 (en) * | 2003-12-01 | 2005-06-02 | Cisco Technology, Inc. | System and method for provisioning and authenticating via a network |
US20050138355A1 (en) * | 2003-12-19 | 2005-06-23 | Lidong Chen | System, method and devices for authentication in a wireless local area network (WLAN) |
US20050198489A1 (en) * | 2003-12-24 | 2005-09-08 | Apple Computer, Inc. | Server computer issued credential authentication |
Cited By (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20120166801A1 (en) * | 2010-12-23 | 2012-06-28 | Electronics And Telecommunications Research Institute | Mutual authentication system and method for mobile terminals |
US9379896B1 (en) * | 2011-10-24 | 2016-06-28 | Google Inc. | Compromised password mitigation |
US9355233B1 (en) * | 2014-01-27 | 2016-05-31 | Sprint Communications Company L.P. | Password reset using hash functions |
US11050741B2 (en) * | 2015-09-21 | 2021-06-29 | American Express Travel Related Services Company, Inc. | Applying a function to a password to determine an expected response |
US9954867B1 (en) * | 2015-12-15 | 2018-04-24 | Amazon Technologies, Inc. | Verification of credential reset |
US10484390B2 (en) * | 2015-12-15 | 2019-11-19 | Amazon Technologies, Inc. | Verification of credential reset |
US11228599B2 (en) * | 2015-12-15 | 2022-01-18 | Amazon Technologies, Inc. | Verification of credential reset |
Also Published As
Publication number | Publication date |
---|---|
US20050198489A1 (en) | 2005-09-08 |
US7735120B2 (en) | 2010-06-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7735120B2 (en) | Server computer issued credential authentication | |
CN109728909B (en) | Identity authentication method and system based on USBKey | |
US10382485B2 (en) | Blockchain-assisted public key infrastructure for internet of things applications | |
WO2018046009A1 (en) | Block chain identity system | |
KR101237632B1 (en) | Network helper for authentication between a token and verifiers | |
US8413221B2 (en) | Methods and apparatus for delegated authentication | |
KR101265873B1 (en) | Distributed single sign-on service | |
US6993652B2 (en) | Method and system for providing client privacy when requesting content from a public server | |
JP4617763B2 (en) | Device authentication system, device authentication server, terminal device, device authentication method, and device authentication program | |
EP1959368B1 (en) | Security link management in dynamic networks | |
US7886345B2 (en) | Password-protection module | |
EP0651533B1 (en) | Method and apparatus for privacy and authentication in a mobile wireless network | |
US20040123156A1 (en) | System and method of non-centralized zero knowledge authentication for a computer network | |
KR101188705B1 (en) | Method and devices for secure measurements of time-based distance between two devices | |
US20070033392A1 (en) | Augmented single factor split key asymmetric cryptography-key generation and distributor | |
US20110179478A1 (en) | Method for secure transmission of sensitive data utilizing network communications and for one time passcode and multi-factor authentication | |
KR20080004165A (en) | Method for device authentication using broadcast encryption | |
MXPA03003710A (en) | Methods for remotely changing a communications password. | |
CN112703702A (en) | Distributed authentication | |
EP4096147A1 (en) | Secure enclave implementation of proxied cryptographic keys | |
KR20190010016A (en) | User Authentication Server and System | |
EP1623551B1 (en) | Network security method and system | |
KR20020040378A (en) | Method for Authentication without Password Transmission on the basis of Public Key | |
Singh et al. | Survey and analysis of Modern Authentication system | |
CN115883104B (en) | Secure login method and device for terminal equipment and nonvolatile storage medium |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO PAY ISSUE FEE |