WO2002050630A2 - Systeme et procede de regulation de mots de passe - Google Patents

Systeme et procede de regulation de mots de passe Download PDF

Info

Publication number
WO2002050630A2
WO2002050630A2 PCT/US2001/048301 US0148301W WO0250630A2 WO 2002050630 A2 WO2002050630 A2 WO 2002050630A2 US 0148301 W US0148301 W US 0148301W WO 0250630 A2 WO0250630 A2 WO 0250630A2
Authority
WO
WIPO (PCT)
Prior art keywords
user
challenge
transmitted
length
response
Prior art date
Application number
PCT/US2001/048301
Other languages
English (en)
Other versions
WO2002050630A9 (fr
WO2002050630A3 (fr
Inventor
Ravi Sandhu
Colin Desa
Karuna Ganesan
Original Assignee
Singlesignon.Net
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Singlesignon.Net filed Critical Singlesignon.Net
Publication of WO2002050630A2 publication Critical patent/WO2002050630A2/fr
Publication of WO2002050630A3 publication Critical patent/WO2002050630A3/fr
Publication of WO2002050630A9 publication Critical patent/WO2002050630A9/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2103—Challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption

Definitions

  • This invention relates to secure computing. More particularly, the present invention relates to user authentication.
  • Networks Today, computing devices are almost always interconnected via networks. As these networks can be large closed networks, as within a corporation, or truly public networks as the Internet is, the network itself might have hundreds, thousands or even millions of potential users. Consequently it is often required to restrict access to any given computer or service, or a part of a computer or service t ⁇ - a subset of the users on the public or closed network.
  • a brokerage might have a public website accessible to all, but would like to only give Ms. Alice Smith access to Ms. Alice Smith's brokerage account.
  • every user has .a unique password and the computer has knowledge of the user password.
  • the computer When attempting to log on Alice would enter her userid, say alice, and password, say apple23 r the computer would compare the pair, i.e. alice, apple23, w 1th the pair it had stored for Alice, and if there is a match would establish a session and give Alice access.
  • the computer could instead store a one way function of the password.
  • F (apple23) XD45DTY, and the pair ⁇ alice, XD45DTY) .
  • F() is a one way function
  • computing XD45DTY from apple23 is easy, but as it is a "one way function", the reverse is believed to be difficult or close to impossible.
  • the computer can compute F (apple23) and compare the result with XD45DTY.
  • the UNIX operating system was among the first to implement such a system in the late 1970' s.
  • Symmetric keys can also be used to provide integrity and authentication of messages in a network. Integrity and authentication means that the receiver knows who sent a message and that the message has not been modified so it is received as it was sent. Integrity and authentication is achieved by attaching a Message Authentication Code (MAC) to a message M.
  • MAC Message Authentication Code
  • HMAC hash-based MAC
  • Symmetric key systems have been in use for literally thousands of years, and have always suffered from a major problem - namely how to perform key distribution. How do Bob and Alice agree on K? Asymmetric key cryptography was invented to solve this problem.
  • every user is associated with two keys, which are related by special mathematical properties. These properties result in the following functionality: a message encrypted with one of the two keys can then only be decrypted with the other.
  • Asymmetric cryptography can solve the key distribution problem.
  • Asymmetric cryptography can also be used to solve another important problem, that of digital signatures.
  • the RSA cryptosystem is one system that implements asymmetric cryptography as described above.
  • the RSA cryptosystem allows the same public-private key pair to be used for encryption and for digital signatures.
  • asymmetric cryptosystems which implement encryption only e.g., ElGamal or digital signature only, e.g., DSA.
  • Asymmetric key cryptosystems have been around for a long time, but have found limited use. The primary reasons are twofold: (a) the private key D in most systems is long, which means that users cannot remember them, and they have to either be stored on every computer they use, or carried around on smart cards or other tokens; and (b) the infrastructure for ensuring a certificate is valid, which is critical, is cumbersome to build, operate and use.
  • the first technique proposed to validate certificates was to send every recipient a list of all certificates that had been revoked. This clearly does not scale well to an environment with millions of users.
  • the second method proposed was to require that one inquire about the validity of a certificate on-line, which has its own associated problems.
  • Daa can be made short, which allows the user to remember it as a password, so this system is consumer friendly. Further, if the server is informed that a particular ID has been revoked, then it will cease to perform its part of the operation for that user, and consequently no further signatures can ever be performed. This provides for instant revocation in a simple highly effective fashion.
  • SSL which is widely used on the Internet in effect implements a more elaborate method of exactly this protocol.
  • SSL has two components, ⁇ server side SSL' in which a server proves its identity by signing a particular message during connection set-up.
  • SSL which lets a client authenticate herself to a server is rarely used, because although the technical mechanism is exactly the same, it now requires users to manage certificates and long private keys which has proven to be difficult, unless they use the split private key system.
  • server side SSL So in practice, most Internet web sites use server side SSL to authenticate themselves to the client, and to obtain a secure channel, and from then on use Userid, Password pairs to authenticate the client. So far from disappearing, the use of passwords has increased dramatically. Passwords themselves are often dubbed as inherently “weak” which is inaccurate, because if they are used carefully passwords can actually achieve "strong” security. As discussed earlier passwords should not be sent over networks, and if possible should not be stored on the receiving computer. Instead, in a "strong” system, the user can be asked to prove knowledge of the password without actually revealing the password. And perhaps most critically passwords should not be vulnerable to dictionary attacks .
  • Dictionary attacks can be classified into three types. In all three cases the starting point is a "-dictionary' of likely passwords. Unless the system incorporates checks to prevent it y users tend to pick poor passwords, and compilations of lists of widely used poor passwords are widely available.
  • the split private key system is a password based system which meets almost all the requirements for being a secure password system.
  • the secure server knows only its portion Das of the private key, and the user knows Daa.
  • the server challenges the user to sign a random challenge and when a user does so successfully the user has revealed knowledge of Daa without revealing Daa. Further, Daa itself is never transmitted over a network. In a carefully constructed protocol based on the split private key system it is possible to prevent both encrypt and decrypt dictionary attacks.
  • a request for access to, for example, a network site, services available at a network site, or data residing at a network site or individual station is received from a user claiming to be a particular user.
  • a first challenge having a first level of complexity which could for example be based on the bit length of the challenge, is transmitted to the user.
  • a response to the transmitted first challenge is transmitted by the user.
  • a determination is made as to whether or not the transmitted response authenticates the user as the particular user.
  • the requested access is allowed to the user.
  • a second challenge having a second level of complexity, which is greater than that of the first challenge is transmitted to the user.
  • a further challenge with a still greater level of complexity is preferably transmitted to the user.
  • this process of increasing the complexity of the challenge only continues until a pre-set maximum_complexity threshold is reached. If it was to continue indefinitely, there is a possibility that the legitimate user will also in effect be locked out. Therefore increasing complexity is not sufficient, the increase must stop at a carefully chosen maximum_complexity threshold if an authorized user is to be ensured that he/she will not be locked out.
  • this maximum_complexity threshold is chosen such that a legitimate user entering the correct password will experience a delay in gaining access, but this delay is as large as is considered to be tolerable to the user. For instance, if a user is normally granted access in two seconds but has to wait thirty seconds, the delay may be deemed tolerable, but asking the user to wait five minutes would likely be considered intolerable.
  • the maximum_complexity threshold should advantageously be sufficiently large to be a significant impediment to the attacker.
  • the attacker unlike the legitimate user, does not know the correct password and has to try perhaps tens of millions of guesses Gl,
  • the response to the transmitted first challenge includes the transmitted first challenge transformed with a first crypto-key.
  • a first crypto-key By further transforming the transformed first challenge with a second crypto-key, it can be determined if the transmitted response authenticates the user as the particular user. More particularly, if the transmitted first challenge is recovered by further transforming the transformed first challenge, the user is authenticated.
  • the first and the second crypto-keys are associated asymmetric crypto-keys.
  • the first challenge to the user is transmitted after the passage of a first time period following receipt of the request. If a second challenge is required due to non-authentication of the user by the response to the first challenge, the second challenge to the user is transmitted after the passage of a second time period, which is longer than the first time period, following receipt of the response.
  • a further challenge is preferably transmitted to the user after a still longer time period, i.e. a time period longer than the time period between receipt of an earlier response and transmission of the immediately proceeding challenge.
  • a maximum time threshold similar to the maximum complexity threshold described above could also be utilized.
  • a system for authenticating a user includes a communications port for receiving communications from and for transmitting communications to a user, and a processor.
  • the processor generates the first challenge responsive to a first communication requesting access from the user which is received via the communications port.
  • the processor also directs transmission of the generated first challenge to the user via the communications port. If, based on a second communication from the user responding to the generated first challenge which the processor receives via the communications port, the processor is able to authenticate the user as the particular user, the processor allows the requested access to the user responsive to the second communication. However, if the processor cannot authenticate the user based on the second communication, the processor generates a second challenge responsive to the second communication and directs transmission of the generated second challenge to the user via the communications port .
  • a first network processor which could form part of virtually any type of network device, transmits the request for access from the user claiming to be a particular user .
  • a second network processor transmits the first challenge to the first network processor responsive to the transmitted request .
  • the first network processor transmits a response to the transmitted first challenge .
  • the second network processor either allows the requested access to the user, if the transmitted response authenticates the user as the particular user, or transmits a second challenge, if the transmitted response does not authenticate the user .
  • Figure 1 depicts an exemplary network of the present invention, including networked devices of the present invention .
  • Figures 2a-2c is a flow chart showing the operations which are performed by a user and the sponsor station of the present invention for the user to log on with the sponsor station
  • Figures 3a-3b is a flow chart showing the operations which are performed by a user and the sponsor station of the present invention for a user to authenticate himself or herself to a server .
  • Figure 4 depicts a computer suitable for use .by a user to access a network in accordance with the invention .
  • Figure 5 is an exemplary block diagram of components of the computer depicted in Figure 6 .
  • Figure 6 depicts a server suitable for use by the sponsor station, distinguished entities , and merchants in accordance with the present invention .
  • Figure 7 is an exemplary block diagram of components of the server depicted in Figure 8 .
  • Figure 8 is a simplified depiction of a password database in accordance with the present invention .
  • Figure 9 is a simplified depiction of an alternative password database in accordance with the present invention .
  • Figure 10 is a flow chart showing the operations which are performed by a user and a merchant server of the present invention for the user to authenticate himself to the merchant server.
  • Figure 11 is a simplified depiction of a list of time periods which correspond to a number of unsuccessful authentication attempts .
  • FIG. 1 illustrates a network 10, which could be the Internet.
  • the network 10 is an interconnection of networked devices in communication with each other. These networked devices include networked devices 30-33 associated with individual network users, networked device 40-41 associated with a merchant network user, a sponsor station 50 associated with a sponsor, and networked devices 60-62 associated with entities known to and trusted by the sponsor.
  • Networked devices 30-33 will be referred to as user devices. These network devices are typically personal computers.
  • Networked devices 40-41 will be referred to as merchant servers.
  • Networked devices 60-62 will be referred to as distinguished servers. It will be understood that a network may consist of more networked devices , than depicted in Figure 3 !
  • Figures 4 and 5 depict an exemplary personal computer suitable for use by individual users to access the network 10 in the below- described invention.
  • the computer is preferably a commercially available personal computer. It will be recognized that the computer configuration is exemplary in that other components (not shown) could be added or substituted for those depicted and certain of the depicted components could be eliminated .if desired.
  • the computer functions in accordance with stored programming instructions which drive its operation.
  • the computer stores its unique programming instructions on an EPROM, or hard disk .
  • EPROM electrically erasable read-only memory
  • routine programming is required to implement the instructions required to drive the computer to operate in accordance with the invention, as described below .
  • routine operations performed by depicted components will generally not be described, such operations being well understood in the art .
  • the computer 1000 includes a main unit 1010 with slots 1011 , 1012 , and 1013 , respectively provided for loading programming or data from a floppy disk and/or compact dis k (CD) onto the computer 1000 .
  • the computer 1000 also includes a keyboard 1030 and mouse 1040 which serve as user input devices .
  • a display monitor 1020 is also provided to vi sually communicate information to the user .
  • the computer 1000 has a main processor 1100 which is interconnected via bus 1110 with various storage devices including EPROM 1122 , RAM 1123 , hard drive 1124 , which has an associated hard disk 1125, CD drive 1126, which has an associated CD 1127 , and floppy drive 1128 , which has an associated floppy disk 1129 .
  • the memories , disks and CD all serve as storage media on which computer programming or data can be stored for access by the processor 1100 .
  • the memory associated with a personal computer here a fter will collectively be referred to as Memory 1170 .
  • a drive controller 1150 controls the hard drive 1124 , CD drive 1126 and floppy drive 1128 .
  • a display controller 1120 interconnected to display interface 1121 , a keyboard controller 1130 interconnected to keyboard interface 1131 , a- ouse controller 1140 . interconnected to mouse interface 1141 and a modem 1160 interconnected to I /O port 1165 , all of which are connected to the bus 1110 .
  • the mode 1160 and interconnected I /O port 1165 are used to transmit and receive signals via the Internet 100 as described below . it will be understood that other components may be connected if desired to the bus 1110 .
  • the processor 1100 is driven to operate in accordance with the present invention .
  • Sponsor station 50 the merchant users and the distinguished entities are preferably represented on network 10 by an Internet server of the applicable type shown in Figures 6 and 7, as will be described further below.
  • Internet server of the applicable type shown in Figures 6 and 7, as will be described further below.
  • any network compatible device which is capable of functioning in the described manner could be substituted for the servers shown in Figures 6 and
  • FIGS 6 and 7 depict an exemplary network server suitable for use by the sponsor, merchants, and distinguished entities to access the network 10 in the below-described invention.
  • the server is preferably a commercially available high power, mini-computer or mainframe computer.
  • the server configuration is exemplary in that other components (not shown) could be added or substituted for those depicted and certain of the depicted components could be eliminated if desired.
  • the server functions as described below in accordance with stored programming instructions which drive its operation.
  • the server stores its unique programming instructions on an EPROM or hard disk. It will be recognized that only routine programming is required to implement the instructions required to drive the server to operate in accordance with the invention, as described below. Further, since the server components and configuration are conventional, routine operations performed by depicted components will generally not be described, such operations being well understood in the art.
  • the server 1000' includes a main unit 1010' with slots 1011', 1012', 1013' and 1014', respectively provided for loading programming or data from a floppy disk, CD and/or hard disk onto the server 1000'.
  • the server 1000' also i-ncludes a keyboard 1030' and mouse 1040', which serve as user input devices.
  • a display monitor 1020' is also provided to visually communicate information to the user.
  • the server 1000' has a main processor 1100' which is interconnected via bus 1110' with various storage devices including EPROM 1122', RAM 1123', hard drive 1124', which has an associated hard disk 1125', CD- drive 1126', which has an associated CD 1127', and floppy drive 1128', which has an associated floppy disk 1129' .
  • the memories, disks and CD all serve as storage media on which computer programming or data can be stored for access by the processor 1100'.
  • the stored data includes one or more databases containing information associated with network users.
  • the memories associated with a server hereafter will be collectively referred to as memory 1170' .
  • a drive controller 1150' controls the hard drive 1124', CD drive 1126' and floppy drive 1128'. Also depicted in Figure 7 is a display controller 1120' interconnected to display interface 1121', a keyboard controller 1130' interconnected to keyboard interface
  • the processor 1100' is driven to operate in accordance with the present invention.
  • An asymmetric crypto-key is associated with at least individual network users 30-32 and each distinguished server. If desired, an asymmetric crypto-key can also be associated with each merchant user. Each asymmetric crypto-key is consists of two portions, a public portion and a private portion. The public portion of each asymmetric crypto-key is known to at least each merchant user. If desired, the public portion of each asymmetric crypto-key can also be known to each individual user. Each of these public portions can be stored on each merchant server, or on each merchant server and each individual device. The private portion of each asymmetric crypto-key consists of at least a first private portion and a second private portion. The first private portion is retained by the individual or merchant user with whom the asymmetric crypto-key is associated.
  • the first private portion of the asymmetric crypto-key will be referred to as Dxx and serves as a user password, as will be discussed below.
  • the second private portion of each asymmetric crypto-key is retained by the sponsor station 50 and will be referred to as Dxs .
  • the asymmetric crypto-keys are used in transforming information.
  • the asymmetric crypto-keys are used in providing trusted authentication of network users. This authentication includes authentication of an individual user to a merchant user, to the sponsor station 50, and to other individual users.
  • the asymmetric crypto-keys can be used in providing trusted authentication between merchant users and the sponsor station 50 and distinguished servers.
  • a communication session between user device 30 and merchant server 40 via network 10 is established, step 401 of Figure 2.
  • Merchant server 40 transmits a request via network 10 to user device 30 requesting that the individual user authenticate himself or herself to the merchant user, step 410.
  • this request typically is a request for the party being authenticated to sign a 36 bit hash provided by the authenticating party.
  • the user device 30 determines if a logged-in ticket is stored on memory 1170 at the user ,device 30, step 415. If so, operations continue as described below and shown at step 510 of Figure 3a. If not, user device 30 requests the individual user to enter his or her user ID and password into the user device 30 to begin a log on protocol, step 420.
  • a user associated with an asymmetric crypto-key may contact the sponsor station 50, via the network 10, to log on prior to establishing a communications session with another network station.
  • processing begins with establishing a communications session between the user device and the sponsor station 50, step 405. Processing in this instance continues with step 420 as herein described.
  • User device 30 processes the entered password to obtain Dxx, the first private portion of the asymmetric crypto-key, step 425. Processing of the entered password to obtain Dxx is discussed below. User device 30 then transmits a log-in request to sponsor station 50, step 430.
  • the log-in request includes at least the user's user ID. It should be understood that step 425 can occur previous to step 430, concurrent with step 430, or subsequent to step 430, though it is shown previous to step 430 in Figure 2a.
  • FIG. 8 is a simplified depiction of such a database 1001.
  • This database includes user ID's 1010 and corresponding passwords 1015. Along with this information is an indication of the date 1020 and time 1025 at which unsuccessful log-in attempts have been made by an associated user.
  • the database also includes an indication of the size of a most recent challenge presented to a user 1030 and if that challenge was correctly met 1035, all to be explained below. From this database the sponsor station determines if the most recent challenge was correctly met, step 436. If so, operations continue as depicted in step 437.
  • the sponsor station generates a challenge C to the user device 30, step 437.
  • This challenge is preferably a 128 bit length alphanumeric string.
  • the challenge C is transmitted to the user device 30, step 440.
  • the log-in request and challenge are preferably each transmitted in the clear. That is, neither of these messages are protected. However, as will be discussed below, optional operations can be performed to protect these messages.
  • the user device 30 receives the challenge and generates a random number Rl and a time stamp, step 445.
  • Rl is a 192 bit number.
  • the user device 30 signs the challenge, time stamp and Rl with Dxx, forming a first transformed message, step 450.
  • User device 30 transmits the first transformed message to sponsor station 50, step 451.
  • Sponsor station 50 further transforms the first transformed message using the second portion of the user's private key to recover the challenge, time stamp and Rl, step 455. This operation authenticates the user device 30 to the sponsor station 50. If this authentication fails, that is, the challenge, time stamp and
  • Rl are not transformed with Dxx and therefore are unrecoverable using the second portion of the user's private key, sponsor station
  • step 420 30 to prompt the user to reenter his or her password, and user ID, step 460, and operations continue with step 420 as described above.
  • the sponsor station 50 determines the size of the last challenge presented to the user device 30, step 438.
  • the sponsor station 50 then generates another challenge C whose size is larger than the size of the first challenge C, step 439.
  • the increase in challenge size can be termed 'password throttling' .
  • This larger challenge C is then transmitted to the user device 30, as described above and depicted in step 440. Operations then continue as described above and depicted in step 445. As will be discussed further below, the operations of determining if challenges have been successfully met and if not, increasing the challenge size, preferably should continue until the maximum_challenge size is reached.
  • the sponsor station 50 stores an indication of a successful authentication in the database 1001, generates a second random number R2, computes the function XOR of Rl and R2, generates a time stamp, and determine a lifetime- value, step 465.
  • R2 is preferably a 192 bit number.
  • the lifetime-value is the life span of the logged-in ticket. This value may be a finite time period, such as 1 hour or any other finite time period so desired, or this value may be an end time such that the logged-in ticket expires upon that time being reached.
  • the sponsor station 50 transforms R2, the time stamp, and the lifetime-value with Rl, forming a second transformed message, step 470.
  • the sponsor station 50 transmits this second transformed message to the user device 30, step 471.
  • the user device 30 further transforms the second transformed message using Rl/ recovering R2, the time stamp, and the lifetime- value, step 475.
  • This operation authenticates the sponsor station 50 to the user device 30.
  • the user device 30 computes function XOR of Rl and R2, encrypts Dxx with Rl, and then destroys Rl and the unencrypted Dxx, step 480.
  • the user device 30 stores the encrypted Dxx, user ID, time stamp, and the lifetime-value on memory 1170, forming the logged-in ticket, step 485.
  • the user device 30 transmits a message to the sponsor station 50 which includes a 'done' indication and a time stamp which are encrypted using R12, step 490.
  • the sponsor station 50 stores an indication in memory 1170' that the user is logged in.
  • the user has now successfully logged in and can use the services of the sponsor station 50 to sign tHe 36 byte hash.
  • the user need not provide the user's client ID or password again to provide authentication to another network station requesting authentication .
  • the user device 30 transmits an authorization request to the sponsor station 50, step
  • the authorization request includes the user's user ID which is stored as part of the logged-in ticket on memory
  • the user device 30 retrieves the user ID from memory 1170, the user device 30 does not prompt the user to enter the user ID.
  • This transmission is sent using a Message Authentication Protocol
  • MAC MACed message
  • the user device 30 MACs the authorization request with R12.
  • the sponsor station 50 processes the received message to authenticate the user based upon the MACed message, step 515. Then, the sponsor station 50 generates and transmits an acknowledgement message to the user device 30. This is also MACed with R12, step 516.
  • the user device 30 authenticates the received acknowledgment and encodes a 36 byte hash, provided by the merchant server 40, step 520.
  • the 36 byte hash is encoded using the PKCS1 algorithm, though other well known algorithms could be used.
  • the user device 30 encrypts the 36 byte hash and a time stamp with R12 and transmits both to the sponsor station 50, step 525.
  • the sponsor station 50 decrypts encoded 36 byte hash and time stamp using R12, step 530.
  • the sponsor station 50 signs the encoded 36 byte hash with Dxs, the second private portion of the asymmetric crypto-key, step 535.
  • the sponsor station 50 generates a fresh time stamp, recalls Rl from memory 1170' , and transmits the time stamp, the signed encoded 36 byte hash, and Rl to the user device 30, all encrypted with R12, step 540.
  • the user device 30 decrypts the time stamp, the signed encoded 36 byte hash, and Rl using R12, step 545. Then, the user device 30 recalls encrypted Dxx from the memory 1170 and decrypts Dxx using Rl obtained from the sponsor box 50, step 550. The user device 30 then uses Dxx to complete the signature of the encoded 36 byte hash and transmits the fully signed 36 byte hash to the merchant server 40, step 555. To complete the transaction, the user device 30 transmits a 'done' message to the sponsor station 50, step 560.
  • any or all of the communications depicted in Figures 2a-2c and 3a-3b between the user device 30 and sponsor station 50 could include a sequence number. It also will be understood that any or all of the communications depicted in Figures 3a-3b could be encrypted with R12, MACed with R12, or both encrypted and M Ced with R12. Also, further protection of encrypted messages can be obtained by use of a Salt, which will be understood by one skilled in the art.
  • step 401 To provide trusted authentication to yet another merchant server, or perhaps to merchant server 40 at a later time, operations continue as depicted in Figure 2a, step 401, and as discussed above. If, as depicted in step 415, the user device 30 determines that an unexpired log-in ticket is stored in memory 1170, operations continue as depicted in Figure 3a, step 510. Thus, the user associated with network station 30 need only enter his or her user ID and password once, while the user is able to provide trusted authentication to more than one merchant user.
  • the user device 30 must transform a challenge C for authentication.
  • the size of the challenge C and the time required to process the challenge correspond, as will be understood by one skilled in the art.
  • a larger challenge C takes more time to compute than a smaller challenge C.
  • This computational time can be used to foil an on-line guessing attack, and especially to foil those aided by computer programming for instituting such attacks.
  • the first issued challenge C is preferably 128 bits in size.
  • the computational time to transform a challenge of this time is imperceptible to a human user. If a second challenge must be issued due to an incorrect password being submitted, the size of the challenge is increased, preferably to 256 bits in size. This increases the computational time required to transform the challenge C.
  • This increase in challenge size can be repeated for each submission of an invalid password. But, the number of times the challenge size is increased is preferably limited such that when the challenge size reaches 64,000 bits, any additional challenges will not be increased in size. However, it should be understood that the size of this limit can be chosen as desired, that the size of the increase challenge size can be varied, or even that a threshold limit may not be used if so desired.
  • the sponsor station 50 never locks-out or times-out a user. Although, a user could in effect by locked-out if no limit is placed on the complexity increases. In any event, an authorized user who has inadvertently entered a wrong password is never prevented from becoming authenticated. When the user remembers or otherwise determines the correct password, the sponsor station 50 will authenticate the user. As discussed above, once a user is authenticated, an indication is stored in the database 1001 that the user has successfully logged in. Therefore, the next time the user attempts to authenticate, the challenge size will be small-.
  • the sponsor station 50 may also be configured to reset the indication in the database 1001 of an authentication after a predetermined time period. This time period may be set as desired, but preferably is set at three hours. Thus, an authorized user who unsuccessfully authenticates, but who later remembers or otherwise obtains his or her correct password can immediately be authenticated by the sponsor station 50.
  • the present invention also protects against those on-line guessing attacks which come from more than one computing device, or from a computing device which can appear as multiple computing devices. Because the database 1001 stores an indication of the failure of the previous attempts at authentication associated with user ID'S and passwords, a subsequent attempt at authentication is required to meet a larger challenge, assuming the database has not been reset as described above. Thus, if an attacker attempts four guesses using one computing device and then uses a different computing device, the sponsor station 50 will still present the larger size challenge than that last tried unless an established threshold has already been reached, even though the attacker is using a different computing device, because before any challenge is generated the data base is consulted. Furthermore, if at attacker is attacking with more than one machine at a time, the sponsor station 50 will still present a larger challenge for each subsequent attempt, no matter which machine is in communication with the sponsor station 50 because of the same reason.
  • Password throttling can also be used to provide enhanced security in the conventional elementary password authentication techniques discussed above. If user device 33 and merchant server 41 are not associated with crypto-keys, merchant server 41 can still authenticate user device 33 without having to use either of the techniques of lock-out or time-out.
  • the merchant server 41 maintains a database- 1101, as depicted in Figure 9, which contains associated user ID's 1110 and passwords 1115. This database also includes an indication of the. number of unsuccessful authentication attempts 1120.
  • a user establishes a communication session with the merchant server 41.
  • Merchant server transmits a request for the user to supply his or her user ID and password, step 1205.
  • the user enters the requested information and transmits the same to the merchant server 41, step 1210.
  • the merchant server accesses the password database 1101 and determines i-f the password is valid, step 1215. If so, the user is authenticated and granted access to the merchant server.
  • the merchant server 41 sets the indication of the number of unsuccessful authentication attempts 1120 to a value of zero, step
  • the merchant server 41 determines the time period which corresponds with the recalled value, step 1235. The merchant server 41 then waits the determined time value before operations continue, step 1240. After the determined time period has lapsed, the merchant server 41 transmits another request for the user to supply his or her user ID and password, step 1245. Thereinafter, operations continue as described above and depicted beginning at step 1210.
  • the times stored in list 1301 may be varied by according to the needs and desires of the entity controlling the merchant server 41.
  • a user is never denied an opportunity to attempt to authenticate himself or herself, yet an on-line guessing attack can be foiled.
  • the rate at which an attacker learns if he or she has hit upon a valid password is slowed.
  • each subsequent attempt results in a doubling of the time period which must elapse before the merchant server 41 requests that the password and user ID be reentered.
  • the increases in the time period only continue up to a- pre- established threshold limit. However, as soon as a valid password is received, the user device 33 is granted access to the merchant server 41.
  • Password throttling in this embodiment also defends against on-line guessing attacks performed, from several computing devices, as in this embodiment each attempt at authentication must include referencing the database 1101 to determine the number of previous unsuccessful attempts at authentication.

Abstract

Un procédé d'authentification d'un utilisateur consiste à recevoir une demande d'accès d'un utilisateur prétendant être un utilisateur particulier. Une première intervention ayant un premier niveau de complexité est transmise à l'utilisateur. Une réponse à la première intervention transmise est transmise. Une détermination est effectuée afin de savoir si oui ou non la réponse transmise authentifie l'utilisateur comme étant l'utilisateur particulier. L'accès demandé par l'utilisateur est autorisé si la réponse transmise authentifie l'utilisateur. Toutefois, une seconde intervention d'un second niveau de complexité, supérieur à celui du premier niveau de complexité, est transmise à l'utilisateur si la réponse transmise authentifie l'utilisateur.
PCT/US2001/048301 2000-12-19 2001-12-18 Systeme et procede de regulation de mots de passe WO2002050630A2 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US79311000A 2000-12-19 2000-12-19
US09/793,110 2001-02-27

Publications (3)

Publication Number Publication Date
WO2002050630A2 true WO2002050630A2 (fr) 2002-06-27
WO2002050630A3 WO2002050630A3 (fr) 2002-11-07
WO2002050630A9 WO2002050630A9 (fr) 2002-12-19

Family

ID=25159118

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2001/048301 WO2002050630A2 (fr) 2000-12-19 2001-12-18 Systeme et procede de regulation de mots de passe

Country Status (1)

Country Link
WO (1) WO2002050630A2 (fr)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6006328A (en) * 1995-07-14 1999-12-21 Christopher N. Drake Computer software authentication, protection, and security system

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6006328A (en) * 1995-07-14 1999-12-21 Christopher N. Drake Computer software authentication, protection, and security system

Also Published As

Publication number Publication date
WO2002050630A9 (fr) 2002-12-19
WO2002050630A3 (fr) 2002-11-07

Similar Documents

Publication Publication Date Title
US6883095B2 (en) System and method for password throttling
US7055032B2 (en) One time password entry to access multiple network sites
US7069435B2 (en) System and method for authentication in a crypto-system utilizing symmetric and asymmetric crypto-keys
US6970562B2 (en) System and method for crypto-key generation and use in cryptosystem
US7017041B2 (en) Secure communications network with user control of authenticated personal information provided to network entities
US7599493B2 (en) Asymmetric key pair having a kiosk mode
US7630493B2 (en) Multiple factor private portion of an asymmetric key
US8340287B2 (en) Securing multifactor split key asymmetric crypto keys
US7386720B2 (en) Authentication protocol using a multi-factor asymmetric key pair
US7596697B2 (en) Technique for providing multiple levels of security
US6940980B2 (en) High security cryptosystem
US7149310B2 (en) Method and system for authorizing generation of asymmetric crypto-keys
US8213608B2 (en) Roaming utilizing an asymmetric key pair
US7065642B2 (en) System and method for generation and use of asymmetric crypto-keys each having a public portion and multiple private portions
US7565527B2 (en) Technique for asymmetric crypto-key generation
WO2006078561A2 (fr) Technique pour une generation de cryptocles asymetriques
WO2006078560A2 (fr) Itinerance faisant appel a une paire de cles asymetriques
WO2002050630A2 (fr) Systeme et procede de regulation de mots de passe
WO2006078557A2 (fr) Protocole d'authentification faisant appel a une paire de cles asymetriques multifactorielles
WO2006078555A2 (fr) Architecture pour le stockage de cle de chiffrement asymetrique
WO2006078556A2 (fr) Technique pour fournir plusieurs niveaux de securite
WO2006078559A2 (fr) Paire de cles asymetriques presentant un mode kiosque

Legal Events

Date Code Title Description
AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR

AL Designated countries for regional patents

Kind code of ref document: A3

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR

121 Ep: the epo has been informed by wipo that ep was designated in this application
AL Designated countries for regional patents

Kind code of ref document: C2

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR

COP Corrected version of pamphlet

Free format text: PAGES 1/12-12/12, DRAWINGS, REPLACED BY NEW PAGES 1/11-11/11; DUE TO LATE TRANSMITTAL BY THE RECEIVING OFFICE

122 Ep: pct application non-entry in european phase