GB2281991A

GB2281991A - Authentication

Info

Publication number: GB2281991A
Application number: GB9318823A
Authority: GB
Inventors: Ulf Erik Andersson
Original assignee: ICL System AB
Current assignee: ICL System AB
Priority date: 1993-09-10
Filing date: 1993-09-10
Publication date: 1995-03-22
Also published as: GB9318823D0

Abstract

A method of and system for authentication between two parties. A challenge is transmitted between the two parties and to achieve authentication the response to the challenge must be both correct and received within a predetermined time interval.

Description

AUTHENTICATION This invention relates to authentication methods and systems.

In many information systems, for example, the basis for ensuring security is an authentication process, involving computers and software as well as use of a user ID (identification). In dependence on the actual area of application, there are many ways to achieve this authentication. It is necessary to have efficient methods for authentication both between different computers and at the interface between computers and people using them. Often this means some kind of mutual authentication ie from both or all participants. In many cases methods of encryption/coding are used for authentication or for protecting the authentication procedure itself. An example of an authentication procedure is given in WO 92127958A in which computer network terminals are interfaced to a communications medium via respective user-side terminators. The processors of a computer node are interfaced to the medium via a computer-side terminator. Sensitive data can be sent over the medium using end-to-end encryption. The identity of a user is verified by authentication apparatus which accepts a personal user token holding a countersign, and by a password.

When a user logs off, countersign generating apparatus at the computer node writes a new countersign at the token. This provides a secure interface and allows a user and the computer to authenticate each other.

According to one aspect of the present invention there is provided a method of authentication between two parties including the steps of transmitting a challenge between the two parties, and verifying that a response to the challenge is correct and received within a predetermined time interval.

According to another aspect of the present invention there is provided a method of authentication between first and second parties, including the steps of transmitting a challenge from the first party to the second party for the second party to transmit a response to the first party, transmitting the response from the second party to the first party, verifying that the response received by the first party is correct, and verifying that the correct response is received within a predetermined time interval following the transmission of the challenge.

According to a further aspect of the present invention there is provided a system for authentication between two parties including means for transmitting a challenge between the two parties, and means for verifying that a response to the challenge is correct and received within a predetermined time interval.

Embodiments of the invention will now be described with reference to the accompanying drawings, in which: Figure 1 is a block circuit diagram of an example configuration of hardware; Figure 2 illustrates the messaging between the processors of Figure 1 for one embodiment and Figure 3 illustrates the messaging between the processors for another embodiment.

The authentication procedure between the parties according to invention basically comprises the issuance of a "challenge" by one of two parties and the issuance of a predetermined response by the other party within a certain time limit. The challenge and the response can take various forms. For example, the challenge may simply be a request for the other party to send a pre-agreed password to the one party. The challenge could alternatively be the sending of a numerical value which the other party has to operate on in a pre-agreed manner before returning an appropriate response. For example, the operation may comprise returning a value which is a cryptographic function of the received numerical value.

There are many possibilities. The basic feature of authentication process is, however, that upon issuance of a challenge the correct response must be received within a predetermined time interval.

In the embodiment illustrated in Figure 1, the two parties to the authentication are processors 1 and 2. There is a reset communication channel between the processors 1 and 2, together with transmit and receive communication channels as illustrated.

Figure 2 illustrates an example of authentication of processor 2 by processor 1, and Figure 3 illustrates an example of authentication of processor 1 by processor 2. For mutual authentication, the messaging of Figure 2 may be directly followed by the messaging of Figure 3.

Alternatively, the specific examples of challenges/responses as illustrated can be varied, without diverging from the basic premise of receiving a predetermined response to a challenge within a predetermined time interval.

Referring firstly to Figure 2, the reset on processor 1 is released and the time is measured. This releases the reset on (challenges) processor 2, which responds by transmitting a password to processor 1. Processor 1 checks the time of arrival of the response (password) and if the password is correct. For an "OK" message to be sent from processor 1 to processor 2 the password must be both correct and received within a predetermined time or time interval. If the password is not correct or it is received outside of the predetermined time, processor 1 is reset.

Referring to Figure 3, processor 2 measures the time and issues a challenge to processor 1. This may be in response to the "OK" message referred to above for mutual authentication, or part of a separate authentication procedure. Processor 1 sends an appropriate response to processor 2, which checks the time of arrival of the response and that the response is in a previously agreed form. If the response and the timing are correct, an "OK" message is transmitted from processor 2 to processor 1. If the response or the timing is incorrect, processor 2 terminates communications between it and processor 1.

The following expresses the basic premise in more general terms and indicates some of the many possible variants.

For authentication between two parties referred to as A and B, the following expressions are employed: CV Challenge Value RV Response Value SV Secret Value (known to both A and B) D Date tR Response time f() A function of some kind eg mathematic, cryptographic etc (known to both A and B).

A sends a challenge to B in the form of (a) Hardware signal(s) (b) Question (c) CV or a combination of them.

B responds with (a) Hardware signal(s) (b) RV within the time tR.

B regards A as authentic if RV is correct and FP(x) < = tR < = FQ(y) where FP = FQB or FP < > FQ and F = (a) a constant eg SV, or (b) function f x, y may be: (a) CV (b) RV (c) D (d) SV or a combination of them.

RV is (a) f(z), where z is CV, SV, D or a combination them (b) a hardware signal(s) or a combination of (a) and (b) From the above it will be appreciated that for example, the response value may be a function of a translated challenge ie the challenge as translated by the receiving party, and that the response time may be a function of the response value in conjunction with date information.

Claims

1. A method of authentication between two parties including the steps of transmitting a challenge between the two parties, and verifying that a response to the challenge is correct and received within a predetermined time interval.

2. A method as claimed in Claim 1 wherein the response is a password and the predetermined time interval commences from the transmission of the challenge.

3. A method as claimed in Claim 1 wherein the two parties are two processors and the challenge is comprised by a release reset message transmitted between them in one direction, and the response is a password transmitted in the opposite direction.

4. A method as claimed in Claim 1 wherein the response is a function of the challenge as translated by the party receiving it.

5. A method as claimed in Claim 1 wherein the predetermined time interval is a response time which is a function of a response value in conjunction with date information.

6. A method of authentication between first and second parties, including the steps of transmitting a challenge from the first party to the second party for the second party to transmit a response to the first party, transmitting the response from the second party to the first party, verifying that the response received by the first party is correct, and verifying that the correct response is received within a predetermined time interval following the transmission of the challenge.

7. A system for authentication between two parties including means for transmitting a challenge between the two parties, and means for verifying that a response to the challenge is correct and received within a predetermined time interval.

8. A system as claimed in Claim 7 wherein the response is a password, and wherein the predetermined time interval commences from the transmission of the challenge.

9. A system as claimed in Claim 7 wherein the two parties are two processors and the challenge is comprised by a release reset message transmitted between them in one direction, and the response is a password transmitted in the opposite direction.

10. An authentication method substantially as herein described with reference to and as illustrated in Figures 1 and 2, Figures 1 and 3, or Figures 1-3 of the accompanying drawings.

11. An authentication system substantially as herein described with reference to and as illustrated in Figures 1 and 2, Figures 1 and 3, or Figures 1-3 of the accompanying drawings.