GB2347248A

GB2347248A - Super passwords

Info

Publication number: GB2347248A
Application number: GB9904233A
Authority: GB
Inventors: Colin David Mccall
Original assignee: International Business Machines Corp
Current assignee: International Business Machines Corp
Priority date: 1999-02-25
Filing date: 1999-02-25
Publication date: 2000-08-30
Also published as: GB9904233D0

Abstract

A system for ensuring secure access to a resource 14 comprises a password checker 12 adapted to check a user's password before allowing access to the resource. The password checker further includes means, responsive to user input, for generating a string indicative of the identity of the resource; means, responsive to receipt of a super-password from a super-password generator 10, for decrypting the super-password with a public key 22 associated with the resource; and means, responsive to the string and the decrypted super-password matching, for allowing access to the resource. The super-password generator responds to the string being provided by an accredited user to encode the string with a private key 20 corresponding to the public key 22.

Description

SUPER PASSWORDS The present invention relates to a method and apparatus for providing secure access to resources.

Computers and many other devices (such as mobile computer hard drives or car radios) contain passwords in non-volatile memory eg. flash memory, battery backed up memory or on a storage medium, to protect them from unauthorized use. It is also possible that certain aspects of a device's functionality may have access restricted only to a user providing a password. For example, many application programs require a password which may be written to a predefined location in memory.

Furthermore, some applications or devices have aspects of their functionality restricted to administrator type users providing an administrator password.

In any case, if a user sets a password and forgets it, or sets a password maliciously to deny legitimate access to a resource, be it a computer, a computer application or an electronic device such as a phone, it usually requires physical intervention at the resource to reset the password. In the case of a computer, this may require the covers to be opened and a jumper set on the system board. This is a very expensive process involving a skilled technician visiting the machine on site, or the machine being taken out of service and shipped to a service centre.

In some cases it may be impossible to recover the resource.

Cellular Mobile Phones already implement a super password technique. In the case of GSM phones, the phone is equipped with a SIM card which gives the phone its unique identity on the GSM network. The SIM card can be password protected to prevent illegal use of the customer's account on the phone network if the phone is lost. In the event that the password is forgotten, the network operator can provide the customer with a PUK (personal unlocking key) which is unique to the SIM card serial number and is generated using some non-obvious algorithm and the SIM card serial number. The PUK overrides the password and allow access to the SIM card and is only divulged once the customer has proven that he/she is the proper owner of the SIM card. The system works because there are relatively few network operators and, so far, they have managed to keep this algorithm secret.

This system is clearly not workable where many manufacturers or parties who verify a user's identity before supplying a super password may be involved.

The present invention provides a system according to claim 1, a resource according to claim 2 and a super-password generator according to claim 12.

The invention solves the problem of the prior art by implementing a super password that overrides any password set by a user, which can be calculated from some attribute of the resource such as its serial number, licence number or Universally Unique IDentifier (UUID), and transmitted to the end user and typed into the machine, but which does not rely on maintaining the secrecy of the algorithm for generating the password.

This is based on the fact that counter to common asymmetric cryptography implementations, the user's private key is not actually held by the user rather it is held by the party entrusted with issuing super-passwords.

Because, the super password generated according to the invention is based on a resource-specific property and a public key (which can be programmed into the device), the resource can only be unlocked knowing 1) the algorithm, 2) the resource specific attribute and 3) the private key corresponding to the public key. This means that security is not compromised even if the algorithm, public key and resource specific property are widely known.

This gives the invention far wider appeal than if it relied on a manufacturer guarding the algorithm and giving out the super-passwords.

Nonetheless, reading the public key is allowed because the private key cannot be easily deduced from the public key (using a scheme such as RSA encryption).

Further, including a resource-specific attribute to the calculation (which in one embodiment is a random number generated each time the challenge is made) prevents the super-password for one resource being used to access a different resource where, for example, a site wide public key is common to a number of resources.

Embodiments of the invention will now be described with reference to the accompanying drawing which is a schematic view of the system according to the invention.

The system according to the invention comprises two computer programs: a super password generator 10 cooperable with a database 20 of private keys which is kept secure by the resource manufacturer or a party trusted to dispense super-passwords, and a password checker 12 which is built into resources protected with the invention.

A preferred embodiment of the invention will be described in terms of a system for providing secure access to a device 14 such as a personal computer. It is well known for such devices to include a start-up or bootstrap program 16 which runs when a computer is started or re-started.

Such bootstrap programs may include the routine 12 for setting and checking for a password which executes before continuing to load the operating system for the computer.

If a user forgets the password 18 stored in memory, or a system owner finds that the password 18 has been set maliciously to deny access, the present embodiment allows the user to hit a special function key which causes the password checker routine 12 to generate and display a unique identifier string rather than prompt the user for the stored password 18.

The unique identifier string is preferably generated using a secure combination of the current (lost) password 18 and some unique attribute of the system. (using an irreversible, for example, MD5 to generate a message digest which is used as the ID string prevents 3rd parties discovering the password 18 even if they discover the ID string.) Typically the device serial number, UUID, or MAC (Media Access Control) address could be used as the unique attribute. In any case, the attribute should be unique to the resource, not normally modifiable by the user, and accessible to the password checker routine.

The user must now supply proof that he is entitled to use the resource, along with the identifier string to an authorised dispenser of super-passwords. This can be done in any number of ways such as telephoning a manufacturers service line or e-mailing the manufacturer with the ID string and the user's credentials.

Once the user's credentials are verified, and this can be done automatically, if the credentials are supplied electronically, the password generator program 10 then uses the identifier string and the users private key, stored in the database 20, to generate a'super' password which is highly likely to be unique to the supplied identifier.

This program 10 may use any of several well known public keyt encryption technologies, for example RSA.

The super password is returned to the user, either electronically or orally and the user then enters the super password. It will be seen that if the ID string is generated from constants like the old password and the device serial number, the super password will remain the same, and so the user need not wait for the super password with the device in the same state as when the ID string was generated. Rather, the user can use the device in so far as is allowed without the password, and then re start the password checker program to arrive at the point of requiring the super-password.

The password checker 12 decrypts the super password using a'public key, 22 matching the private key used by the super password generator.

Where a computer or phone is used, this is stored in non-volatile, whereas for an application program the key would more likely be stored on disk. The decrypted super password supplied will only match the identifier string if matching public and private keys are used. If so, the checker 12 can reset the password 18 to allow the user access and allow the user to set a different password if required.

It will be seen that the invention can be applied to application programs or any other device simply by allowing a user to run the password checker routine before being prompted for the password for the program or device.

In an alternative embodiment, the ID string is generated from a random number output by a random number generator 24. This means that a different ID string is generated every time a request to override the password 18 is made. It means that, although the user must wait with the resource in the same state as when the ID string was generated, only one resource may be released at a time and so this is particularly useful if a single private key is used for many resources.

The invention is also adaptable to mitigate problems caused by such a single private key for a group of resources being revealed.

In one embodiment, the public key is set in flash memory, but changes every time the code changes. So if the private key is compromised, the manufacturer can issue a new level of flash code. in this case, the password checker 12 displays both the ID string and the Flash level, and the password generator 10 looks up the Flash level to get the private key matching the public key for that level of Flash code.

Alternatively, the public key is stored in EEPROM and is setable by a user. In this case an owning organization owns its own private/public key pair. Once a public key is set for the first time, the user must first get the super password from his administrator before changing the key. This gives less protection from the'trusted malicious user'tan the Flash option, but is still better than the current password protection.

Claims

CLAIMS 1. A system for ensuring secure access to a resource comprising: password checker means adapted to check a user's password before allowing access to said resource, said password checker means further including: means, responsive to user input, for generating a string indicative of the identity of said resource; means, responsive to receipt of a super-password from a superpassword generator means, for decrypting said super-password with a public key associated with said resource; and means, responsive to said string and said decrypted super-password matching, for allowing access to said resource; super-password generator means, responsive to said string being provided by an accredited user, for encoding said string with a private key corresponding to said public key.
2. An access controlled resource comprising password checker means adapted to check a user's password before allowing access to said resource, said password checker means further including: means, responsive to user input, for generating a string indicative of the identity of said resource ; means, responsive to receipt of a super-password from a superpassword generator means, for decrypting said super-password with a public key corresponding to a private key accessible only by a superpassword generator means; and means, responsive to said string and said decrypted super-password matching, for allowing access to said resource.
3. A resource according to claim 2 in which said string generator means is adapted to generate said string from any combination of said password and a resource serial number.
4. A resource according to claim 2 in which said string generator means is adapted to generate said string from a random number generator.
5. A resource according to claim 3 in which said string generator means is adapted to generate said string using a non-reversible algorithm.
6. A resource according to claim 5 in which said algorithm is the MD5 algorithm.
7. A resource according to claim 2, said resource being one of a computer, a computer application or an electronic device.
8. A resource according to claim 2 wherein said string generating means is adapted to transmit said string and said users credentials to said super-password generator means.
9. A resource according to claim 2 wherein the string generator means is adapted to be initiated by a user striking a special function key.
10. A resource according to claim 2 in which said public key is stored in electrically erasable memory and said resource comprises means, responsive to said super-password being provided by an accredited user, to enable a user to update said public key.
11. A resource according to claim 2 in which said public key is stored in a flash memory having an associated flash-level and said private key, accessible only by said super-password generator means, is associated with said flash level.
12. A super-password generator for ensuring secure access to a resource comprising: super-password generator means, responsive to a string indicative of the identity of said resource being provided by an accredited user, for encoding said string with a private key corresponding to a public key associated with said resource.
13. A super-password generator according to claim 12 including means for verifying a user's credentials and means for transmitting said superpassword to said resource.
14. A method of controlling access to a resource comprising the steps of: responsive to user input, generating a string indicative of the identity of said resource; responsive to receipt of a super-password from a super-password generator means, decrypting said super-password with a public key corresponding to a private key accessible only by a super-password generator means ; and responsive to said string and said decrypted super-password matching, allowing access to said resource.
15. A computer program product comprising computer program code stored on a computer readable storage medium for, when executed on a computer, controlling access to a resource, the program code comprising password checker means adapted to check a user's password before allowing access to said resource, said password checker means further including: means, responsive to user input, for generating a string indicative of the identity of said resource; means, responsive to receipt of a super-password from a superpassword generator means, for decrypting said super-password with a public key corresponding to a private key accessible only by a superpassword generator means; and means, responsive to said string and said decrypted super-password matching, for allowing access to said resource.
16. A computer program product comprising computer program code stored on a computer readable storage medium for, when executed on a computer, generating a super-password, the program code comprising super-password generator means according to claim 12.