WO2012036683A2 - Universal authentication method - Google Patents
Universal authentication method Download PDFInfo
- Publication number
- WO2012036683A2 WO2012036683A2 PCT/US2010/049018 US2010049018W WO2012036683A2 WO 2012036683 A2 WO2012036683 A2 WO 2012036683A2 US 2010049018 W US2010049018 W US 2010049018W WO 2012036683 A2 WO2012036683 A2 WO 2012036683A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- character string
- authenticator
- requester
- encryption key
- authentication
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2103—Challenge-response
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
Definitions
- the universal authentication method is a challenge-response method which does not require the user to generate or remember passwords. It may reside on the electronic system as an auxiliary application or reside on the hardware specific for the
- the universal authentication method can be used for one and two way authentication.
- the challenger or requester can be either the user or the electronic system.
- Fig. 1 is a flow chart showing conventional authentication methods.
- the authenticator (1) is the electronic system.
- the authenticator displays a screen prompting for username and password or password (2).
- the user or requester enters his username and password or password (3).
- the username and password is transmitted over some communication medium (4) and the requester is authenticated (5).
- usernames and passwords are limited in size and content.
- Conventional authentication methods also allow would be thief easy access to passwords and usernames.
- electronic systems that use the conventional authentication method usually store usernames and passwords within the electronic system. If, for example, an electronic system is stolen, a thief can, by using the numerous brute force programs available, determine the usernames and passwords to that particular electronic system as well as usernames and passwords that may be stored in the electronic system for other electronic system.
- Some electronic systems accept authentication data via internet protocol technology.
- the universal authentication method removes these barriers, among others, by removing the human user from the equation.
- the universal authentication method comprises methods for one-way authentication, two-way authentication, and two-way authentication which utilizes one time authentication keys.
- Fig. 2 is a flow chart showing one-way universal authentication method.
- the requester makes a request for authentication to the authenticator (1).
- the authenticator passes its unique identifier and randomly generated character string to the requester (2).
- the requester uses the identifier to retrieve an encryption key for the authenticator and encrypts the passed in randomly generated character string (3).
- the encrypted randomly generated character string, and an identifier which uniquely identifies the requester is passed back to the authenticator (4).
- the authenticator retrieves the encryption key, which corresponds to the identifier, and decrypts the encrypted string (5). If the decrypted character string matches the random character string sent in the initial request, the requester is authenticated (6).
- Fig. 3 is a flow chart showing two-way authentication. In two way authentication the requester makes a request for authentication to the authenticator (1).
- the requester makes a request for authentication to the authenticator (1).
- authenticator passes its unique identifier and randomly generated character string to the requester (2).
- the requester uses the identifier to retrieve an encryption key for the authenticator and encrypts the randomly generated passed in character string (3).
- the encrypted character string, an identifier which uniquely identifying the requester, and a new randomly generated character string is passed back to the authenticator (4).
- the authenticator retrieves the encryption key corresponding to the received identifier, and decrypts the encrypted character string (5). If the decrypted character string does not match the random character string sent in the initial request, authentication fails and communication is terminated (6).
- the random character string from the requester is encrypted (7).
- the encrypted character string is passed back to the requester along with the authenticator' s identifier (8).
- the requester uses the identifier to retrieve the encryption key for the authenticator and decrypts the encrypted string (9). If the decrypted character string matches the random character string sent in the initial request, both parties are authenticated (11).
- Fig. 4 is a flow chart showing the two-way universal authentication method which utilizes one time authentication keys.
- the requester makes a request for authentication to the authenticator (1).
- the authenticator passes its unique identifier and randomly generated character string to the requester (2).
- the requester uses the identifier to retrieve a one time encryption key (eg. Key A) for the authenticator and encrypts the randomly generated passed in character string (3).
- the encrypted character string, an identifier which uniquely identifying the requester, and a new randomly generated character string is passed back to the authenticator (4).
- the authenticator retrieves the encryption key (eg. Key A) corresponding to the received identifier, and decrypts the encrypted character string (5). If the decrypted character string does not match the random character string sent in the initial request, authentication fails and communication is terminated (6).
- the random character string from the requester is encrypted (7).
- the encrypted character string is passed back to the requester along with the authenticator' s identifier (8).
- the requester uses the identifier to retrieve the encryption key for the authenticator and decrypts the encrypted string (9). If the decrypted character string matches the random character string sent in the initial request, both parties are
- a new random encryption key (eg. Key C) is then created and encrypted with the next encryption key in the rotation (eg. Key B) and sent to the authenticator (12).
- the new random encryption key (eg. Key C) is received and decrypted by the authenticator (13). Both the requester and authenticator replace the key use in the current
- Encryption Key A is used once and discarded.
- the next time through the authentication method the system will use Key B to encrypt and decrypt the random string, and used Key C to transmit the new Key D.
- the number of keys held by the requester and authenticator can be predetermined. For example, if the predetermined number of keys is 5 and Keys A, B, C, D, E are the first set of authentication keys, then Keys B, C, D, E, F will be the second set of authentication keys. Keys C, D, E, F, G will be the third set of authentication keys, etc..
- the universal authentication system can use either one or two encryption keys per authentication. When two encryption keys are used, one key is designated for incoming requests and another is designated for outgoing responses. If one time keys are to be used, both keys would be replaced after each authentication. Users of the universal authentication method can also request rotating encryption key(s); either a single encryption key or one encryption key for incoming requests and one encryption key for outgoing responses. For website authentication, the IP address of the requester and authenticator can be added as part of the encryption key(s) to prevent "man in the middle" scams.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
- Signal Processing For Digital Recording And Reproducing (AREA)
Abstract
The object of the current invention is to provide the user with an authentication method that is more secure than conventional authentication methods and can be used on personal computers, PDAs, cell phones, personal digital media devices, home and car locks and security systems, televisions/VCR/DVD remote controls, credit card authentication systems, automatic teller machine authentication systems, among others.
Description
UNIVERSAL AUTHENTICATION METHOD
DETAILED DESCRIPTION OF THE INVENTION
The universal authentication method is a challenge-response method which does not require the user to generate or remember passwords. It may reside on the electronic system as an auxiliary application or reside on the hardware specific for the
authentication method. The term electronic system(s) is used to describe systems such as personal computers, personal digital media devices, cell phones, PDAs, among others. This list is not exclusive. The universal authentication method can be used for one and two way authentication. In the universal authentication method the challenger or requester can be either the user or the electronic system.
Fig. 1 is a flow chart showing conventional authentication methods. In conventional authentication methods the authenticator (1) is the electronic system. The authenticator displays a screen prompting for username and password or password (2). The user or requester enters his username and password or password (3). The username and password is transmitted over some communication medium (4) and the requester is authenticated (5).
Because the human requester can remember only a limited number and type of symbols , usernames and passwords are limited in size and content. Conventional authentication methods also allow would be thief easy access to passwords and usernames. Additionally, electronic systems that use the conventional authentication method usually store usernames and passwords within the electronic system. If, for example, an electronic system is stolen, a thief can, by using the numerous brute force programs available, determine the usernames and passwords to that particular electronic
system as well as usernames and passwords that may be stored in the electronic system for other electronic system. Some electronic systems accept authentication data via internet protocol technology. This requires the user to pass along his username and password through cyberspace; a place where this information can be intercepted.The universal authentication method removes these barriers, among others, by removing the human user from the equation. The universal authentication method comprises methods for one-way authentication, two-way authentication, and two-way authentication which utilizes one time authentication keys.
Fig. 2 is a flow chart showing one-way universal authentication method. In oneway authentication the requester makes a request for authentication to the authenticator (1). The authenticator passes its unique identifier and randomly generated character string to the requester (2). The requester uses the identifier to retrieve an encryption key for the authenticator and encrypts the passed in randomly generated character string (3). The encrypted randomly generated character string, and an identifier which uniquely identifies the requester, is passed back to the authenticator (4). The authenticator retrieves the encryption key, which corresponds to the identifier, and decrypts the encrypted string (5). If the decrypted character string matches the random character string sent in the initial request, the requester is authenticated (6).
Fig. 3 is a flow chart showing two-way authentication. In two way authentication the requester makes a request for authentication to the authenticator (1). The
authenticator passes its unique identifier and randomly generated character string to the requester (2). The requester uses the identifier to retrieve an encryption key for the authenticator and encrypts the randomly generated passed in character string (3). The
encrypted character string, an identifier which uniquely identifying the requester, and a new randomly generated character string is passed back to the authenticator (4). The authenticator retrieves the encryption key corresponding to the received identifier, and decrypts the encrypted character string (5). If the decrypted character string does not match the random character string sent in the initial request, authentication fails and communication is terminated (6).
If the decrypted character string matches the random character string sent in the initial request, the random character string from the requester is encrypted (7). The encrypted character string is passed back to the requester along with the authenticator' s identifier (8). The requester uses the identifier to retrieve the encryption key for the authenticator and decrypts the encrypted string (9). If the decrypted character string matches the random character string sent in the initial request, both parties are authenticated (11).
Fig. 4 is a flow chart showing the two-way universal authentication method which utilizes one time authentication keys. In two way authentication which utilizes one time authentication keys, the requester makes a request for authentication to the authenticator (1). The authenticator passes its unique identifier and randomly generated character string to the requester (2). The requester uses the identifier to retrieve a one time encryption key (eg. Key A) for the authenticator and encrypts the randomly generated passed in character string (3). The encrypted character string, an identifier which uniquely identifying the requester, and a new randomly generated character string is passed back to the authenticator (4). The authenticator retrieves the encryption key (eg. Key A) corresponding to the received identifier, and decrypts the encrypted character string (5).
If the decrypted character string does not match the random character string sent in the initial request, authentication fails and communication is terminated (6).
If the decrypted character string matches the random character string sent in the initial request, the random character string from the requester is encrypted (7). The encrypted character string is passed back to the requester along with the authenticator' s identifier (8). The requester uses the identifier to retrieve the encryption key for the authenticator and decrypts the encrypted string (9). If the decrypted character string matches the random character string sent in the initial request, both parties are
authenticated (11).
A new random encryption key (eg. Key C) is then created and encrypted with the next encryption key in the rotation (eg. Key B) and sent to the authenticator (12). The new random encryption key (eg. Key C) is received and decrypted by the authenticator (13). Both the requester and authenticator replace the key use in the current
authentication (eg. Key A) with the new encryption key (eg. Key C) (14).
The following is an example how the requested random encryption keys will cycle through the authentication process. Encryption Key A is used once and discarded. The next time through the authentication method the system will use Key B to encrypt and decrypt the random string, and used Key C to transmit the new Key D. The next time the system will use Key C and Key D. It is important to note that each encryption key is used only once. The number of keys held by the requester and authenticator can be predetermined. For example, if the predetermined number of keys is 5 and Keys A, B, C, D, E are the first set of authentication keys, then Keys B, C, D, E, F will be the second
set of authentication keys. Keys C, D, E, F, G will be the third set of authentication keys, etc..
In the two-way universal authentication method the universal authentication system can use either one or two encryption keys per authentication. When two encryption keys are used, one key is designated for incoming requests and another is designated for outgoing responses. If one time keys are to be used, both keys would be replaced after each authentication. Users of the universal authentication method can also request rotating encryption key(s); either a single encryption key or one encryption key for incoming requests and one encryption key for outgoing responses. For website authentication, the IP address of the requester and authenticator can be added as part of the encryption key(s) to prevent "man in the middle" scams.
In view of the above, it will be seen that various aspects and features of the invention are achieved and other results and advantages can be attained. While preferred embodiments of the invention have been shown and described, it will be obvious to those skilled in the art that changes and modification may be made therein without departing from the invention in its broader aspects.
Claims
1. A method for one way authentication using a challenge and response system where a first apparatus (requester) initiates a request for authentication to a second apparatus (authenticator), the method comprising the steps of:
a. the authenticator passing its unique identifier and a randomly generated character string to the requester;
b. the requester uses the identifier to retrieve an encryption key for the authenticator and encrypts the passed in randomly generated character string; c. the encrypted character string and the requester's unique identifier is passed back to the authenticator;
d. the authenticator retrieves the encryption key that corresponds to the received identifier and decrypts the encrypted character string;
e. if the decrypted character string matches the random character string sent in the initial request, the requester is authenticated.
2. The encryption key of claim 1 is determined from a plurality of rotating encryption keys.
3. The rotation of encryption keys of claim 2 is determined by a predefined pattern in the randomly generated character string of claim 1.
4. A means to determine the rotation of encryption keys of claim 2.
5. The authentication method of claim 1 is configured to authenticate a website by using the website name as an identifier.
6. The authentication method of claim 1 uses the IP address of the website as part of the encryption key.
7. A method for two way authentication using a challenge and response system where a first apparatus (requester) initiates a request for authentication to a second apparatus (authenticator), the method comprising the steps of :
a. the authenticator passing its unique identifier and a randomly generated character string to the requester;
b. the requester uses the identifier to retrieve an encryption key for the authenticator and encrypts the passed in randomly generated character string; c. the encrypted character string, the requester's unique identifier, and a new randomly generated character string is passed back to the authenticator ;
d. the authenticator retrieves the encryption key corresponding to the received identifier and decrypts the passed back encrypted character string;
e. if the decrypted character string does not match the random character string sent in the initial request, authentication fails and communication is terminated; f. if the decrypted character string matches the random character string sent in the initial request, the random character string from the requester is encrypted;
g. the encrypted character string is passed back to the requester with the authenticator' s unique identifier;
h. the requester uses the identifier to retrieve the encryption key for the authenticator and decrypts the encrypted character string;
i. if the decrypted character string matches the random character string sent in the initial request, both parties are authenticated.
8. The method of claim 7 uses one encryption key.
9. The method of claim 7 uses one encryption key for incoming requests and one encryption key for outgoing requests.
10. The encryption key of claim 7 is determined from a plurality of rotating encryption keys.
11. The rotation of the encryption keys of claim 10 is determined by a predefined pattern in the randomly generated character string of claim 7.
12. A means to determine the rotation of encryption keys of claim 10.
13. The authentication method of claim 7 is configured to authenticate a website by using the website name as an identifier;
14. The authentication method of claim 7 uses the IP address of the website as part of the encryption key.
15. The method of claim 7 further comprises:
a. the requester or authenticator generating a new random encryption key;
b. the new encryption key is encrypted with the next encryption key in the rotation from claim 10.
c. the encrypted key is communicated between the requester and authenticator. d. both parties replaces the encryption key used in the current authentication.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/US2010/049018 WO2012036683A2 (en) | 2010-09-16 | 2010-09-16 | Universal authentication method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/US2010/049018 WO2012036683A2 (en) | 2010-09-16 | 2010-09-16 | Universal authentication method |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2012036683A2 true WO2012036683A2 (en) | 2012-03-22 |
WO2012036683A3 WO2012036683A3 (en) | 2014-03-27 |
Family
ID=45832150
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2010/049018 WO2012036683A2 (en) | 2010-09-16 | 2010-09-16 | Universal authentication method |
Country Status (1)
Country | Link |
---|---|
WO (1) | WO2012036683A2 (en) |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20100005303A1 (en) * | 2007-12-14 | 2010-01-07 | James Ng | Universal authentication method |
US20100180328A1 (en) * | 2007-06-26 | 2010-07-15 | Marks & Clerk, Llp | Authentication system and method |
-
2010
- 2010-09-16 WO PCT/US2010/049018 patent/WO2012036683A2/en active Application Filing
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20100180328A1 (en) * | 2007-06-26 | 2010-07-15 | Marks & Clerk, Llp | Authentication system and method |
US20100005303A1 (en) * | 2007-12-14 | 2010-01-07 | James Ng | Universal authentication method |
Also Published As
Publication number | Publication date |
---|---|
WO2012036683A3 (en) | 2014-03-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10027631B2 (en) | Securing passwords against dictionary attacks | |
EP2519906B1 (en) | Method and system for user authentication | |
CN110324143A (en) | Data transmission method, electronic equipment and storage medium | |
EP3038316B1 (en) | Identity authentication system, apparatus, and method, and identity authentication request apparatus | |
US20070240226A1 (en) | Method and apparatus for user centric private data management | |
US20160205098A1 (en) | Identity verifying method, apparatus and system, and related devices | |
US20080148057A1 (en) | Security token | |
CN103685282A (en) | Identity authentication method based on single sign on | |
CN111159684B (en) | Safety protection system and method based on browser | |
CN108809633B (en) | Identity authentication method, device and system | |
WO2005088892A1 (en) | A method of virtual challenge response authentication | |
US20110162053A1 (en) | Service assisted secret provisioning | |
US9954853B2 (en) | Network security | |
US20150328119A1 (en) | Method of treating hair | |
US10686787B2 (en) | Use of personal device for convenient and secure authentication | |
CN105281902A (en) | Web system safety login method based on mobile terminal | |
US8307209B2 (en) | Universal authentication method | |
US20090319778A1 (en) | User authentication system and method without password | |
CN109412799B (en) | System and method for generating local key | |
RU2698424C1 (en) | Authorization control method | |
KR101271464B1 (en) | Method for coding private key in dual certificate system | |
US20090158038A1 (en) | Universal authentication method | |
WO2012036683A2 (en) | Universal authentication method | |
JP6165044B2 (en) | User authentication apparatus, system, method and program | |
Xu et al. | Qrtoken: Unifying authentication framework to protect user online identity |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 10857381 Country of ref document: EP Kind code of ref document: A2 |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 10857381 Country of ref document: EP Kind code of ref document: A2 |