System and method for secure comparison of a common secret of communicating devices

• US 20020018570A1
• Filed: 07/06/2001
• Published: 02/14/2002
• Est. Priority Date: 07/07/2000
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Merk, Lothar, Nicklous, Martin Scott, Stober, Thomas, Hansmann, Uwe
• Application Number:
  US09/900,637
• Publication Number:
  US 20020018570A1
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A simplified authentication system for communicating devices having fewer security requirements than conventional cryptographic systems. The device to be authenticated includes a secret, a function component for generating a random number, a function component for exchanging messages with other devices and finally an algorithm for calculating a hash using random number and secret. The device requesting authentication includes a secret and an algorithm for calculating a hash using a random number received from the device to be authenticated. A function component for comparing both hashes may be implemented in both devices. If the hashes calculated by both devices match it can be assumed that the authentication was successful. Preferably, this system and method may be used within a communication structure using portable communication devices like smartcards, personal digital assistants or mobile phones. Neither an exchange of the plain secret itself nor the storage of digital keys is required. A misuse of the secret may be excluded by sending a hash using the random number and the secret. The infrastructure required by the present invention is very simple and does not consume storage capacity like conventional encryption methods, since digital keys and conventional symmetric or asymmetric algorithms are not required. Instead of using the digital keys and conventional symmetric or asymmetric algorithms, the present invention contemplates using a relatively simple random number and a simple hash algorithm, which sufficiently fulfills the security requirements of many communication architectures.

Claims

1. A method for authentication of communicating devices having a common secret, said method comprising the steps of:

receiving a hash by a receiving device from a sending device; and

comparing said hash received from said sending device with a hash of said receiving device, wherein both hashes are calculated by hash algorithms using identification data and said common secret.

2. The method of claim 1 wherein said identification data is generated by said sending device.

3. The method of claim 2 wherein said identification data is sent from said sending device to said receiving device.

4. The method of claim 1 wherein said hash algorithms are identical.

5. The method of claim 1 wherein said common secret comprises a PIN.

6. The method of claim 1 wherein said common secret comprises a password.

7. The method of claim 1 wherein said identification data is a random number.

8. The method of claim 7 wherein said random number is generated by an operating system of said sending device.

9. The method of claim 7 wherein said random number is generated by a separate software component which is part of said sending device.

10. The method of claim 1 wherein said comparing step is accomplished by said sending device.

11. The method of claim 1 wherein said comparing step is accomplished by said receiving device.

12. The method of claim 1 wherein said common secret, said hash algorithm and said comparing component of said sending device are stored in a smartcard and communication between smartcard and receiving device is established via a card reader.

13. The method of claim 12 wherein said smartcard and said card reader are part of a portable sending device.

14. The method of claim 1 wherein the data connection between the sending device and the receiving device is an insecure data connection.

15. The method of claim 1 wherein said sending device and said receiving device form a client-server architecture.

16. The method of claim 1 wherein said client is a portable device.

17. A client in a client-server architecture having an authentication system for executing the method of claim 1.

18. A server in a client-server architecture having an authentication system for executing the method of claim 1.

19. A sender device communicating with a receiver device, wherein one or both of said sender device and said receiver device comprise an authentication system for executing the method of claim 1.

20. A computer program product stored on a computer-readable medium containing software code for performing the method of claim 1 if the program product is executed on the computer.