Challenge-response data communication protocol

• US 20030065956A1
• Filed: 09/28/2001
• Published: 04/03/2003
• Est. Priority Date: 09/28/2001
• Status: Abandoned Application

• Current Assignee: Senam Consulting Incorporated
• Original Assignee: Senam Consulting Incorporated
• Inventors: Azeez, Abdul Rafman, Belapurkar, Abhijit, Krishnamurthy, Gayathri
• Application Number:
  US09/967,774
• Publication Number:
  US 20030065956A1
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A data communication technique facilitates the transmission of a data element in a trusted manner such that the receiver component can trust that the data element was not modified during the transmission. In addition, the receiver component is assured that the data element could only have been transmitted by a particular sender component. The data communication technique utilizes a challenge-response routine that ensures data integrity and non-repudiation. The data element is sent from the sender component to the receiver component during the challenge-response routine; in accordance with the example embodiment, the hashed response generated by the sender component is based upon the data element. The data communication technique can be implemented in the context of a single sign-on protocol that allows an authenticated user of a linking site to access protected resources associated with a linked web site without having to separately login to the linked web site.

Claims

1. A data communication method comprising:

sending an ID from a first component to a second component, said ID identifying said first component;

sending a challenge from said second component to said first component, said challenge being based upon said ID;

sending a response to said challenge, and a data element, from said first component to said second component if said first component validates said challenge, said response being based upon said data element; and

accepting said data element at said second component if said second component validates said response.

2. A method according to claim 1, further comprising:

said second component retrieving a shared key corresponding to said ID; and

said second component generating said challenge based upon said shared key.

3. A method according to claim 2, further comprising said second component creating a timestamp, wherein generating said challenge comprises said second component generating said challenge based upon said shared key and said timestamp.

4. A method according to claim 3, wherein generating said challenge comprises:

forming a string based upon said shared key and said timestamp; and

performing a one-way hashing operation on said string.

5. A method according to claim 3, further comprising sending said timestamp from said second component to said first component.

6. A method according to claim 1, further comprising said first component performing a validation routine on said challenge.

7. A method according to claim 1, further comprising:

said first component retrieving a shared key corresponding to said ID; and

said first component generating said response based upon said shared key and said data element.

8. A method according to claim 7, wherein generating said response comprises said first component generating said response based upon said shared key, said data element, and said challenge.

9. A method according to claim 8, wherein generating said response comprises:

forming a string based upon said shared key, said data element, and said challenge; and

performing a one-way hashing operation on said string.

10. A method according to claim 1, further comprising said second component performing a validation routine on said response.

11. A data communication method comprising:

conducting a challenge-response protocol to establish trust between a first component and a second component;

sending a data element from said first component to said second component during said challenge-response protocol; and

verifying integrity of said data element as received by said second component.

12. A data communication method according to claim 11, wherein conducting said challenge-response protocol comprises:

said second component retrieving a secret key shared between said first component and said second component; and

said second component generating a challenge based upon said secret key.

13. A data communication method according to claim 12, wherein conducting said challenge-response protocol comprises:

sending said challenge from said second component to said first component;

said first component retrieving said secret key; and

said first component generating a response to said challenge based upon said secret key and said data element.

14. A method according to claim 13, wherein generating said response comprises said second component generating said response based upon said shared key, said data element, and said challenge.

15. A method according to claim 14, further comprising:

sending said response from said first component to said second component;

said second component performing a validation routine on said response; and

accepting said data element at said second component if said second component validates said response.

16. A data communication method comprising:

sending an ID from a first component to a second component, said ID identifying said first component;

receiving a challenge from said second component, said challenge being based upon said ID;

generating a response to said challenge, said response being based upon a data element; and

sending said response, and said data element, to said second component.

17. A method according to claim 16, further comprising performing a validation routine on said challenge.

18. A method according to claim 16, wherein generating said response comprises said first component generating said response based upon said data element and said challenge.

19. A method according to claim 18, wherein generating said response comprises:

forming a string based upon said data element and said challenge; and

performing a one-way hashing operation on said string.

20. A computer program for establishing trust between a first processing component and a second processing component, said computer program being embodied on a computer-readable medium, said computer program having computer-executable instructions for carrying out a method comprising:

sending an ID from a first component to a second component, said ID identifying said first component;

receiving a challenge from said second component, said challenge being based upon said ID;

generating a response to said challenge, said response being based upon a data element; and

sending said response, and said data element, to said second component.

21. An apparatus for establishing trusted data communication with a processing component, said apparatus comprising:

at least one data communication element configured to establish a communication session with said processing component, send data to said processing component, and receive data from said processing component; and

at least one processor configured to carry out a method comprising;

sending an ID from a first component to a second component, said ID identifying said first component;

receiving a challenge from said second component, said challenge being based upon said ID;

generating a response to said challenge, said response being based upon a data element; and

sending said response, and said data element, to said second component.

22. A data communication method comprising:

retrieving a secret key shared between a first component and a second component;

generating a challenge based upon said secret key;

sending said challenge to said first component;

receiving a data element from said first component;

receiving a response to said challenge from said first component, said response being based upon said data element; and

said second component accepting said data element if said second component validates said response.

23. A method according to claim 22, further comprising performing a validation routine on said response.

24. A method according to claim 23, wherein said validation routine comprises:

generating a response confirmation based upon said data element received by said second component; and

comparing said response confirmation to said response received by said second component.

25. A method according to claim 22, further comprising receiving an ID that identifies said first component, said secret key corresponding to said ID.

26. A method according to claim 22, wherein generating said challenge comprises:

forming a string based upon said secret key; and

performing a one-way hashing operation on said string.

27. A computer program for establishing trust between a first processing component and a second processing component, said computer program being embodied on a computer-readable medium, said computer program having computer-executable instructions for carrying out a method comprising:

retrieving a secret key shared between a first component and a second component;

generating a challenge based upon said secret key;

sending said challenge to said first component;

receiving a data element from said first component;

receiving a response to said challenge from said first component, said response being based upon said data element; and

said second component accepting said data element if said second component validates said response.

28. An apparatus for establishing trusted data communication with a processing component, said apparatus comprising:

at least one data communication element configured to establish a communication session with said processing component, send data to said processing component, and receive data from said processing component; and

at least one processor configured to carry out a method comprising;

retrieving a secret key shared between a first component and a second component;

generating a challenge based upon said secret key;

sending said challenge to said first component;

receiving a data element from said first component;

receiving a response to said challenge from said first component, said response being based upon said data element; and

said second component accepting said data element if said second component validates said response.