Systems and methods for password-based connection

• US 20040073795A1
• Filed: 10/10/2002
• Published: 04/15/2004
• Est. Priority Date: 10/10/2002
• Status: Abandoned Application

• Current Assignee: Phoenix Technologies Limited (Pharaoh Acquisition LLC)
• Original Assignee: Phoenix Technologies Limited (Pharaoh Acquisition LLC)
• Inventors: Jablon, David P.
• Application Number:
  US10/268,160
• Publication Number:
  US 20040073795A1
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Cryptographic systems and methods that allow secure connection of two devices over an open network, using passwords communicated in an out-of-band process. One-time versus static passwords, active versus passive models of user participation, and different combinations of password-input and password-output mechanisms may be employed. The present invention uses either a password agreement protocol or a zero-knowledge password proof to securely establish a shared password and a shared key between two parties, and incorporates explicit steps to insure that the user(s) of the system authenticates that the same password, and thus the same key, is used at both devices.

Claims

1. A cryptographic system that allows secure connection of two devices over an open network, comprising:

a first device;

a second device; and

a password and a shared key that are established in a cryptographic protocol between the first and second devices, which password is communicated in an out-of-band process by one or more users of the devices to selectively allow secure connection of the two devices.

2. The cryptographic system recited in claim 1 wherein the password is established using a password agreement protocol.

3. The cryptographic system recited in claim 1 wherein knowledge of the password is communicated using a zero-knowledge password proof.

4. The cryptographic system recited in claim 3 wherein the zero-knowledge password proof comprises a password-authenticated key agreement protocol.

5. The cryptographic system recited in claim 1 wherein the password is established using an ephemeral password agreement protocol.

6. The cryptographic system recited in claim 1 wherein an Out-Out password device connection protocol is employed wherein the first and second devices use a password agreement protocol to establish a shared password and a shared key, each device displays the shared password to its respective user, each user is given an opportunity to check to see if the password matches the password displayed on the other device, after which each user accepts or rejects the password to selectively allow secure connection of the two devices.

7. The cryptographic system recited in claim 6 wherein the first and second devices comprises a light-emitting diode (LED) display and a synchronized blinking pattern corresponding to the password is output on each device.

8. The cryptographic system recited in claim 6 wherein the first and second devices comprises a speaker and a synchronized beeping pattern corresponding to the password is output on each device.

9. The cryptographic system recited in claim 1 wherein an Out-In password device connection protocol is employed wherein the first and second devices use a password agreement protocol to establish a shared password and a shared key, the first device displays the shared password to its user who conveys the password to the second device, the password is entered into the second device, and the shared password is verified by the second device to allow secure connection of the two devices.

10. The cryptographic system recited in claim 1 wherein an Out-In password device connection protocol is employed wherein the first and second devices use a password authenticated key agreement protocol to derive a shared key from a password, the first device displays the shared password to its user who conveys the password to the second device, the password is entered into the second device, and the shared password is verified to allow secure connection of the two devices.

11. A cryptographic method that allows secure connection of two devices over an open network, comprising the steps of:

providing a first device;

providing a second device;

establishing a password in an out-of-band process between users of the first and second devices; and

evaluating the password by the respective users to selectively allow secure connection of the two devices.

12. The cryptographic method recited in claim 11 wherein the password is established between the first device and the second device using a password agreement protocol.

13. The cryptographic method recited in claim 11 wherein the password is evaluated and verified using a zero-knowledge password proof.

14. The cryptographic method recited in claim 13 wherein the zero-knowledge password proof comprises a password-authenticated key agreement protocol.

15. The cryptographic method recited in claim 11 wherein the password is established using an ephemeral password agreement protocol.

16. The cryptographic method recited in claim 11 wherein an Out-Out password device connection protocol is employed which comprises the steps of:

using a password agreement protocol with the first and second devices to establish a shared password and a shared key;

displaying the shared password to a respective user of each device;

checking to see if the password displayed on one device matches the password displayed on the other device; and

accepting or rejecting the password to selectively allow secure connection of the two devices.

17. The cryptographic method recited in claim 16 wherein the step of displaying the shared password comprises the step of displaying a synchronized blinking pattern corresponding to the password on the first and second devices using a light-emitting diode (LED) display.

18. The cryptographic method recited in claim 16 wherein the step of displaying the shared password comprises the step of outputting a synchronized sound corresponding to the password.

19. The cryptographic method recited in claim 11 wherein an Out-In password device connection protocol is employed which comprises the steps of:

using a password agreement protocol with the first and second devices to establish a shared password and a shared key;

displaying the shared password to a user of the first device;

conveying the password to the second device;

entering the password into the second device;

verifying that the password displayed on the second device matches the password displayed on the first device; and

accepting or rejecting the password to selectively allow secure connection of the two devices.