Network security system and method

• US 20050144459A1
• Filed: 12/15/2004
• Published: 06/30/2005
• Est. Priority Date: 12/15/2003
• Status: Abandoned Application

• Current Assignee: Zeewaves Systems, Inc.
• Original Assignee: Zeewaves Systems, Inc.
• Inventors: Qureshi, Khurshid, Nizmuddin, Nadir
• Application Number:
  US11/012,776
• Publication Number:
  US 20050144459A1
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A network security system has a terminal access authentication system with a physical key for mutual authenticating a terminal. A frame authentication system is coupled to the terminal and authenticates each frame sent from the terminal.

Claims

1. A network security system, comprising:

a terminal access authentication system having a physical key for mutually authenticating a terminal; and

a frame authentication system coupled to the terminal and authenticating each frame sent from the terminal.

2. The system of claim 1 wherein the terminal access authentication system has an authentication server.

3. The system of claim 2, wherein the authentication server has an authorization database containing a copy of the physical key.

4. The system of claim 3, wherein the terminal has a dynamic key.

5. The system of claim 2, wherein the terminal and the authentication server perform a mutual authentication.

6. The system of claim 1, wherein the frame authentication system includes an authenticator that is separate from the terminal or a receiver.

7. The system of claim 6, wherein the authenticator converts a signed frame into an unsigned standard frame.

8. The system of claim 7, wherein the authenticator forwards the unsigned standard frame to a destination.

9. The system of claim 1, wherein the frame authentication system includes a signature algorithm operating on the terminal.

10. The system of claim 1, wherein the signature algorithm calculates a partial cyclical redundancy code of a frame.

21. An authentication system according to claim 1 where physical key can reside on any of the media such as USB memory stick, floppy disc, PCMCIA card or embedded in the device.

11. A network security method, comprising the steps of:

a) encrypting a physical key at a station with a dynamic encryption key to form an encrypted physical key;

b) transmitting the encrypted physical key to an access authentication server; and

c) decrypting the encrypted physical key to form a decrypted key.

12. The method of claim 11, further including the steps of:

d) when the decrypted key matches a stored key, transmitting a new dynamic key to the station.

13. The method of claim 11, further including the steps of:

d) when the decrypted key matches a stored key at the access authentication server, encrypting a server physical key using a server dynamic key to form an encrypted server physical key;

e) transmitting the encrypted server physical key to the station;

f) decrypting the encrypted server physical key to form a decrypted server physical key;

g) comparing the decrypted server physical key to a stored server key.

14. The method of claim 13, further including the steps of:

h) when the decrypted server physical key matches the stored server key, using a signature algorithm to form a signed frame;

g) encrypting the signed frame to form an encrypted signed frame.

15. The method of claim 14, further including the steps of:

h) transmitting the encrypted signed frame to a frame authenticator;

i) decrypting the encrypted signed frame to recover a decrypted signature;

j) comparing the decrypted signature to a stored signature;

k) when the decrypted signature is the same as the stored signature, transmitting an unsigned standard frame to a destination.

16. A network security method, comprising the steps of:

a) creating a signed frame at a transmitting station;

b) receiving the signed frame at a frame authenticator;

c) when a signature of the signed frame is authentic, transmitting an unsigned standard frame to a receiving station.

17. The method of claim 16, wherein step (a) further includes the steps of:

a1) calculating a partial cyclical redundancy code for a frame to form a signature;

a2) encrypting the frame and the signature to form the signed frame.

18. The method of claim 16, further including the step of:

d) when the signature of the signed frame is not authentic, discarding the signed frame.

19. The method of claim 16, wherein step (a) further including the step of:

a1) authenticating an access to a network of the transmitting station.

20. The method of claim 19, wherein step (a1) includes the steps of:

i) encrypting a physical key at the transmitting station with a dynamic encryption key to form an encrypted physical key;

ii) transmitting the encrypted physical key to an access authentication server; and

iii) decrypting the encrypted physical key to form a decrypted key.

22. An authentication system where the key dynamic key exchange program resides on the physical key and on the authentication server.

23. An authentication system where key exchange protocol can be downloaded from a secured website.