Method and appartus for network security using a router based authentication system

• US 20090199286A1
• Filed: 02/20/2009
• Published: 08/06/2009
• Est. Priority Date: 10/01/2003
• Status: Active Grant

• Current Assignee: Tara Chand Singhal
• Original Assignee: Tara Chand Singhal
• Inventors: Singhal, Tara Chand
• Granted Patent: US 8,561,139 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A router based authentication system provides packet level authentication of incoming data packets and eliminates the risk of having data packets come in to the network whose source cannot be authenticated. In Router Based Authentication System (RBAS), a prior art router is adapted with an authentication function that works in conjunction with a security function in the client. Alternatively, a new router can be built that embeds an authentication function. The router based authentication function includes: (i) an ability to receive a telephone call and verify the caller by comparing with pre-stored caller id, (ii) generate a random alphanumeric code, deliver to the caller, and save in the system, (iii) reject all packets from the client that do not have a passkey embedded in the header of the packet. The security function in the client includes (i) display of an authentication screen that may display a telephone number to a border or internal router of a computer network of a business and enables entry of the passkey made up of the telephone number of the user and the alphanumeric code, and (ii) a function that encrypts the passkey and inserts the passkey in the header of each outgoing data packet to the business.

Claims

1. A system of security in a computer network comprising:

the system enables access from a client to classes of networks behind a router, the classes of networks have different access policies, the access based on a packet level authentication in the router, where the router has an authentication subsystem that does not use IP addresses in the packet header to perform an authentication of incoming data packet to the router, and based on the results of the authentication routes the packets to networks with different access policies.

2. The system of security in a computer network as in claim 1, further comprising:

the authentication subsystem creates a random code token and uses a telephone network to deliver the random code token to the client;

the client embeds the token in the packets outgoing from the client to the router, where the router verifies the presence of the token, before routing the packet to the different classes of the network.

3. The system of security in a computer network as in claim 2, further comprising:

the authentication subsystem uses the telephone network to receive a call, verifies the caller by a combination of a caller id and a personal identification number and creates and delivers a random code token to the client, the client uses the token, after encrypting the token in the outgoing packet from the client to the router, and where the router authenticates the token and determine the applicable access policy before routing the packet to the different classes of the network.

4. A system for continuous authenticated communication from an authorized user on a client to a server on a computer network, wherein a router routing data packets between the client and the server comprising:

a. the router adapted with an authentication system;

b. the system having (i) a means to receive a telephone call from the authorized user, (ii) means to verify user by caller id features of a public telephone infrastructure and a personal identification number and (iii) means to voice responds with a randomly generated alphanumeric, (iv) a means that verifies each packet of communication from the client for the presence of a passkey embedded with the alphanumeric in the packet header.

5. The claim as in 4, further comprising:

a function that encrypts the passkey before embedding it in the header of the packet.

6. The claim as in 4, the users being authenticated by pre-storing their cellular telephone numbers and a user selected PIN the authentication subsystem.

7. A method of identifying a caller to a server for the purpose of granting access to the caller into a computer network, comprising the steps of:

a. receiving a telephone call by the server and verifying caller to the server, by caller id and an entry of first personal identification number wherein the server is adapted with a telephone interface equipped with an interactive voice response system and the server having pre-stored data of the caller id and the first number;

b. calling back by the server on a pre-stored caller id number and receiving entry of a second personal identification number; and

c. verifying the second number with a pre-stored data in the server, before granting access to the server.

8. The method as in claim 7, comprising the steps of:

a. entering on a telephone keypad 4-digit numeric PIN1 of.

b. entering on keypad a 4-digit numeric PIN2.

9. The method as in claim 7, comprising the steps of:

a. generating a random number by a function in the server and voice delivering to the caller via the interactive voice response system;

b. using the caller id and the random number to identify and verify to the server for gaining access.