CHALLENGE RESPONSE-BASED DEVICE AUTHENTICATION SYSTEM AND METHOD

• US 20090240943A1
• Filed: 04/22/2009
• Published: 09/24/2009
• Est. Priority Date: 05/04/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: BROWN, Michael K., LITTLE, Herbert A., KIRKUP, Michael G., BROWN, Michael S.
• Granted Patent: US 8,074,072 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A challenge response scheme authenticates a requesting device by an authenticating device. The authenticating device generates and issues a challenge to the requesting device. The requesting device combines the challenge with a hash of a password provided by a user, and the combination is further hashed in order to generate a requesting encryption key used to encrypt the user supplied password. The encrypted user supplied password is sent to the authenticating device as a response to the issued challenge. The authenticating device generates an authenticating encryption key by generating the hash of a combination of the challenge and a stored hash of an authenticating device password. The authenticating encryption key is used to decrypt the response in order to retrieve the user-supplied password. If the user-supplied password hash matches the stored authenticating device password hash, the requesting device is authenticated and the authenticating device is in possession of the password.

Claims

1. A method, implemented at a transmitting device, for transmitting a secret value to a receiving device, the receiving device being provided with a hash of a previously stored value and with a challenge value, the method comprising:

receiving the challenge value from the receiving device;

generating a hash of the secret value;

combining the challenge value with the hash of the secret value;

defining a key comprising a hash of a combination of the challenge value and the hash of the secret value;

generating a response comprising the key and the secret value;

transmitting the response to the receiving device, such that the receiving device can determine the secret value from the response using a receiving key, the receiving key comprising a hash of a combination of the challenge value and the hash of the previously stored value.

2. The method of claim 1, wherein the secret value is a password.

3. The method of claim 1, wherein the challenge value comprises a value generated by a hardware-based random number generator or a software-based random number generator.

4. The method of claim 1, wherein combining the challenge value with the hash of the secret value comprises concatenating the challenge value and the hash of the secret value, and the combination of the challenge value and the hash of the previously stored value comprises a concatenation of the challenge value and the hash of the previously stored value.

5. The method of claim 1, wherein generating the response comprises encrypting the secret value with the key, such that the receiving device can determine the secret value by decrypting the response using the receiving key.

6. The method of claim 1, wherein generating the response comprises applying an exclusive-or function to the key and the secret value, such that the receiving device can determine the secret value by applying the exclusive-or function to the response and the receiving key.

7. The method of claim 1, wherein the receiving device is further provided with a salt value, and the hash of the previously stored value comprises a hash of a combination of the salt and the previously stored value, the method further comprising receiving the salt from the receiving device, and wherein generating the hash of the secret value comprises generating a hash of a combination of the salt and the secret value.

8. The method of claim 1, further comprising receiving the secret value via a user interface.

9. The method of claim 1, wherein the secret value determined from the response is used by the receiving device to authenticate the transmitting device if a hash of the secret value determined from the response matches the hash of the previously stored value.

10. A computing device program product comprising a computer-readable medium embodying code operative, when implemented on a computing device, to:

receive a challenge value from a receiving device, the receiving device being provided with the challenge value and a hash of a previously stored value;

generate a hash of the secret value;

combine the challenge value with the hash of the secret value;

define a key comprising a hash of a combination of the challenge value and the hash of the secret value;

generate a response comprising the key and the secret value;

transmit the response to the receiving device, such that the receiving device can determine the secret value using a receiving key, the receiving key comprising a hash of a combination of the challenge value and the hash of the previously stored value.

11. The computing device program product of claim 10, wherein the code is further operative to generate the response by encrypting the secret value with the key, such that the receiving device can determine the secret value by decrypting the response using the receiving key.

12. A system for transmitting a secret value to a receiving device, the system comprising:

a user interface for receiving the secret value;

a communication module for receiving a challenge value from the receiving device and for transmitting a response to the receiving device;

a hash generator for generating a hash of the secret value;

a key generator for generating a key comprising a hash of a combination of the challenge value and the hash of the secret value;

a response generator for generating the response, the response comprising the key and the secret value,

such that the receiving device, upon receipt of the response from the communication module, can determine the secret value using a receiving key comprising a hash of a combination of the challenge value and the hash of a previously stored value.

13. The system of claim 12, wherein the secret value is a password.

14. The system of claim 12, wherein the key generator generates the key by hashing a concatenation of the challenge value and the hash of the secret value, and the receiving key comprises a hash of a concatenation of the challenge value and the hash of the previously stored value.

15. The system of claim 12, wherein the response comprises the secret value encrypted using the key.

16. A system for transmitting a secret value to a receiving device, comprising:

a transmitting device comprising;

a communication module for receiving a challenge value from the receiving device and for transmitting a response to the receiving device;

a hash generator for generating a hash of the secret value;

a key generator for generating a key comprising a hash of a combination of the challenge value and the hash of the secret value; and

a response generator for generating the response, the response comprising the key and the secret value, and

a receiving device comprising;

a memory for storing a previously stored value;

a challenge generator for generating the challenge value,

a communication module for transmitting the challenge value to the transmitting device and receiving the response from the transmitting device;

a hash generator for generating a receiving key by hashing a combination of the challenge value and a hash of the previously stored value; and

a decryptor for determining, using the receiving key, the secret value from the response received from the transmitting device.

17. The system of claim 16, wherein the receiving device further comprises a comparator for comparing a hash of the secret value determined from the response with the hash of the previously stored value, whereby if said hash of the secret value matches the hash of the previously stored value, the transmitting device is authenticated by the receiving device.

18. The system of claim 16, wherein the secret value is a password.

19. The system of claim 16, wherein the challenge generator is a hardware-based or a software-based random number generator.

21. The method of claim 18, wherein the connection request comprises a software request sent by the requesting device.

22. The method of claim 18, wherein the connection request comprises a change in a hardware state of a communication link between the requesting device and the authenticating device.

23. The method of claim 18, wherein the secret value is a password.

20. A method for authentication of a requesting device by an authenticating device, the method comprising the authenticating device:

detecting a connection request by the requesting device,

transmitting a challenge to the requesting device;

receiving a response from the requesting device, the response comprising a requesting key determined by carrying out a hash operation on a combination of the challenge and a hash of a secret value;

defining an authenticating key by carrying out the hash operation on a combination of the challenge and a hash of a previously stored value;

using the authenticating key to obtain a further value from the response and carrying out the hash operation on the further value;

comparing the hash of the further value with the hash of the previously stored value to authenticate the requesting device when the comparison indicates a match.