Keyed Pseudo-Random Number Generator

• US 20090271462A1
• Filed: 04/29/2008
• Published: 10/29/2009
• Est. Priority Date: 04/29/2008
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Schneider, James Paul
• Granted Patent: US 8,660,268 B2
• Time in Patent Office: Days
• US Class Current: 708/250
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards

Abstract

A method and apparatus for client authentication using a pseudo-random number generation system. The pseudo-random number generation utilizes a secret key as well as state information as input into the hash function to generate a pseudo-random number. The state information that is part of the input can be any number of prior generated pseudo-random numbers. The authentication allows for synchronization of the client and server by exchanging state information. The authentication is not dependent on any absolute time and consequently the client and servers are not required to maintain a reliable shared time base.

Claims

1. A computer-implemented method comprising:

retrieving state data including at least a first output value and a second output value, the first output value and second output value generated by previous executions of the computer-implemented method;

encrypting a combination of the state data using a secret key to produce a third output value; and

truncating the output value to generate a pseudo-random value.

2. The computer-implemented method of claim 1, further comprising:

replacing the first output value with the third output value; and

calculating a fourth output value based at least on the second output value and third output value.

3. The method of claim 1, further comprising:

receiving a personal identification number as an input from a user.

4. The method of claim 1, further comprising:

comparing the pseudo-random number with another pseudo-random number generated by a device requesting authentication.

5. The computer-implemented method of claim 4, further comprising:

requesting synchronization of state data from the device requesting authentication, in response to a failed comparison of the pseudo-random number.

6. The method of claim 5, further comprising:

validating the state data from the device.

7. The method of claim 5, further comprising:

recalculating the pseudo-random number based on the state date received from the device.

8. The method of claim 4, further comprising:

authenticating a request in response to a successful comparison of the pseudo-random number.

9. The method of claim 1, further comprising:

receiving a request for the state data from an authentication server; and

sending the state data including the including at least the first output value and the second output value to the authentication server.

10. A computer readable storage medium, having instructions stored therein, which when executed, cause a computer to perform a set of operations comprising:

retrieving state data including at least a first output value and a second output value, the first output value and second output value generated by previous executions of the instructions;

encrypting a combination of the state data using a secret key to produce a third output value; and

truncating the output value to generate a pseudo-random value.

11. The computer readable storage medium of claim 10, having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:

replacing the first output value with the third output value; and

calculating a fourth output value based at least on the second output value and third output value.

12. The computer readable storage medium of claim 10, having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:

receiving a personal identification number as an input from a user.

13. The computer readable storage medium of claim 10, having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:

comparing the pseudo-random number with another pseudo-random number generated by a device requesting authentication.

14. The computer readable storage medium of claim 10, having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:

requesting synchronization of state data from the device requesting authentication, in response to a failed comparison of the pseudo-random number.

15. The computer readable storage medium of claim 14, having further instructions therein, which when executed, cause the computer to perform a further set of operations, further comprising:

validating the state data from the device.

16. The computer readable storage medium of claim 10, having further instructions stored therein, which when executed perform a set of operations, further comprising:

recalculating the pseudo-random number based on the state date received from the device.

17. The computer readable storage medium of claim 14, having further instructions stored therein, which when executed perform a set of operations, further comprising:

authenticating a request from a client in response to a successful comparison of the pseudo-random number.

18. A system comprising:

a computer having a display and an input mechanism, the computer including,

an encryption module, and

a pseudo-random number generator coupled to the encryption module, the pseudo-random number generator module to generate a pseudo-random number by calling the encryption module and using at least two prior pseudo-random output values of the pseudo-random number generator.

19. The system of claim 18, further comprising:

a state data tracker module coupled to the pseudo-random number generator, the state data tracker module to maintain a time value and at least two prior pseudo-random output values.

20. The system of claim 18, further comprising:

a synchronization module coupled to the pseudo-random number generator module to synchronize the state data with state data of another computer.