NETWORK AUTHENTICATION METHOD AND DEVICE FOR IMPLEMENTING THE SAME

• US 20110185181A1
• Filed: 01/24/2011
• Published: 07/28/2011
• Est. Priority Date: 01/27/2010
• Status: Abandoned Application

• Current Assignee: Keypasco AB
• Original Assignee: Keypasco AB
• Inventors: Lin, Maw-Tsong
• Application Number:
  US13/012,350
• Publication Number:
  US 20110185181A1
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A network authentication method is to be implemented using a network authentication device and a user end for authenticating the user end. The network authentication method includes the steps of: configuring the network authentication device to store hardware information associated with unique identification codes of hardware components of the user end; when it is intended to verify identity of the user end, configuring the user end to execute a terminal program stored therein for scanning the hardware components thereof to obtain the identification codes of the hardware components, for establishing a hardware list according to the identification codes thus obtained, and for sending to the network authentication device verification data that is associated with the hardware list; and configuring the network authentication device to verify identity of the user end based on relationship between the verification data received from the user end and the hardware information stored therein.

Claims

1. A network authentication method to be implemented using a network authentication device and a user end for authenticating the user end, the user end storing a terminal program and including a plurality of hardware components each of which has a unique identification code, said network authentication method comprising the steps of:

a) configuring the network authentication device to store hardware information associated with the identification codes of the hardware components of the user end;

b) when it is intended to verify identity of the user end, configuring the user end to execute the terminal program for scanning the hardware components thereof to obtain the identification codes of the hardware components of the user end, for establishing a hardware list according to the identification codes of the hardware components thus obtained, and for sending to the network authentication device verification data that is associated with the hardware list; and

c) configuring the network authentication device to verify identity of the user end based on relationship between the verification data received from the user end in step b) and the hardware information stored in step a).

2. The network authentication method as claimed in claim 1, further comprising, prior to step a), the steps of:

i) configuring the user end to download the terminal program from a specified website; and

ii) configuring the user end to execute the terminal program for scanning the hardware components thereof to obtain the identification codes of the hardware components, for establishing a reference hardware list serving as the hardware information according to the identification codes thus obtained, and for sending the hardware information to the network authentication device for storage in step a).

3. The network authentication method as claimed in claim 2, wherein:

in step i), the user end is configured to download the terminal program from the specified website during registration of the user end at a network server;

said network authentication method further comprising, between steps a) and b), the step of configuring the network authentication device to notify the network server that the hardware information of the user end has been stored in the network authentication device.

4. The network authentication method as claimed in claim 1, to be implemented further using a network server, wherein step b) includes the sub-steps of:

b1) in response to a login request from the user end for accessing the network server through a first communication channel, configuring the network server to redirect the user end for connecting with the network authentication device through a second communication channel; and

b2) configuring the network authentication device to enable the user end to execute the terminal program.

5. The network authentication method as claimed in claim 4, wherein:

in step b1), the network server is further configured to notify the network authentication device that identity of the user end is to be verified; and

in step c), the network authentication device is configured to notify the network server of result of verification made thereby.

6. The network authentication method as claimed in claim 1, wherein:

in step b), the verification data sent to the network authentication device is obtained by encrypting the hardware list with a session key; and

in step c), the network authentication device is configured to decrypt the verification data to obtain the hardware list, and to compare the hardware list with the hardware information stored therein for verifying the identity of the user end.

7. The network authentication method as claimed in claim 1, to be implemented further using a network server, said network authentication method further comprising the steps of:

d) configuring the network authentication device to generate a key according to the hardware information stored therein, and to send the key to the user end and the network server;

e) when the user end intends to conduct an electronic transaction with the network server, configuring the user end to generate a first digital signature corresponding to transaction data of the electronic transaction using the key sent by the network authentication device and to send the transaction data and the first digital signature to the network server, and configuring the network server to generate a second digital signature corresponding to the transaction data received from the user end using the key sent by the network authentication device; and

f) configuring the network server to compare the first digital signature from the user end with the second digital signature generated thereby, and to determine that the transaction data was not tampered during transmission from the user end to the network server when the first digital signature conforms with the second digital signature.

8. The network authentication method as claimed in claim 1, wherein step a) includes the sub-steps of:

a1) configuring the user end to execute the terminal program for scanning the hardware components thereof to obtain the identification codes of the hardware components, and for generating and storing a reference key using the identification codes thus obtained;

a2) configuring the user end to encrypt the reference key so as to obtain an encrypted key and to send the encrypted key to the network authentication device; and

a3) configuring the network authentication device to decrypt the encrypted key received from the user end so as to obtain the hardware information to be stored in the network authentication device.

9. The network authentication method as claimed in claim 8, wherein:

in step b), the verification data sent to the network authentication device is a one-time password obtained using the reference key generated in sub-step a1); and

in step c), the network authentication device is configured to generate a reference one-time password using the hardware information stored therein, and to compare the verification data with the reference one-time password for verifying the identity of the user end.

10. The network authentication method as claimed in claim 8, further comprising the steps of:

d′

) when the user end intends to conduct an electronic transaction with the network authentication device, configuring the user end to generate a first digital signature corresponding to transaction data of the electronic transaction using the reference key and to send the transaction data and the first digital signature to the network authentication device, and configuring the network authentication device to generate a second digital signature corresponding to the transaction data received from the user end us ing the hardware information stored therein; and

e′

) configuring the network authentication device to compare the first digital signature from the user end with the second digital signature generated thereby, and to determine that the transaction data was not tampered during transmission from the user end to the network authentication device when the first digital signature conforms with the second digital signature.

11. The network authentication method as claimed in claim 9, wherein, in step b), the user end is configured to execute the terminal program for generating a new key using the identification codes of the hardware components, for comparing the new key with the reference key generated in sub-step a1), and for generating the verification data when the new key conforms with the reference key.

12. The network authentication method as claimed in claim 1, wherein the hardware information stored in the network authentication device in step a) and the verification data sent to the network authentication device in step b) are associated with the identification codes of at least one of the following hardware components of the user end:

a central processing unit;

a basic input/output system (BIOS) unit;

a storage device;

a network interface;

a motherboard; and

an external peripheral device.

13. A network authentication device for authenticating a user end, the user end including a plurality of hardware components each of which has a unique identification code, the user end being configured to scan the hardware components thereof to obtain the identification codes of the hardware components, and to establish verification data associated with the identification codes of the hardware components thus obtained, said network authentication device comprising:

a database module for storing hardware information associated with the identification codes of the hardware components of the user end; and

a verification module for verifying identity of the user end based on relationship between the verification data received from the user end and the hardware information stored in said database module.

14. The network authentication device as claimed in claim 13, further comprising:

a control module for generating a device-assigned identification code; and

a transmission module for transmitting the device-assigned identification code to the user end for storage in an external peripheral device connected to the user end so as to serve as the identification code of the external peripheral device.