Computer accessing system

• US 4,310,720 A
• Filed: 03/31/1978
• Issued: 01/12/1982
• Est. Priority Date: 03/31/1978
• Status: Expired due to Term

• Current Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Original Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Inventors: Check, Frank T. Jr.
• Primary Examiner(s): Thomas, James D.
• Application Number:
  US06/892,252
• Time in Patent Office: 1,383 Days
• Field of Search: 364/200 MS File, 364/900 MS File, 178/22, 340/149 R, 340/149 A, 340/152 R, 235/382
• US Class Current: 713/155
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: Y10S 379/903 Password

Abstract

A communications link between a computer and a remote user is effected by a portable access unit which generates a nonrecurring access code which is a function of a password and a pseudorandomly generated number. The access code is transmitted and compared with an access code generated by a computer access controller. In addition to the access code, the pseudorandomly generated number provides an encryption key which is not transmitted but corresponds to a mating encryption key generated at the controller. The mating encryption keys are utilized to set up data transmission enciphering/deciphering networks successive links are established by incremented pseudorandomly generated access codes.

Claims

1. A system for accessing a computer by a user having an assigned password to establish a communications link for data transmission between a computer terminal and a computer, the system comprising access means at the terminal for sequentially generating a pseudorandom number of a first sequence of pseudorandom numbers, means receiving said pseudorandom number and said user assigned password and in response thereto modifying the pseudorandom number as a predetermined function of the password to provide an access code signal unique to itself, means transmitting the access code signal and identification signal from the terminal, controller means at said computer, the controller means receiving the transmitted access code signal and identification signal, the controller means including means responsive to the identification signal for sequentially generating a pseudorandom number of a second sequence of pseudorandom numbers congruent with the numbers of the first sequence and generating a signal corresponding to said user assigned password, and means for modifying said pseudorandom number of the second sequence with said last mentioned signal to provide a congruent access code signal and in response to the equality of the congruent access code signal and transmitted access code signal providing an access signal, and means receiving the access signal and in response thereto establishing a data transmission path between the terminal and the computer, said first and second sequences being the same, whereby computer access is secured through a sequential change of access codes in a pseudorandom fashion without direct transmission of said user'"'"'s password.

2. A system for accessing a computer to establish a communications link for data transmission constructed in accordance with claim 1 wherein the computer terminal is positioned remote from the computer.

3. A system for accessing a computer to establish a communications link for data transmission from a remote terminal as constructed in accordance with claim 2 wherein the means transmitting the access code comprises a telephone communications link.

4. A system for accessing a computer to establish a communications link for data transmission constructed in accordance with claim 1 wherein the means generating the pseudorandom number comprises a portable unit.

5. A system for accessing a computer to establish a communications link for data transmission constructed in accordance with claim 1 wherein a plurality of said access means are provided for use with at least one said terminal, said plurality of access means having different pseudorandom number sequences and different identification signals, the controller means further including a plurality of means generating pseudorandom number sequences according to said plurality of access means, in a reproducible fashion.

6. A system for accessing a computer to establish communication links for data transmission constructed in accordance with claim 1 wherein the means generating the first pseudorandom number sequence comprises an access unit, the access unit further including first encryption means adapted to establish an enciphering/deciphering network in response to an encryption key signal produced therein, the controller means including second encryption means adapted to encipher and decipher signals in accordance with said key as produced in said controller, the pair of encryption means being adapted to encrypt data transmission between the terminal and the computer.

7. A system for securing a communications link for data transmission constructed in accordance with claim 6 wherein the access unit includes means adapted to separate the pseudorandom number of the first sequence into segments, one of the segments comprising an encryption key signal, the controller means including means to separate the pseudorandom number of the second sequence into segments, a congruent segment comprising the encryption key for the second encryption means, whereby data transmission is secured through a sequential change of encryption keys in a pseudorandom fashion without direct transmission of the encryption keys.

8. A system for securing a communications link for data transmission constructed in accordance with claim 6 wherein the means adapted to generate the pseudorandom number of the first sequence is adapted to generate a pair of psuedorandom numbers, one of which is modified by the password and the other of which comprises the encryption key signal, the means for sequentially generating pseudorandom numbers of the second sequence being adapted to generate a pair of second pseudorandom numbers one of which is modified by the signal corresponding to the user assigned password to provide the congruent access code signal and the other of which comprises the encryption key signal for the controller, whereby data transmission is secured through a sequential change of encryption keys in a pseudorandom fashion without direct transmission of the encryption keys.

10. A method of accessing a computer as set forth in claim 8 wherein the next sequential congruent access code is generated prior to receipt of the next transmitted access code;

the method further including the steps of storing the next congruent access code and recalling said next congruent access code upon receipt of the next transmitted access code.

9. A method of accessing a computer at one location by a user positioned at a second location and having an assigned password, the method comprising the steps of

(a) sequentially generating a nonrecurring pseudorandom number of a first sequence at the second location,

(b) modifying the pseudorandom number as a function of the user assigned password to provide an access code,

(c) transmitting the access code and an identifying signal unique to the second location from the second location to the first location,

(d) receiving the transmitted access code and identifying signal at the first location,

(e) in response to the identifying signal, sequentially generating a pseudorandom number of a second sequence congruent with said first sequence, at the first location, and also generating, in response to the identifying signal, a signal corresponding to the user assigned password,

(f) modifying the pseudornandom number of the second sequence with said last mentioned signal corresponding to the user assigned password to provide a congruent access code,

(g) comparing the received access code with the congruent access code, and

(h) granting access to the computer upon recognition of an equality between the received access code and the congruent access code,

whereby computer access is secured through a change of access codes in a pseudorandom fashion without direct transmission of the user'"'"'s password.

11. A method of accessing a computer as set forth in claim 9 wherein the pseudorandom number of the first sequence generated at the second location comprises two segments, one of which is used to generate the access code, the method further including the step of keying an encryptor at the second location with a further segment of the pseudorandom number, the pseudorandom number of the second sequence comprising two segments, one of which is used to generate the congruent access code, the method further including the step of keying a congruent encryptor at the first location with a further segment of the congruent pseudorandom number, whereby data transmission is secured through sequential change of encryption keys in a pseudorandom fashion without transmission of the encryption key from one location to the other.

12. The method of claim 9 in which the second location comprises a terminal and a portable access unit, said terminal being coupled to said computer at said first location, said method further comprising inserting said access unit in the coupling between said terminal and computer at said second location, before said step of sequentially generating a nonrecurring pseudorandom number at said second location, whereby data passing through said coupling must pass through said access unit, said steps of sequentially generating a nonrecurring pseudorandom number at said second location, modifying said pseudorandom number as a function of the user assigned password in said second location, and transmitting said access code and identifying signal from said second location are effected in said access unit.

13. The method of claim 12 wherein said access unit further comprises encryption means, said method further comprising the step of encrypting all messages from said terminal in said encrypting means.

14. A system for accessing a computer by a user having an assigned password to establish a communication link for data transmission between a computer terminal and a computer via a data transmission path, said system comprising a portable access unit connected as a peripheral to said terminal and comprising:

(a) means sequentially generating nonrecurring pseudorandom numbers in a reproducible fashion, and

(b) means modifying said pseudorandom numbers as a predetermined function of said password to provide a first access code, and means applying said access code and a unique identifying signal to said data transmission path prior to data from said computer terminal;

said system further comprising, at said computer;

(c) means for sequentially generating pseudorandom numbers congruent with those generated by said access unit in response to the reception of said identifying signal,

(d) means responsive to said identifying signal for generating a signal corresponding to said user assigned password and for modifying said congruent pseudorandom numbers with said last mentioned signal to provide a second access code,

(e) means for receiving said first access code and comparing it with said second access code and in response to the equality thereof providing an access signal,

(f) means receiving the access signal and in response thereto establishing a data transmission path between the terminal and the computer, whereby computer access is secured through a sequential change of access codes in a pseudorandom fashion without direct transmission of the user'"'"'s password.

15. The system of claim 14, wherein said terminal comprises a I/O unit for providing data signals, and said access unit is connected to said I/O unit.

16. The system of claim 15, wherein said access unit includes keyboard means for entering said password.

17. The system of claim 15, wherein said access unit further comprises means for generating a constant access unit code signal individual to said access unit, and transmitting said constant signal prior to said access code as said identifying signal.

18. The system of claim 15, wherein said access unit comprises means for encrypting data from said I/O unit prior to application to said data transmission path.

19. In a system comprising a computer coupled to a plurality of terminals, the improvement comprising a plurality of portable access units each adapted to be inserted at one of said terminals between the respective terminal and said computer, each said access unit comprising a pseudorandom number generator for sequentially generating a separate pseudorandom sequence, a source of an identifying signal unique to the respective unit, means for receiving a password from a user, means modifying the pseudorandom numbers of the respective sequence by said passwords, means transmitting to the computer the identifying signal and the access code, and means passing data between the terminal and computer, said system further comprising a controller at said computer, said controller comprising means for receiving the identifying signals from the access unit, and, in response thereto, sequentially generating a pseudorandom number congruent with the sequence of the given access unit and also generating a signal corresponding to the password of the respective access unit, to provide an access code signal generated therein, means for modifying the pseudorandom number generated in said controller by said access code signal generated therein to produce a congruent access code, and means responsive to equality of the congruent access code and first mentioned access code for enabling access of the respective terminal to said computer.

20. The system of claim 19 wherein said access unit comprises encrypting means for encrypting data from the respective terminal for transmission to said computer.