Integrated network security system

• US 5,237,614 A
• Filed: 06/07/1991
• Issued: 08/17/1993
• Est. Priority Date: 06/07/1991
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: Security Dynamics Technologies, Inc. (Symphony Technology Group LLC)
• Inventors: Weiss, Kenneth P.
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US07/712,186
• Time in Patent Office: 802 Days
• Field of Search: 380/4, 380/23-25, 380/46, 340/825.31, 340/825.34, 395/725
• US Class Current: 713/159
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An integrated network security system is provided which permits log-on to a normally locked client on the network in response to at least one coded non-public input to the client by a user. At least a selected portion of the coded input is encrypted and sent to a network server where the user is authenticated. After authentication, the server preferably returns a decryption key, an encryption key for future use and any critical files previously stored at the server to the client. The decryption key is utilized to decrypt any material at the client which were encrypted when the client was locked, including any material sent from the server, thereby unlocking the client. The decryption key may be combined with untransmitted portions of the original coded input in a variety of ways to generate an encryption key for the next time the terminal is to be locked. When one of a variety of client locking conditions occurs, the previously generated encryption key is utilized to encrypt at least selected critical material at the client. Critical directories or the like in encrypted form may be sent to the server and a message is sent to the server that the client is locked, which message is utilized by the server to inhibit the client from further access to at least selected resources on the network.

Claims

1. An integrated security system for a network having a server and at least one client comprising:

means for normally locking each client to restrict in a selected way use of the client itself and use of the client in gaining access to the network;

means at the client for receiving at least one coded input from a user;

means at the client for transmitting to the server signals which are a representation of at least a selected portion of the coded input;

means at the server for utilizing the received signal representation to authenticate the user, for retrieving unlock inputs for the user and, when the user has been authenticated, for sending to the client signals representative of the unlock inputs; and

means at the client for utilizing the unlock input signals to unlock the client.

2. A system as claimed in claim 1 including means at the client for saving a selected portion of the coded input, said means for transmitting transmitting signals which are a representation of the remaining portion of the coded input.

3. A system as claimed in claim 2 wherein the coded input from the user includes the current value of a dynamically varying non-predicatable number generated by a device in the possession of the user;

wherein signals indicative of a client ID are transmitted to the server with the representation signals; and

wherein the means to authenticate at the server includes means for using the client ID signals to retrieve appropriate representation signals for the user, and means for matching the retrieved representation signals with the transmitted representation signals to authenticate the user.

4. A system as claimed in claim 3 wherein the user has a PIN which is inputted into the device by the user and combined in a selected way in the device in producing the non-predictable number inputted by the user.

5. A system as claimed in claim 3 wherein the user has an alpha numeric PIN (AN-PIN), wherein the coded input from the user includes the AN-PIN, wherein a selected portion of both the non-predictable number and the AN-PIN are saved at the client, and wherein remaining portions of the non predictable number and the AN-PIN are combined in a predetermined way to produce the representation signals transmitted to the server.

6. A system as claimed in claim 2 wherein, when the client is locked, at least selected material stored at the client is stored in encrypted form, and wherein the unlock inputs sent to the client include a decryption key for said selected material.

7. A system as claimed in claim 6 wherein the server includes means for transmitting an encryption key to the client after user authentication;

and

wherein the client includes means for utilizing the encryption key the next time the client is to be locked to encrypt said selected material.

8. A system as claimed in claim 7 wherein the means at the client for encrypting includes means for combining the transmitted encryption key from the server with at least a portion of the coded input saved at the client to product an encryption key for the selected material.

9. A system as claimed in claim 8 wherein the user has a device which generates a dynamically varying non predictable number which is unique to the user, the coded input from the user including the current non predictable number from the device.

10. A system as claimed in claim 9 wherein the device includes a user controlled means for generating a second non-predictable code for the user which may also form part of said coded input;

and

wherein the client includes means for combining the second non-predictable code with the transmitted encryption key to product a longer encryption key for the selected material.

11. A system as claimed in claim 7 including means for running the encryption key, at least a portion of the stored coded input and selected non-secret data through a one-way function to obtain a longer encryption key.

12. A system as claimed in claim 2 including means for passing all of the coded input from the user through a one-way function, the transmitted representation signals including at least a sufficient portion of the output from the one-way function to assure that all of the coded input is correct when authentication occurs at the server.

13. A system as claimed in claim 1 including means for utilizing selected data, including at least a portion of the coded input from the user, to generate an encryption key, means for utilizing at least a portion of said encryption key for end-to end encryption of communications with the client, and means for utilizing at least a portion of the encryption key to encrypt at least selected material at the client when the client is locked.

14. A system as claimed in claim 13 wherein the portion of the encryption key utilized for end-to-end encryption and the portion utilized for encryption on client locking are not identical.

15. A system as claim in claim 1 including means at the client for running at least a portion of the coded input and selected non-secret data through a one-way function to obtain a value having more characters than the coded input, which value may be utilized as all or a portion of an encryption key.

16. A system as claimed in claim 1 wherein selected material required to operate a client is zeroized at the client when the client is locked and is transmitted in encrypted form to be stored at the server;

and wherein the server includes means operative when the user has been authenticated for retransmitting the stored encrypted material to the client along with a decryption key.

17. A system as claimed in claim 1 including means responsive to selected conditions at the client for locking the client.

18. A system as claimed in claim 17 wherein one of said selected conditions is a discourteous disconnect of the client.

19. A system as claimed in claim 17 wherein one of said selected conditions is an end-of-session input from the user.

20. A system as claimed in claim 17 wherein one of said selected conditions is there being no activity by the user at the client for a selected time interval.

21. A system as claimed in claim 17 including means for storing a release code at the client, and means responsive to the release code for inhibiting the full locking of the client in response to a selected condition.

22. A system as claimed in claim 21 wherein said means for inhibiting permits the locking of the client from access to the network, but permits at least the selected continued use of the client.

23. A system as claimed in claim 21 wherein the client may generate or receive selected protected files, each of which contains a protection flag, and means responsive to the detection of a protection flag for preventing use of the protected file at the client after one of said selected conditions has occurred.

24. A system as claimed in claim 23 wherein said means for preventing use of the protected file includes means for removing or reducing the release code so that the client cannot access the file after a selected condition occurs.

25. A system as claimed in claim 23 wherein said means for preventing includes means for encrypting or zeroizing the protected file at the client when a selected condition occurs.

26. A system as claimed in claim 25 including means for indicating if the protected file may be written into at the client, and including means responsive to an indication that a protected file may be written into for transmitting the protected file to the server prior to zeroizing the file.

27. A method for providing integrated security on a network having a server and at least one client comprising the steps of:

normally locking each client to restrict in a selected way use of the client itself and use of the client in gaining access to the network;

receiving at the client at least one coded input from a user;

transmitting signals which are a representation of at least a selected portion of the coded input from the client to the server;

utilizing the received representation signals at the server to authenticate the user, to retrieve unlock inputs for the user and, when the user has been authenticated, to send the unlock inputs to the client; and

utilizing the unlock inputs at the client to unlock the client.

28. A method as claimed in claim 27 including the step performed at the client of saving a selected portion of the coded input, the representation signals transmuted during the transmitting step being of the remaining portion of the coded input.

29. A method as claimed in claim 28 wherein the coded input from the user includes the current value of a dynamically varying non-predictable number generated by a device in the possession of the user;

wherein signals indicative of a client ID are transmitted to the server with the representation signals; and

wherein the authenticating step at the server includes the steps of using the client ID signals to retrieve the appropriate representation signals for the user, and matching the retrieved representation signals with the transmitted representation signals to authenticate the user.

30. A method as claimed in claim 29 wherein the user has a PIN which is inputted into the device by the user and combined in a selected way in the device in producing the non-predictable number inputted by the user.

31. A method as claimed in claim 29 wherein the user has an alphanumeric PIN (AN-PIN), wherein the coded input from the user includes the AN-PIN, wherein a selected portion of both the non-predictable number and the AN-PIN are saved at the client, and wherein remaining portions of the non-predictable number and the AN-PIN are combined in a predetermined way to product the representation transmitted to the server.

32. A method as claimed in claim 28 wherein, when the client is locked, at least selected material stored at the client is stored in encrypted form, and wherein the unlock inputs sent to the client include a decryption key for said selected material.

33. A method as claimed in claim 32 including the steps of transmitting an encryption key from the server to the client after user authentication, and utilizing the encryption key at the client the next time the client is to be locked to encrypt said selected material.

34. A method as claimed in claim 33 wherein the encrypting step at the client includes the step of combining the transmitted encryption key from the server with at least a portion of the coded input saved at the client to produce an encryption key for the selected material.

35. A method as claimed in claim 34 wherein the user has a device which generates a dynamically varying non-predictable number which is unique to the user, the coded input from the user including the current non-predictable number from the device.

36. A method as claimed in claim 35 wherein the device includes a user controlled means for generating a second non-predictable code for the user which may also form part of said coded input;

and including the step performed at the client of combining the second non-predictable code with the transmitted encryption key to produce a longer encryption key for the selected material.

37. A method as claimed in claim 33 including the step of running the encryption key, at least a portion of the stored coded input and selected non-secret data through a one-way function to obtain a longer encryption key.

38. A method as claimed in claim 28 including the step of passing all of the coded input from the user through a one-way function, the transmitted representation including at least a sufficient portion of the output from the one-way function to assure that all of the coded input is correct when authentication occurs at the server.

39. A method as claimed in claim 27 including the steps of utilizing selected data, including at least a portion of the coded input from the user, to generate an encryption key, utilizing at least a portion of said encryption key for end-to-end encryption of communications with the client, and utilizing at least a portion of the encryption key to encrypt at least selected material at the client when the client is locked.

40. A method as claimed in claim 39 wherein the portion of the encryption key utilized for end-to-end encryption and the portion utilized for encryption on client locking are not identical.

41. A method as claimed in claim 27 including the step performed at the client of running at least a portion of the coded input and selected non-secret data through a one-way function to obtain a value having more characters than the coded input, which value may be utilized as all or a portion of an encryption key.

42. A method as claimed in claim 27 wherein selected material required to operate a client is zeroized at the client when the client is locked and is transmitted in encrypted form to be stored at the server;

and including the step performed at the server when the user has been authenticated for retransmitting the stored encrypted material to the client along with a decryption key.

43. A method as claimed in claim 27 including the step of locking the client in response to selected conditions at the client.

44. A method as claimed in claim 43 wherein one of said selected conditions is a discourteous disconnect of the client.

45. A method as claimed in claim 43 wherein one of said selected conditions is an end-of-session input from the user.

46. A method as claimed in claim 43 wherein one of said selected conditions is there being no activity by the user at the client for a selected time interval.

47. A method as claimed in claim 43 including the steps of storing a release code at the client, and inhibiting the full locking of the client in response to a selected condition when a release code is present.

48. A method as claimed in claim 47 wherein said inhibiting step permits the locking of the client from access to the network, while permitting at least the selected continued use of the client.

49. A method as claimed in claim 47 wherein the client may generate or receive selected protected files, each of which contains a protection flag, and including the step performed in response to the detection of the protection flag of preventing use of the protected file at the client after one of said selected conditions has occurred.

50. A method as claimed in claim 49 wherein the step of preventing use of the protected file includes the step of removing or reducing the release code so that the client cannot access the file after a selected condition occurs.

51. A method as claimed in claim 49 wherein said step of preventing includes the step of encrypting or zeroizing the protected file at the client when a selected condition occurs.

52. A method as claimed in claim 51 including the steps of indicating if the protected file may be written into at the client, and retransmitting the protected file to the server prior to zeroizing the file in response to an indication that a protected file may be written into.