Electronic information network user authentication and authorization system

• US 5,590,199 A
• Filed: 10/12/1993
• Issued: 12/31/1996
• Est. Priority Date: 10/12/1993
• Status: Expired due to Term

• Current Assignee: Green Wireless LLC (Intellectual Ventures LLC)
• Original Assignee: Mitre Corporation
• Inventors: Trostle, Jonathan T., Chodorow, David A., Krajewski, Marjan Jr., Baldwin, Peter T., Chipchak, John C.
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/134,399
• Time in Patent Office: 1,176 Days
• Field of Search: 380/25, 380/4, 380/23, 380/21
• US Class Current: 713/159
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A system for authenticating and authorizing a user to access services on a heterogenous computer network. The system includes at least one workstation and one authorization server connected to each other through a network. A user couples a personally protectable coprocessor (smart card) to the workstation by means of a bidirectional communications channel. The coprocessor is adapted to receive signals including first encrypted authentication information and to decrypt the first encrypted authentication information using a preselected first key. The coprocessor is further adapted to assemble and encrypt second authentication information using a preselected second key and to transmit the encrypted second encrypted authentication information to the workstation. The workstation then communicates the information onto the network whereby the user is authenticated to access the networked computer or service.

Claims

1. A system for authenticating a user to any service or computer on a heterogenous computer network comprising:

at least one workstation in communication with a network; and

a removable, personally protectable coprocessor adapted to communicate with the workstation,

the coprocessor adapted to receive user-provided initialization information from the workstation,

the coprocessor adapted to receive signals including first encrypted authentication information from the workstation, the coprocessor including a preselected first key to decrypt the first encrypted authentication information, the coprocessor further programmed to assemble second authentication information and to encrypt the second authentication information using at least one of (i) a key contained within the first encrypted authentication information and (ii) a preselected second key and to send the second encrypted authentication information to the network via the workstation,

whereby the user is authenticated to access the networked computer or service.

2. The system of claim 1 wherein the first and second keys are preprogrammed into the personally protectable coprocessor.

3. The system of claim 2 wherein the first and second keys are preprogrammed in encrypted form into the personally protectable coprocessor.

4. A system for authenticating a user to any service or computer on a heterogenous computer network comprising:

one authorization server in communication with the network;

at least one workstation in communication with the network; and

a removable, personally protectable coprocessor adapted to communicate with the workstation,

the coprocessor adapted to receive user-provided initialization information from the workstation,

the coprocessor adapted to receive signals including first encrypted authentication information from the workstation, the coprocessor programmed to include a preselected first key to decrypt the first encrypted authentication information, the coprocessor further programmed to receive signals including a preselected second key from the authorization server, the coprocessor further programmed to assemble second authentication information and to encrypt the second authentication information using at least one of (i) a key contained within the first encrypted authentication information and (ii) the preselected second key, and to send the second encrypted authentication information to the network via the workstation,

whereby the user is authenticated to access the networked computer or service.