Dual key reflexive encryption security system

• US 5,636,280 A
• Filed: 10/31/1994
• Issued: 06/03/1997
• Est. Priority Date: 10/31/1994
• Status: Expired due to Fees

• Current Assignee: Communication Devices, Inc.
• Original Assignee: Communication Devices, Inc.
• Inventors: Kelly, Tadhg
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/331,975
• Time in Patent Office: 946 Days
• Field of Search: 380/21, 380/25, 380/4
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A security system is disclosed, which system is for granting access to a host computer in response to a demand from a remote computer. The security system has a permanent encryption key mounted on the remote computer. The software portion of the system provides for the identification number associated with the permanent encryption key to be sent unencrypted to the host computer. Using the identification number the host computer selects an encryption device and encrypts a transitory encryption key generated by the host computer and transmits the transitory encryption key to the remote for emplacement on a write-only receptor in the permanent encryption key. Thereafter a comparator in the host computer, in response to encrypted identifying data transmitted from the remote computer and encrypted with said the transitory encryption key, authenticates the access demand. Access is granted by the host computer to the remote computer upon the favorable comparison of an encrypted identifier provided by the remote computer.

Claims

1. A security system for granting access to a host computer in response to a demand from a remote computer, each said computer having a central processing unit (CPU), an operating system, and a printer port, said security system comprising;

a permanent encryption key mounted on said remote computer, said permanent encryption key having an associated identifier;

a selectable encryption key in said host computer providing corresponding coding/encoding to said permanent encryption key and selectable utilizing said associated identifier;

a transitory encryption key generated in said host computer and transmitted to and emplaced within the remote computer for use thereby;

comparator means in said host computer for authenticating access demands in response to encrypted identifying data transmitted from said remote computer and encrypted with said said transitory encryption key;

whereby access is granted by the host computer to the remote computer upon said unencrypted identifier provided by the remote computer enabling the selection of said selectable encryption key, the encryption therewith of a transitory encryption key and the transmission thereof to said remote computer, and the successful comparison at the host computer of encrypted identifying data encrypted with the transitory key at the remote computer.

2. A security system as described in claim 1 further comprising:

validating program in said host computer for authenticating access demands, said validating program having a transitory encryption key; and

,

an encryption program in said remote computer capable of detecting, upon the occurrence of an access demand, the presence of said validating program in said host computer.

3. A security system as described in claim 2 wherein said unencrypted identifying data is an identification number and said encrypted identifying data is a password.

4. A security system as described in claim 3 wherein said encryption program at said remote computer using the permanent encryption key, decodes the transitory key received from the host computer, and, using the transitory key, encodes the password for reflexively transmission to the host computer, said validating program means authenticating the access demand by decoding the encrypted password and comparing the same to a record thereof.

5. A security system as described in claim 4 wherein said permanent encryption key is a data encryption standard (DES) token and wherein after decoding, said transitory key is placed on a write-only portion of said DES token.

6. A security system described in claim 3 wherein said remote computer has installed therein a communications program, wherein upon the remote computer detecting said validating program, the encryption program interrupts said communications program during said authenticating procedures;

and, upon authentication, resumes said communications program.

7. A security system as described in claim 1 wherein said unencrypted identifying data is an identification number and said encrypted identifying data is a challenge statement received encrypted from the said host computer using the selectable encryption key.

8. A security system as described in claim 7 wherein said encryption program at said remote computer using the permanent encryption key, decodes the transitory key received from the host computer, and, using the transitory key, encodes the challenge statement for reflexively transmission to the host computer, said validating program means authenticating the access demand by decoding the encrypted challenge statement and comparing the same to a record thereof.

9. A security system as described in claim 8 wherein said permanent encryption key is a data encryption standard (DES) token and wherein after decoding, said transitory encryption key is placed on a write-only portion of said DES token.

10. A security system described in claim 9 wherein said remote computer has installed therein a communications program, wherein upon the remote computer detecting said validating program, the encryption program interrupts said communications program during said authenticating procedures;

and, upon authentication, resumes said communications program.

11. A method of providing security for a first computer in a system having a second computer making access demands upon said first computer, said second computer having installed thereon a permanent encryption key and an encryption program therefor, said first computer having a validating program for authenticating access demands including a selectable encryption key corresponding to said permanent encryption key, said method comprising the steps of:

(1) upon making an access demand, detecting by the second computer the presence of said validating program in said first computer;

(2) entering identifying data into said permanent encryption key of said second computer;

(3) authenticating said access demand by said first computer by a dual-key reflexive encryption transmission from said second computer and by an acceptable comparison of the decoded form thereof at said first computer;

(4) upon authentication, connecting said second computer to said first computer; and

,

(5) providing access by said second computer to said first computer.

12. A method as described in claim 11 wherein said identifying data is an identification number and a password.

13. A method as described in claim 12 wherein step (3) further comprises the substeps of:

(a) sending unencrypted an identification member from said second computer to said first computer;

(b) by use of said selectable encryption key, sending encrypted a transitory key from said first computer to said second computer;

(c) by use of said permanent encryption key, decoding at the second computer said encrypted transitory key;

(d) by use of said transitory key at the second computer, sending encrypted said password from said second computer to said first computer; and

,

(e) completing authentication at the first computer by decrypting said password and comparing the same to a record thereof.

14. A method as described in claim 13 wherein said permanent encryption key is a data encryption standard (DES) token and wherein said transitory key is placed on a write-only portion of said DES token.

15. A method as described in claim 14 wherein said second computer has installed therein a communications program, said method further comprising the step of:

upon the second computer detecting said validating program, interrupting said communications program during said authenticating procedures; and

,

said method further comprising the step of;

upon authentication, resuming the communications program.

16. A method as described in claim 11 wherein said identifying data is an identification number and a challenge statement.

17. A method as described in claim 16 wherein step (3) further comprises the substeps of:

(a) sending unencrypted an identification number from said second computer to said first computer;

(b) by use of said selectable encryption key, sending encrypted transitory key with a challenge statement from said first computer to second remote computer;

(c) by use of said permanent encryption key, decoding at the second computer said encrypted transitory key;

(d) by use of said transitory key at the second computer, sending encrypted said challenge statement from said second computer to said first computer;

(e) completing authentication at the first computer by decrypting said challenge statement and comparing the same to a record thereof.

18. A method as described in claim 17 wherein said permanent encryption key is a data encryption standard (DES) token and wherein said transitory key is placed on a write-only portion of said DES token.

19. A method as described in claim 18 wherein said second computer has installed therein a communications program, said method further comprising the step of:

upon the second computer detecting said validating program, interrupting said communications program during said authenticating procedures; and

,

said method further comprising the step of;

upon authentication, resuming the communications program.

20. A method of providing security for a host computer in a system having a remote computer making access demands upon said host computer, said remote computer having installed therein a dedicated encryption key, an encryption program therefor and a communications program, said host computer having a validating program for authenticating access demands including a selectable encryption key corresponding to said dedicated encryption key, said method comprising the steps of:

(1) upon making an access demand, detecting by the remote computer the presence of said validating program in said host computer;

(2) entering identifying data into said dedicated encryption key of said remote computer;

(3) interrupting said communications program of said remote computer while said remote computer undergoes authentication processing by said host computer, said authentication processing comprising the substeps of;

(a) sending unencrypted a first portion of said identifying data from said remote computer to said computer;

(b) by use of said selectable encryption key, sending encrypted a session key from said host computer to said remote computer;

(c) by use of said dedicated encryption key, decoding at the remote computer said session key;

(d) by use of said session key at the remote computer, sending encrypted a second portion of said identifying data from said remote computer to said host computer;

(e) completing authentication at the host computer by decrypting said second portion of said identifying data and comparing the same to a record thereof;

(4) upon authentication, connecting said remote computer to said host computer; and

,

(5) resuming said communications program to provide access by said remote computer to said host computer.

21. A security system for granting access to a host computer in response to a demand from a remote computer, each said computer having a central processing unit (CPU), an operating system, a communications program and a printer port, said security system comprising;

a permanent encryption key mounted on said remote computer, said permanent encryption key having an associated identifier;

a selectable encryption key in said host computer providing corresponding coding/encoding to said permanent encryption key and selectable utilizing said associated identifier;

a transitory encryption key generated by said host computer and transmitted to the remote computer for use thereby;

validating program means for performing authenticating procedures, said validating progrtam means in said host computer for authenticating access demands, said validating program means including said transitory encryption key;

an encryption program in said remote computer capable of detecting, upon the occurrence of an access demand, the presence of said validating program in said host computer, and, upon the remote computer detecting said validating program, the encryption program interrupts said communications program during said authenticating procedures;

comparator means in said host computer for authenticating access demands in response to encrypted identifying data transmitted from said remote computer and encrypted with said said transitory encryption key;

said encryption program, upon completion of said authentication procedures, resumes said communications program;

whereby access is granted by the host computer to the remote computer upon said unencrypted identifier provided by the remote computer enabling the selection of said selectable encryption key, the encryption therewith of a transitory encryption key and the transmission thereof to said remote computer, and the successful comparison at the host computer of encrypted identifying data encrypted with the transitory key at the remote computer.

22. A security system as described in claim 21 wherein said unencrypted identifying data is an identification number and said encrypted identifying data is a password.

23. A security system as described in claim 22 wherein said encryption program at said remote computer using the permanent encryption key, decodes the transitory key received from the host computer, and, using the transitory key, encodes the password for reflexively transmission to the host computer, said validating program means authenticating the access demand by decoding the encrypted password and comparing the same to a record thereof.

24. A security system as described in claim 21 wherein said unencrypted identifying data is an identification number and said encrypted identifying data is a challenge statement received encrypted from the said host computer using the selectable encryption key.

25. A security system as described in claim 24 wherein said encryption program at said remote computer using the permanent encryption key, decodes the transitory key received from the host computer, and, using the transitory key, encodes the challenge statement for reflexively transmission to the host computer, said validating program means authenticating the access demand by decoding the encrypted challenge statement and comparing the same to a record thereof.

26. A security system as described in claim 25 wherein said encryption key is a data encryption standard (DES) token and wherein after decoding, said transitory key is placed on a write-only portion of said DES token.

27. A security system described in claim 26 wherein said remote computer has installed therein a communications program, wherein upon the remote computer detecting said validating proram, the encryption program interrupts said communications program during said authenticating procedures;

and, upon authentication, resumes said communications program.