Method and apparatus for cryptographic authentication

• US 5,666,415 A
• Filed: 07/28/1995
• Issued: 09/09/1997
• Est. Priority Date: 07/28/1995
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Digital Equipment Corporation (HP Inc.)
• Inventors: Kaufman, Charles William
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/508,766
• Time in Patent Office: 774 Days
• Field of Search: 380/23, 380/24, 380/25, 380/30, 380/28, 380/21, 380/49
• US Class Current: 713/159
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

Method for providing user authentication and a memory for storing a computer program for providing user authentication are described. The method includes the steps of providing a first argument including a one-way cryptographic transformation of a password and a second argument including a one-way cryptographic transformation of a cryptographic combination of the password and a first nonce, computing a first term using the first argument and computing a second term using the first nonce, and comparing the second term with the second argument. The memory storing a computer program, the computer program including, means for providing a first argument including a one-way cryptographic transformation of a password and a second argument including a one-way cryptographic transformation of a cryptographic combination of the password and a first nonce, means for computing a first term using the first argument and computing a second term using the first nonce, and means for comparing the second term with the second argument.

Claims

1. A method for providing authentication of a user including the steps of:

providing a first argument including a one-way cryptographic transformation of a password and a second argument including a one-way cryptographic transformation of a cryptographic combination of the password and a first nonce;

computing a first term using the first argument and computing a second term using the first nonce; and

comparing the second term with the second argument.

2. The method as recited in claim 1 wherein the step of providing a first term includes the step of:

applying a first one-way cryptographic function to the first argument.

3. The method of claim 2 wherein the step of computing a second term includes the substeps of:

retrieving a first value from a first database;

providing a first result comprising a cryptographic combination of the first value and the first nonce; and

applying a second one-way cryptographic function to said first result.

4. The method of claim 3 further comprising the steps of:

retrieving a second value from the first database; and

comparing the first term with the second value.

5. The method of claim 1 wherein the step of providing a first argument includes the substeps of:

providing a first result comprising a cryptographic combination of a second nonce and the one-way cryptographic transformation of the password; and

applying a third one-way cryptographic transformation function to said first result.

6. The method of claim 5 further including the step of:

cryptographically combining the password and a third nonce prior to said step of providing a first argument and a second argument.

7. The method of claim 6 wherein the step of computing a first term includes the step of:

retrieving a third value from a second database; and

applying a bidirectional cryptographic transformation function to the third value and the first argument.

8. The method of claim 7 wherein the step of computing a second term includes the step of:

applying a fourth one-way cryptographic transformation function to a cryptographic combination of the first term and the first nonce.

9. A method for providing authentication of a user including the steps of:

providing from a user to a server a first argument including a password of the user encrypted using a first one-way cryptographic transformation function and a second argument including said password encrypted using a second one-way cryptographic transformation function and crytographically combined with a nonce providing a first result, with said first result being encrypted using a third one-way cryptographic transformation function;

computing by the server a first term including said first argument encrypted using a fourth one-way cryptographic transformation function and a second term including a crytographic combination of said nonce with a first value from a database providing a second result, with said second result being encrypted using said third one-way cryptographic transformation function; and

comparing said first term with a second value from the database and said second term with said second argument.

10. The method of claim 9 wherein prior to said providing step said method includes the step of:

providing said nonce, by the server, in response to a request for access to the server by the user.

11. The method of claim 9 further including the step of:

providing, during an authorized communication between the user and the server, said nonce for use during a subsequent authentication.

12. A method for providing authentication of a user including the steps of:

providing from a user to a server a first argument being an expression encrypted using a first one-way cryptographic transformation function cryptographically combined with a first nonce and with the first nonce cryptographically combined with said expression being encrypted using a second one-way cryptographic transformation function, and a second argument being said expression encrypted using said first one-way cryptographic transformation function cryptographically combined with a second nonce and with the second nonce cryptographically combined with said expression encrypted using a third one-way cryptographic transformation function;

computing by the server a first term including a decryption of a first value from a database using said first argument as a key to a decryption algorithm;

computing by the server a second term including said first term cryptographically combined with said second nonce, encrypted using said third one-way cryptographic transformation function; and

comparing said second term with said second argument.

13. The method of claim 12 wherein said expression is a password of said user.

14. The method of claim 12 wherein said expression is the result of a cryptographic combination of a password of said user with a third nonce.

15. The method of claim 13 wherein prior to said step of providing, the method includes the step of:

providing said first nonce and a randomly selected value as said second nonce, by the server in response to a request for access to the server by the user.

16. The method of claim 14 further including the step of:

providing said first nonce, said third nonce and a randomly selected value as said second nonce, by the server, in response to a request for access to the server by the user.

17. The method of claim 12 further including subsequent to said step of comparing, the steps of:

selecting a new first nonce;

computing a new first value using said new first nonce; and

updating the database with the new first value.

18. A method for providing authentication of a user comprising the steps of:

storing at a server a first nonce and an encrypted quantity, said encrypted quantity being derived from said first nonce and a password;

sending the user said first nonce;

sending a reply derived from said first nonce to the server;

decrypting said encrypted quantity using said reply; and

using said decrypted encrypted quantity and a second nonce to generate a new encrypted quantity.

19. A memory storing a computer program for providing a user authentication system for use on a computer system said computer program comprising:

means for providing a first argument including a password of a user encrypted using a third hashing function and a second argument including said password encrypted using a first hashing function and crytographically combined with a nonce providing a first result, with said first result being encrypted using a fourth hashing function;

means for computing a first term including said first argument encrypted using a second hashing function and a second term including a crytographic combination of said nonce with a first value from a database providing a second result, with said second result being encrypted using a fourth hashing function; and

means for comparing said first term with a second value from the database and said second term with said second argument.

20. A memory storing a computer program for providing a user authentication system for use on a computer system said computer program comprising:

means for providing a first argument including an expression encrypted using a first hashing function providing a first result with said first result being cryptographically combined with a first nonce providing a second result with said second result being encrypted using a second hashing function and a second argument including said expression encrypted using said first hashing function providing a third result with said third result being crytographically combined with a second nonce providing a fourth result with said fourth result being encrypted using a third hashing function;

means for computing a first term including a decryption of a first value from a database using said first argument as a key to a decryption algorithm;

means for computing a second term including said first term crytographically combined with said second nonce providing a fifth result with said fifth result being encrypted using said third hashing function; and

means for comparing said second term with said second argument.