User-transparent security method and apparatus for authenticating user terminal access to a network

• US 5,721,780 A
• Filed: 05/31/1995
• Issued: 02/24/1998
• Est. Priority Date: 05/31/1995
• Status: Expired due to Term

• Current Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Primatic, Agesino, Kowalski, Thaddeus Julius, Ensor, Myra L.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/455,614
• Time in Patent Office: 1,000 Days
• Field of Search: 380/4, 380/23, 380/25, 380/49, 380/50, 380/59, 380/9, 380/24, 340/825.31, 340/825.34
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04Q 2213/13515 authentication, authorisation - fraud prevention
• CPC Class Codes: H04Q 3/0016 Arrangements providing connection between exchanges
• CPC Class Codes: H04Q 3/0029 Provisions for intelligent networking

Abstract

The present invention provides a password authentication security system for a telecommunications network having a plurality of user terminals or subscriber stations communicably coupled to the network. The system comprises a network control center coupled to the subscriber stations, to service provider stations and to network databases via the network. Upon establishment of a communication with a subscriber station, a network coupling identifier comprising in one embodiment the telephone number of the line to which the subscriber station is connected is detected at a telephone switching office and transmitted to the control center. If this is the first time communications have been established between the subscriber station and the network, the received telephone number is encrypted to produce a secret password that is then automatically transmitted to the subscriber station for storage in memory. Upon subsequent communications, the telephone number is again received by the control center where it is encrypted to produce a second password. The first password is then automatically retrieved from memory of the subscriber station independent of user interaction. The two passwords are compared, and the network control center causes the incoming call of the selected user terminal to be connected to a network service provider station, a network database, a network output device or the like if the passwords are at least similar. If the two passwords are not at least similar, the control center causes the incoming call of the selected user terminal to be disconnected, thereby terminating the user terminal'"'"'s access to the network.

Claims

1. A method for determining whether access to a network from a selected one of a plurality of user terminals in communication through the network is authorized, each of the plurality of user terminals having an identifier for distinguishing one of the user terminals from the remainder of the user terminals within the network, the method comprising the steps of:

detecting the identifier of the selected user terminal upon establishment of a communication between the network and the user terminal, the identifier containing information of the user terminal'"'"'s coupling to the network;

retrieving from the user terminal a password;

comparing the identifier and the password;

allowing access to the network for the selected user terminal if a first predetermined portion of the identifier and a second predetermined portion of the password satisfy a predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password; and

denying access to the network for the selected user terminal if the first predetermined portion of the identifier and the second predetermined portion of the password do not satisfy the predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password,

wherein the detecting, retrieving and comparing steps are automatically performed independent of and transparent to the user by a network control center in communication with the network.

2. The method of claim 1, wherein the network comprises a telecommunications network selected from the group consisting of a wired network, a wireless network, a satellite network, a fiber optic cable network and a coaxial cable network and the step of detecting the identifier comprises the step of detecting the communications channel of an incoming call from the selected user terminal.

3. The method of claim 1, wherein the network comprises a telephone network and the step of detecting the identifier comprises the step of detecting the telephone number of an incoming call from the selected user terminal.

4. The method of claim 3, wherein the step of detecting the telephone number of an incoming call from the selected user terminal comprises the step of receiving the incoming call'"'"'s telephone number from an automatic number identification unit of a telephone network switching office.

5. The method of claim 3, wherein the steps of allowing access to the network and denying access to the network comprise the steps of:

coupling the incoming call of the selected user terminal to one of a network service, a network database and a network output device if the first predetermined portion of the identifier and the second predetermined portion of the password satisfy the predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password; and

disconnecting the incoming call of the selected user terminal from the network if the first predetermined portion of the identifier and the second predetermined portion of the password do not satisfy the predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password.

6. The method of claim 1, wherein the network comprises a computer network and the step of detecting the identifier comprises the step of detecting the network address of one of a server managing a local network to which the user terminal is connected, a remote link through which the user terminal is coupled to the network and a home directory of the network or a sub-network of the network.

7. The method of claim 1, wherein the network comprises a telecommunications network further in communication with at least one service provider station for downloading software and service information from the station to user terminals, with the network selected from the group consisting of a wired network, a wireless network, a satellite network, a fiber optic cable network and a coaxial cable network, and wherein the step of detecting the identifier comprises the step of detecting the telephone number of an incoming call from the selected user terminal.

8. The method of claim 1, wherein the step of retrieving from the user terminal a password comprises the step of reading from memory provided in the user terminal a password previously stored in memory.

9. The method of claim 1, wherein the step of comparing the identifier and the password further comprises the step selected from the group of steps consisting of:

encrypting the identifier to produce an encrypted password for comparison with the password received from the user terminal, and

decrypting the password to produce a decrypted identifier for comparison with the detected identifier.

10. The method of claim 1, wherein the steps of allowing access to the network for the selected user terminal if the first predetermined portion of the identifier and the second predetermined portion of the password satisfy the predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password, and denying access to the network for the selected user terminal if the first predetermined portion of the identifier and the second predetermined portion of the password do not satisfy the predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password comprise the steps of:

allowing access to the network for the selected user terminal if the identifier and the password are identical; and

denying access to the network for the selected user terminal if the identifier and the password are not identical.

11. The method of claim 1, wherein upon establishment of a first communication between the network and the user terminal, the method further comprises the steps of:

detecting the identifier of the selected user terminal upon establishment of the first communication between the network and the user terminal, the identifier containing information of the user terminal'"'"'s coupling to the network;

encrypting the identifier to generate a secret password; and

transmitting the password to the user terminal via the network for storage in memory of the user terminal.

12. In a security system for authenticating access to a network from a selected one of a plurality of user terminals in communication through the network, each of the plurality of user terminals having an identifier for distinguishing one of the user terminals from the remainder of the user terminals within the network, a method is provided for selecting and passing to the selected user terminal a password used to obtain access to the network, the method comprising the steps of:

detecting the identifier of the selected user terminal upon establishment of a communication between the network and the user terminal, the identifier containing unique information of the user terminal'"'"'s coupling to the network;

encrypting the identifier to generate a secret password; and

transmitting the password to the user terminal via the network.

13. The method of claim 12, wherein the detecting, encrypting and transmitting steps of the method are automatically performed independent of and transparent to the user by a network control center in communication with the network.

14. The method of claim 12, wherein the network comprises a telecommunications network selected from the group consisting of a wired network, a wireless network, a satellite network, a fiber optic cable network and a coaxial cable network and the step of detecting the identifier comprises the step of detecting the communications channel of an incoming call from the selected user terminal.

15. The method of claim 12, wherein the network comprises telephone network and the step of detecting the identifier comprises the step of detecting the telephone number of an incoming call from the selected user terminal.

16. The method of claim 15, wherein the step of detecting the telephone number of an incoming call from the selected user terminal comprises the step determining the incoming call'"'"'s telephone number from an automatic number identification unit of a telephone network switching office.

17. The method of claim 12, wherein the network comprises a computer network and the step of detecting the identifier comprises the step of detecting the network address of the users terminal'"'"'s coupling to the computer network.

18. The method of claim 12, wherein the network comprises a telecommunications network further in communication with at least one service provider station for downloading software and services from the station to user terminals, with the network selected from the group consisting of a wired network, a wireless network, a satellite network, a fiber optic cable network and a coaxial cable network, and wherein the step of detecting the identifier comprises the step of detecting the telephone number of an incoming call from the selected user terminal.

19. The method of claim 12, wherein the step of transmitting the password to the user terminal via the network comprises the step of storing the password in memory of the user terminal.

20. The method of claim 12, wherein the step of transmitting the password to the user terminal via the network comprises the step of storing the password in memory of the user terminal, and wherein upon a selected subsequent establishment of a communication between the network and the user terminal, the method further comprises the steps of:

detecting the identifier of the selected user terminal upon establishment of a communication between the network and the user terminal, the identifier containing information of the user terminal'"'"'s coupling to the network;

encrypting the identifier to generate a second secret password different form the first secret password; and

transmitting the second password to the user terminal via the network to replace the first secret password stored in memory of the user terminal.

21. In a security system for a telecommunications network having a plurality of user terminals in communication through the network, an apparatus is provided for authenticating access to the network from a selected one of the plurality of user terminals having memory, each of the plurality of user terminals having an identifier for distinguishing one of the user terminals from the remainder of the user terminals within the network, the apparatus comprising:

a network control center in communication with the network for receiving the identifier from memory of the selected user terminal upon establishment of a communication between the network and the user terminal, the identifier comprising one of a communications channel indicator, a network address and a telephone number of an incoming communication from the selected user terminal, the network control center comprising

comparison logic for comparing the identifier with a password read from a predetermined location in memory of the selected user terminal, and

a switch for allowing or denying access to the network for the selected user terminal based upon the result of the comparison.

22. The apparatus of claim 21, wherein the network control center automatically receives the identifier from the user terminal and the comparison logic automatically compares the identifier with the password upon establishment of the communication independent of and transparent to the user.

23. The apparatus of claim 21, wherein the telecommunications network comprises one of a wired network, a wireless network, a satellite network, a fiber optic cable network and a coaxial cable network, and the apparatus further comprises a switching office of the telecommunications network having an automatic number identification unit for detecting the telephone number of an incoming communication from the selected user terminal.

24. The apparatus of claim 23, wherein the network control center causes the incoming call of the selected user terminal to be connected to one of a network service provider station, a network database and a network output device if a first predetermined portion of the identifier and a second predetermined portion of the password satisfy a predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password, and further causes the incoming call of the selected user terminal to be disconnected from the network if the first predetermined portion of the identifier and the second predetermined portion of the password do not satisfy the predetermined relation between the first predetermined portion of the identifier and the second predetermined portion of the password.

25. In a telecommunications system comprising a network service bureau having subscriber accounts and being in communication with one or more subscriber stations via a telecommunications network for the provision of services and information from the network to subscribers located at the subscriber stations, a method is provided for uniquely associating each subscriber with a corresponding subscriber account maintained at the service bureau upon establishment of communications between the subscriber and the service bureau, the method comprising the steps of:

creating a subscriber account for each subscriber upon initial communication between the subscriber and the service bureau;

associating the subscriber account with a unique telephone number provided by the subscriber, the telephone number being assigned by the telecommunications network to a first subscriber station from which the subscriber currently establishes communications with the service bureau and recorded at the service bureau for future use in associating the subscriber with the subscriber account;

detecting the telephone number generated by an automatic number identification service of the network upon subsequent establishments of communication between the subscriber and the service bureau; and

selecting the subscriber account associated with the generated telephone number;

wherein when the subscriber selects a second different subscriber station for establishing communications with the service bureau, the method further comprises the step of the telecommunications network assigning the same unique telephone number to the second subscriber station such that upon call establishment between the subscriber from the second subscriber station to the service bureau, the previously created subscriber account will be selected for the subscriber.