System for supporting secured log-in of multiple users into a plurality of computers using combined presentation of memorized password and transportable passport record

• US 6,081,893 A
• Filed: 05/28/1997
• Issued: 06/27/2000
• Est. Priority Date: 05/28/1997
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Grawrock, David, Lohstroh, Shawn R.
• Primary Examiner(s): Swann, Tod R.
• Assistant Examiner(s): Darrow, Justin T.
• Application Number:
  US08/864,297
• Time in Patent Office: 1,126 Days
• Field of Search: 713/202, 713/155, 713/156, 713/164, 713/165, 713/182, 713/183, 708/144, 380/21, 380/25, 380/28, 380/30, 380/262, 380/279, 380/282, 380/283, 705/72
• US Class Current: 713/183
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3249 using RSA or related signature schemes, e.g. Rabin scheme

Abstract

A system is disclosed for controlling intelligible access to secured files by means of a user-memorized password in combination with a user-associated passport record. The passport record takes on two forms, one when it is physically secured within the workstation and a different second form when the passport record is in-transit. Log-in privileges are granted after a presented passport record passes a number of tests including digital signature authentication, and the ability to extract two different encrypted keys from the passport record. The in-transit record does not carry one of those two keys.

Claims

1. A machine-readable memory [650] for operable use by a machine system [FIGS. 1,6] that maintains confidential digital information [113,643] generally in encrypted form [109,656] while allowing for intelligible access to such confidential information by users who are authorized for access by a combination of a user-associated password [101] and a user-associated passport [150], said machine-readable memory storing for each of an associated one or more authorized users, a passport data structure [150/170] comprising:

(a) a first field [156/176] storing a first secured-by-encryption key [KS(0/1)*], where said first secured key is covered by a first covering signal [PW*] derived from a valid password [PW,101] of the passport-associated user;

(b) a second field [155/175] storing a second secured-by-encryption key [PriUK*], where said second secured key is covered by a plaintext version [KS(0/1)] of the first secured key; and

(c) a third field [154/174],

(c.1) where said third field stores a third secured-by-encryption key [PriWK1*] that is different from the first secured key in situations where the machine-readable memory is physically-secured [100] within said machine system,

(c.2) where said third field [174] is blank or is filled with irrelevant information in situations where the machine-readable memory is not physically-secured within said machine system, and

(d) where said machine system requires local presence of a physically-secured, in-system version of the associated passport data structure [150] and a verified local uncovering from said in-system version of the associated passport data structure of the secured keys in the second and third fields [154,155] before the machine system locally grants to a requesting user, intelligible access to corresponding confidential information.

2. A machine-implemented method for providing intelligible access to algorithmically-secured data in response to an access request, wherein the access request includes submission of a password [101] and submission of an identification [152] of a requesting user, said method [201] comprising the steps of:

(a) finding [200] a machine-readable passport [150] associated with the submitted identification, wherein said passport includes;

(a.1) a first field [152] having a user identification matching the submitted identification and associating the passport with a corresponding user;

(a.2) a second field [156] containing a first secured key [KS(0/1)*] derived from a valid password [PW] of the passport-associated user;

(a.3) a third field [155] containing a second secured key [PriuK*] covered by a plaintext version [KS(0/1)] of the first secured key; and

(a.4) a fourth field [154] containing a third secured key [PriWK1*] that is different from the first secured key;

(b) using [216] the submitted password [101] to attempt decryption of the first secured key [KS(0/1)*], said attempt producing a putative first uncovering [116] of the first secured key;

(c) using [245] the putative first uncovering [116] to attempt decryption of the second secured key [PriUK*], said attempt producing a putative second uncovering [121] of the second secured key; and

(d) using [235] the putative first uncovering [116] to attempt decryption of the third secured key [PriWK*], said attempt producing a putative third uncovering [PriWK1] of the third secured key.

3. A machine-implemented method according to claim 2 wherein:

(c.1) said attempted decryption of the second secured key [PriUK*] provides a respective indication of whether or not the attempted decryption was successful; and

(d.1) said attempted decryption of the third secured key [PriUK*] provides a respective indication of whether or not the attempted decryption was successful;

said method further comprising the step of;

(e) requiring [104,114] respective indications of decryption success from the attempted decryptions of the second and third secured keys before providing intelligible access to algorithmically-secured data [106,109] in response to said access request.

4. A machine-implemented method according to claim 2 wherein:

(a.3a) a correctly decrypted version of said second secured key [PriUK*] has a prespecified format that indicates correct decryption thereof; and

(a.4a) a correctly decrypted version of said third secured key [PriUK*] has a prespecified format that indicates correct decryption thereof;

said method further comprising the step of;

(e) testing [250] the format of each of the putative second uncovering [121] and the putative third uncovering [PriWK1] for an indication of correct decryption.

5. A machine-instructing device [635] for instructing a prespecified, instructable machine [610] to carry out a method for providing intelligible access to algorithmically-secured data in response to an access request, wherein the access request includes submission of a password [101] and submission of an identification [152] of a requesting user, said instruction-defined method comprising the steps of:

(a) finding [200] a machine-readable passport [150] associated with the submitted identification, wherein said passport includes;

(a.1) a first field [152] having a user identification matching the submitted identification and associating the passport with a corresponding user;

(a.2) a second field [156] containing a first secured key [KS(0/1)*] derived from a valid password [PW] of the passport-associated user;

(a.3) a third field [155] containing a second secured key [PriUK*] covered by a plaintext version [KS(0/1)] of the first secured key; and

(a.4) a fourth field [154] containing a third secured key [PriWK1*] that is different from the first secured key;

(b) using [216] the submitted password [101] to attempt decryption of the first secured key [KS(0/1)*], said attempt producing a putative first uncovering [116] of the first secured key;

(c) using [245] the putative first uncovering [116] to attempt decryption of the second secured key [PriUK*], said attempt producing a putative second uncovering [121] of the second secured key; and

(d) using [235] the putative first uncovering [116] to attempt decryption of the third secured key [PriWK*], said attempt producing a putative third uncovering [PriWK1] of the third secured key.

6. The machine-instructing device [635] of claim 5 and further wherein said instruction-defined method comprises the steps of:

(e) checking [250] respective formats of the putative third uncovering [PriWK1] and of the putative second uncovering [121,PriUK] for compliance with predefined format requirements; and

(g) blocking [259] the requested access if said checking indicates that either one or both of the respective formats does not comply.

7. The machine-instructing device [635] of claim 5 wherein said passport further includes:

(a.5) a fifth field [157] containing a fourth secured key [KS1*], where a plaintext version [KS1] of the fourth secured key covers the third secured key [PriWK*1] of the fourth field [154]; and

wherein said instruction-defined method further comprises the steps of;

(e) determining [200] whether the found passport originated locally [201,210] or not [203,202];

(f) performing said step (d) of using [235] the putative first uncovering [116] to attempt the decryption of the third secured key [PriWK*] in response to a determination [128] by said determining step (e) that the found passport originated locally; and

(g) alternatively, in response to a determination [128] by said determining step (e) that the found passport did not originate locally, using data stored in said fifth field [157] and data stored in said third field [155] to attempt an alternate decryption [227,228] of the third secured key [PriWK*].

8. A machine-implemented method for providing intelligible access to algorithmically-secured data in response to an access request submitted at a first location [100], wherein the access request includes submission of a password [101] and submission of an identification [152] of a requesting user, said method [202] comprising the steps of:

(a) obtaining for importation into a physically secured part of said first location [221]a machine-readable passport [170] associated with the submitted identification, wherein said obtained passport includes;

(a.1) a first field [172] having a user identification matching the submitted identification and associating the passport with a corresponding user;

(a.2) a second field [176] containing a first algorithmically-secured key [KS0*] derived from a valid password [PW] of the passport-associated user;

(a.3) a third field [175] containing a second algorithmically-secured key [PriUK*] covered by a plaintext version [KS0] of the first secured key;

(a.4) a fourth field [174] that is either blank or contains irrelevant data, where a revised version [154] of the fourth field must be filled with a relevant, third algorithmically-secured key [PriWK1*] before said intelligible access is provided; and

(a.5) a fifth field [180] containing a digital signature covering at least said first through fourth fields; and

(b) using [222] the digital signature to authenticate the signature-covered contents of the obtained passport [170].

9. A machine-implemented method according to claim 8 wherein:

(a.6) the obtained passport further includes a sixth field [173] containing a public key [PubUK] of the passport-associated user;

(a.5a) the digital signature of said fifth field [180] further covers the sixth field; and

(b.1) said step of using the digital signature includes applying the public key of the sixth field [173] to the digital signature of the fifth field [180] for authenticating the signature-covered contents of the found passport.

10. A machine-implemented method according to claim 9 wherein:

(a.7) the obtained passport further includes a seventh field [171] containing an indication that the obtained passport originated at a location other than the first location [100];

(a.8) the obtained passport further includes an eighth field [177] that is either blank or contains irrelevant data; and

(a.5b) the digital signature of said fifth field [180] further covers the seventh and eighth fields.

11. A machine-implemented method according to claim 10 further comprising, if the signature-covered contents of the obtained passport are successfully authenticated [222] by the digital signature, the additional steps of:

(c) generating [223] a new key [KS1] at the first location [100];

(d) overwriting the eighth field [177] with an encrypted version [KS1*] of the new key, said encrypted version of the new key being covered by the public key [PubUK] of the passport-associated user;

(e) overwriting the fourth field [174] with an encrypted version [PriWK1*] of a location-specific key, said location-specific key being specific to the first location [100], said encrypted version of the location-specific key being covered by the new key [KS1].

12. A machine-implemented method according to claim 11 further comprising, after said steps of overwriting the fourth and eighth fields, the additional step of:

(f) overwriting the fifth field [160] with a new digital signature covering all other fields of the overwritten passport [150].

13. The machine-implemented method of claim 8 and further comprising the step of:

(c) after the obtained passport [170] is authenticated, generating [223] within said physically secured part, the third algorithmically-secured key [PriWK1*] for filling into said revised version [154] of the fourth field.

14. The machine-implemented method of claim 13 and further wherein said obtained passport includes:

(a.6) a sixth field [179] containing an encryption [DOS.txt*] of a predefined string, where said encryption of the predefined string is covered by the plaintext [KS0] of the first secured key; and

said method further comprises a performance, before the third algorithmically-secured key [PriWK1*] is generated for filling into said revised version [154] of the fourth field, of the steps of;

(d) using the submitted password and the second field [176] of the obtained passport to uncover [117] a plaintext version [KS0] of the first algorithmically-secured key;

(e) using the uncovered plaintext version [KS0] of the first algorithmically-secured key to attempt to produce [138] an uncovered version of the predefined string [DOS.txt] from the sixth field [179] of the obtained passport; and

(f) checking [139] the produced plaintext version of the data string for correctness, and if the check fails, blocking said step (c) of generating the third algorithmically-secured key [PriWK1*], thereby denying said intelligible access to the algorithmically-secured data [109] because of incompatibility between the obtained passport [170] and the supplied user identification [152], and the submitted putative password [101].

15. A machine-implemented method for providing intelligible access to algorithmically-secured data in response to an access request submitted at a first location [Wk2], wherein the access request includes submission of a password [101] and submission of an identification [152] of a requesting user at the first location, and further wherein a user-associated passport [150] required for servicing the access request is physically secured in a second location [100], said method [400] comprising the steps carried out at the second location of:

(a) finding [200] the passport [150] associated with the submitted identification, wherein said passport includes;

(a.1) a first field [152] having a user identification matching the submitted identification and associating the passport with a corresponding user;

(a.2) a second field [156] containing a first secured key [KS(0/1)*] derived from a valid password [PW] of the passport-associated user;

(a.3) a third field [155] containing a second secured key [PriUK*] covered by a plaintext version [KS(0/1)] of the first secured key;

(a.4) a fourth field [154] containing a third secured key [PriWK1*] that is different from the first secured key, said third secured key being covered by either a plaintext version the first secured key or by an alternate key [KS1];

(a.5) a fifth field [157] containing a secured copy [KS1*] of the alternate key, said secured copy of the alternate key being covered by the public key [PubUK] of the passport-associated user; and

(a.6) a sixth field [160] containing a digital signature covering at least said first through fifth fields;

(b) copying [410] the found passport;

(c) clearing [420] the fourth and fifth fields [154,157] of the passport copy;

(d) overwriting [430] the sixth field [160] of the passport copy with a new digital signature covering all other fields of the cleared passport copy; and

(e) exporting [450] the cleared and resigned passport copy [170] out of the second location [100].

16. A machine-implemented method for protecting algorithmically-secured data [109] from being intelligibly accessed [123/113] by other than authorized users, where an access request includes submission of a putative password [101] of an authorized user, and submission of a putative identification [152] of the same authorized user [X/Y/Z] to a request-servicing station [100,600] that has physically secured, storage [640,650] and processing [610] facilities, said method [200] comprising the steps of:

(a) requiring presentation within said physically secured, storage facilities of the request-servicing station, of an authenticated [210,222] passport record associated with a user identified by the putative identification, where the presented passport record [150] includes;

(a.1) a first field [156] containing data of a first algorithmically-secured key [KS(0/1)*], where said first secured key is derived from a valid password [PW] of the passport-associated user and from a first counterpart-plaintext key [115] that is temporarily originated [112] in either the physically secured facilities of the request-servicing station or in physically secured facilities of a like, external station;

(a.2) a second field [155] containing data of a second algorithmically-secured key [PriUK*], where said second secured key is derived from a second counterpart and private key of the passport-associated user and from said first counterpart-plaintext key [KS(0/1),115];

(a.3) a third field [157] containing data of a third algorithmically-secured key [KS1)*], where said third secured key is derived from a public key [PubUK_-- X] of the passport-associated user and from a third counterpart-plaintext key [115] that is temporarily created [112] in the physically secured facilities of the request-servicing station, where the third counterpart-plaintext key [KS1] may be the same as the first counterpart-plaintext key [KS(0/1)] if both of the first and third counterpart-plaintext keys originate in the physically secured facilities of the request-servicing station;

(a.4) a fourth field [154] containing data of a fourth algorithmically-secured key [PriWK1*], where said fourth secured key is derived from a fourth counterpart and private key [162] of the request-servicing station [100] and from said third counterpart-plaintext key [KS1];

(b) requiring use of the data of said fourth field [154] and use of the data of at least of said first field [156] for reproducing [118] in the physically secured facilities of the request-servicing station, said fourth counterpart and private key [162] of the request-servicing station; and

(c) requiring use of the data of said second field [155] and use of the data of said first field [156] for reproducing [120] in the physically secured facilities of the request-servicing station, said second counterpart and private key of the passport-associated user.

17. The machine-implemented method of claim 16 and further comprising the step of:

(d) preventing [161] transmission to outside of the physically secured facilities of the request-servicing station, of the data in said third field [157].

18. The machine-implemented method of claim 17 and further comprising the step of:

(e) preventing [161] transmission to outside of the physically secured facilities of the request-servicing station, of the data in said fourth field [154].

19. The machine-implemented method of claim 17 and further comprising the step of:

(e) allowing export to outside of the physically secured facilities of the request-servicing station, of an authenticatable copy [170] of said authenticated passport record where the authenticatable copy [170] does not contain in its respective third and fourth fields, the corresponding data of the third and fourth fields of the authenticated and physically secured passport record [150].