System and method for building and exchanging encrypted passwords between a client and server

• US 6,182,220 B1
• Filed: 03/30/1998
• Issued: 01/30/2001
• Est. Priority Date: 03/30/1998
• Status: Expired due to Term

• Current Assignee: Uniloc 2017 LLC (SoftBank Group Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Rieth, Paul Francis, Murphy, Jr., Thomas Edwin, Chen, Qilun, Stevens, Jeffrey Scott
• Primary Examiner(s): Swann, Tod R.
• Assistant Examiner(s): Smithers, Matthew
• Application Number:
  US09/050,679
• Time in Patent Office: 1,037 Days
• Field of Search: 713/182, 713/183, 709/208, 380/255, 380/259, 380/262
• US Class Current: 713/182
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method and system is provided for communicating encrypted user passwords from a client to a server. During new environment negotiations, the server communicates to the client a server random seed value. The client then generates a client random seed value and, using the client random seed value, the server random seed value, and the user variable name, an encrypted user password. The client then communicates to the server the client random seed, the user variable name and the encrypted user password. Then the server validates the encrypted user password using the server random seed, the client random seed and the user variable name.

Claims

1. Method for communicating encrypted user passwords from a client to a server, comprising the steps of:

during new environment negotiations, communicating from the server to the client a server random seed value;

generating at said client a client random seed value and, using said client random seed value, said server random seed value, said user variable name and an encrypted user password;

communicating from said client to said server said client random seed, said user variable name and said encrypted user password; and

at said server, validating said encrypted user password using both said server random seed, said client random seed and said user variable name.

2. The method of claim 1, wherein a single user variable is used for communicating said server random seed and a request for said client random seed.

3. Method for encrypting and communicating a user password from a client system to a server system, comprising the steps of:

communicating from said server to said client an invitation to engage in new environment negotiations;

communicating from said client to said server a willingness to engage in new environment negotiations;

communicating from said server to said client a request for a user variable name, said request including a server seed;

operating said client to generate a client seed and, responsive to said user variable name, said user password, server seed and client seed, to form an encrypted password; and

communicating from said client to said server said user variable name including said encrypted password, said client seed and said user variable name.

4. The method of claim 3, comprising the further steps of:

when communicating said server seed from said server to said client, associating said server seed with a first command identifier, and

when communicating said client seed from said client to said server, associating said client seed with said first command identifier.

5. Method for encrypting and communicating a user variable name and a user password from a Telnet client system to a Telnet server system, comprising the steps of:

communicating from said Telnet server to said Telnet client a DO NEW-ENVIRON invitation;

communicating from said Telnet client to said Telnet server a WILL NEW-ENVIRON response;

communicating from said Telnet server to said Telnet client a sub-negotiation NEW-ENVIRON SEND invitation including the user variable SRVRSEEDxxxxxxxx consisting of the variable identifier SRVRSEED carrying a server seed;

operating said Telnet client to generate a client seed and, responsive to said user variable name, said user password, server seed and client seed, to form an encrypted password; and

communicating from said Telnet client to said Telnet server a sub-negotiation NEW-ENVIRON IS response including an encrypted password and said client seed carryied with said SRVRSEED variable identifier and said user variable name.

6. Method for receiving at a server system an encrypted user password from a client system, comprising the steps of:

communicating to said client an invitation to engage in new environment negotiations;

receiving from said client a response indicating willingness to engage in new environment negotiations;

communicating to said client a request for a user variable name, said request including a server seed;

receiving from said client said user variable name including a client seed and said encrypted password;

operating said server using said server seed, said client seed and said user variable name to decrypt said encrypted password.

7. Method for encrypting and communicating a user password from a client system to a server system, comprising the steps of:

receiving from said server an invitation to engage in new environment negotiations;

communicating from said client to said server a willingness to engage in new environment negotiations;

receiving from said server a request for a user variable name, said request including a server seed;

generating a client seed and, responsive to said user password, user variable name, server seed and client seed, forming an encrypted password; and

communicating to said server said user variable name including said encrypted password and said client seed.

8. System for communicating encrypted user passwords from a client to a server, comprising:

means responsive during new environment negotiations for communicating from the server to the client a server random seed value;

means at said client for generating a client random seed value and, using said user variable name, said client random seed value and said server random seed value, an encrypted user password;

means for communicating from said client to said server said client random seed, said user variable name and said encrypted user password; and

means at said server for validating said encrypted user password using said server random seed, said client random seed and said user variable name.

9. A program storage device readable by a client machine, tangibly embodying a program of instructions executable by a machine to perform method steps for encrypting and communicating to a server a user password, said method steps comprising:

receiving from said server an invitation to engage in new environment negotiations;

communicating from said client to said server a willingness to engage in new environment negotiations;

receiving from said server a request for a user variable name, said request including a server seed;

generating a client seed and, responsive to said user password, user variable name, server seed and client seed, forming an encrypted password; and

communicating to said server said user variable name including said encrypted password and said client seed.

10. An article of manufacture comprising:

a computer usable medium having computer readable program code means embodied therein for encrypting and communicating to a server a user password, the computer readable program means in said article of manufacture comprising;

computer readable program code means for causing a computer to effect receiving from said server an invitation to engage in new environment negotiations;

computer readable program code means for causing a computer to effect communicating from said client to said server a willingness to engage in new environment negotiations;

computer readable program code means for causing a computer to effect receiving from said server a request for a user variable name, said request including a server seed;

computer readable program code means for causing a computer to effect generating a client seed and,

responsive to said user password, user variable name, server seed and client seed, forming an encrypted password; and

computer readable program code means for causing a computer to effect communicating to said server said user variable name including said encrypted password and said client seed.

11. Method for communicating an encrypted user password over a wide area network from a nurse data device used by a nurse to maintain a database of patient information at a server system, comprising the steps of:

during new environment negotiations, communicating from the server to said nurse data device a server random seed value;

generating at said nurse data device a device random seed value and, using both said device random seed value, said server random seed value, and nurse identifier, an encrypted user password;

communicating from said nurse data device to said server said device random seed, said encrypted user password and said nurse identifier; and

at said server, validating said encrypted user password using said server random seed, said device random seed and said nurse identifier.