User authentication in a communications network

• US 6,574,730 B1
• Filed: 02/11/1997
• Issued: 06/03/2003
• Est. Priority Date: 08/17/1994
• Status: Expired due to Fees

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Roberts, David Anthony, Hicks, Richard Middleton, Harding, Peter Maxwell, Meyerstein, Michael Victor, Stirland, Mark Jonathan, Britnell, Michael John, Rabson, John, Bosworth, Kevin Paul, Bissell, Robert Andrew, Swale, Richard Paul, Kingan, Jonathan James, Ranger, Jonathan Crispin, Nolde, Keith Eric
• Primary Examiner(s): BARRON JR, GILBERTO
• Application Number:
  US08/797,699
• Time in Patent Office: 2,303 Days
• Field of Search: 386/21, 386/23, 386/25, 386/49, 713/168, 713/169, 380/257, 380/266, 380/262
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04Q 2213/13339 Ciphering, encryption, security
• CPC Class Codes: H04Q 2213/13515 authentication, authorisation - fraud prevention
• CPC Class Codes: H04Q 3/0029 Provisions for intelligent networking

Abstract

An authentication system of a terminal on a public switched telephone network provides a security node associated with a local exchange and a network terminal. For one-way authentication, the terminal responds to a call initiation by sending a unique authentication code comprising a number and a secret key encrypted according to a first algorithm, the secret key being specific to the terminal. The security node constructs the expected authentication code from the number, using the first algorithm and a second key which is a function of a terminal identification number, and compares the expected code with the received code. In two-way authentication, the security node responds to the call initiation by sending a transaction number to the terminal encrypted according to a second algorithm. The terminal generates the authentication code as a function of the first algorithm, the secret key and the transaction number. The authentication code is sent back to the security node. An expected code is compared with the received one in the same way. In both cases, a match between expected and received authentication codes constitutes authentication of the terminal allowing the user access to the network.

Claims

1. A telecommunications station for use with a telecommunications network, said station performing an authentication process in which said station exchanges authentication signals with the network and permits exchange of telecommunications traffic with the network only when said authentication process is successful, said station comprising:

a network termination unit with a network port for connection to said network, and a terminal port for connection to separate non-authenticating user equipment;

separate non-authenticating user equipment removably connected to said terminal port;

wherein;

said network termination unit contains circuitry, connected to said network port, for performing said authentication process automatically upon detection of an off-hook condition indicating initiation of use of said separate non-authenticating user equipment and without further user intervention, and a switch connected between said terminal port and said network port, said switch being responsive to signals from said authentication circuitry to permit exchange of said telecommunications traffic between said user equipment and said network only when said authentication process is successful.

2. An authentication station for connection between a telecommunications network and separate non-authenticating user equipment, comprising:

a network port for connecting the authentication station to the telecommunications network;

a terminal port for removably connecting the authentication station to the separate non-authenticating user equipment, said separate non-authenticating user equipment being incapable of providing authentication for any other equipment connected thereto; and

authentication circuitry for automatically, upon detection of an off-hook condition indicating initiation of use of said separate non-authenticating user equipment and without further user intervention, exchanging authentication signals with the network and permitting exchange of telecommunications traffic between the telecommunications network and the separate non-authenticating user equipment only when an authentication process between the telecommunications network and said authentication station permits said exchange.

3. A method of authenticating a line of a communications network automatically upon detection of an off-hook condition of separate non-authenticating user equipment and without further user intervention, the line being connected to a network termination unit, said network termination unit not functioning as a user terminal and having a port for removable operative connection to said separate non-authenticating user equipment, the method comprising the steps of:

detecting an off-hook condition of the separate non-authenticating user equipment;

indicating to a security node associated with the network that a user of the network termination unit requires use of the network;

calculating an authentication code at the network termination unit, the authentication code being a function of a transaction number encrypted by means of at least one first key associated with the termination unit, and an algorithm;

transmitting the authentication code to the security node;

calculating an expected authentication code at the security node based on the transaction number, the algorithm and said at least one first key;

comparing the expected authentication code with the received authentication code; and

denying unrestricted access to the network for the network termination unit unless the expected and received authentication codes match.

4. A method as claimed in claim 3, in which the security node calculates said at least one first key for the network termination unit, each said at least one first key being a function of a security algorithm stored within the node, an identification code for the network termination unit and a second key, each said at least one first key being loaded into the network termination unit for later use with the first algorithm in authenticating a line.

5. A method as claimed in claim 4, in which a first key is loaded into the network termination unit remotely by the security node, or locally from storage means connected temporarily to the unit.

6. A method as claimed in claim 3, in which the security node generates the transaction number, which is sent as a challenge to the network termination unit in response to the indication received by the security node that the user requires use of the network.

7. A method as claimed in claim 3, in which the network termination unit transmits a negative acknowledgment to the security node when no challenge, or an invalid challenge, is received following an indication that the user requires use of the network.

8. A method as claimed in claim 3, in which the security node permits a dial tone to be established with the network termination unit independent of the result of the authentication.

9. A method as claimed in claim 3, in which the telecommunications network has a plurality of exchanges, each for routing traffic to, and from, a plurality of network termination units, at least one of the exchanges having the security node associated therewith.

10. A system for authenticating lines of a communications network automatically upon detection of an off-hook condition of separate non-authenticating user equipment each connected to the network via a network termination unit and without further user intervention, comprising:

a plurality of network termination units each connected to the network, each of said plurality of network termination units not functioning as a user terminal and having a terminal port for removable operative connection to said separate non-authenticating user equipment compatible with the network, at least one of the network termination units comprising processing means including a memory, and signaling means operably connected to the network and enabled by the processing means, the signaling means being arranged to transmit to the line an authentication code automatically after a potential user initiates a use of the network, the authentication code being calculated by the processing means as a function of a transaction number encrypted by means of an algorithm and a key associated with that network termination unit; and

a security node operable to receive authentication codes from the network termination units, to determine whether a received code corresponds, in accordance with said algorithm, to the transaction number a key corresponding to that network termination unit, and to deny unrestricted access to the network for that unit unless such correspondence is found.

11. A system as claimed in claim 10, in which the security node includes means operable to calculate the first key as a function of a security algorithm stored in the node, an identification code for that network termination unit, and a second key, and to transmit the first-mentioned key to that unit for later use in the authentication of that unit.

12. A system as claimed in claim 10, in which the security node further includes means operable to generate the transaction number, and node signaling means for sending the transaction number as a challenge to a line in response to an indication received by the security node that the user of that line requires use of the network.

13. A system as claimed in claim 10, in which the network termination unit includes means for transmitting a negative acknowledgment to the security node when no challenge, or an invalid challenge, is received following an indication that the user requires use of the network.

14. A system as claimed in claim 10, in which the network is a telecommunications network having a plurality of exchanges, each for routing traffic to, and from, a number of network termination units, at least one of the exchanges having the security node associated therewith.

15. A system as claimed in claim 14, in which the security node is arranged to permit a dial tone to be established with that network termination unit independent of the result of the authentication.

16. A network termination unit for a communications network, the network termination unit not functioning as a user terminal and comprising a terminal port for removable operative connection to separate non-authenticating user equipment compatible with the network, a network port for connecting the network termination unit to a line of the network, processing means including a memory, and signaling means arranged to transmit signals through the network port, the processing means being operable, following initiation of use of the network by a user, to automatically, upon detection of an off-hook condition of said separate non-authenticating user equipment connected to said network termination unit and without further user intervention, calculate an authentication code which is a function of a transaction number encrypted by means of an algorithm and a key stored in the processing means and to enable the signaling means to transmit the authentication code through the network port.

17. A network termination unit as claimed in claim 16, in which the processing means is arranged to receive signals through the network port and is responsive to a challenge signal from the network to calculate the authentication code and to enable the signaling means, the transaction number being obtained from the challenge signal.

18. A network termination unit as claimed in claim 17, in which the processing means includes error checking means for signals received through the network port, the processing means being operable to enable the signaling means to transmit a negative acknowledgment in the event that an invalid challenge is received from the network.

19. A communications network comprising:

a plurality of network termination units connected to the network, said network termination units not functioning as a user terminal and including a terminal port for removable operative connection to separate non-authenticating user equipment;

at least one of said plurality of network termination units comprising a processor, said processor including a memory and a signaling circuit enabled by said processor and operatively connected to the network;

said signaling circuit being arranged to transmit an authentication code automatically, upon detection of an off-hook condition of said separate non-authenticating user equipment connected to said network termination unit and without further user intervention, said authentication code being determined by the processor based on a transaction number encrypted by an algorithm and a key associated with the network termination unit; and

a security node operable to receive authentication codes from the network termination units, said security node further determining whether a received code corresponds to the transaction number and a key corresponding to that network termination unit, said security node denying unrestricted access to the network for that unit unless a correspondence is found.

20. A network termination unit that does not function as a user terminal comprising:

a terminal port for removably operatively connecting the network termination unit to separate non-authenticating user equipment;

a network port for connecting the network termination unit to a line of a communications network; and

a processor including a memory and a signaling circuit arranged to transmit signals through the network port, said processor being operable, automatically, upon detection of an off-hook condition of said separate non-authenticating user equipment connected to said network termination unit and without further user intervention, to determine an authentication code based on a transaction number encrypted by means of an algorithm and a key stored in the processor, said processor further enabling the signaling circuit to transmit the authentication code through the network port.