User authentication method and user authentication system

• US 6,615,353 B1
• Filed: 07/17/1998
• Issued: 09/02/2003
• Est. Priority Date: 07/23/1997
• Status: Expired due to Fees

• Current Assignee: Yokogawa Digital Computer Corp. (DTS Corporation)
• Original Assignee: Yokogawa Digital Computer Corp. (DTS Corporation)
• Inventors: Hashiguchi, Masahiro
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): Arani, Taghi T.
• Application Number:
  US09/118,149
• Time in Patent Office: 1,873 Days
• Field of Search: 380/262, 380/43, 713/162, 713/167, 713/168, 713/185, 713/201, 713/193, 713/202, 713/183, 705/51
• US Class Current: 713/185
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A user authentication method and system which maintains reliable security using a low cost storage medium in place of cryptocards, wherein the system comprises control equipment and an operating section connected to the control equipment, and wherein the method comprises the steps of the operating section reading a storage medium that stores specific parameters, creating a user authenticaly code using a specific function from the specific parameters and other parameters provided by the control equipment, and supplying the created user authentication code to the control equipment, wherein the user authentication code sent from the operating section is compared with another code computed using a specific function generated by the control equipment, and when both codes are found to coincide, the control equipment causes information to be interchanged between the control equipment and the operating section. Advantageously, the invention method provides reliable security combined with low cost.

Claims

1. An authentication method using a one time authentication code, and comprising the steps of:

in advance of a current authentication request, writing in a reusable particular storage means disposed in an operating section, authentication purpose information comprising;

a changeable user identification parameter,

an unchangeable unique parameter assigned to said particular storage means, and

a changeable access parameter which includes date and time and sequence number of a prior authentication request using said particular storage means, so that no separate input mechanism is required to supply input data for personal identification at time of an authentication request, wherein said particular storage means is interchangeable with a plurality of similar storage means with each storage means having an unchangeable unique different parameter assigned thereto and also having stored therein other parameters similar to those stored in said particular storage means, and with the same one of said changeable user identification parameter being written into one or more of said plurality of storage means;

storing in a control section authentication purpose information comprising said changeable user indentification parameter, said unchangeable unique parameter assigned to said particular storage means; and

said changeable access parameter including date and time and sequence number of said prior authentication request;

requesting current authentication without use of an input mechanism to input data for personal identification at time of requesting authentication by reading said authentication purpose information from said particular storage means;

creating a one time current authentication code from said authentication purpose information read from said particular storage means, said authentication purpose information comprising said changeable user indentification parameter, said unchangeable unique parameter assigned to said particular storage means, and said changeable access parameter including date and time and sequence number of a prior authentication request, and using a first specific function based on priorly stored information;

sending said one time current authentication code and said user identification parameter from said operating section to said control section;

creating in said control section a current checking code from said one time current authentication code and said user identification parameter sent from said operating section and using a second special function based on priorly stored information including date and time and sequence number of a prior authentication request from the same particular storage means and corresponding to said user identification parameter;

updating said access parameter with respect to date and time and sequence number of said current authentication request for the corresponding unchangeable unique parameter assigned to said particular storage means and corresponding to said user identification parameter;

storing in said control section said updated access parameter;

comparing said one time current authentication code and said current checking code for authentication;

sending results of authentication back to said operating section; and

providing said particular storage means with an updated access parameter identifying the updated date and time and sequence number of the current authentication request,

whereby security is maintained keeping the unique parameter assigned to a particular storage means in a form which cannot be accessed by any outside means.

2. The method of claim 1, wherein a proxy is created in said control section and is used in the comparing step.

3. The method of claim 1, wherein said operating section obtains an applet from said control section and said applet obtains said access parameter from said particular storage means and provides information to said particular storage means for updating said access parameter in said particular storage means.

4. An authentication systems comprising:

a reusable particular storage means which is interchangeable with a plurality of similar storage means;

an operating section comprising said particular storage means; and

a control section connected to said operating section;

wherein;

in advance of a current authentication request, writing in said particular storage means, authentication purpose information comprising;

a changeable user identification parameter, an unchangeable unique parameter assigned to said particular storage means, and a changeable access parameter which includes date and time and sequence number of a prior authentication request using said particular storage means, so that no separate input mechanism is required to supply input data for personal identification at time of an authentication request, wherein said particular storage means is interchangeable with said plurality of similar storage means with each storage means having an unchangeable unique different parameter assigned thereto and also having stored therein other parameters similar to those stored in said particular storage means, and with the same one of said changeable user identification parameter being written into one or more of said plurality of storage means;

storing in said control section authentication purpose information comprising said changeable user identification parameter, said unchangeable unique parameter assigned to said particular storage means, and said changeable access parameter including date and time and sequence number of said prior authentication request;

requesting current authentication without use of an input mechanism to input data for personal identification at time of requesting authentication by reading said authentication purpose information from said particular storage means;

creating a one time current authentication code from said authentication purpose information read from said particular storage means, said authentication purpose information comprising said changeable user identification parameter, said unchangeable unique parameter assigned to said particular storage means, and said changeable access parameter including date and time and sequence number of a prior authentication request, and using a first specific function based on priorly stored information;

sending said one time current authentication code and said user identification parameter from said operating section to said control section;

creating in said control section a current checking code from said one time current authentication code and said user identification parameter sent from said operating section and using a second special function based on priorly stored information including date and time and sequence number of a prior authentication request from the same particular storage means and corresponding to said user identification parameter;

updating said access parameter with respect to data and time and sequence number of said current authentication request for the corresponding unchangeable unique parameter assigned to said particular storage means and corresponding to said user identification parameter;

storing in said control section said updated access parameter;

comparing said one time current authentication code and said current checking code for authentication;

sending results of authentication back to said operating section; and

providing said particular storage means with an updated access parameter identifying the updated date and time and sequence number of the current authentication request, whereby security is maintained by keeping the unique parameter assigned to a particular storage means in a form not identifiable by any outside means.

5. The system of claim 4, further comprising means for creating a proxy in said control section to be used in place of a user.

6. The system of claim 4, wherein said operating section comprises means for obtaining an applet from said control section and wherein said applet obtains said access parameter from said operating section and provides information to update said access parameter.

7. An authentication method using a system comprising a control section and an operating section, said method comprising the steps of:

reading from a particular storage means authentication information previously written in said particular storage means, said authentication information comprising a changeable user information parameter, an unchangeable unique parameter assigned to said particular storage means, and a changeable access parameter including date and time and sequence number of a prior authentication request using that particular storage means, wherein said particular storage means is interchangeable with a plurality of similar storage means, each having written thereinto a different unique parameter assigned thereto;

creating a one time current authentication code using said authentication information read from said particular storage means and using a first specific function based on priorly stored information so that said unchangeable unique parameter assigned to said particular storage means cannot be identified by any outside source;

sending to said control section said one time current authentication code together with said user information parameter obtained from said reading step;

creating a current checking code in said control section using said user identification and a second specific function based on previously stored information; and

comparing said current authentication code and said current checking code for authentication;

whereby security of access is maintained by keeping secret from outside influence at least the unique parameter assigned to said particular storage means.

8. The method of claim 7, wherein said storage means is a floppy disk.

9. An authentication method wherein a user with a browser accesses an authentication manager and an authentication web server connected to a network, said method comprising the steps of:

said user accesses a targeted page from said authentication web server using said browser;

said web server sending an applet for authentication to said browser;

using said applet in said browser for authentication;

reading user information including user name from a storage disk for authentication;

creating a challenge code with said user information, an unchangeable unique parameter assigned to said storage disk, and a changeable access parameter which includes date and time and sequence number of a prior authentication request read from said storage disk; and

sending said user name and said challenge code to said authentication manager;

said authentication manager then;

authenticating the user by analyzing user name and challenge code, and

then sending authentication results to said browser;

said browser upon identifying said user with the authentication results;

creating a new Uniform Resource Locator to access a targeted page, and

accessing the web server using said new Uniform Resource Locator and a key to obtain said targeted page;

said web server;

authenticating the received new Uniform Resource Locator and

thereafter obtaining the targeted page from a linked web site and then

sending the targeted page to said browser; and

said browser causing display of said targeted page.

10. The method of claim 9, wherein said authentication manager concurrently with sending of authentication results to said browser, creates a proxy for the authenticated user and sends said proxy to said web server;

and wherein said browser accesses the web server without using any key to obtain the targeted page.

11. An apparatus on a computer readable medium for authenticating a user, comprising:

an authentication manager, a browser and a web server;

wherein

said browser comprises means for accessing a targeted page from said web server;

said web server comprises means for sending an applet for authentication to said browser;

said browser comprising means for running said applet for authentication, a storage disk for reading using information including user name from said storage disk for authentication, means for creating a challenge code with said user name, an unchangeable unique parameter assigned to said storage disk, and a changeable access parameter which includes date and time and sequence number of prior authentication request read from said storage disk, and means for sending said user name and said challenge code to said authentication manager;

said authentication manager comprising means for the authentication of said user of said browser by analyzing user name and challenge code, and means for then sending authentication results to said browser;

said browser further comprising means upon identifying said user with the authentication results for creating a new Uniform Resource Locator and key to access a targeted page, and means for accessing the web server using said new Uniform Resource Locator and key to obtain the targeted page;

said web server further comprising means for authenticating the received new Uniform Resource Locator and key and means for thereafter obtaining the targeted page from a linked web site and sending the targeted page to said browser; and

said browser causing display of the targeted page.

12. The apparatus of claim 11, wherein said authentication manager comprises means for creating a proxy for the authentication user concurrently with the sending of the authentication results to said browser;

and wherein said web server further comprises means for using said proxy for the authentication user in place of the key from the browser.