Authenticating communications

• US 6,912,653 B2
• Filed: 01/23/2001
• Issued: 06/28/2005
• Est. Priority Date: 01/23/2001
• Status: Active Grant

• Current Assignee: Siemens Industry Software Limited (Siemens AG)
• Original Assignee: Mentor Graphics (Egypt) (Siemens AG)
• Inventors: Gohl, Erika Monika
• Primary Examiner(s): Darrow, Justin T.
• Application Number:
  US09/767,617
• Publication Number:
  US 20020099942A1
• Time in Patent Office: 1,617 Days
• Field of Search: 713/155, 713/162, 713/167, 713/168, 713/170, 380/229, 380/232, 380/248, 705/67, 709/202, 709/203, 709/227, 709/228, 709/237
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method and apparatus are described that authenticates a first terminal to a second terminal. In one embodiment, the invention includes, requesting a string from the second terminal, obtaining the requested string from the second terminal, merging the obtained string with a password to create an identification code, receiving an authentication if the identification code matches an identification code expected at the second terminal and sending information from an information server to the authenticated first terminal. In a further embodiment, the string is a pseudo random number sequence and an element of an ordered series. Merging the string can include merging the string with the password using an applet at the first terminal, the applet executing an encryption algorithm with a unique merging key.

Claims

1. A method for authenticating a first terminal to a second terminal comprising:

requesting a string from the second terminal;

obtaining the requested string from the second terminal;

merging the obtained string with a user-entered, encrypted password to create an identification code;

receiving an authentication if the identification code matches an identification code expected at the second terminal; and

sending information from an information server to the first terminal.

2. The method of claim 1, wherein the string is a pseudo random number sequence.

3. The method of claim 1, wherein the string is an element of an ordered series.

4. The method of claim 1, wherein merging the string comprises performing a block addition of the string and the password.

5. The method of claim 1, further comprising opening another communications session using a string that is an element of an ordered series and wherein the string of the prior communications session is the preceding element of the same ordered series.

6. A method for authenticating a first terminal to a second terminal comprising:

requesting a string from the second terminal;

obtaining the requested string from the second terminal;

merging the obtained string with a user-entered, encrypted password to create an identification code, wherein merging the string comprises merging the string with the password using an applet at the first terminal, the applet executing an encryption algorithm with a unique merging key;

receiving an authentication if the identification code matches an identification code expected at the second terminal; and

sending information from an information server to the first terminal.

7. The method of claim 6, further comprising closing the applet after sending the encrypted data and thereby invalidating the string.

8. A method for authenticating a first terminal to a second terminal comprising:

requesting a string from the second terminal;

obtaining the requested string from the second terminal;

merging the obtained string with a password to create an identification code, wherein merging the string comprises performing a block addition of the string and the password, wherein performing a block addition further comprises performing a permutation to the string and to the password and adding the permutated string and the permutated password;

receiving an authentication if the identification code matches an identification code expected at the second terminal; and

sending information from an information server to the first terminal.

9. A method for authenticating a first terminal to a second terminal comprising:

requesting a string from the second terminal;

obtaining the requested string from the second terminal, wherein obtaining the requested string comprises receiving a web page containing a program for generating requests and the string;

merging the obtained string with a password to create an identification code;

receiving an authentication if the identification code matches an identification code expected at the second terminal; and

sending information from an information server to the first terminal.

10. The method of claim 9, wherein the web page is an HTML page and the program is an applet.

11. A method for authenticating a first terminal to a second terminal comprising;

creating a string and storing it in association with an identification of a first terminal;

sending the string to the first terminal;

receiving an identification code from the first terminal composed by merging the sent string with a sender password;

comparing the identification code to an expected identification code; and

if the identification code matched an expected identification code, then authenticating the first terminal.

12. The method of claim 11, wherein the string is a pseudo random number sequence.

13. The method of claim 11, wherein the string is an element of an ordered series.

14. The method of claim 11, wherein merging the string comprises performing a block addition of the string and the password.

15. The method of claim 14, wherein performing a block addition further comprises performing a permutation to the string and to the password and adding the permutated string and the permutated password.

16. The method of claim 11, further comprising opening another communications session using a string that is an element of an ordered series and wherein the string of the prior communications session is the preceding element of the same ordered series.

17. A method for authenticating a first terminal to a second terminal comprising:

creating a string and storing it in association with an identification of a first terminal;

sending the string to the first terminal;

receiving an identification code from the first terminal composed by merging the sent string with a sender password, wherein merging the string comprises merging the string with the password using an applet at the first terminal, the applet executing an encryption algorithm with a unique merging key;

comparing the identification code to an expected identification code; and

if the identification code matched an expected identification code, then authenticating the first terminal.

18. The method of claim 17, further comprising closing the applet after sending the encrypted data and thereby invalidating the string.

19. A method for authenticating a first terminal to a second terminal comprising:

creating a string and storing it in association with an identification of a first terminal;

sending the string to the first terminal, wherein sending the string comprises sending a web page containing a program for generating requests and the string;

receiving an identification code from the first terminal composed by merging the sent string with a sender password;

comparing the identification code to an expected identification code; and

if the identification code matched an expected identification code, then authenticating the first terminal.

20. The method of claim 19, wherein the web page is an HTML page and the program is an applet.

21. An authentication terminal comprising:

a merge string library coupled to a processor to create a merge string and to store it in association with an identification of a second terminal;

an output device to send the merge string to the second terminal;

an input device to receive an identification code from the second terminal, the identification code being composed by merging the sent string with a second terminal password; and

an identification test library coupled to the processor to compare the identification code to an expected identification code and if the identification code matches an expected identification code, to authenticate the second terminal.

22. The terminal of claim 21, wherein the string is an element of an ordered series.

23. An authentication terminal comprising:

a merge string library coupled to a processor to create a merge string and to store it in association with an identification of a second terminal;

an output device to send the merge string to the second terminal;

an input device to receive an identification code from the second terminal, the identification code, being composed be merging the sent string with a second terminal password;

an identification test library coupled to the processor to compare the identification code to an expected identification code and if the identification code matches an expected identification code, to authenticate the second terminal; and

an encryption library coupled to the processor to generate the expected identification code by merging the string with the second terminal password using an encryption algorithm with a merging key unique to the second terminal.

24. An authentication terminal comprising:

a merge string library coupled to a processor to create a merge string and to store it in association with an identification of a second terminal;

an output device to send the merge string to the second terminal;

an input device to receive an identification code from the second terminal, the identification code being composed by merging the sent string with a second terminal password, wherein the terminal is a web server, wherein the input device and the output device communicate over the web and wherein the terminal transmits a web page to the second terminal containing a program for merging the second terminal password and the merge string; and

an identification test library coupled to the processor to compare the identification code to an expected identification code and if the identification code matches an expected identification code, to authenticate the second terminal.