System and method for strong access control to a network

• US 7,310,813 B2
• Filed: 09/30/2003
• Issued: 12/18/2007
• Est. Priority Date: 09/30/2002
• Status: Active Grant

• Current Assignee: Authenex Incorporated
• Original Assignee: Authenex Incorporated
• Inventors: Lin, Paul, Hon, Henry, Lu, Jenny
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US10/675,496
• Publication Number:
  US 20040064740A1
• Time in Patent Office: 1,540 Days
• Field of Search: 726/2, 726/3
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0838 using one-time-passwords

Abstract

A system and method for strong access control to a network is provided. An access control server and authentication device are provided for controlling access to a network. The access controlled by the access control server may include network protocols, network resources, and electronic devices that may be coupled to the network. Network resources may include data stored on the network. The access control server may grant access to the network to a user based upon a correct response received from an authentication device assigned to the user. The user may be able to access only selected data that may be determined by an access level assigned to the authentication device. Upon authentication, the authentication device must remain active to maintain a network session. The authentication device becomes inactive when it is deactivated, uncoupled from the network, or in any mode in which the device cannot produce a response to the access control server. The network session ends when it is determined that the authentication device is inactive.

Claims

1. A method for strong access control to a network, the method comprising the following steps:

(a) coupling an authentication device to a network;

(b) transmitting an initial response;

(c) generating a network response upon receipt of the initial response;

(d) comparing the initial response and the network response;

(e) authenticating the authentication device if the initial response and network response match, and not authenticating the authentication device if the initial response and network response do not match;

(f) providing access to network resources upon authentication of the authentication device;

(g) transmitting a subsequent response for accessing subsequent network resources;

(h) comparing the subsequent response to a subsequent network response;

(i) authenticating the authentication device if the subsequent response and subsequent network response match, and not authenticating the authentication device if the subsequent response and subsequent network do not match; and

(j) providing access to subsequent network resources upon authentication of the authentication device.

2. The method of claim 1 wherein access to network resources is determined by an access level assigned to the authentication device.

3. The method of claim 1 further comprising:

(k) determining whether the authentication device is coupled to the network, if the authentication device is not coupled to the network then repeating steps (a) through (f) and if the device is coupled to the network then providing access to network resources upon authentication of the authentication device.

4. The claim 1 further comprising:

(l) repeating steps (g) through (j) for each subsequent response for accessing subsequent network resources.

5. A method for strong access control to a network, the method comprising the following steps:

(a) coupling an authentication device to a network;

(b) generating an access request for accessing network resources;

(c) generating a challenge upon receipt of the access request;

(d) generating an initial response upon receipt of the challenge;

(e) generating an initial network response upon receipt of the initial response;

(f) comparing the initial response and initial network response;

(g) authenticating the authentication device if the initial response and initial network response match, and not authenticating the authentication device if the initial response and initial network response do not match;

(h) providing limited access to network resources to the authentication device upon authentication of the authentication device;

(i) transmitting a subsequent access request for accessing subsequent network resources;

(j) generating a subsequent network response upon receipt of the subsequent access request;

(k) comparing the subsequent access request and subsequent network response;

(l) authenticating the authentication device if the subsequent access request and subsequent network response match, and not authenticating the authentication device if the subsequent access request and subsequent network response do not match; and

(m) providing limited access to subsequent network resources upon authentication of the authentication device.

6. The method of claim 5 wherein access to network resources is determined by an access level assigned to the authentication device.

7. The method of claim 5 further comprising:

(k) determining whether the authentication device is coupled to the network, if the authentication device is not coupled to the network —

then repeating steps (a) through (g) and if the device is coupled to the network then providing access to network resources upon authentication of the authentication device.

8. The claim 5 further comprising:

(l) repeating steps (j) through (m) for each subsequent response for accessing subsequent network resources.

9. The method of claim 5 wherein the initial response and initial network response comprise an answer.

10. The method of claim 9 wherein the subsequent access request comprises the answer.

11. The method of claim 9 wherein the subsequent network response comprises the answer.

12. The method of claim 9 wherein each subsequent access request and each subsequent network response comprises the answer.