System and method for controlling access to multiple public networks and for controlling access to multiple private networks

• US 7,334,255 B2
• Filed: 09/29/2003
• Issued: 02/19/2008
• Est. Priority Date: 09/30/2002
• Status: Expired due to Fees

• Current Assignee: Authenex Incorporated
• Original Assignee: Authenex Incorporated
• Inventors: Cheng, Fred, Hon, Henry, Lin, Paul
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US10/675,888
• Publication Number:
  US 20040064706A1
• Time in Patent Office: 1,604 Days
• Field of Search: 726/2
• US Class Current: 726/2
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A system and method for controlling access to multiple public networks and for controlling access to multiple private networks is provided. Authentication is used with unique public shared secrets and unique private shared secrets to control access to the networks. The invention includes a user device for communicating with at least a public network and/or a private network. The device may be capable of accessing multiple networks through one or more private networks with multiple access control servers. The user device must provide a correct response to each access control server, before access to the network may be granted. The device generates a one-time password, or response, to gain access to a controlled network server. The response generated by the device is matched to a response generated by an access control server that may have generated a challenge that prompted the response. If the two responses match, the device is authenticated and a user of the device is granted access to the network server.

Claims

1. A method for controlling access to a network, the method comprising the following steps:

(a) coupling a user device to a network;

(b) transmitting a first response including a particular secret of at least two secrets stored in the user device to the network;

(c) generating a second response including the particular secret upon receipt of the first response by the network;

(d) comparing the first response and second response; and

(e) authenticating the user device if the first response and second response match, and not authenticating the user device if the first response and second do not match.

2. The method of claim 1 wherein the first response includes a public shared secret as the particular secret.

3. The method of claim 1 wherein the first response includes a private shared secret as the particular secret.

4. The method of claim 1 wherein the first response includes a public shared secret and a private shared secret as the particular secret.

5. The method of claim 1 wherein the second response includes a public shared secret.

6. The method of claim 1 wherein the second response includes a private shared secret.

7. The method of claim 1 wherein the second response is generated by the network.

8. A method for controlling access to a network, the method comprising the following steps:

(a) coupling a user device storing at least two secrets to a network;

(b) transmitting a request to the network;

(c) transmitting a challenge including an instruction to use a particular secret of the secrets to the user device;

(d) generating a first response including the particular secret;

(e) transmitting the first response to the network;

(f) generating a second response including the particular secret upon receipt of the first response by the network;

(g) comparing the first response and second response; and

(h) authenticating the user device if the first response and second response match, and not authenticating the user device if the first response and second do not match.

9. The method of claim 8 wherein the first response includes a symmetric public shared secret in the particular secret.

10. The method of claim 8 wherein the first response includes a symmetric private shared secret in the particular secret.

11. The method of claim 8 wherein the first response includes a symmetric public shared secret in the particular secret and a symmetric private shared secret in the particular secret.

12. The method of claim 8 wherein the second response includes a symmetric public shared secret in the particular secret.

13. The method of claim 8 wherein the second response includes a symmetric private shared secret in the particular secret.

14. The method of claim 8 wherein the second response is generated by the network.

18. The method of claim 8 wherein the second response is generated by the server.

15. A method for controlling access to a public network, the method comprising the following steps:

(a) coupling a user device to a public network, the network including a server and the user device stores at least two public shared secrets;

(b) transmitting an access request from the user device to the server;

(c) transmitting a challenge from the server to the user device;

(d) processing the challenge to ascertain one of the public shared secrets as a selected public shared secret stored on the user device;

(e) generating a first response using at least the selected public shared secret;

(f) transmitting the first response to the server;

(g) generating a second response upon receipt of the first response by the server;

(h) comparing the first response and second response; and

(i) authenticating the user device to grant access to the public network if the first response and second response match, and not authenticating the user device if the first response and second do not match.

16. The method of claim 15 wherein the first response includes a symmetric public shared secret.

17. The method of claim 15 wherein the second response includes a symmetric public shared secret.

19. A method for controlling access to a private network, the method comprising the following steps:

(a) coupling a user device to a private network, the network including a server and the user device stores at least two private shared secrets;

(b) transmitting an access request from the user device to the server;

(c) transmitting a challenge from the server to the user device;

(d) processing the challenge to ascertain at least a selected private shared secret stored on the user device;

(e) generating a first response using at least the selected private shared secret as one of the private shared secrets;

(g) transmitting the first response to the server;

(h) generating a second response upon receipt of the first response by the server;

(i) comparing the first response and second response; and

(j) authenticating the user device to grant access to the private network if the first response and second response match, and not authenticating the user device if the first response and second do not match.

20. A method for controlling access to a private network, the method comprising the following steps:

(a) coupling a user device to a private network, the network including an access control server, and the user device stores at least two private shared secrets and at least two public shared secrets;

(b) transmitting an access request from the user device to the server, the access request comprising a first response that includes a selected public shared secret as one of the public shared secrets and a selected private shared secret as one of the private shared secrets, both stored on the user device;

(c) invoking the server to generate a second response upon receipt of the first response, the server generating the second response by means of the following steps,

(i) processing the challenge transmitted to the user device to retrieve the selected public shared secret and the selected private shared secret, and

(ii) processing the selected public shared secret and selected private shared secret to generate the second response;

(h) comparing the first response and second response; and

(i) authenticating the user device to grant access to the private network if the first response and second response match, and not authenticating the user device if the first response and second do not match.

21. The method of claim 20 wherein the first response includes a symmetric public shared secret and a symmetric private shared secret.

22. The method of claim 20 wherein the second response includes a symmetric public shared secret and a symmetric private shared secret.

23. A method for controlling access to a private network, the method comprising the following steps:

(a) coupling a user device to a private network, the network including an access control server, and the user device stores at least two private shared secrets and at least two public shared secrets;

(b) transmitting an access request from the user device to the server;

(c) transmitting a challenge from the server to the user device;

(d) processing the challenge to retrieve a selected public shared secret and a selected private shared secret stored on the user device;

(e) processing the selected public shared secret and selected private shared secret to generate a first response;

(f) transmitting the first response to the server;

(g) invoking the server to generate a second response upon receipt of the first response by the server, the server generating the second response by means of the following steps,

(i) processing the challenge transmitted to the user device to retrieve the selected public shared secret and the selected private shared secret, and

(ii) processing the selected public shared secret and selected private shared secret to generate the second response;

(h) comparing the first response and second response; and

(i) authenticating the user device to grant access to the private network if the first response and second response match, and not authenticating the user device if the first response and second do not match.