Tunneled authentication protocol for preventing man-in-the-middle attacks

• US 7,363,500 B2
• Filed: 12/03/2003
• Issued: 04/22/2008
• Est. Priority Date: 12/03/2002
• Status: Expired due to Fees

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Funk, Paul
• Primary Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US10/728,360
• Publication Number:
  US 20050125663A1
• Time in Patent Office: 1,602 Days
• Field of Search: 713/180
• US Class Current: 713/180
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

Systems and methods for preventing a Man-in-the-Middle attack on a communications network, without combining encryption keys of an inner authentication protocol and a tunneling protocol encapsulating the inner authentication protocol. The performance of a hash function may be split between two network devices on the communications network. For example, in response to a challenge issued by a tunnel server, a client may initiate performance of a hash function using only a first part only of the challenge and generate an intermediate result of the hash function (i.e., a preliminary hash). The client then may transmit the preliminary hash to the tunnel server as part of a response to the challenge. The tunnel server then may complete the hash function using the preliminary hash and the remaining part of the challenge to produce a final hash. The final hash then may be used to authenticate a user.

Claims

1. A method of at least partially authenticating a user on a communications network, the method comprising acts of:

(A) receiving, with a second network device, a first communication from a first network device, wherein the first communication includes a challenge;

(B) in response to receiving the challenge, generating, with the second network device, a preliminary hash value by performing only a first part of a hash function on a first part of the challenge when the second network device received the challenge via a secure network tunnel between the first network device and the second network device, wherein the first part of the challenge is less than the complete challenge;

(C) transmitting a second communication from the second network device to the first network device via the secure network tunnel, the second communication including the preliminary hash value;

(D) applying, with the first network device, a remaining part of the hash function to the preliminary hash value, thereby generating a final hash value; and

(F) authenticating the user based on the final hash value.

2. The method of claim 1, wherein act (B) comprises:

performing only part of a Message Digest 5-based encryption function.

3. The method of claim 2, wherein act (B) comprises:

(1) generating an input sequence to the Message Digest 5-based encryption function by concatenating information to be communicated from the second network device to the first network device; and

(2) inputting the input sequence into the Message Digest 5-based encryption function without previously adding an appendage of information to the input sequence.

4. The method of claim 1, wherein a complete performance of the hash function comprises performing a first number of iterations, wherein act (B) comprises performing a second number of iterations that is less than the first number of iterations, and wherein act (D) comprises performing a third number of iterations equal to the first number minus the second number, resulting in the complete performance of the hash function.

5. The method of claim 1, wherein act (D) includes applying the remaining part of the hash function using a second part of the challenge, wherein the first part and the second part form the complete challenge.

6. The method of claim 1, wherein act (B) includes generating the preliminary hash value based, at least in part, on the first part of the challenge and a user credential.

7. The method of claim 6, wherein act (B) includes dividing the challenge into the first part and a second part, and the method further comprises:

configuring the second communication to include an indication of a length in bits of the user credential, and

wherein act (D) includes applying the remaining part of the hash function based, at least in part, on the second part of the challenge and the length of the user credential.

8. The method of claim 7, wherein act (D) includes:

(1) determining a state of the hash function based, at least in part, on the length of the user credential; and

(2) applying the remaining part of the hash function based, at least in part, on the determined state.

9. The method of claim 7, wherein act (D) further comprises:

(1) determining a length of the second part based, at least in part, on a length of the challenge and the length of the user credential; and

(2) applying the remaining part of the hash function based, at least in part, on the determined length of the second part.

10. The method of claim 1, further comprising an act of:

generating the challenge on the first network device, including generating a portion of the challenge having a length equal to a desired amount of entropy for the challenge, and appending bits to the portion of the challenge to produce the challenge.

11. The method of claim 10, wherein generating the challenge includes appending sixty-three bits to the portion.

12. The method of claim 1, the method further comprising an act of:

generating the challenge on the first network device such that the challenge includes a plurality of sequences of bits, wherein each sequence of bits in the plurality of sequences of bits includes at least one non-zero bit.

13. The method of claim 12, wherein each sequence of bits in the plurality of sequences of bits is an octet of bits.

14. The method of claim 1, further comprising an act of:

generating the challenge on the first network device, including configuring the challenge to include at least a minimum number of octets of bits.

15. The method of claim 1, wherein act (B) comprises:

(1) determining a length of a concatenation of an authentication protocol identifier, a user credential and the challenge; and

(2) dividing the challenge into the first part and a second part based on the determined length.

16. The method of claim 1, wherein the method further comprises an act of:

transmitting a third communication including the final hash value to a third network device configured to authenticate the user.

17. The method of claim 1, further comprising generating, with the second network device, a complete hash value by performing all of the hash function on the complete challenge when the second network device receives the complete challenge external to the secure network tunnel.

18. A system for at least partially authenticating a user on a communications network, the system comprising:

a first network device that transmits a first communication to a second network device, wherein the first communication includes a challenge;

a second network device that is configured to receive the challenge, to generate a preliminary hash value by performing only a first part of a hash function on a first part of the challenge when the second network device received the challenge via a secure network tunnel between the first network device and the second network device, wherein the first part of the challenge is less than the complete challenge, and to transmit a second communication from the second network device to the first network device via the secure tunnel, the second communication including the preliminary hash value,

wherein the first network device is configured to apply a remaining part of the hash function to the preliminary hash value, thereby generating a final hash value; and

an authentication device that authenticates the user based on the final hash value.

19. The system of claim 18, wherein the second network device is operative to perform only part of a Message Digest 5-based encryption function.

20. The system of claim 19,

wherein the second network device is operative to generate an input sequence to the Message Digest 5-based encryption function by concatenating information to be communicated from the second network device to the first network device, and is operative to input the input sequence into the Message Digest 5-based encryption function without previously adding an appendage of information to the input sequence.

21. The system of claim 18, wherein a complete performance of the hash function comprises performing a first number of iterations, and the second network device is operative to perform a second number of iterations that is less than the first number of iterations, and wherein the first network device is operative to perform a third number of iterations equal to the first number minus the second number, resulting in a complete performance of the hash function.

22. The system of claim 18, wherein the first network device is operative to apply the remaining part of the hash function using a second part of the challenge, wherein the first part of the challenge and the second part of the challenge form the challenge.

23. The system of claim 18, wherein the first network device is operative to generate the preliminary hash value based, at least in part, on the first part of the challenge and a user credential.

24. The system of claim 23, wherein the second network device is operative to divide the challenge into the first part and a second part, and to configure the second communication to include an indication of a length in bits of the user credential, and the first network device is operative to apply the remaining part of the hash function based, at least in part, on the second part of the challenge and the length of the user credential.

25. The system of claim 24, wherein the first network device is operative to determine a state of the hash function based, at least in part, on the length of the user credential, and to complete the hash function based, at least in part, on the determined length.

26. The system of claim 24, wherein the first network device is operative to determine a length of the second part based, at least in part, on a length of the challenge and the length of the user credential, and to apply the remaining part of the hash function based, at least in part, on the determined length of the second part.

27. The system of claim 18, wherein the first network device is operative to generate a portion of the challenge having a length equal to a desired amount of entropy for the challenge, and to append bits to the portion of the challenge, thereby producing the challenge.

28. The system of claim 27, wherein the first network device is operative to append sixty-three bits to the portion.

29. The system of claim 18, wherein the first network device is operative to generate the challenge such that the challenge includes a plurality of sequences of bits, wherein each sequence of bits in the plurality of sequences of bits includes at least one non-zero bit.

30. The system of claim 29, wherein each sequence of bits in the plurality of sequences of bits is an octet of bits.

31. The system of claim 18, wherein the first network device is operative to generate the challenge such that the challenge includes at least a minimum length of bits.

32. The system of claim 18, wherein the second network device is operative to determine a length of a concatenation of an authentication protocol identifier, a user credential and the challenge, and to divide the challenge into the first part and a second part based on the determined length.

33. The system of claim 18, wherein the authentication device is integrated into the first network device.

34. The system of claim 18, wherein the first network device is operative to transmit a third communication including the final hash value to the authentication device.

35. The system of claim 18, wherein the second network device generates a complete hash value by performing all of the hash function on the complete challenge when the second network device receives the complete challenge external to the secure network tunnel.

36. The system of claim 18, wherein the second device is configured to generate a complete hash value by applying all of the hash function on the challenge when the second network device received the challenge external to the secure network tunnel.

37. A system for at least partially authenticating a user on a communications network, the system comprising:

a first communication device operative to transmit a first communication to a second network device, wherein the first communication includes a challenge; and

a second network device operative to receive the challenge and to transmit a second communication from the second network device to the first network device via secure network tunnel between the first network device and the second network device, the second communication including a preliminary hash value,

wherein the second network device includes means for generating a preliminary hash value by performing only a first part of a hash function on a first part of the challenge when the second network device received the challenge via the secure network tunnel, wherein the first part of the challenge is less than the complete challenge, and

wherein the first network device includes means for applying a remaining part of the hash function to the preliminary hash value, thereby producing a final hash value; and

an authentication device that comprises means for authenticating the user based on the final hash value.

38. A computer-readable medium having computer-readable signals stored thereon that define instructions that, as a result of being executed by one or more processors of a second network device, cause the one or more processors to:

(A) receive a first communication from a first network device that is configured to authenticate a user of the second network device based on a final hash value generated by applying a remaining part of a hash function to a preliminary hash value, wherein the first communication includes a challenge;

(B) generate, in response to receiving the challenge, the preliminary hash value by performing only a first part of the hash function on a first part of the challenge when the second network device received the challenge via a secure network tunnel between the first network device and the second network device, wherein the first part of the challenge is less than the complete challenge; and

(C) transmit a second communication to the first network device via the secure network tunnel, the second communication including the preliminary hash value.

39. A method of at least partially authenticating a user on a communications network, the method comprising acts of:

(A) transmitting a first communication from a first network device to a second network device, wherein the first communication includes a challenge;

(B) receiving a second communication from the second network device via a secure network tunnel between the first network device and the second network device, the second communication including a preliminary hash value resulting from performance of only a first part of a hash function on a first part of the challenge when the second network device received the challenge via the secure network tunnel, wherein the first part of the challenge is less than the complete challenge;

(C) applying, with the first network device, a remaining part of the hash function to the preliminary hash value, thereby generating a final hash value; and

(D) authenticating the user based on the final hash value.

40. The method of claim 39, wherein the preliminary hash value is a result of partial performance of an Message Digest 5-based encryption function on the first part of the challenge, and wherein act (C) comprises:

completing the Message Digest 5-based encryption function.

41. The method of claim 39, wherein complete performance of the hash function involves performing a first number of iterations, and wherein the preliminary hash value resulted from performance of a second number of iterations that is less than the first number of iterations, and

wherein act (C) includes performing a third number of iterations equal to the first number minus the second number, resulting in a complete performance of the hash function.

42. The method of claim 39, wherein act (C) includes applying the remaining part of the hash function using a second part of the challenge, wherein the first part of the challenge and the second part of the challenge form the complete challenge.

43. The method of claim 39, wherein the challenge includes two parts:

the first part and a second part, and the preliminary hash value is based, at least in part, on the first part of the challenge and a user credential, and the second communication includes an indication of a length in bits of the user credential, and

wherein act (C) includes applying the remaining part of the hash function based, at least in part, on the second part of the challenge and the length of the user credential.

44. The method of claim 43, wherein act (C) includes:

(1) determining a state of the hash function based, at least in part, on the length of the user credential; and

(2) applying the remaining part of the hash function based, at least in part, on the determined state.

45. The method of claim 43, wherein act (C) further comprises:

(1) determining a length of the second part of the challenge based, at least in part, on a length of the challenge and the length of the user credential; and

(2) applying the remaining part of the hash function based, at least in part, on the determined length of the second part.

46. The method of claim 39, further comprising an act of:

generating the challenge on the first network device, wherein generating the challenge comprises;

generating a portion of the challenge having a length equal to a desired amount of entropy for the challenge, and

appending bits to the portion of the challenge to produce the challenge.

47. The method of claim 46, wherein appending bits comprises appending sixty-three bits to the challenge.

48. The method of claim 39, the method further comprising an act of:

generating the challenge on the first network device such that the challenge includes a plurality of sequences of bits, wherein each sequence of bits in the plurality of sequences of bits includes at least one non-zero bit.

49. The method of claim 48, wherein each sequence of bits in the plurality of seciuences of bits is an octet of bits.

50. The method of claim 39, further comprising an act of:

generating the challenge on the first network device, wherein generating the challenge comprises configuring the challenge to include at least a minimum length of bits.

51. The method of claim 39,

wherein the second network device is configured to generate a complete hash value by performing all of the hash function on the complete challenge when the second network device receives the complete challenge external to the secure network tunnel.

52. A tunnel server residing on a first network device of a communications network for at least partially authenticating a user on the communications network, the tunnel server comprising:

a challenge generator to generate a challenge that is transmitted from the first network device to a second network device;

a final hash value generator to receive via a secure network tunnel between the first network device and the second network device a preliminary hash value from the second network device, the preliminary hash value resulting from performance of only a first part of a hash function on a first part of the challenge when the second device received the challenge via the secure network tunnel, wherein the first part of the challenge is less than the complete challenge,

wherein the final hash value generator is operative to apply a remaining part of the hash function device to the preliminary hash value, thereby generating a final hash value; and

an authenticator that authenticates the user based on the final hash value.

53. The tunnel server of claim 52, wherein the complete performance of the hash function involves performing a first number of iterations, and the preliminary hash value is the result of performance of a second number of iterations that is less than the first number of iterations, and wherein the final hash value generator is operative to perform a third number of iterations equal to the first number minus the second number, resulting in a complete performance of the hash function.

54. The tunnel server of claim 52, wherein the final hash value generator is operative to apply the remaining part of the hash function using a second part of the challenge, wherein the first part of the challenge and the second part of the challenge form the complete challenge.

55. The tunnel server of claim 52, wherein the challenge includes the first part and a second part, and the second communication includes an indication of a length in bits of a user credential, and

wherein the final hash value generator is operative to apply the remaining part of the hash function based, at least in part, on the second part of the challenge and the length of the user credential.

56. The tunnel server of claim 55, wherein the final hash value generator is operative to determine a state of the hash function based, at least in part, on the length of the user credential, and to apply the remaining part of the hash function based, at least in part, on the determined length.

57. The tunnel server of claim 55, wherein the final hash value generator is operative to determine a length of the second part of the challenge based, at least in part, on a length of the challenge and the length of the user credential, and to apply the remaining part of the hash function based, at least in art on the determined length of the second part of the challenge.

58. The tunnel server of claim 52, wherein the challenge generator is operative to generate the challenge, to generate a portion of the challenge having a length equal to a desired amount of entropy for the challenge, and to append bits to the portion of the challenge to produce the challenge.

59. The tunnel server of claim 58, wherein the challenge generator is operative to append sixty-three bits to the portion.

60. The tunnel server of claim 52, wherein the challenge generator is operative to generate the challenge such that the challenge includes a plurality of sequences of bits, wherein each sequence of bits in the plurality of sequences of bits includes at least one non-zero bit.

61. The tunnel server of claim 60, wherein each sequence of bits in the plurality of sequences of bits is an octet of bits.

62. The tunnel server of claim 52, wherein the challenge generator is operative to generate the challenge such that the challenge includes at least a minimum length of bits.

63. The tunnel server of claim 52, wherein the tunnel server is operative to control transmission of a third communication including the final hash value to a third network device configured to authenticate the user.

64. The tunnel server of claim 52, wherein the second network device is configured to generate a complete hash value by performing all of the hash function on the complete challenge when the second network device receives the complete challenge external to the secure network tunnel.

65. A tunnel server residing on a first network device of a communications network for at least partially authenticating a user on the communications network, the tunnel server comprising:

a challenge generator to generate a challenge that is transmitted from the first network device to a second network device, wherein the tunnel server is operative to receive a preliminary hash value from the second network device via a secure network tunnel between the first network device and the second network device, the preliminary hash value resulting from performance of only a first part of a hash function on a first part of the challenge when the second network device received the challenge via the secure network tunnel, wherein the first part is less than the complete challenge;

means for applying a remaining part of the hash function to the preliminary hash value, thereby generating a final hash value; and

means for authenticating the user based on the final hash value.

66. A computer-readable medium having computer-readable signals stored thereon that define instructions that, as a result of being executed by a first network device, control the first network device to perform a method of at least partially authenticating a user on a communications network, the method comprising acts of:

(A) transmitting a first communication from the first network device to a second network device, wherein the first communication includes a challenge;

(B) receiving a second communication from the second network device to the first network device via a secure network tunnel between the first network device and the second network device, the second communication including a preliminary hash value generated by performing only a first part of a hash function on a first part of the challenge when the second network device received the challenge via the secure network tunnel, wherein the first part of the challenge is less than the complete challenge; and

(C) applying a remaining part of the hash function to the preliminary hash value on the first network device, thereby generating a final hash value.

67. A method of at least partially authenticating a user on a communications network in response to a challenge received at a second network device from a first network device, the method comprising acts of:

receiving a challenge from a first network device that is configured to authenticate a user of the second network device based on a final hash value generated by applying a remaining part of a hash function to a preliminary hash value;

generating the preliminary hash value by performing only a first part of a hash function on a first part of the challenge when the second network device received the challenge via a secure network tunnel between the first network device and the second network device, wherein the first part of the challenge is less than the complete challenge; and

transmitting a communication from the second network device to the first network device via the secure network tunnel, the communication including the preliminary hash value.

68. The method of claim 67, wherein generating the preliminary hash value comprises:

performing only part of a Message Digest 5-based encryption function.

69. The method of claim 68, wherein generating the preliminary hash value comprises:

(1) generating an input sequence to the Message Digest 5-based encryption function by concatenating information to be communicated from the second network device to the first network device; and

(2) inputting the input sequence into the Message Digest 5-based encryption function without previously adding an appendage of information to the input sequence.

70. The method of claim 67, wherein the complete performance of the hash function involves performing a first number of iterations, and wherein generating the preliminary hash value comprises performing a second number of iterations that is less than the first number of iterations.

71. The method of claim 67, wherein generating the preliminary hash value comprises generating the preliminary hash value based, at least in part, on the first part of the challenge and a user credential.

72. The method of claim 71, wherein generating the preliminary hash value comprises dividing the challenge into the first part and a second part, and the method further comprises:

configuring the communication to include an indication of a length in bits of the user credential.

73. The method of claim 67, wherein generating the preliminary hash value comprises:

(1) determining a length of a concatenation of an authentication protocol identifier, a user credential and the challenge; and

(2) dividing the challenge into the first part of the challenge and a second part of the challenge based on the determined length.

74. The method of claim 67, further comprising generating, with the second network device, a complete hash value by performing all of the hash function on the complete challenge when the second network device receives the complete challenge external to the secure network tunnel.

75. A client residing on a second network device of a communications network, the client comprising:

an interface that receives a challenge from a first network device that is configured to authenticate a user of the second network device based on a final hash value generated by applying a remaining part of a hash function to a preliminary hash value;

a preliminary hash generator to generate the preliminary hash value by performing only a first part of the hash function on a first part of the challenge when the client received the challenge via a secure network tunnel between the first network device and the second network device, wherein the first part of the challenge is less than the complete challenge,

wherein the second network device is operative to transmit a communication from the second network device to the first network device via the secure network tunnel, the communication including the preliminary hash value.

76. The client of claim 75, wherein the preliminary hash generator is operative to perform only part of a Message Digest 5-based encryption function.

77. The client of claim 76,

wherein the preliminary hash generator is operative to generate an input sequence to the Message Digest 5-based encryption function by concatenating information to be communicated from the second network device to the first network device, and to input the input sequence into the Message Digest 5-based encryption function without previously adding an appendage of information to the input sequence.

78. The client of claim 75, wherein the complete performance of the hash function involves performing a first number of iterations, and

wherein the preliminary hash generator is operative to perform a second number of iterations less than the first number of iterations.

79. The client of claim 75, wherein the preliminary hash generator is operative to generate the preliminary hash value based, at least in part, on the first part of the challenge and a user credential.

80. The client of claim 79, wherein the preliminary hash generator is operative to divide the challenge into the first part and a second part, and to configure the communication to include an indication of a length in bits of the user credential.

81. The client of claim 75, wherein the preliminary hash generator is operative to determine a length of a concatenation of an authentication protocol identifier, a user credential and the challenge, and to divide the challenge into the first part and a second part based on the determined length.

82. The client of claim 75, wherein the client is operative to generate a complete hash value by performing all of the hash function on the complete challenge when the second network device receives the complete challenge external to the secure network tunnel.

83. A client residing on a second network device of a communications network, the client comprising:

means for receiving a challenge from a first network device that is configured to authenticate a user of the second network device based on a final hash value generated by applying a remaining part of a hash function to a preliminary hash value;

means for generating the preliminary hash value by performing only a first part of the hash function on a first part of the challenge when the client received the challenge via a secure network tunnel between the first network device and the second network device, wherein the first part is less than the complete challenge,

wherein the second network device is operative to transmit a communication from the second network device to the first network device via the secure network tunnel, the communication including the preliminary hash value.

84. A computer-readable medium having computer-readable signals stored thereon that define instructions that, as a result of being executed by a second network device, control the second network device to:

receive a challenge from a first network device that is configured to authenticate a user of the second network device based on a final hash value generated by applying a remaining part of a hash function to a preliminary hash value;

generate the preliminary hash value by performing only a first part of the hash function on a first part of the challenge when the second network device received the challenge via a secure network tunnel between the first network device and the second network device, wherein the first part of the challenge is less than the complete challenge; and

transmit a communication from the second network device to the first network device via the secure network tunnel, the second communication including the preliminary hash value.