System and method for generating and authenticating a computer password

• US 7,581,113 B2
• Filed: 02/18/2005
• Issued: 08/25/2009
• Est. Priority Date: 02/14/2001
• Status: Active Grant

• Current Assignee: JSM Technologies LLC
• Original Assignee: 5TH Fleet LLC
• Inventors: Smith, Steven W., Pritchard, James B.
• Primary Examiner(s): Moazzami; Nasser G
• Assistant Examiner(s): Traore; Fatoumata
• Application Number:
  US11/061,223
• Publication Number:
  US 20050149762A1
• Time in Patent Office: 1,649 Days
• Field of Search: None
• US Class Current: 713/184
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords

Abstract

A system and method for generating and authenticating a password to protect a computer system from unauthorized access. The characters of the password are placed in data packets by an access device. Prior to sending the packets, the device inserts predefined time intervals between each of the data packets. The value of the time intervals is retrieved from a sequence of time intervals that is shared between the access device and an authentication device. The authentication device determines whether the received set of password characters matches a stored set of password characters, measures the time intervals between the packets, and determines whether the measured time intervals match the predefined time intervals. The authentication device positively authenticates the access device only if both the characters and the time intervals match. Periodically, different time intervals from the sequence are inserted to change the password.

Claims

1. In a network access device, an apparatus for constructing and transmitting a network password utilized by an authentication device to authenticate the network access device, said apparatus comprising:

means for receiving from a user, a plurality of predefined characters forming a user password;

a memory for storing a plurality of time intervals in a predefined sequence;

a network password generator comprising;

packet forming means for placing the received characters of the user password in different ones of a plurality of data packets; and

timing means for delaying transmission of each data packet by a time interval retrieved from the memory without regard to any timing characteristics with which the characters were received from the user; and

means for transmitting the network password to the authentication device with the data packets separated by the time interval retrieved from the memory, wherein the network password comprises both the plurality of predefined characters and the retrieved time interval, which separates the data packets.

2. The apparatus of claim 1, wherein the timing means retrieves a next time interval from the predefined sequence of time intervals each time the network password is constructed.

3. The apparatus of claim 1, wherein the timing means retrieves a next time interval from the predefined sequence of time intervals after each data packet in the network password is transmitted, thereby delaying the transmission of each data packet in the network password by a different time interval.

4. The apparatus of claim 1, wherein the packet forming means includes means for dividing the password characters into groups and placing a group of password characters in each data packet, wherein a group comprises zero, one, or more than one character.

5. A method of authenticating a user device by an authentication device, said method comprising the steps of:

sending from the authentication device to the user device, information regarding time intervals to be inserted by the user device between each pair of data packets forming a password, wherein the time intervals have no relationship to timing characteristics with which password characters were input to the user device by a user;

receiving by the authentication device, a password sent from the user device, said password comprising a plurality of data packets that transport a set of password characters, wherein each data packet is separated from an adjacent data packet by a time interval retrieved from a first memory in the user device in accordance with the information sent by the authentication device;

determining by the authentication device, whether the received set of password characters matches a stored set of password characters;

comparing the time intervals separating the data packets with predefined time intervals retrieved from a second memory in the authentication device; and

positively authenticating the user device only if the received set of password characters matches the stored set of password characters, and the time intervals separating the data packets match the retrieved predefined time intervals.

6. The method of claim 5, wherein the comparing step includes retrieving a next time interval from a predefined sequence of time intervals each time the password is received.

7. The method of claim 5, wherein the comparing step includes retrieving a next time interval from a predefined sequence of time intervals after each data packet in the network password is received, thereby verifying a different time interval between each of the data packets in the password.

8. The method of claim 5, wherein the user device includes means for inputting customer credit information, and the authentication device is connected to a server in a financial authorization network.

9. A system for protecting a network against unauthorized access, said system comprising:

an access device for constructing and transmitting a network password through the network; and

an authentication server connected to the network for receiving the network password and authenticating the access device utilizing the network password;

wherein the access device comprises;

means for receiving from a user, a plurality of predefined characters forming a user password;

a lookup table for determining at least one time interval based on information received by the access device from the authentication server, wherein the at least one time interval is determined without regard to any timing characteristics with which the characters were received from the user;

a network password generator comprising;

packet forming means for placing the received characters of the user password in different ones of a plurality of data packets; and

timing means for delaying transmission of each data packet by the at least one time interval determined by the lookup table; and

means for transmitting the network password to the authentication server with the data packets separated by the at least one time interval determined by the lookup table, wherein the network password comprises both the plurality of predefined characters and the determined time interval, which separates the data packets; and

wherein the authentication server comprises;

means for receiving the network password sent from the access device;

means for determining whether the received set of password characters matches a stored set of password characters;

means for comparing the at least one time interval separating the data packets with at least one predefined time interval retrieved from a memory;

means for positively authenticating the user device only if the received set of password characters matches the stored set of password characters, and the at least one time interval separating the data packets matches the at least one retrieved predefined time interval; and

means for sending information regarding the time intervals to the access device, wherein the information is utilized by the access device to determine the at least one time interval to be used for constructing a new network password.

10. The system of claim 9, wherein the network password generator retrieves the next time interval from the lookup table after each data packet in the network password is transmitted, thereby delaying the transmission of each data packet in the network password by a different time interval.

11. The system of claim 9, wherein the means within the authentication server for sending information regarding the time intervals includes means for encrypting the information and sending the encrypted information to the access device through the network.

12. The system of claim 9, wherein the authentication server periodically sends the information regarding the time intervals to the access device.

13. The system of claim 9, wherein the access device includes a magnetic card reader, and the authentication server is a server in a financial authorization network.