Secure login credentials for substantially anonymous users

• US 7,661,128 B2
• Filed: 03/31/2005
• Issued: 02/09/2010
• Est. Priority Date: 03/31/2005
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Chen, Kai, Shen, Shioupyn
• Primary Examiner(s): Shiferaw; Eleni A
• Application Number:
  US11/096,432
• Publication Number:
  US 20060225130A1
• Time in Patent Office: 1,776 Days
• Field of Search: 726/15, 726/2, 726/4, 726/5, 726/7, 726/8, 726/14, 726/10, 713/158, 713/156, 713/183, 713/184, 709/203
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Methods and apparatus for secure communications. The techniques feature receiving over the first connection a login credential for the server, generated by the server without the use of any information identifying a computer user. The techniques further feature establishing a second secure connection with the server using a secure protocol and the login credential provided by the server.

Claims

1. A method comprising:

receiving in a user computer a certificate from a virtual private network (VPN) server;

establishing a first secure connection between the user computer and the VPN server using a Transport Layer Security (TLS) protocol based on the certificate provided by the VPN server;

in the user computer, receiving over the first secure connection from the VPN server a login credential including a username and a password to login to the VPN server, the username and the password having been generated by the VPN server and without any identifying information provided to the VPN server;

calculating a secret encryption key based on the username and the password;

establishing a second secure connection with the VPN server using a Point-to-Point Tunneling Protocol (PPTP) tunnel based on the username and the password and the secret encryption key;

logging in to the VPN server over the second secure connection using the username and the password; and

maintaining the second secure connection indefinitely, even after the login credential expires.

2. A method comprising:

on a server computer, receiving an anonymous request from a user computer to establish a first secure connection, the request including no identifying information of a user of the user computer;

establishing the first secure connection between the server computer and the user computer using a Transport Layer Security (TLS) protocol;

sending over the first secure connection to the user computer a username and a password, without using any identifying information identifying the user;

receiving a login request containing the username and the password from the user computer;

providing a distinct second secure connection between the server computer and the user computer using a Point-to-Point Tunneling Protocol (PPTP) tunnel based on the username and the password;

on the server computer, receiving encrypted communications from the client computer over the second secure connection;

sending encrypted communications to the client computer over the second secure connection; and

maintaining the second secure connection indefinitely, even after the user name and the password expire.

3. The method of claim 2, wherein the username and password can only be used a predetermined number of times.

4. The method of claim 3, wherein the number of times is protected by a digital signature of the server computer.

5. The method of claim 2, wherein the username and password are purchased.

6. The method of claim 2, wherein the username and password are assigned a set expiration time.

7. The method of claim 2, further comprising verifying a purchase of the username and password.

8. A method comprising:

on a server computer, receiving an anonymous request from a user computer to establish a first secure connection, the request including no identifying information of a user of the user computer, wherein the server computer is a virtual private network (VPN) server;

establishing the first secure connection between the server computer and the user computer using a Transport Layer Security (TLS) protocol or a Secure Sockets Layer (SSL) protocol;

generating a username and a password without using andy information identifying the user;

sending over the first secure connection to the user computer the username and the password;

receiving a login request containg the username and the password from the user computer;

providubg a distinct second secure connection between the server computer and the user computer based on the username and the password; and

maintaining the second secure connection indefinitely, even after the user name and the password expire.

9. The method of claim 8, wherein the username and the password are randomly generated.

10. The method of claim 8, wherein the username and password can only be used a predetermined number of times.

11. The method of claim 10, wherein the number of times is protected by a digital signature of the server computer.

12. The method of claim 8, wherein the username and password are purchased.

13. The method of claim 8, wherein the VPN server uses a Point-to-Point Tunneling Protocol (PPTP).

14. The method of claim 8, wherein the username and password are assigned a set expiration time.

15. The method of claim 8, further comprising verifying a purchase of the username and password.