Split channel authenticity queries in multi-party dialog

• US 8,510,225 B2
• Filed: 09/01/2004
• Issued: 08/13/2013
• Est. Priority Date: 09/01/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Yach, David, Little, Herbert A., Klassen, Gerhard D.
• Primary Examiner(s): Augustin, Evens J
• Application Number:
  US10/931,211
• Publication Number:
  US 20060047606A1
• Time in Patent Office: 3,268 Days
• Field of Search: 713/155, 713/50, 713/201, 705/50, 705/51, 726/26
• US Class Current: 705/50
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/386 using messaging services or messaging apps using mobile network messaging services for payment, e.g. SMS G06Q20/3255
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 65/40 Support for services or applications
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Authenticity of a proposed future or current participant in a multi-party dialog is checked by splitting an authenticity challenge query into at least two portions wherein none of the portions individually contains sufficient information to fully define the challenge query. These separated portions are then sent to another dialog participant over at least two different communication channels thus enhancing the probability that a successive challenge response is authentic. The authenticity challenge query and splitting thereof into plural portions may include formation of a logical combination (e.g., exclusive-OR) of first and second data strings (one of which may be a challenge question) to produce a resultant third data string where the separated and separately communicated portions include the first and third data strings as separate portions as being sent over respectively different communication channels.

Claims

1. A method for, at a first communication device in use by a first party in a multi-party dialog, initiating checking of the authenticity of a second party in said multi-party dialog, said method comprising:

receiving, at the first communication device, a request for the second party to participate in the multi-party dialog;

in response to receiving the request, generating, using a central processing unit in said first communication device, an authenticity challenge query data string, wherein the authenticity challenge query data string comprises a question that is easily answerable by the second party in the multi-party dialog if the second party is authentic;

forming, at said central processing unit and using said authenticity challenge query data string and a first data string, at least a second data string;

sending, at said central processing unit, said first data string to a first address associated with said second party;

sending, at said central processing unit, said second data string to a second address associated with said second party;

receiving, at said first communication device, an answer to the question from a second communication device associated with said second party;

determining that said answer is correct; and

responsive to said determining, allowing participation of said second party in said multi-party dialog to proceed.

2. A method as in claim 1 wherein said sending said first data string and said sending said second data string comprises communicating over wireless communication channels.

3. A method as in claim 1 wherein:

said forming said second data string comprises producing a logical combination of said first data string and said authenticity challenge query data string.

4. A method as in claim 3 wherein said producing said logical combination comprises performing an exclusive-OR operation with said first data string and said authenticity challenge query data string as input.

5. A method as in claim 1 wherein said method further comprises:

receiving, at said second communication device, said first data string;

receiving, at said second communication device, said second data string;

reconstructing, at said second communication device, said authenticity challenge query data string from said first data string and said second data string;

formulating, at said second communication device, the answer to the question of said authenticity challenge query data string; and

sending, at said second communication device, said answer to said first party.

6. A method as in claim 5 wherein:

said forming said second data string comprises producing a logical combination of said first data string and said authenticity challenge query data string.

7. A method as in claim 6 wherein:

said reconstructing said authenticity challenge query data string comprises producing a logical combination of said first data string and said second data string.

8. A method as in claim 7 wherein:

said producing the logical combination during said forming said second data string comprises performing an exclusive-OR operation with said first data string and said authenticity challenge query data string as input.

9. A method as in claim 8 wherein:

said producing the logical combination during said reconstructing said authenticity challenge query data string comprises performing an exclusive-OR operation with said first data string and said second data string as input.

24. The method of claim 1 wherein said first address is one of an e-mail address, a Short Messaging Service address, a Multimedia Messaging Service address, a Hypertext Transport Protocol Address and an Instant Messaging System address.

25. The method of claim 24 wherein said second address is one of an e-mail address, a Short Messaging Service address, a Multimedia Messaging Service address, a Hypertext Transport Protocol Address and an Instant Messaging System address, said second address being distinct from said first address.

10. A system for initiating checking of the authenticity of a second party in a multi-party dialog, said system comprising:

a first communication device with a main control central processing unit adapted to;

receive a request for the second party to participate in the multi-party dialog;

in response to receipt of the request, generate an authenticity challenge query data string, wherein the authenticity challenge query data string comprises a question that is easily answerable by the second party in the multi-party dialog if the second party is authentic;

form, using said authenticity challenge query data string and a first data string, at least a second data string;

send said first data string to a first address associated with said second party;

send said second data string to a second address associated with said second party;

receive, at said first communication device, an answer to the question from a second communication device associated with said second party;

determine that said answer is correct; and

allow participation of said second party in said multi-party dialog to proceed.

11. A system as in claim 10 further comprising a second communication device associated with said second party, wherein said multi-party dialog is conducted over wireless communication channels, where at least one of said first communication device and second communication device is a mobile wireless communication device.

12. A system as in claim 10 wherein:

said main control central processing unit is further adapted to form said second data string by producing a logical combination of said first data string and said authenticity challenge query data string.

13. A system as in claim 12 wherein said main control central processing unit is further adapted to form said second data string by performing an exclusive-OR operation with said first data string and said authenticity challenge query data string as input.

14. A system as in claim 10, wherein a main control central processing unit at said second communication device is adapted to:

receive said first data string;

receive said second data string;

reconstruct said authenticity challenge query data string from said first data string and said second data string;

formulate the answer to the question of said authenticity challenge query data string; and

send said answer to said first party.

15. A system as in claim 14 wherein:

main control central processing unit at said first communication device is further adapted to form said second data string by producing a logical combination of said first data string and said authenticity challenge query data string.

16. A system as in claim 15 wherein:

said main control central processing unit at said second communication device is further adapted to reconstruct said authenticity challenge query data string by producing a logical combination of said first data string and said second data string.

17. A system as in claim 16 wherein:

said main control central processing unit at said first communication device is further adapted to form said second data string by performing an exclusive-OR operation with said first data string and said authenticity challenge query data stream as input.

18. A system as in claim 17 wherein:

said main control central processing unit at said second communication device is further adapted to reconstruct said authenticity challenge query data string by performing an exclusive-OR operation with said first data string and said second data string as input.

19. A computer program storage medium holding a computer program, which, when executed by a processor to initiate a check of the authenticity of a second party in a multi-party dialog, causes said processor to:

receive a request for the second party to participate in the multi-party dialog;

in response to receipt of the request, generate an authenticity challenge query data string, wherein the authenticity challenge query data string comprises a question that is answerable by the second party in the multi-party dialog if the second party is authentic;

form, using said authenticity challenge query data string and a first data string, at least a second data string;

send said first data string to the first address associated with said second party;

send said second data string to a second address associated with said second party;

receive an answer to the question from a second communication device associated with said second party;

determine that said answer is correct; and

allow participation of said second party in said multi-party dialog to proceed.

20. A computer program storage medium as in claim 19 wherein said multi-party dialog is conducted over wireless communication channels using at least one mobile wireless communication device.

21. A computer program storage medium as in claim 19 wherein:

computer program further causes said processor to form said second data string by producing a logical combination of said first data string and said authenticity challenge query data string.

22. A computer program storage medium as in claim 21 wherein said logical combination comprises an exclusive-OR of said first data string and said authenticity challenge query data string.

23. A system for use for a dialog between a first party and at least a second party, said system comprising:

a first communication device for use by said first party, said first communication device adapted to;

receive a request for the second party to participate in the multi-party dialog;

in response to receipt of the request, generate an authenticity challenge query data string, wherein the authenticity challenge query data string comprises a question that is answerable by the second party in the multi-party dialog if the second party is authentic;

form, using said authenticity challenge query data string and a first data string, at least a second data string;

send said first data string to a first address associated with said second party;

send said second data string to a second address associated with said second party;

receive an answer to the question of said authenticity challenge query data string from a second communication device associated with the second party;

determine that said answer is correct; and

responsive to said determining, allow participation of said second party in said dialog to proceed;

the second communication adapted to;

receive said first data string;

receive said second data string;

reconstruct said authenticity challenge query data string from said first data string and said second data string;

formulate said answer to the question of said authenticity challenge query data string; and

send said answer to an address associated with said first party.