Method and apparatus for providing continuous user verification in a packet-based network

• US 8,683,572 B1
• Filed: 01/24/2008
• Issued: 03/25/2014
• Est. Priority Date: 01/24/2008
• Status: Active Grant

• Current Assignee: Rupaka Mahalingaiah
• Original Assignee: Dunti, LLC
• Inventors: Mahalingaiah, Rupaka
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Salehi, Helai
• Application Number:
  US12/018,861
• Time in Patent Office: 2,252 Days
• Field of Search: 370/389
• US Class Current: 726/10
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A system and method of authenticating a user of a data network which inserts control information into certain data packets being sent over the network. The control information is user-specific, including such items as user identity, password, originating CPU, or biometric information. Inserting the control information into data packets transmitted during the entire session permits continuous authentication.

Claims

1. A system for authenticating a user on a public data network based on the Internet Protocol (“

IP”

) comprising;

an originating host connected to said IP network and associated with said user;

a control information generator coupled to the originating host to insert control information into a plurality of IP data packets emanating from said originating host, wherein the control information includes user verification information inserted into the payload portion of a data packet, and wherein the header of the plurality of IP data packets remains unchanged;

one or more intermediate devices configured to run standard IP that transmit said plurality of IP data packets based on said unchanged header without the routing being affected by said control information in the payload portion of said IP data packets; and

a receiving host connected to said IP network for receiving data packets from said originating host, including a function which operates to identify data packets containing said control information in the payload portion, authenticating the user based on said user verification information, and restoring said payload portion of a data packet without said control information.

2. The system of claim 1, wherein the control information generator operates to insert control information into a plurality of data packets in a data stream emanating from the originating host, and the receiving host continuously authenticates the user based on said plurality of data packets having control information.

3. The system of claim 1, wherein the payload portion of each data packet does not contain IP protocol, and each data packet transits at least a portion of the network without reference to the control information.

4. The system of claim 1, wherein said control information includes user verification information and originating host verification information.

5. The system of claim 1, wherein the control information is placed in variable locations within the payload and of variable length, and the payload is encrypted at the originating host.

6. The system of claim 5, wherein the receiving host operates to identify the location and length of the control information, remove the control information, and decrypt the remaining payload.

7. A method of authenticating a host device continuously for a session on a public IP communication network, comprising one or more sending hosts connected across the said public communication network to one or more receiving hosts:

a. generating data by an application residing on a sending host to be transmitted to a receiving host over said communication system;

b. requesting a security module on said sending host to transmit said data with authentication information by said application;

c. generating said authentication information by said security module;

d. generating a plurality of authenticating packets containing said data and said authentication information in the payload portion of said authenticating packets;

e. transmitting said authenticating packets over said IP communication network;

f. delivering said authenticating packets to said receiving host;

g. extracting said authentication information from said authenticating packets by said receiving host;

h. restoring the original data by said receiving host by removing authentication information from said payload portion;

i. authenticating the sending host based on the authentication information by said receiving host; and

j. delivering the data to an application on the receiving host.

8. The method of claim 7, further ensuring said authenticating packets conform to said IP communication network protocol, wherein the header of said authenticating packets does not change such that the authentication information is transparent to other hosts in the said network.

9. The method of claim 7, wherein said authentication information includes one or more of the following:

user name, password, transmitting host, biometrics, CPU identification, hardware configuration, checksum of packet data, packet number, and time.

10. The method of claim 7, wherein said authentication information is encrypted when created.

11. The method of claim 7, wherein authentication information is segmented and each segment is inserted into different locations within the payload portion of said data packets.

12. The method of claim 8, wherein ensuring said authenticating packets conform to said IP communication network includes modifying MTU to accommodate authentication information.

13. A system for authenticating a host device on an IP network comprising:

a. a sending host connected to said IP network configured to generate a plurality of IP packets;

b. an authentication information generator coupled to the sending host to insert authentication information into the payload portion of a continuous plurality of said IP packets emanating from said sending host forming a plurality of authenticating packets;

c. a transmission controller coupled to the sending host to assure IP protocol integrity for said authenticating packets by modifying the MTU value to reflect said authentication information;

d. one or more intermediate hosts configured to transmit said authenticating packets as standard IP packets; and

e. a receiving host connected to said IP network for receiving data packets from said sending host, including a function which operates to identify authenticating packets containing said authentication information, authenticating said sending host based on said authentication information, and restoring said IP packets without said authentication information.

14. The system of claim 13, wherein the control information generator operates to insert control information into a continuous plurality of data packets in a data stream emanating from the sending host, and the receiving host continuously authenticates the user based on said continuous plurality of data packets having control information.

15. The system of claim 13, wherein the authentication information is placed in variable locations within the data of the IP packet and of variable length, and the data is encrypted at the sending host.

16. The system of claim 13, wherein the receiving host operates to identify the location and length of the authentication information, remove the control information, and decrypt the remaining data.