System and method for secure access

• US 8,762,726 B2
• Filed: 03/21/2011
• Issued: 06/24/2014
• Est. Priority Date: 09/30/2003
• Status: Active Grant

• Current Assignee: BCE Incorporated
• Original Assignee: BCE Incorporated
• Inventors: Yeap, Tet Hin, Lou, Dafu, O'Brien, William G.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US13/052,565
• Publication Number:
  US 20110170696A1
• Time in Patent Office: 1,191 Days
• Field of Search: 713/150, 713/153, 713/155, 713168-171, 380277-279, 380/282
• US Class Current: 713/170
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The present invention provides a method and system for secure access to computer equipment. An embodiment includes a secure access controller connected to a link between a transceiver (such as a modem) and the computer equipment. Public and private keys are used by the secure access controller and a remote user. The keys are provided to the secure access controller by an authentication server. Once the transceiver establishes a communication link with the user, the access controller uses these keys to authenticate packets issued by the user to the computer equipment. If the packet is authenticated, the access controller passes the packet to the computer equipment. Otherwise, the packet is discarded.

Claims

1. A method, performed by an authorization server, of securing access between a client having temporary connection to a computer via an access controller, said access controller for selectively passing instructions received from said client to said computer if a verification protocol utilizing a set of keys is met, said method comprising:

receiving a request from said access controller for an updated first key;

authenticating said request;

determining said updated first key and a second key corresponding to said updated first key;

delivering said updated first key to said access controller; and

wherein said verification protocol includes a generation of a random number by said client, an encryption of said random number by said client using said second key, a delivery of said random number and said encrypted random number from said client to said access controller, a decryption of said encrypted number using said updated first key by said access controller, a comparison of said random number and said decrypted number, and a decision to pass at least a portion of said instructions if said comparison finds a match of said random number with said decrypted number, and a decision not to pass said at least a portion of said instructions if no match is found.

2. The method according to claim 1, wherein determining said updated first key and said second key includes generating said updated first key and said second key.

3. The method according to claim 1, wherein said updated first key is a private encryption key and said second key is a public, encryption key complementary to said private encryption key.

4. The method according to claim 1, wherein a communication medium between at least one of said authentication server, said access controller and said client is selected from the group of networks consisting of the Internet, the PSTN, a local area network, and a wireless network.

5. The method according to claim 1, wherein said computer is a telecommunications switch.

6. The method according to claim 1, wherein said instructions are encrypted by said client using said second key and said verification protocol is based on a successful decryption of said instructions by said access controller using said updated first key.

7. The method according to claim 1, wherein said second key is delivered to said client only after said updated first key has been verified as having been successfully delivered to said access controller.

8. The method according to claim 1, wherein said second key is delivered to said client only if a user operating said client authenticates said user'"'"'s identity with said authentication server.

9. The method according to claim 1, wherein said access controller contains a preset first key and said authentication server maintains a record of said preset first key said authentication server operable to deliver said updated first key and said second key only if said access controller successfully transmits said preset first key to said authentication server and said transmitted preset first key matches said authentication server'"'"'s record thereof.

10. The method according to claim 1, wherein receiving a second request from said client for said second key;

authenticating said second request; and

delivering said second key to said client.

11. An authentication server for securing access between a client having temporary connection to a computer via an access controller, said access controller for selectively passing instructions received from said client to said computer if a verification protocol utilizing a set of keys is met, said authentication server comprising:

means for receiving a request from said access controller for an updated first key;

means for authenticating said request;

means for determining said updated first key and a second key corresponding to said updated first key;

means for delivering said updated first key to said access controller; and

wherein said verification protocol includes a generation of a random number by said client, an encryption of said random number by said client using said second key, a delivery of said random number and said encrypted random number from said client to said access controller, a decryption of said encrypted number using said updated first key by said access controller, a comparison of said random number and said decrypted number, and a decision to pass at least a portion of said instructions if said comparison finds a match of said random number with said decrypted number, and a decision not to pass said at least a portion of said instructions if no match is found.

12. The authentication server of claim 11, wherein said means for determining said updated first key and said second key is operable to generate said updated first key and said second key.