Authentication for computer networks

• US 20030023848A1
• Filed: 07/24/2002
• Published: 01/30/2003
• Est. Priority Date: 07/27/2001
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Wray, Michael
• Application Number:
  US10/202,050
• Publication Number:
  US 20030023848A1
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A method for a user to authenticate to a first computer on a computer network comprises:

a) a user authenticating himself to the first computer with a symmetric-type password unknown to the first computer and by means of a hybrid protocol; and

b) if the authentication is accepted the first computer then sends a digital certificate to the user, for subsequent use by the user to authenticate himself by means of the digital certificate to the first computer or other computers.

Claims

1. A method for a user to authenticate to a first computer on a computer network comprises:

a) a user authenticating himself to the first computer with a symmetric-type password unknown to the first computer and by means of a hybrid protocol; and

b) if the authentication is accepted the first computer then sends a digital certificate to the user, for subsequent use by the user to authenticate himself by means of the digital certificate to the first computer or other computers.

2. A method as claimed in claim 1, wherein the first computer authenticates the symmetric-type password using a verifier related to the symmetric-type password.

3. A method as claimed in claim 2, in which the verifier is a hash or derived from a hash of the symmetric-type password.

4. A method as claimed in claim 1, in which a shared secret is created between the user and the first computer during the hybrid protocol.

5. A method as claimed in claim 4, in which the shared secret is unrelated to the symmetric-type password.

6. A method of authentication as claimed in claim 1, in which the first computer issues the digital certificate to the user based on a public key sent to the first computer by the user.

7. A method of authentication as claimed in claim 6, in which the public key is generated by the user.

8. A method of authentication as claimed in claim 1, in which the digital certificate sent to the user is one stored by the first computer for the user.

9. A method of authentication as claimed in claim 8, in which public and private keys for the digital certificate are also sent to the user in encrypted form.

10. A method of authentication as claimed in claim 1, in which the hybrid protocol is a secure remote password (SRP) protocol or an Encrypted Key Exchange (EKE) protocol.

11. A method of authentication as claimed in claim 1, in which the certificate is an attribute certificate, such as a SPKI certificate defining attributes of the subject.

12. A method of authentication as claimed in claim 1, in which the method includes the user authenticating to the first computer in a subsequent session by means of a digital certificate combined with public key encryption.

13. A method of authentication as claimed in claim 1, in which second or further computers, on a computer network authenticate the user by means of a name certificate, relying on a name certificate to bind the user'"'"'s name to a public key.

14. A recordable medium carrying a computer program operable to perform the method of claim 1.

15. A computer operable to perform the method of claim 1.

16. A method for a user to authenticate to a first computer on a computer network comprises:

a) a user authenticating himself to the first computer with a symmetric-type password unknown to the first computer and by means of a hybrid protocol; and

b) if the authentication is accepted the first computer then sends a digital certificate to the user, for subsequent use by the user to authenticate himself by means of the digital certificate to the first computer or other computers, wherein the first computer authenticates the symmetric-type password using a verifier that is a hash or is derived from a hash of the symmetric-type password.