Authentication of remotely originating network messages

• US 20040003241A1
• Filed: 06/27/2002
• Published: 01/01/2004
• Est. Priority Date: 06/27/2002
• Status: Active Grant

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia, Inc. (Nokia Corporation)
• Inventors: Sengodan, Senthil, Chan, Tat
• Granted Patent: US 7,290,141 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/064 Hierarchical key distribution, e.g. by multi-tier trusted parties
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method and system for authenticating messages received from users across multiple remote devices are provided. A residential gateway authenticates a user using a modified digest authentication scheme by storing a sequence number in the nonce field. Access encryption keys and sequence number spaces may be assigned based on user or on user/remote device pairs. When sequence number spaces are assigned based on user, and the user uses multiple remote devices to access the residential gateway, the sequence number space may be divided into mini-sequence number spaces for each of the multiple remote devices. Access encryption may be two-tiered, such that a secondary key is generated based on a user'"'"'s primary key, and the secondary key is only valid for a limited amount of time before it expires and a new secondary key must be generated.

Claims

1. A computer-implemented method for authenticating data messages using a challenge-response authentication mechanism, comprising:

(i) receiving a message comprising a first authentication credential, a user ID and a predetermined sequence number;

(ii) retrieving a secret corresponding at least to the user ID;

(iii) generating a second authentication credential based on information comprising the retrieved secret and the predetermined sequence number; and

(iv) comparing the first and second authentication credentials.

2. The method of claim 1, further comprising the step of receiving subsequent messages from a same sending entity, each subsequent message comprising a sequence number incremented in predetermined steps for each consecutive message.

3. The method of claim 2, wherein the predetermined steps are increments of one.

4. The method of claim 1, further comprising the step of sending an authentication challenge message comprising a challenge sequence number,

wherein the predetermined sequence number is based on the challenge sequence number.

5. The method of claim 4, wherein the authentication challenge message indicates a Digest Authentication challenge.

6. The method of claim 1, wherein the predetermined sequence number is manually configured.

7. The method of claim 1, further comprising:

(v) comparing the predetermined sequence number to information corresponding to a window of sequence numbers, wherein the information indicates whether each sequence number in the window has or has not been received; and

(vi) rejecting the message if any of the following conditions are met;

i. the predetermined sequence number is below the window of sequence numbers;

ii. the predetermined sequence number is within the window of sequence numbers and is marked as received;

or

iii. the authorization credentials do not match.

8. The method of claim 1, further comprising:

(v) comparing the predetermined sequence number to information corresponding to a window of sequence numbers, wherein the information indicates whether each sequence number in the window has or has not been received; and

(vi) accepting the message when the authentication credentials match, and;

i. the predetermined sequence number is within the window of sequence numbers and is marked as not received, or

ii. the predetermined sequence number is above the window of sequence numbers;

(vii) moving the window of sequence numbers up to the predetermined sequence number when in step (v) the sequence number is above the current window of sequence numbers; and

(viii) marking the predetermined sequence number as received.

9. The method of claim 1, wherein in the message the sequence number is stored in a nonce field.

10. The method of claim 1, wherein in the message the first authentication credential is stored in a response field.

11. The method of claim 1, wherein in step (i) the message comprises a device control message.

12. The method of claim 1, wherein in step (i) the message comprises a device monitoring message.

13. The method of claim 11, wherein in step (i) the device comprises a networked appliance.

14. The method of claim 12, wherein in step (i) the device comprises a networked appliance.

15. The method of claim 1, wherein in step (i) the received message comprises encrypted data, and further comprising selecting a decryption key based on the user ID.

16. The method of claim 1, wherein in step (i) the received message comprises encrypted data, and further comprising selecting a decryption key based on the user ID and a device ID corresponding to a device used to send the message.

17. The method of claim 1, wherein the secret comprises a password.

18. The method of claim 1, wherein in step (ii) the secret corresponds to a combination of the user ID and a device ID corresponding to a device used to send the message.

19. A data processing device that authenticates communications from a user using a plurality of remote devices, comprising:

a processor for controlling operation of the data processing device;

a first database for storing information corresponding to ranges of sequence numbers associated with pairs of users and remote devices, and for storing sliding window information corresponding to each range of sequence numbers;

memory storing software comprising computer executable instructions that, when executed by the processor, perform a method comprising

(i) receiving a first message comprising a user ID and a first remote device ID;

(ii) assigning a first available range of sequence numbers to the user ID and first remote device ID pair;

(iii) receiving a second message comprising the user ID and a second remote device ID; and

(iv) assigning a second available range of sequence numbers to the user ID and second remote device ID pair.

20. The device of claim 19, wherein the software comprises application layer software.

21. The device of claim 19, wherein each received message comprises encrypted data, and wherein the software method further comprises, for each of the first and second received messages, decrypting the encrypted data using a decryption key corresponding to the user ID.

22. The device of claim 21, wherein the encrypted data comprises networked appliance information.

23. The device of claim 19, wherein each received message comprises encrypted data, and wherein the software method further comprises:

(v) decrypting the encrypted data in the first received message using a first decryption key corresponding to the user ID and first remote device ID pair; and

(vi) decrypting the encrypted data in the second received message using a second decryption key, different from the first decryption key, corresponding to the user ID and second remote device ID pair.

24. The device of claim 19, wherein the first available range of sequence numbers and the second available range of sequence numbers each comprise a sub-part of a range of sequence numbers assigned to the user ID.

25. The device of claim 19, wherein the first available range of sequence numbers and the second available range of sequence numbers are mutually exclusive.

26. The device of claim 24, wherein the first available range of sequence numbers and the second available range of sequence numbers are of equal size.

27. The device of claim 24, where the size of each of the first available range of sequence numbers and the second available range of sequence numbers is proportional to an access frequency by the user ID.

28. The device of claim 24, where the size of each of the first available range of sequence numbers and the second available range of sequence numbers is proportional to an access frequency by the remote device.

29. The device of claim 24, where the size of each of the first available range of sequence numbers and the second available range of sequence numbers is proportional to an access frequency by the user ID using the remote device.

30. A data processing device using a challenge response mechanism to authenticate communications from a user using a plurality of remote devices to communicate with at least one networked appliance, comprising:

a processor for controlling operation of the data processing device;

memory storing software comprising computer executable instructions that, when executed by the processor, perform a method comprising;

(i) initially establishing a primary key corresponding to the user;

(ii) generating a secondary key corresponding to the user based on the primary key, wherein the secondary key is valid for a predetermined amount of time;

(iii) authenticating messages from the user received within the predetermined amount of time based on the secondary key.

31. The device of claim 30, wherein in step (ii) and (iii) the predetermined amount of time comprises one day.

32. The device of claim 30, wherein in step (ii) the secondary key is generated using secure remote password (SRP) protocol.

33. The device of claim 30, wherein step (ii) comprises generating a hash value based on the primary key and a date.

34. The device of claim 30, wherein the challenge-response mechanism comprises Digest authentication.

35. A mobile device, comprising:

a processor controlling operation of the device;

memory storing software comprising computer executable instructions that, when executed by the processor, cause the device to perform a method utilizing a challenge-response authentication mechanism, said method comprising;

(i) sending a first message including a predetermined sequence number, and a first authentication credential value based on information including the predetermined sequence number and a secret;

(ii) incrementing the sequence number; and

(iii) sending a second message including the incremented sequence number, and a second authentication credential value based on information including the incremented sequence number and the secret.

36. The device of claim 35, wherein in each message the sequence number is stored in a nonce field.

37. The device of claim 35, wherein in each message the corresponding authentication credential is stored in a response field.

38. The device of claim 35, wherein each sent message comprises a networked appliance message.

39. The device of claim 35, wherein the software method further comprises the step of receiving an authentication challenge message comprising a challenge sequence number,

wherein the predetermined sequence number is based on the challenge sequence number.

40. The device of claim 35, wherein the challenge-response mechanism comprises Digest Authentication.

41. The device of claim 35, wherein the predetermined sequence number is based on user input.

52. The data processing device of claim 41, wherein the networked appliance message comprises encrypted data, and the software method further comprises decrypting the message using a decryption key based on the user ID and a device ID corresponding to the remote access device used to send the message.

42. A data processing device that uses a challenge-response mechanism to authenticate communications with a user, comprising:

a processor for controlling operation of the data processing device;

memory storing software comprising computer executable instructions that, when executed by the processor, perform a method comprising

(i) receiving a message comprising a first authentication credential, a user ID and a predetermined sequence number;

(ii) retrieving a secret corresponding at least to the user ID;

(iii) generating a second authentication credential based on information comprising the retrieved secret and the predetermined sequence number; and

(iv) comparing the first and second authentication credentials.

43. The device of claim 42, further comprising:

a sequence number database for storing information corresponding to ranges of sequence numbers associated with pairs of users and remote devices, and for storing sliding window information corresponding to each range of sequence numbers, said sliding window information indicating whether each message within the sliding window has or has not been received.

44. The device of claim 43, wherein the software method further comprises:

(v) querying the database for the received sequence number; and

(vi) rejecting the message when any of the following conditions are met

i. the sequence number is below the corresponding window of sequence numbers;

ii. the sequence number is within the corresponding window of sequence numbers and is marked as received;

or

iii. the authorization credentials do not match.

45. The device of claim 43, wherein the software method further comprises:

(v) querying the database for the received sequence number; and

(vi) accepting the message when the authentication credentials match and

i. the sequence number is within the corresponding window of sequence numbers and is marked as not received, or

ii. the sequence number is above the corresponding window of sequence numbers;

(vii) moving the corresponding window of sequence numbers up to the sequence number when in step (vi) the sequence number is above the window of allowed sequence numbers; and

(viii) marking the received sequence number as received within the window.

46. The device of claim 42, wherein in step (i) the received message comprises encrypted data, and the software method further comprises selecting a decryption key based on the user ID and a device ID corresponding to a device used to send the message.

47. The device of claim 42, wherein in step (i) the sequence number is stored in a nonce field.

48. The device of claim 42, wherein in step (i) the message comprises a networked appliance message.

49. The device of claim 42, wherein in step (i) the authentication credential is stored in a response field.

50. The device of claim 42, wherein in step (ii) the secret corresponds to a combination of the user ID and a device ID corresponding to a device used to send the message.

51. A data processing device acting as a gateway between a networked appliance connected to the data processing device via a local network, and a remote access device communicating with the networked appliance by sending authenticated networked appliance control messages over a wide area network using a challenge-response authentication mechanism, said data processing device comprising:

a processor for controlling operation of the data processing device;

a user database for storing user authentication information;

a sequence number database for storing information corresponding to ranges of sequence numbers associated with pairs of users and remote devices, and for storing sliding window information corresponding to each range of sequence numbers, said sliding window information indicating whether each message within the sliding window has or has not been received;

software comprising computer executable instructions that, when executed by the processor, perform a method comprising;

(i) receiving a networked appliance control message comprising a first authentication credential value, a user ID and a sequence number;

(ii) querying the sequence number database for the sequence number;

(iii) rejecting the networked appliance control or monitoring message when the sequence number is below the corresponding window of sequence numbers, or the sequence number is within the corresponding window of sequence numbers and is marked as received;

(iv) querying the user database for a password corresponding to the user ID;

(v) generating a second authentication credential based on information including the password and the sequence number;

(vi) comparing the first and second authentication credentials.

(vii) rejecting the networked appliance control or monitoring message when the two authentication credentials do not match;

(viii) accepting the networked appliance control message when the authentication credentials match and, either, the sequence number is within the corresponding window of sequence numbers and is marked as not received, or the sequence number is above the corresponding window of sequence numbers;

(ix) moving the corresponding window of sequence numbers up to the sequence number when in step (viii) the sequence number is above the window of allowed sequence numbers and the authentication credentials match; and

(x) marking the sequence number as received within the window.