SYSTEMS AND METHODS FOR SECURELY ACCESSING PROGRAMMABLE DEVICES

• US 20150350182A1
• Filed: 01/15/2013
• Published: 12/03/2015
• Est. Priority Date: 01/15/2013
• Status: Active Grant

• Current Assignee: Schneider Electric USA, Inc. (Schneider Electric SE)
• Original Assignee: Schneider Electric USA, Inc. (Schneider Electric SE)
• Inventors: Pyle, Michael
• Granted Patent: US 11,178,126 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

According to various aspects and embodiments, a system including a programmable device is provided. The programmable device includes a memory storing an identifier of an authentication session and at least one processor coupled to the memory. The at least one processor is configured to receive an authentication credential, decode the authentication credential to access a session identifier and information associated with a requestor of the authentication credential, determine whether the session identifier matches the identifier of the authentication session, and grant the requestor access to protected functionality of the programmable device if the session identifier matches the identifier of the authentication session.

Claims

1. A system comprising:

a programmable device comprising;

a memory storing an identifier of an authentication session; and

at least one processor coupled to the memory and configured to;

receive an authentication credential;

decode the authentication credential to access a session identifier and information associated with a requestor of the authentication credential;

determine whether the session identifier matches the identifier of the authentication session; and

grant the requestor access to protected functionality of the programmable device if the session identifier matches the identifier of the authentication session.

2. The system according to claim 1, wherein the at least one processor is configured to determine that the session identifier matches the identifier of the authentication session if the session identifier equals the identifier of the authentication session.

3. The system according to claim 1, wherein the at least one processor is configured to decode the authentication credential by decrypting the authentication credential using a public key.

4. The system according to claim 3, wherein the at least one processor is further configured to:

receive a session request;

generate the identifier of the authentication session in response to receiving the session request;

provide the identifier of the authentication session to the requestor; and

initiate a timer in response to providing the identifier of the authentication session to the requestor.

5. The system according to any of claim 1, wherein the at least one processor is further configured to:

determine whether a predetermined period of time has expired since the timer was initiated; and

terminate the authentication session if the predetermined period of time has expired.

6. The system according to claim 5, wherein the at least one processor is further configured to limit subsequent generation of identifiers of authentication sessions if the predetermined period of time has expired.

7. The system according to claim 1, wherein the at least one processor is further configured to deny the requestor access to the protected functionality of the programmable device if the session identifier does not match the identifier of the authentication session.

8. The system according to claim 7, wherein the at least one processor is further configured to:

record an access failure event if the session identifier does not match the identifier of the authentication session;

calculate whether a total number of access failure events exceeds a predetermined threshold; and

terminate the authentication session if the total number of access failure events exceeds the predetermined threshold.

9. The system according to claim 7, wherein the at least one processor is further configured to limit subsequent generation of identifiers of authentication sessions if the total number of access failure events exceeds the predetermined threshold.

10. The system according to claim 1, further comprising a computer system configured to:

receive a credential request including the identifier of the authentication session and information identifying a destination;

generate an authentication credential in response to receiving the credential request; and

provide the authentication credential to the destination.

11. The system according to claim 10, wherein the computer system is configured to generate the authentication credential based on a combination of the identifier of the authentication session, a unique identifier of the requestor, and additional characters.

12. The system according to claim 11, wherein the computer system is configured to generate the authentication credential by encrypting the combination.

13. The system according to claim 12, wherein the computer system is configured to generate the authentication credential by configuring the length of the combination to generate an authentication credential having a length not to exceed 48 characters.

14. The system according to claim 13, wherein the programmable device further comprises a utility meter including a sensor configured to measure utility usage and the protected functionality includes functionality to configure operational parameters of the utility meter.

15. A computer system comprising:

a memory; and

at least one processor coupled to the memory and configured to;

receive a credential request including an identifier of the authentication session and information identifying a destination;

generate an authentication credential in response to receiving the credential request; and

provide the authentication credential to the destination.

16. The computer system according to claim 15, wherein the at least one processor is configured to generate the authentication credential based on a combination of the identifier of the authentication session, a unique identifier of a requestor, and additional characters.

17. The system according to claim 16, wherein the at least one processor is configured to generate the authentication credential by encrypting the combination.

18. The system according to claim 17, wherein the at least one processor is configured to generate the authentication credential by configuring the length of the combination to generate an authentication credential having a length not to exceed 48 characters.

19. A method of generating authentication credentials using a programmable device and a computer system, the method comprising:

receiving an authentication credential at a programmable device;

decoding, by the programmable device, the authentication credential to access a session identifier and information associated with a requestor of the authentication credential;

determining whether the session identifier matches the identifier of the authentication session; and

granting the requestor access to protected functionality of the programmable device if the session identifier matches the identifier of the authentication session.

20. The method according to claim 19, further comprising:

receiving a credential request including the identifier of the authentication session and information identifying a destination;

generating an authentication credential in response to receiving the credential request; and

provide the authentication credential to the destination.