User authentication system employing encryption functions

• US 4,590,470 A
• Filed: 07/11/1983
• Issued: 05/20/1986
• Est. Priority Date: 07/11/1983
• Status: Expired due to Term

• Current Assignee: Bell Telephone Laboratories, Inc. (Nokia Corporation)
• Original Assignee: AT&T, Inc.
• Inventors: Koenig, Andrew R.
• Primary Examiner(s): YUSKO, DONALD
• Application Number:
  US06/512,887
• Time in Patent Office: 1,044 Days
• Field of Search: 340/825.3, 340/825.31, 340/825.34, 178/22.08, 375/2.1, 235/379, 235/380
• US Class Current: 340/5.74
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A system which employs a pair of encryption functions f and g in the "log on" protocol of a computer dial-up arrangement. The functions are inverses of each other and, hence, a random sequence when encrypted with f and then with g results in the original sequence. When a user wishes to "log on", the computer selects a random sequence and forms a challenge sequence. The user encrypts the challenge sequence with the function g and thus forms a response sequence. Encryption with the function f by the computer permits verification of the response sequence.

The secrecy of the user'"'"'s function is maintained by providing the user with an authenticating device having only two ports: a power port and an I/O port. The I/O port is connected to a microprocessor which accesses a memory that contains the secret encryption function g.

Claims

1. A communication system employing a two-way communication link (111 and 112), first means (10 and 20) connected to said link for initiating an authentication protocol and second means (30) connected to said link for responding to initiated authentication protocol, characterized in that:

said communication system employs a public key encryption approach characterized by a pair of encryption functions, one being a public key and the other being a private key; and

said first means comprises;

a generator (10) for initiating a protocol by developing an essentially random authentication message, third means for sending a challenge signal over said link to said second means, and fourth means for comparing said authentication message with a response signal sent by said second means.

2. The system of claim 1 wherein

said generator (10) develops an essentially random authentication message;

said third means comprises a coder (21) responsive to said generator for encrypting said authentication message with one encryption function of said pair of encryption functions to develop said challenge signal, and for applying said challenge signal to said comunication link;

said second means enciphers said challenge signal with the other encryption function of said pair of encryption functions to develop response signal; and

said fourth means comprises comparison means (22) for comparing said authentication message to said response signal sent by said second means.

3. The system of claim 1 wherein

said generator (10) develops an essentially random authentication message and applies said message to said communication link as said challenge signal;

said second means enciphers said challenge signals with one encryption formation of said pair of encryption functions; and

said third means comprises a coder (21) responsive to said response signal for encrypting said response signal with the other encryption function of said pair of encryption functions to develop a decrypted response signal, and comparison means (22) for comparing said authentication message to said decrypted response signal.

4. The system of claim 1 wherein said second means develops said response signal by encrypting said authentication message with an encryption function g and said first means includes coding means (21) for encrypting signals with an encryption function f that is the inverse function of g.

5. An authentication system comprising:

first means for generating essentially random signal sequences (10);

a two-way communication link (111 and

     112);

second means (30) for receiving signals from said communications link, coding said received signals with a private key to develop encrypted signals and applying said encrypted signals to said communication link; and

third means (20) for controlling communications between said first means and said second means, for coding said encrypted signals with a public key to develop deciphered signals and for comparing said deciphered signals to said signal sequences.