Apparatus and methods for verifying the identity of a party

• US 5,721,779 A
• Filed: 08/28/1995
• Issued: 02/24/1998
• Est. Priority Date: 08/28/1995
• Status: Expired due to Term

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Funk Software, Inc. (Juniper Networks Incorporated)
• Inventors: Funk, Paul
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/520,155
• Time in Patent Office: 911 Days
• Field of Search: 380/23, 380/24, 380/25, 380/28, 380/30
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Apparatus for verifying the identity of a party are disclosed, the apparatus including a database memory that stores a password signal encrypted by operation of a one-way commutative function; a number generator that generates an non-repeating number or signal representative thereof; and a processor element that can generate a challenge signal as a function of the number signal and a selected one-way commutative function and that can further generate a key signal as a function of the encrypted password signal and the number. The system includes a communication port for transmitting the generated challenge signal to a party requesting access to the secure system and for receiving a response from the party; and further includes a comparator element for comparing the received response with the generated key signal and for generating a match signal that indicates whether the response signal received from the party is substantially identical to the encrypted password signal stored in the database memory.

Claims

1. Digital logic apparatus for verifying a party, comprising

a memory element for storing an authentication value representative of a password encoded by operation of a one-way commutative function of a base signal representative of a numeric value,

a number generator for generating a number signal,

a processor element coupled to said number generator and to said memory element for generating a key signal representative of said authentication value encoded by operation of said one-way commutative function of said number signal and for generating a challenge signal representative of said number signal encoded by operation of said one-way commutative function of said base signal,

a communication element for transmitting said challenge signal to said party and for receiving a response signal from said party, and

a comparator element for comparing said response signal with said key signal and for generating a match signal representative of a substantial identity between said key signal and said response signal.

2. Apparatus according to claim 1 wherein said processor element includes means for performing a one-way commutative exponential function modulo a prime number.

3. Apparatus according to claim 1 wherein said number generator includes a random number generator element for generating a sequence of random numbers.

4. Apparatus according to claim 1 wherein said number generator includes a non-repeating number generator element for generating a sequence of non-repeating numbers.

5. Apparatus according to claim 1 wherein said communication port includes error correction means for encoding said challenge signal and decoding said response signal to detect and correct errors that occur in said signals during the transfer of signals between said apparatus and said party.

6. Apparatus according to claim 1 further comprising means for generating said base signal.

7. Apparatus according to claim 1 wherein said memory element includes means for storing said base signal.

8. Apparatus according to claim 1 further comprising means for generating a prime number signal.

9. Apparatus according to claim 1 wherein said memory element includes means for storing a prime number signal.

10. Apparatus according to claim 1 further comprising means for generating a randomized password signal, including

means for storing a randomizing factor,

means for storing a user selected password signal, and

processor means for digesting said user selected password signal with said randomizing factor for generating said randomized password signal.

11. Apparatus according to claim 1 further comprising digest processor means adapted for digesting said key signal to generated an encrypted key signal.

12. Apparatus according to claim 11 wherein said digest processor means is adapted for implementing an MD5 encryption process.

13. Apparatus for transmitting a secure password signal over a public communication channel, comprising

a server element having

a memory element having storage for an authentication value signal representative of said password signal encoded according to a one-way commutative function,

a non-repeating number generator having an output means and arranged for providing a non-repeating number signal at said output means,

processor element arranged for processing signals according to a one-way commutative function, and coupled to said non-repeating number generator and to said memory element for generating a key signal representative of said authentication value encoded as a one-way commutative function of said non-repeating number signal and for generating a challenge signal representative of numeric value encoded as a one-way commutative function of said non-repeating number,

a communication port, interfaced to the communication channel, for transmitting said challenge signal and for receiving a response signal, and

a comparator element for comparing said key signal with said response signal and for generating a match signal representative of a substantial identity between said key signal and said response signal,

a client element having

a communication port, interfaced to the communication channel, for receiving said challenge signal and for transmitting said response signal, and

processor element arranged for processing signals according to a one-way commutative function, and coupled to said communication port for generating said response signal as a one-way commutative function of said challenge signal, and said password signal.

14. Apparatus according to claim 13 wherein said server processor element and said client processor element each includes means for generating a signal according to an exponential function modulo a prime number.

15. Apparatus according to claim 13 wherein said memory element has storage for a plurality of authentication values, each representative of encrypted password signals, and

said processor means is arranged for processing said plurality of authentication values to generate plural key signals and has output means for transmitting each of said key signals to said comparator element for comparison with said response signal for detecting one of said plural key signals substantially identical to said response signal.

16. Apparatus according to claim 13 wherein said client element further includes a terminal element interfaced with said client processor means and arranged for inputting said password signal to said client processor means.

17. Apparatus according to claim 13 further including a secure database memory element arranged for storing information and having a controller unit coupled to said comparator element for receiving said match signal and for transferring data between said database memory element and said host communication port responsive to said match signal.

18. Apparatus according to claim 13 further including means for generating a randomized password signal, including

means for storing a randomizing factor,

means for storing a user selected password signal, and

processor means for digesting said user selected password signal with said randomizing factor for generating said randomized password signal.

19. Apparatus according to claim 13 wherein said server element further comprises digest processor means adapted for digesting said key signal to generated an encrypted key signal.

20. Apparatus according to claim 13 wherein said client element further comprises digest processor means adapted for digesting said response signal to generated an encrypted response signal.

21. Method for transmitting a password over a communication channel, said method comprising the steps of

providing a memory element for storing an authentication value signal representative of said password encoded according to a one-way commutative function,

generating a non-repeating number signal,

generating, according to said one-way commutative function, a key signal representative of said authentication value encoded as a one-way commutative function of said non-repeating number signal, and a challenge signal representative of a numeric value encoded as a one-way commutative function of said non-repeating number signal,

transmitting said challenge signal to a client requesting access to a secure system and receiving a response signal from said client, and

comparing said response signal with said key signal to generate a match signal representative of a substantial identity between said response signal and said key signal.

22. Method according to claim 21 wherein said step of generating a challenge signal includes the step of generating said challenge signal as a one-way commutative function of said numeric value and said non-repeating number signal.

23. Method according to claim 21 wherein said step of providing a memory element adapted to store an authentication value signal includes the step of providing a memory element having a plurality of said authentication value signals, and

generating plural key signals as a one-way commutative function of said plural authentication value signals and said non-repeating number signal.

24. Method according to claim 21 including the further step of accessing data stored in a secure database responsive to said match signal and transferring data between said database and said client.

25. Apparatus for responding to a challenge signal transmitted over a communication, comprising

memory element adapted to store a signal representative of a password signal,

a communication port adapted to interface to the communication channel, for transmitting a response signal, and

processor element arranged for processing signals according to a one-way commutative function, and coupled to said communication port for generating said response signal as a one-way commutative function of said challenge signal, and said password signal.

26. Method for responding to a challenge signal transmitted over a communication channel, comprising the steps of

storing in a memory element, a signal representative of a password signal,

providing a communication port adapted to interface to the communication channel, for transmitting a response signal,

generating said response signal processor element as a one-way commutative function of said challenge signal, and said password signal, and

transmitting said response signal via said communication port.

27. Apparatus for verifying the identity of a client having a password, said apparatus comprising

a memory element for storing an authentication value, said authentication value being formed by application of a one-way commutative function to a base signal, and to said password,

a processor element configured for generating a challenge signal by application of said one-way commutative function to said base signal and to a number signal, and

a comparator element for comparing a return signal generated by said client, said return signal being generated by application of said one way commutative function to said challenge signal and to said password.

28. Method for verifying the identity of a client having a password, said method comprising the steps of

storing an authentication value, said authentication value being formed by application of a one-way commutative function to a base signal and to said password,

generating a challenge signal by application of said one-way commutative function to said base signal and to a number signal, and

comparing a return signal generated by said client, said return signal being generated by application of said one way commutative function to said challenge signal and to said password.