Apparatus and method for protecting a computer system

• US 7,043,640 B2
• Filed: 02/14/2001
• Issued: 05/09/2006
• Est. Priority Date: 02/14/2001
• Status: Active Grant

• Current Assignee: JSM Technologies LLC
• Original Assignee: JSM Technologies LLC
• Inventors: Pritchard, James B., Calcote, Clyde R.
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US09/783,049
• Publication Number:
  US 20020147930A1
• Time in Patent Office: 1,910 Days
• Field of Search: 713/202, 713/183, 713/182, 713/184, 713/185, 380/52
• US Class Current: 713/184
• CPC Class Codes: G06F 21/31 User authentication

Abstract

There is disclosed an apparatus and method for protecting a computer system by providing an improved password to prevent unauthorized access to the computer system. The apparatus of the present invention generally comprises a password controller capable of comparing a received password attempt with a stored password. The stored password of the present invention comprises a time envelope that comprises at least one password segment comprising: 1) an entry event; 2) a predetermined time interval following the entry event; and 3) a terminating signal to mark the end of the password segment. Access to the computer system is authorized when password segments of a password attempt match the corresponding password segments of the stored password. The stored password of the present invention generally comprises groups of computer readable characters separated by time intervals of variable length. A time delay is added to each response to a password attempt in order to conceal the length of the time intervals within the stored password.

Claims

1. Computer-implementable instruction code operable on a user device for constructing and transmitting a password to an authentication device that authenticates the password and grants the user device access to protected information, said instruction code being operable for;

receiving through an input device from a user, a sequence of predefined characters to be utilized to construct the password;

retrieving from a memory, a time interval mutually agreed upon by the user device and the authentication device; and

individually transmitting the characters to the authentication device separated in time by the mutually agreed upon time interval, and without regard to any timing characteristics with which the characters were received from the user.

2. In a user device, a computer-implemented method of constructing and transmitting a password to an authentication device that authenticates the password and grants the user device access to protected information, said method comprising:

receiving through an input device from a user, a sequence of predefined characters to be utilized to construct the password;

retrieving from a memory, a predefined time interval; and

individually transmitting the characters to the authentication device separated in time by the predefined time interval.

3. The method of claim 2, wherein the password includes at least three characters, and wherein the step of retrieving a predefined time interval includes retrieving a first predefined time interval for separating a first pair of adjacent characters and retrieving a different second predefined time interval for separating a second pair of adjacent characters.

4. The method of claim 2, further comprising, before the retrieving step, the steps of:

receiving at least one predefined time interval from the authentication device; and

storing the at least one predefined time interval in the memory.

5. In an authentication device, a computer-implemented method of authenticating a user device requesting access to protected information through the authentication device, said method comprising:

receiving at least two individually transmitted password characters from the user device;

measuring a time of receipt for each received password character to determine a received time interval separating each password character from an adjacent password character received from the user device;

determining by the authentication device, whether the received time interval separating each password character from an adjacent password character matches a predefined time interval;

determining by the authentication device, whether the received password characters match a sequence of predefined characters; and

positively authenticating the user device only if the received time interval separating each password character from an adjacent password character matches the predefined time interval, and the received password characters match the sequence of predefined characters.

6. A method of transmitting a computer password having a plurality of characters, comprising:

obtaining at least one predefined time interval for defining individual transmission times for transmitting at least two password characters from a user device to an authentication device; and

individually transmitting the at least two password characters from the user device to the authentication device at the individual transmission times for each password character;

wherein a valid password must include the correct password characters, and the password characters must be received by the authentication device with the correct time interval between sequential password characters.

7. A computer-implemented method of authenticating a user device requesting access to protected information through an authentication device, said method comprising:

in the user device;

receiving through an input device from a user, a sequence of predefined characters to be utilized to construct the password;

retrieving from a memory, a predefined time interval; and

individually transmitting the password characters to the authentication device separated In time by the predefined time Interval; and

in the authentication device;

receiving the individually transmitted password characters from the user device;

measuring a time of receipt for each received password character to determine a received time interval separating each password character from an adjacent password character in the password;

determining by the authentication device, whether the received time interval separating each password character from an adjacent password character matches the predefined time interval;

determining by the authentication device, whether the received password characters match the sequence of predefined characters; and

positively authenticating the user device only if the received time interval separating each password character from an adjacent password character matches the predefined time interval, and the received password characters match the sequence of predefined characters.