Steganographic authentication

• US 7,257,708 B2
• Filed: 08/25/2005
• Issued: 08/14/2007
• Est. Priority Date: 11/05/1999
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Guthery, Scott B.
• Primary Examiner(s): Smithers; Matthew
• Assistant Examiner(s): Fields; Courtney D
• Application Number:
  US11/211,838
• Publication Number:
  US 20050283830A1
• Time in Patent Office: 719 Days
• Field of Search: 713/168, 713/172, 713/173, 713/169, 713/155, 705/41, 705/67
• US Class Current: 713/168
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/12 Card verification
• CPC Class Codes: G07F 7/122 Online card verification
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Various embodiments pertain to steganographically authenticating identities and authorizing transactions based on the authenticated identities.

Claims

1. A computer-implemented authentication method comprising:

defining an authentication network having a plurality of authentication paths;

receiving steganographic communication from an identity that is to be authenticated, the steganographic communication having a purpose that appears to be unrelated to authentication;

using the steganographic communication from the identity to follow an authentication path through the authentication network; and

authenticating the identity if the authentication path leads to a valid authentication state for the identity, wherein said acts of receiving, using and authenticating are performed independent of any encryption/decryption procedures.

2. The method of claim 1, wherein the steganographic communication that is used to follow the authentication path comprises content which is in the clear, and wherein said content is used to follow said authentication path.

3. The method of claim 2, wherein said content comprises multiple commands.

4. The method of claim 2, wherein said content comprises multiple commands, at least some of which are not inherently related to authentication.

5. The method of claim 2, wherein said content comprises multiple commands, at least some of which are data processing or data handling commands and are not inherently related to authentication.

6. The method of claim 2, wherein said content comprises multiple commands, at least some of which are ISO 7816-4 or ISO 7816-9 data processing or data handling commands and are not inherently related to authentication.

7. A computer-implemented authentication method comprising:

receiving steganographic communication from an identity that is to be authenticated, the steganographic communication comprising content which is in the clear and which appears unrelated to authentication, said steganographic communication also comprising content that is false cryptographic content;

using the content of said steganographic communication to authenticate an identity.

8. The method of claim 7, wherein said false cryptographic content comprises at least one cryptographic command.

9. The method of claim 7, wherein said content that is in the clear comprises multiple commands.

10. The method of claim 7, wherein said content that is in the clear comprises multiple data processing or data handling commands.

11. The method of claim 7, wherein said content that is in the clear comprises multiple commands, and said act of using is performed by authenticating said identity based on an order of said commands.

12. The method of claim 7, wherein said content that is in the clear comprises multiple commands, and wherein said commands have an apparent function that is not associated with an authentication function.

13. The method of claim 7, wherein said false cryptographic content comprises a false cryptographic protocol.

14. One or more computer-readable storage media having computer-readable instructions stored thereon which, when executed, perform a method comprising:

receiving steganographic communication from an identity that is to be authenticated, the steganographic communication comprising content which is in the clear and which appears unrelated to authentication, said steganographic communication also comprising content that is false cryptographic content;

using the content of said steganographic communication to authenticate an identity.

15. The computer-readable media of claim 14, wherein said false cryptographic content comprises at least one cryptographic command.

16. The computer-readable media of claim 14, wherein said content that is in the clear comprises multiple commands.

17. The computer-readable media of claim 14, wherein said content that is in the clear comprises multiple data processing or data handling commands.

18. The computer-readable media of claim 14, wherein said content that is in the clear comprises multiple commands, and said act of using is performed by authenticating said identity based on an order of said commands.

19. The computer-readable media of claim 14, wherein said content that is in the clear comprises multiple commands, and wherein said commands have an apparent function that is not associated with an authentication function.

20. The computer-readable media of claim 14, wherein said false cryptographic content comprises a false cryptographic protocol.