Secure modem gateway concentrator

• US 8,312,279 B2
• Filed: 08/06/2010
• Issued: 11/13/2012
• Est. Priority Date: 12/30/2004
• Status: Expired due to Fees

• Current Assignee: BCE Incorporated
• Original Assignee: BCE Incorporated
• Inventors: O'Brien, William G., Yeap, Tef Hin, Lou, Dafu
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US12/851,809
• Publication Number:
  US 20100306529A1
• Time in Patent Office: 830 Days
• Field of Search: 713150-155, 713160-163, 713/168, 713/171, 380255-257, 380/270, 380/273, 380277-286, 709223-230
• US Class Current: 713/171
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A method and system for secure access to computer equipment. An embodiment includes a secure access controller connected to a link between a transceiver (such as a modem) and the computer equipment. Public and private keys are used by the secure access controller and a remote user. The keys are provided to the secure access controller by an authentication server. Once the transceiver establishes a communication link with the user, the access controller uses these keys to authenticate packets issued by the user to the computer equipment. If the packet is authenticated, the access controller passes the packet to the computer equipment. Otherwise, the packet is discarded. Another embodiment includes a secure access controller having a plurality of ports for connection to a plurality of different pieces of computer equipment. The secure access controller thus intermediates communications between the modem and the plurality of different pieces of computer equipment.

Claims

1. A system comprising:

an authentication server;

a client; and

an access controller interconnectable for communications therebetween;

said authentication server operable to deliver a first key to said client;

said access controller operable to store a second key complementary to said first key for encrypting at least a portion of communications between said client and said access controller;

said access controller including a plurality of ports each connectable to a computer;

said access controller operable to store at least one third key and to associate each said third key with a corresponding one of said ports;

said access controller further operable to decrypt, using the second key, instructions for a particular computer respective to a particular one of said ports, the instructions having been encrypted by the client using the first key;

said access controller further operable to encrypt the instructions received from said client using a particular third key corresponding to the particular one of said ports and to pass the encrypted instructions to the particular computer respective to the particular one of said ports according to a verification protocol utilizing the particular third key and a fourth key delivered to the particular computer.

2. The system according to claim 1, wherein the authentication server is operable to generate the first key and the second key and to deliver the second key to the access controller.

3. The system according to claim 1, wherein communications between the client and the access controller are carried via the authentication server.

4. The system according to claim 1, wherein the first key is a public encryption key and the second key is a private encryption key complementary to the public encryption key.

5. The system according to claim 1, the authentication server being a first authentication server, the system further comprising:

a second authentication server operable to generate the particular third key and the fourth key and to deliver the particular third key to the access controller.

6. The system according to claim 5, the second authentication server operable to deliver the fourth key to the particular computer.

7. The system according to claim 5, wherein the particular third key is a public encryption key and the fourth key is a private encryption key complementary to the particular third key.

8. The system according to claim 5, wherein communications between the access controller and the particular computer are carried via the second authentication server.

9. The system according to claim 1, wherein the authentication server and the client are interconnectable by a first communication medium and the access controller and the client are interconnectable by a second communication medium;

the mediums selected from the group of networks consisting of an Intranet, the Internet, the PSTN, a local area network, and a wireless network.

10. The system according to claim 1, wherein the access controller and the client are interconnected by a wireless network.

11. The system according to claim 1, wherein the particular computer comprises telecommunications switching equipment and wherein the access controller and the particular computer are interconnected by a wireless network.

12. The system according to claim 1, wherein the first key is only delivered to the client if a user operating the client authenticates the user'"'"'s identity with said server.

13. An access controller for intermediating communications between an interface and a particular port from a plurality of ports;

the access controller operable to store a second key complementary to a first key;

the access controller further operable to store a plurality of third keys corresponding to respective ones of the ports;

the access controller further operable to communicate with a client via the interface and with a computer via the particular port;

the client operable to store the first key and to receive instructions from a user;

the computer operable to store a particular fourth key that is complementary to the third key that corresponds to the particular port; and

, when a verification protocol utilizing the first and second keys is met, the access controller further operable to encrypt the instructions with the third key that corresponds to the particular port and to send the encrypted instructions to the computer via the particular port.

14. The access controller according to claim 13, wherein the access controller is operable to obtain the second key from an authentication server and the client is operable to obtain the first key from the authentication server, the authentication server operable to generate the first key and the second key.

15. The access controller according to claim 14, wherein the access controller is operable to obtain the third key from a second authentication server and the computer is operable to obtain the fourth key from the second authentication server, the second authentication server operable to generate the third key and the fourth key.

16. The access controller of claim 13, wherein the first key is a public encryption key of the access controller and the third key is a public key of the computer.

17. The access controller of claim 13, wherein a medium for connecting the interface and the client is at least one of an RS-232 link, a TTY link, a USB cable, the Internet, an Intranet, a VPN, the PSTN, a local area network, a wireless network, IPSec, PEAP, and TLS.

18. The access controller of claim 13, wherein a medium for connecting the port and the computer is at least one of an RS-232 link, a TTY link, a USB cable, the Internet, an Intranet, a VPN, the PSTN, a local area network, a wireless network, IPSec, PEAP, and TLS.

19. The access controller of claim 13, said instruction being encrypted by the client using the first key and wherein the verification protocol is based on a successful decryption of the instruction by the access controller using the second key.