Computer access control system and method

Claim 2

An access control system, comprising: at least one protected system, each protected system including means for reading a password submitted by a user as part of a request for access to at least a specified portion of said protected system, means for conveying information to said user, and digital computer means coupled to said reading means and said information conveying means for determining whether to permit access to said protected system; said digital computer means including: means for storing at least one authentic password; means for selecting any sequence of one or more encryption steps from a multiplicity of distinct predefined encryption steps; means for generating a new authentic password by encrypting a stored password with the first of said selected sequence of predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps; means for challenging said user, via said information conveying means, to encrypt a previously defined password value with said selected sequence of encryption steps and to submit a password which is the result of said selected sequence of encryption steps; and means for comparing said new authentic password with said submitted password, and for permitting access to said portion of said protected system when a submitted password matches said new authentic password; said access control system further including at least one portable passward issuing device for issuing authentic passwords to the possessor thereof, including storage means for separately storing said previously defined password for each of one or more distinct protected systems or portions of protected systems.

Claim 3

An access control system as in claim 1, wherein said at least one portable password issuing device includes means for selecting a sequence of one or more encryption steps from said multiplicity of distinct predefined encryption steps, and means for generating a new authentic password by encrypting a stored password with the first of said selected sequence of one or more predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps.

Claim 4

An access control system as in claim 2, wherein said at least one portable password issuing device includes backup buffer means coupled to said generating means of said portable password issuing device for storing the results of at least one encryption step prior to the last encryption step performed by said generating means, backup key means for generating a backup signal, and backup means coupled to said generating means of said portable password issuing device for responding to said backup signal generated by transmitting an entry in said backup buffer means to said generating means for use in the next encryption step by said generating means.

Claim 5

An access control system as in claim 1, wherein said at least one portable password issuing device includes means for selecting one of said passwords stored in said device for use by said means for generating a new authentic password; said means for generating including means for replacing said selected password in said storage means with said new authentic password generated by said generating means.

Claim 6

An access control system as in claim 4, wherein said means for conveying includes means for prompting said user to select one of said passwords stored in said portable password issuing device.

Claim 7

An access control system as in claim 1, wherein said means for storing includes means for storing an authentic password and a personal identification number for a plurality of user identification values, each user identification number and value corresponding to a user of said system; said reading means includes means for reading a user identification value; and said means for selecting a sequence of one or more encryption steps includes means for generating a challenge value comprising at least one digit, and means for selecting a sequence of encryption steps corresponding to a predefined combination of said challenge value and a stored personal identification number in said storing means corresponding to said user identification value read by said reading means.

Claim 8

An access control system as in claim 6, said means for generating a challenge value comprising means for generating a random number having at least one randomly generated digit.

Claim 9

An access control system as in claim 1, including means for resynchronization of said digital computer means of a protected system with said at least one portable issuing device, including means in said computer means for resetting said authentic password stored by storing a predefined resynchronization password in said storing means, and means for conveying, via said information conveying means, that said stored password has been reset; and means in said at least one portable password issuing device includes resynchronization key means for generating a resynchronization signal, and means coupled to said generating means of sid portable password issuing device for responding to said resynchronization signal by storing said predefined resynchronization password in said storage means of said portable password issuing device.

Claim 10

In an access control system comprising at least one protected system having means for reading a password submitted as part of a request for access by a user to at least a specified portion of said protected system, means for conveying information to said user, and digital computer means coupled to said reading means and said information conveying means for determining whether to permit access to said protected system, said digital computer means including means for storing at least one authentic password; the improvement comprising: software means in said digital computer means including: means for selecting a sequence of one or more encryption steps from a multiplicity of distinct predefined encryption steps, means for generating a new authentic password by encrypting a stored password with the first of said selected sequence of predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps, means for challenging said user, via said information conveying means, to encrypt a previously defined password value with said selected sequence of encryption steps and to submit a password which is the result of said selected sequence of encryption steps; and means for comparing said new authentic password with said submitted password, and for permitting access to said portion of said protected system when a submitted password matches said new authentic password; and at least one portable password issuing device for issuing authentic passwords to the possessor thereof, including storage means for separately storing said previously defined password for each of one or more distinct protected systems or portions of protected systems.

Claim 11

In an access control system comprising at least one protected system having means for reading a password submitted as part of a request for access by a user to at least a specified portion of said protected system, means for conveying information to said user, and digital computer means coupled to said reading means and said information conveying means for determining whether to permit access to said protected system, said digital computer means including means for storing at least one authentic password; the improvement comprising: software means in said digital computer means including: means for selecting a sequence of one or more encryption steps from a multiplicity of distinct predefined encryption steps, means for generating a new authentic password by encrypting a stored password with the first of said selected sequence of predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps, means for challenging said user, via said information conveying means, to encrypt a previously defined password value with said selected sequence of encryption steps and to submit a password which is the result of said selected sequence of encryption steps; and means for comparing said new authentic password with said submitted password, and for permitting access to said portion of said protected system when a submitted password matches said new authentic password; and at least one portable password issuing device for issuing authentic passwords to the possessor thereof, including storage means for separately storing said previously defined password for each of one or more distinct protected systems or portions of protected systems.

Claim 12

An access control system as in claim 9, wherein said at least one portable password issuing device includes means for selecting a sequence of one or more encryption steps from said multiplicity of distinct predefined encryption steps, and means for generating a new authentic password by encrypting a stored password with the first of said selected sequence of predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps.

Claim 13

An access control system as in claim 10, wherein said at least one portable password issuing device includes backup buffer means coupled to said generating means of said portable password issuing device for storing the results of at least one encryption step prior to the last encryption step performed by said generating means, backup key means for generating a backup signal, and backup means coupled to said generating means of said portable password issuing device for responding to said backup signal generated by transmitting an entry in said backup buffer means to said generating means for use in the next encryption step by said generating means.

Claim 14

An access control system as in claim 9, wherein said at least one portable password issuing device includes means for selecting one of said passwords stored in said device for use by said means for generating a new authentic password; said means for generating including means for replacing said selected password in said storage means with said new authentic password generated by said generating means.

Claim 15

An access control system as in claim 12, wherein said means for conveying includes means for prompting said user to select one of said passwords stored in said portable password issuing device.

Claim 18

An access control method as in claim 14, wherein said at least one portable password issuing device includes means for selecting a sequence of one or more encryption steps from asid multiplicity of distinct predefined encryption steps, and means for generating a new authentic password by encrypting a stored password with the first of said selected sequence of predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps.

Claim 19

An access control method as in claim 15, further including the step of securely receiving a personal identification number specified by said user, including the steps of: after permitting access to said portion of said protected system when a submitted password matches said new authentic password, requesting the submission of a personal identification number by requesting the user to submit a password corresponding to each digit of the personal identification number; responding to each password submitted via said reading means by separately encrypting said authentic password with each of said defined encryption steps until a password is generated that matches said submitted password, storing as part of said user's personal identification number a numeric value corresponding to the encryption step which generates said matching password, and replacing said authentic password with said matching password.

Claim 20

An access control method as in claim 16, wherein said step of selecting a sequence of one or more encryption steps includes the step of generating a challenge value comprising at least one digit, and selecting a sequence of encryption steps corresponding to a predefined combination of said challenge value and said stored personal identification number.

Claim 21

An access control method as in claim 16, wherein said conveying step includes prompting said user to use said user's personal identification number when generating a password.

Claim 22

An access control method as in claim 14, wherein said step of selecting a sequence of one or more encryption steps includes the steps of generating a challenge value comprising at least one digit, and selecting a sequence of encryption steps corresponding to a predefined combination of said challenge value and a stored personal identification number.

Claim 23

An access control method as in claim 19, wherein said conveying step includes prompting said user to use the user's personal identification number when generating a password.

Claim 24

An access control method as in claim 19, wherein said step of generating a challenge value includes the step of generating a random number having at least one randomly generated digit.

Claim 25

An access control system, comprising: at least one protected system, each protected system including means for reading a password submitted by a user as part of a request for access to at least a specified portion of said protected system, means for conveying information to said user, and digital computer means coupled to said reading means and said information conveying means for determining whether to permit access to said protected system; said digital computer means including: means for selecting any sequence of one or more encryption steps from a multiplicity of distinct predefined encryption steps; means for generating a new authentic password by encrypting a defined value with the first of said selected sequence of predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps; means for challenging said user, via said information conveying means, to encrypt a previously defined value using said selected sequence of encryption steps and to submit a password which is the result of said sequence of encryption steps; means for comparing said new authentic password with said submitted password, and for permitting access to said portion of said protected system when a submitted password matches said new authentic password; and said access control system further including at least one portable password issuing device for issuing authentic passwords to the possessor thereof, including means for performing any selected sequence of aid predefined encryption steps.

Claim 26

An access control system, comprising: at least one protected system, each protected system including means for reading a password submitted by a user as part of a request for access to at least a specified portion of said protected system, means for conveying information to said user, and digital computer means coupled to said reading means and said information conveying means for determining whether to permit access to said protected system; said digital computer means including: means for selecting any sequence of one or more encryption steps from a multiplicity of distinct predefined encryption steps; means for generating a new authentic password by encrypting a defined value with the first of said selected sequence of predefined encryption steps and, when said sequence contains more than one encryption step, successively encrypting the result of each previous encryption step with the next of said selected sequence of predefined encryption steps; means for challenging said user, via said information conveying means, to encrypt a previously defined value using said selected sequence of encryption steps and to submit a password which is the result of said sequence of encryption steps; means for comparing said new authentic password with said submitted password, and for permitting access to said portion of said protected system when a submitted password matches said new authentic password; and said access control system further including at least one portable password issuing device for issuing authentic passwords to the possessor thereof, including means for performing any selected sequence of aid predefined encryption steps.

Claim 27

The access control system of claim 22, wherein said selecting means randomly selects said sequence of encryption steps.

Claim 30

An access control method as in claim 24, said selecting step randomly selecting said sequence of encryption steps.