US5311596A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Continuous authentication using an in-band or out-of-band side channel
Assignee: Nokia Bell Labs
•
Filing: 1992-08-31
•
Granted: 1994-05-10
•
Expires: 2012-08-31
Abstract
Abstract A re-authentication procedure between the modems of a public switched telephone network (PSTN) data connection, which is between a computer facility and a user, provides a secure method for protecting the computer facility against an active wire tap, or spoofing, by an intruder. In particular, the user's modem and the computer's modem perform a re-authentication procedure throughout the duration of the data connection. This re-authentication procedure is transparently performed on a side channel of the data connection. This side channel can either be an in-band channel or an out-of-band channel. The re-authentication procedure comprises an exchange of encrypted information between the two modems. If one of the modems detects the presence of an active wire tap, that modem simply interrupts the data connection.
Inventors
- 👤 Robert E. Scott
- 👤 Richard K. Smith
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-25 02:18
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/313; H04L63/18; H04L9/00; H04L9/32; H04L9/3271; G06F2221/00; G06F2221/21; G06F2221/2103
Claims Analysis
Total Claims: 35
Claim 1
Independent Claim
219 words
Apparatus for re-authenticating a user of a data connection, the data connection comprising a primary channel and a side channel, the apparatus comprising: means for sending and receiving to a) send a request for identification to the user and receive an identifier from the user and b) send a plurality of challenges to and receive a plurality of responses from the user on the side channel, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and means for verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses; wherein the means for verifying encrypts each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the user and wherein the means for verifying compares each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 2
Dependent Claim
219 words
Apparatus for re-authenticating a user of a data connection, the data connection comprising a primary channel and a side channel, the apparatus comprising: means for sending and receiving to a) send a request for identification to the user and receive an identifier from the user and b) send a plurality of challenges to and receive a plurality of responses from the user on the side channel, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and means for verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses; wherein the means for verifying encrypts each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the user and wherein the means for verifying compares each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 3
Dependent Claim
19 words
The apparatus of claim 1 wherein the means for verifying is a function of a symmetric data encryption algorithm.
Claim 4
Dependent Claim
19 words
The apparatus of claim 1 wherein the means for verifying is a function of an asymmetric data encryption algorithm.
Claim 5
Dependent Claim
34 words
The apparatus of claim 1 wherein each one of the respective challenges is a random number and the means for verifying and the means for sending are included within a data communications equipment apparatus.
Claim 6
Dependent Claim
13 words
The apparatus of claim 1 wherein the side channel is an in-band channel.
Claim 7
Dependent Claim
17 words
The apparatus of claim 5 wherein the in-band channel is time division multiplexed with the primary channel.
Claim 8
Dependent Claim
13 words
The apparatus of claim 1 wherein the side channel is an out-of-band channel.
Claim 9
Dependent Claim
17 words
The apparatus of claim 7 wherein the out-of-band channel is frequency division multiplexed with the primary channel.
Claim 10
Dependent Claim
228 words
Data communications equipment apparatus for re-authenticating a user of a data connection, the data communications equipment apparatus comprising: means for sending and receiving to a) send a request for identification to a second data communications equipment apparatus and receive an identifier from the second data communications equipment apparatus and b) send a plurality of challenges to and receive a plurality of responses from the second data communication equipment apparatus of the user, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and means for verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses; wherein the means for verifying encrypts each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the second communications equipment apparatus and wherein the means for verifying compares each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 11
Dependent Claim
228 words
Data communications equipment apparatus for re-authenticating a user of a data connection, the data communications equipment apparatus comprising: means for sending and receiving to a) send a request for identification to a second data communications equipment apparatus and receive an identifier from the second data communications equipment apparatus and b) send a plurality of challenges to and receive a plurality of responses from the second data communication equipment apparatus of the user, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and means for verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses; wherein the means for verifying encrypts each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the second communications equipment apparatus and wherein the means for verifying compares each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 12
Dependent Claim
19 words
The apparatus of claim 9 wherein the means for verifying is a function of a symmetric data encryption algorithm.
Claim 13
Dependent Claim
19 words
The apparatus of claim 9 wherein the means for verifying is a function of an asymmetric data encryption algorithm.
Claim 14
Dependent Claim
25 words
The apparatus of claim 9 wherein each one of the respective challenges is a random number and the data communications equipment apparatus is a modem.
Claim 15
Independent Claim
215 words
A method for re-authenticating a user of a data connection, the data connection comprising a primary channel and a side channel, the method comprising the steps of: sending a request for identification to the user and receiving an identifier from the user in response thereto; sending a plurality of challenges to and receiving a plurality of responses from the user on the side channel, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses; wherein the step of verifying encrypts each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the user and wherein the step of verifying compares each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 16
Independent Claim
215 words
A method for re-authenticating a user of a data connection, the data connection comprising a primary channel and a side channel, the method comprising the steps of: sending a request for identification to the user and receiving an identifier from the user in response thereto; sending a plurality of challenges to and receiving a plurality of responses from the user on the side channel, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses; wherein the step of verifying encrypts each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the user and wherein the step of verifying compares each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 17
Dependent Claim
19 words
The method of claim 13 wherein the step of verifying is a function of a symmetric data encryption algorithm.
Claim 18
Dependent Claim
19 words
The method of claim 13 wherein the step of verifying is a function of an asymmetric data encryption algorithm.
Claim 19
Dependent Claim
16 words
The method of claim 13 wherein each one of the respective challenges is a random number.
Claim 20
Dependent Claim
13 words
The method of claim 13 wherein the side channel is an in-band channel.
Claim 21
Dependent Claim
17 words
The method of claim 17 wherein the in-band channel is time division multiplexed with the primary channel.
Claim 22
Dependent Claim
13 words
The method of claim 13 wherein the side channel is an out-of-band channel.
Claim 23
Dependent Claim
17 words
The method of claim 19 wherein the out-of-band channel is frequency division multiplexed with the primary channel.
Claim 24
Independent Claim
239 words
A method for re-authenticating a user of a data connection for use in a first data communications equipment apparatus, the data connection comprising the first data communications equipment apparatus and a second data communication equipment apparatus of the user, the method comprising the steps of: a) sending a request for identification to the second data communications equipment apparatus and receiving an identifier from the second data communications equipment apparatus; b) sending a plurality of challenges to and receiving a plurality of responses from the second data communication equipment apparatus, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and c) verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses wherein the verifying step includes: encrypting each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the second communications equipment apparatus; and comparing each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 25
Independent Claim
239 words
A method for re-authenticating a user of a data connection for use in a first data communications equipment apparatus, the data connection comprising the first data communications equipment apparatus and a second data communication equipment apparatus of the user, the method comprising the steps of: a) sending a request for identification to the second data communications equipment apparatus and receiving an identifier from the second data communications equipment apparatus; b) sending a plurality of challenges to and receiving a plurality of responses from the second data communication equipment apparatus, where each one of the plurality of responses corresponds to a respective one of the plurality of challenges; and c) verifying each one of the plurality of responses as a function of each one of the respective plurality of challenges to provide an output representative of the verification of each one of the plurality of responses wherein the verifying step includes: encrypting each one of the plurality of challenges, where the encryption is a function of a data encryption key that is selected as a function of the identifier of the second communications equipment apparatus; and comparing each one of the plurality of responses with each respective one of the plurality of encrypted challenges to provide the output representative of verification, whereby if there is a mismatch between a respective one of the plurality of encrypted challenges and the one of the plurality of responses the data connection is interrupted.
Claim 26
Dependent Claim
19 words
The method of claim 21 wherein the verifying step b) is a function of a symmetric data encryption algorithm.
Claim 27
Dependent Claim
19 words
The method of claim 21 wherein the verifying step b) is a function of an asymmetric data encryption algorithm.
Claim 28
Dependent Claim
25 words
The method of claim 21 wherein each one of the respective challenges is a random number and the data communications equipment apparatus is a modem.
Claim 29
Independent Claim
217 words
A method for re-authenticating a user of a data connection, the data connection comprising a first data communications equipment apparatus and a second data communications equipment apparatus, the method comprising the steps of: a) storing in the first data communications equipment apparatus a key list comprising a plurality of identification numbers, each identification number associated with a data encryption key; b) receiving in the first data communications equipment apparatus an identification number from the second data communications equipment apparatus; c) retrieving from the key list the data encryption key associated with the identification number received from the second data communications equipment apparatus; d) sending a challenge from the first data communications equipment apparatus to the second data communications equipment apparatus, the challenge comprising a number; e) receiving in the first data communications equipment apparatus a response from the second data communications equipment apparatus, the response comprising a number; and f) processing the response from the second data communications equipment apparatus by encrypting the challenge as a function of the retrieved data encryption key to provide an encrypted challenge; and g) comparing the response with the encrypted challenge and repeating steps d) through g) if the response is equal to the encrypted challenge and interrupting the data connection if the response is not equal to the encrypted challenge.
Claim 30
Independent Claim
217 words
A method for re-authenticating a user of a data connection, the data connection comprising a first data communications equipment apparatus and a second data communications equipment apparatus, the method comprising the steps of: a) storing in the first data communications equipment apparatus a key list comprising a plurality of identification numbers, each identification number associated with a data encryption key; b) receiving in the first data communications equipment apparatus an identification number from the second data communications equipment apparatus; c) retrieving from the key list the data encryption key associated with the identification number received from the second data communications equipment apparatus; d) sending a challenge from the first data communications equipment apparatus to the second data communications equipment apparatus, the challenge comprising a number; e) receiving in the first data communications equipment apparatus a response from the second data communications equipment apparatus, the response comprising a number; and f) processing the response from the second data communications equipment apparatus by encrypting the challenge as a function of the retrieved data encryption key to provide an encrypted challenge; and g) comparing the response with the encrypted challenge and repeating steps d) through g) if the response is equal to the encrypted challenge and interrupting the data connection if the response is not equal to the encrypted challenge.
Claim 31
Dependent Claim
19 words
The method of claim 25 wherein the first data communications equipment apparatus is the originator of the data connection.
Claim 32
Dependent Claim
19 words
The method of claim 25 wherein the second data communications equipment apparatus is the originator of the data connection.
Claim 33
Dependent Claim
27 words
The method of claim 25 wherein the challenge of step d) and the response of step e) are carried by a side channel over the data connection.
Claim 34
Dependent Claim
13 words
The method of claim 25 wherein the side channel is an in-band channel.
Claim 35
Dependent Claim
12 words
The method claim 25 wherein the side channel is an out-of-band channel.
References Cited (Backward Citations)
US4645871A
Cited
US4831648A
Cited
US4965827A
Cited
US5099515A
Cited
US5146472A
Cited
US5148479A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1997-05-09 | 1997-11-08 | 1998-05-10 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2001-05-09 | 2001-11-08 | 2002-05-10 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2005-05-09 | 2005-11-08 | 2006-05-10 | $7700.00 | Window Closed / Lapsed |