US5491752A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens
Assignee: Hewlett Packard Development Co LP
•
Filing: 1994-09-02
•
Granted: 1996-02-13
•
Expires: 2014-09-02
Abstract
Abstract An improved security system inhibits eavesdropping, dictionary attacks, and intrusion into stored password lists. In one implementation, the user provides a workstation with a "password", and a "token" obtained from a passive authentication token generator. The workstation calculates a "transmission code" by performing a first hashing algorithm upon the password and token. The workstation sends the transmission code to the server. Then, the server attempts to reproduce the transmission code by combining passwords from a stored list with tokens generated by a second identical passive authentication token generator just prior to receipt of the transmission code. If any password/token combination yields the transmission code, the workstation is provided with a message useful in communicating with a desired computing system; the message is encrypted with a session code calculated by applying a different hashing algorithm to the password and token. In another embodiment, the workstation transmits a user name to the authentication server. The server verifies the user name's validity, and uses an active authentication token generator to obtain a "response" to an arbitrarily selected challenge. The server generates a session code by performing a hashing algorithm upon the response and the password. The server sends the challenge and a message encrypted with the session code to the workstation. The workstation generates the session code by performing the hashing algorithm on the password and the received challenge, and uses the session code to decrypt the encrypted message. The message is useful in communicating with a desired computing system.
Inventors
- 👤 Charles W. Kaufman
- 👤 Radia J. Pearlman
- 👤 Morrie Gasser
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 19:09
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/34; G06F21/33; G06F21/335; H; H04; H04L; H04L9/00; H04L9/08; H04L9/0861; H04L9/0877; H04L9/32; H04L9/3226; H04L9/3234; H04L9/3236; H04L9/3271; G06F2221/00; G06F2221/21; G06F2221/2103; G06F2221/2151
Claims Analysis
Total Claims: 43
Claim 1
Independent Claim
165 words
A method for securely accessing a computing system, comprising the steps of: (a) a workstation receiving a token from a first passive authentication token generator and receiving a secret password associated with a user; (b) the workstation generating a transmission code by performing a first hashing algorithm upon data comprising: (1) the token and (2) the secret password; (c) the workstation sending the transmission code to an authentication server; (d) the server receiving and verifying the validity of the transmission code; (e) if the transmission code is valid, the server transmitting to the workstation a message encrypted with a session code generated by performing a second hashing algorithm upon data comprising the token and the password, the second hashing algorithm being substantially different than the first hashing algorithm; (f) the workstation receiving the message; (g) the workstation computing the session code by performing the second hashing algorithm on the password and the token; and (h) the workstation using the session code to decrypt the message.
Claim 2
Independent Claim
165 words
A method for securely accessing a computing system, comprising the steps of: (a) a workstation receiving a token from a first passive authentication token generator and receiving a secret password associated with a user; (b) the workstation generating a transmission code by performing a first hashing algorithm upon data comprising: (1) the token and (2) the secret password; (c) the workstation sending the transmission code to an authentication server; (d) the server receiving and verifying the validity of the transmission code; (e) if the transmission code is valid, the server transmitting to the workstation a message encrypted with a session code generated by performing a second hashing algorithm upon data comprising the token and the password, the second hashing algorithm being substantially different than the first hashing algorithm; (f) the workstation receiving the message; (g) the workstation computing the session code by performing the second hashing algorithm on the password and the token; and (h) the workstation using the session code to decrypt the message.
Claim 3
Dependent Claim
52 words
The method of claim 1, wherein the step of generating the transmission code comprises the steps of: (1) hashing the password according to a selected one-way hashing equation; (2) concatenating the token onto the hashed password to form a concatenation; and (3) hashing the concatenation according to the selected one-way hashing equation.
Claim 4
Dependent Claim
52 words
The method of claim 1, wherein the step of generating the transmission code comprises the steps of: (1) hashing the password according to a selected one-way hashing equation; (2) concatenating the hashed password onto the token to form a concatenation; and (3) hashing the concatenation according to the selected one-way hashing equation.
Claim 5
Dependent Claim
40 words
The method of claim 1, wherein the step of generating the transmission code comprises the steps of: (1) concatenating the token onto the password to form a concatenation; and (2) hashing the concatenation according to the selected one-way hashing equation.
Claim 6
Dependent Claim
40 words
The method of claim 1, wherein the step of generating the transmission code comprises the steps of: (1) concatenating the password onto the token to form a concatenation; and (2) hashing the concatenation according to the selected one-way hashing equation.
Claim 7
Dependent Claim
103 words
The method of claim 1, wherein the step of verifying the validity of the transmission code comprises the steps of: (1) the server utilizing a second passive authentication token generator that simultaneously supplies tokens substantially identical to those of the first passive token generator to identify possible tokens occurring at the time the workstation sent the transmission code to the server; (2) the server identifying one or more passwords from a stored list; and (3) the server attempting to reproduce the transmission code by performing the first hashing algorithm on the identified one or more passwords and different identified possible tokens in turn.
Claim 8
Dependent Claim
34 words
The method of claim 6, wherein step (2) comprises the step of utilizing a user name received from the workstation to identify a single password from a cross-referenced list of user names and passwords.
Claim 9
Dependent Claim
105 words
The method of claim 1, wherein the step of verifying the validity of the transmission code comprises the steps of: (1) the server utilizing a second passive authentication token generator that simultaneously supplies tokens substantially identical to those of the first passive token generator to identify possible tokens occurring at the time the workstation sent the transmission code to the server; (2) the server identifying one or more hashed passwords from a stored list; and (3) the server attempting to reproduce the transmission code by performing the first hashing algorithm on the identified one or more hashed passwords and different identified possible tokens in turn.
Claim 10
Dependent Claim
36 words
The method of claim 8, wherein step (2) comprises the step of utilizing a user name received from the workstation to identify a single hashed password from a cross-referenced list of user names and hashed passwords.
Claim 11
Dependent Claim
52 words
The method of claim 1, wherein the step of generating the session code comprises the steps of: (1) hashing the password according to a selected one-way hashing equation; (2) concatenating the token and the hashed password to form a concatenation; and (3) hashing the concatenation according to the selected one-way hashing equation.
Claim 12
Dependent Claim
52 words
The method of claim 1, wherein the step of generating the session code comprises the steps of: (1) hashing the token according to a selected one-way hashing equation; (2) concatenating the hashed token and the password to form a concatenation; and (3) hashing the concatenation according to the selected one-way hashing equation.
Claim 13
Dependent Claim
40 words
The method of claim 1, wherein the step of generating the session code comprises the steps of: (1) concatenating the token onto the password to form a concatenation; and (2) hashing the concatenation according to the selected one-way hashing equation.
Claim 14
Dependent Claim
40 words
The method of claim 1, wherein the step of generating the session code comprises the steps of: (1) concatenating the password onto the token to form a concatenation; and (2) hashing the concatenation according to the selected one-way hashing equation.
Claim 15
Dependent Claim
27 words
The method of claim 1, further comprising the step of the workstation using the message to encrypt subsequent communications between the workstation and a desired computing system.
Claim 16
Dependent Claim
28 words
The method of claim 1, further comprising the step of the workstation using the session code to decrypt subsequent communications between the workstation and a desired computing system.
Claim 17
Dependent Claim
20 words
The method of claim 1, additionally including the step of the authentication server maintaining a log of verified transmission codes.
Claim 18
Dependent Claim
29 words
The method of claim 1, wherein the step of the workstation receiving the password is accomplished by a user typing the password upon keys of a data entry device.
Claim 19
Dependent Claim
29 words
The method of claim 1, wherein the step of the workstation receiving the token is accomplished by a user typing the token upon keys of a data entry device.
Claim 20
Dependent Claim
21 words
The method of claim 1, wherein the token is generated by the first authentication token generator based upon an external reference.
Claim 21
Dependent Claim
20 words
The method of claim 1, wherein the step of the workstation receiving the token is accomplished by an electrical link.
Claim 22
Dependent Claim
30 words
The method of claim 1, wherein the step of the workstation receiving the token is accomplished by the workstation reading a bar code provided by the first authentication token generator.
Claim 23
Dependent Claim
188 words
A secure method for obtaining access to a computing system, wherein a workstation performs steps comprising: (a) receiving an initial password and an initial token, wherein the initial password is supplied by a user and the initial token is supplied by a first authentication token generator; (b) generating a transmission code by performing a first hashing algorithm upon the password and the token; (c) sending the transmission code to an authentication server having a second authentication token generator that simultaneously supplies tokens substantially identical to those provided by the first authentication token generator; (d) if the authentication server successfully reproduces the transmission code by performing successive calculations utilizing different combinations of possible tokens occurring at the time the transmission code was sent and one or more passwords identified from a list of passwords accessible by the authentication server, then receiving a message from the authentication server that is encrypted with a selected secret key routine using a session code obtained by performing a second hashing algorithm upon data comprising the initial token and the initial password, the second hashing algorithm being substantially different than the first hashing algorithm.
Claim 24
Dependent Claim
188 words
A secure method for obtaining access to a computing system, wherein a workstation performs steps comprising: (a) receiving an initial password and an initial token, wherein the initial password is supplied by a user and the initial token is supplied by a first authentication token generator; (b) generating a transmission code by performing a first hashing algorithm upon the password and the token; (c) sending the transmission code to an authentication server having a second authentication token generator that simultaneously supplies tokens substantially identical to those provided by the first authentication token generator; (d) if the authentication server successfully reproduces the transmission code by performing successive calculations utilizing different combinations of possible tokens occurring at the time the transmission code was sent and one or more passwords identified from a list of passwords accessible by the authentication server, then receiving a message from the authentication server that is encrypted with a selected secret key routine using a session code obtained by performing a second hashing algorithm upon data comprising the initial token and the initial password, the second hashing algorithm being substantially different than the first hashing algorithm.
Claim 25
Dependent Claim
30 words
The method of claim 22, wherein the workstation additionally performs steps comprising: (1) decrypting the message; and (2) utilizing the message to encrypt subsequent communications with a desired computing system.
Claim 26
Dependent Claim
30 words
The method of claim 22, wherein the workstation additionally performs steps comprising: (1) decrypting the message; and (2) utilizing the message to decrypt subsequent communication with a desired computing system.
Claim 27
Dependent Claim
192 words
A secure method for obtaining access to a computing system, wherein an authentication server performs steps comprising: (a) receiving a transmission code from a workstation, the transmission code generated by performing a first hashing algorithm upon data comprising an initial password received from a user and an initial token provided by a first passive authentication token generator; (b) utilizing a second passive authentication token generator that simultaneously provides tokens substantially identical to those supplied by the first passive authentication token generator to identify possible tokens occurring at the time the workstation sent the transmission code, identifying one or more passwords from a list of passwords accessible by the authentication server, and attempting to reproduce the transmission code by performing successive calculations utilizing different combinations of the possible tokens and one or more identified passwords; (c) if the server in step (b) successfully reproduced the transmission code, then providing the workstation with a message encrypted with a selected secret key routine using a session code generated by performing a second hashing algorithm upon the initial token and the initial password, wherein the second hashing algorithm is substantially different than the first hashing algorithm.
Claim 28
Dependent Claim
192 words
A secure method for obtaining access to a computing system, wherein an authentication server performs steps comprising: (a) receiving a transmission code from a workstation, the transmission code generated by performing a first hashing algorithm upon data comprising an initial password received from a user and an initial token provided by a first passive authentication token generator; (b) utilizing a second passive authentication token generator that simultaneously provides tokens substantially identical to those supplied by the first passive authentication token generator to identify possible tokens occurring at the time the workstation sent the transmission code, identifying one or more passwords from a list of passwords accessible by the authentication server, and attempting to reproduce the transmission code by performing successive calculations utilizing different combinations of the possible tokens and one or more identified passwords; (c) if the server in step (b) successfully reproduced the transmission code, then providing the workstation with a message encrypted with a selected secret key routine using a session code generated by performing a second hashing algorithm upon the initial token and the initial password, wherein the second hashing algorithm is substantially different than the first hashing algorithm.
Claim 29
Dependent Claim
38 words
In a system including a workstation, an authentication server, and a token generator, a signal comprising a hashed version of a first signal computed from data including a user-supplied password and a token supplied by a token generator.
Claim 30
Dependent Claim
38 words
In a system including a workstation, an authentication server, and a token generator, a signal comprising a hashed version of a first signal computed from data including a user-supplied password and a token supplied by a token generator.
Claim 31
Dependent Claim
36 words
In a system that includes a workstation and an authentication server, a signal comprising a hashed version of a first signal computed from data including a token supplied by a token generator and a user-supplied password.
Claim 32
Dependent Claim
36 words
In a system that includes a workstation and an authentication server, a signal comprising a hashed version of a first signal computed from data including a token supplied by a token generator and a user-supplied password.
Claim 33
Independent Claim
172 words
A method for securely accessing a computing system, comprising the steps of: (a) a workstation receiving a user name associated with a user; (b) the workstation transmitting the user name to an authentication server; (c) the authentication server verifying the validity of the user name, and if the user name is valid: (1) selecting a challenge; (2) obtaining a response by inputting the challenge into a first active authentication token generator; (3) generating a session code by performing a first hashing algorithm on data comprising the response and a password associated with the user; (4) encrypting a message with the session code; (5) transmitting the challenge and the encrypted message to the workstation; and (d) the workstation receiving the challenge and the encrypted message; (e) the workstation obtaining the response by inputting the challenge into a second active authentication token generator that generates tokens substantially identical to those generated by the first active authentication token generator, and using the response and the password to generate the session code and decrypt the message.
Claim 34
Independent Claim
172 words
A method for securely accessing a computing system, comprising the steps of: (a) a workstation receiving a user name associated with a user; (b) the workstation transmitting the user name to an authentication server; (c) the authentication server verifying the validity of the user name, and if the user name is valid: (1) selecting a challenge; (2) obtaining a response by inputting the challenge into a first active authentication token generator; (3) generating a session code by performing a first hashing algorithm on data comprising the response and a password associated with the user; (4) encrypting a message with the session code; (5) transmitting the challenge and the encrypted message to the workstation; and (d) the workstation receiving the challenge and the encrypted message; (e) the workstation obtaining the response by inputting the challenge into a second active authentication token generator that generates tokens substantially identical to those generated by the first active authentication token generator, and using the response and the password to generate the session code and decrypt the message.
Claim 35
Dependent Claim
31 words
The method of claim 28, wherein the step of the workstation receiving the user name is accomplished by the user typing the user name upon keys of a data entry device.
Claim 36
Dependent Claim
44 words
The method of claim 28, wherein the step of generating the session code comprises the steps of: (1) concatenating the response onto a password associated with the user to form a concatenation; and (2) hashing the concatenation according to the selected one-way hashing equation.
Claim 37
Dependent Claim
44 words
The method of claim 28, wherein the step of generating the session code comprises the steps of: (1) concatenating a password associated with the user onto the response to form a concatenation; and (2) hashing the concatenation according to the selected one-way hashing equation.
Claim 38
Dependent Claim
56 words
The method of claim 28, wherein the step of generating the session code comprises the steps of: (1) hashing a password associated with the user according to a selected one-way hashing equation; (2) concatenating the hashed password and the response to form a concatenation; and (3) hashing the concatenation according to the selected one-way hashing equation.
Claim 39
Dependent Claim
55 words
The method of claim 28, wherein the step of generating the session code comprises the steps of: (1) hashing the response according to a selected one-way hashing equation; (2) concatenating the response and a password associated with the user to form a concatenation; and (3) hashing the concatenation according to the selected one-way hashing equation.
Claim 40
Dependent Claim
38 words
The method of claim 28, wherein the step of verifying the validity of the user name comprises the step of the server accessing a database of user names and determining whether the user name appears in the database.
Claim 41
Dependent Claim
39 words
The method of claim 28, wherein the step of verifying the validity of the user name comprises the step of the server accessing a database of hashed user names and determining whether the user name appears in the database.
Claim 42
Dependent Claim
27 words
The method of claim 28, further comprising the step of the workstation using the message to encrypt subsequent communications between the workstation and a desired computing system.
Claim 43
Dependent Claim
27 words
The method of claim 28, further comprising the step of the workstation using the message to decrypt subsequent communications between the workstation and a desired computing system.
References Cited (Backward Citations)
US3798605A
Cited
US3996449A
Cited
US4227253A
Cited
US4218738A
Cited
US4288659A
Cited
US4264782A
Cited
US4386266A
Cited
US4399323A
Cited
US4430728A
Cited
US4626845A
Cited
US4755940A
Cited
US4661991A
Cited
US5023908A
Cited
US4736423A
Cited
US4815031A
Cited
US4799061A
Cited
US4974193A
Cited
US4910773A
Cited
US4881264A
Cited
US4868877A
Cited
US5109152A
Cited
US4924515A
Cited
US4919545A
Cited
US4965568A
Cited
US5029208A
Cited
US4932056A
Cited
US5081678A
Cited
US5068894A
Cited
US5146499A
Cited
US4993068A
Cited
US5204966A
Cited
US5050212A
Cited
US5235644A
Cited
US5136647A
Cited
US5224163A
Cited
US5220604A
Cited
US5136646A
Cited
US5148479A
Cited
US5163096A
Cited
US5201000A
Cited
US5297206A
Cited
US5315658A
Cited
US5315658B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1999-02-12 | 1999-08-14 | 2000-02-13 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2003-02-12 | 2003-08-14 | 2004-02-13 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2007-02-12 | 2007-08-14 | 2008-02-13 | $7700.00 | Window Closed / Lapsed |