US5717756A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for providing masquerade protection in a computer network using hardware and timestamp-specific single use keys
Assignee: International Business Machines Corp
•
Filing: 1995-10-12
•
Granted: 1998-02-10
•
Expires: 2015-10-12
Abstract
Abstract An authentication session key is generated on a trusted machine based upon an identifier of its CPU, hardware configuration, and a timestamp. The trusting machine retrieves this same information about the trusted machine, and then generates session locks for the machine which are valid for a predetermined time interval. If the incoming session key matches one of the session locks, and the incoming session key is not on the list of used keys, the session key is appended to a list of keys which will no longer thereafter be valid, and access is then granted, thereby employing single-use keys. Because the locks and keys are also generated during a timestamp, a user may request service from the same machine multiple times by waiting no more than a predetermined time between requests, or front ends to the masquerade protection tools could be written that re-try until successful. Because the keys generated are specific to the hardware characteristics of the trusted machine upon which they are generated, attempts to gain access from an imposter machine will generate unusable session keys.
Inventors
- 👤 David Allen Coleman
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 21:06
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; H04L63/083; H04L63/0846; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; H04L63/0876; H04L2463/00; H04L2463/121
Claims Analysis
Total Claims: 20
Claim 1
Independent Claim
169 words
A method for providing masquerade protection in a computer network, comprising: executing a one way hash function having an output space with guaranteed output space duplicates, comprising: seeding a pseudo random number generator function with a number corresponding to said one or more hardware characteristics; and wherein said session key is generated from a number generated from said seeded pseudo random number generator function; generating a session key with a first machine as a function of a timestamp and one or more hardware characteristics unique to said first machine; transmitting said session key over said network from said first machine through intermediate machines without said masquerade protection to said second machine; generating a plurality of locks with said second machine as a function of said timestamp and said hardware characteristics; testing with said second machine whether said session key matches one of said plurality of locks; and granting access from said first machine to said second machine when said session key matches said one of said plurality of locks.
Claim 2
Independent Claim
169 words
A method for providing masquerade protection in a computer network, comprising: executing a one way hash function having an output space with guaranteed output space duplicates, comprising: seeding a pseudo random number generator function with a number corresponding to said one or more hardware characteristics; and wherein said session key is generated from a number generated from said seeded pseudo random number generator function; generating a session key with a first machine as a function of a timestamp and one or more hardware characteristics unique to said first machine; transmitting said session key over said network from said first machine through intermediate machines without said masquerade protection to said second machine; generating a plurality of locks with said second machine as a function of said timestamp and said hardware characteristics; testing with said second machine whether said session key matches one of said plurality of locks; and granting access from said first machine to said second machine when said session key matches said one of said plurality of locks.
Claim 3
Dependent Claim
20 words
The method of claim 1 wherein said session key is valid for a predetermined time functionally related to said timestamp.
Claim 4
Dependent Claim
26 words
The method of claim 2 wherein said hardware characteristics include a central processing unit identification number associated with a central processor unit in said first machine.
Claim 5
Dependent Claim
21 words
The method of claim 3 wherein said hardware characteristics include a checksum determined from multiple hardware aspects of said first machine.
Claim 6
Dependent Claim
25 words
The method of claim 4 wherein said session key is a function of a product of said central processor unit identification number and said checksum.
Claim 7
Dependent Claim
57 words
The method of claim 1 further including maintaining with said second machine a list of previously used said session keys; and wherein said method further includes testing whether said session key is on said list, and, if so, inhibiting said testing of whether said session key matches said one of said plurality of locks, and denying access.
Claim 8
Dependent Claim
44 words
The method of claim 1 including specifying at said first and second machines a COMPLEXITY number corresponding to a desired level of said masquerade protection; and wherein said pseudo random number generator function is seeded a number of times corresponding to said complexity number.
Claim 9
Dependent Claim
67 words
The method of claim 1 further including maintaining on said second machine a list of machines on said network which have said masquerade protection and may be granted access to said second machine; wherein said transmitting occurs at a time corresponding to a timestamp generated with said first machine; and wherein said list includes a network address, and information for generating said time with said second machine.
Claim 10
Dependent Claim
57 words
The method of claim 8 further including maintaining on said first machine a list of machines on said network to which said first machine will permit said session keys to be sent; and preventing said transmitting of said session key to said second machine when said second machine is not on said list on said first machine.
Claim 11
Independent Claim
183 words
An apparatus for providing masquerade protection in a computer network, comprising: means for executing a one way hash function having an output space with guaranteed output space duplicates, comprising: means for seeding a pseudo random number generator function with a number corresponding to said one or more hardware characteristics; and wherein said session key is generated from a number generated from said seeded pseudo random number generator function; means for generating a session key with a first machine as a function of a timestamp and one or more hardware characteristics unique to said first machine; means for transmitting said session key over said network from said first machine through intermediate machines without said masquerade protection to said second machine; means for generating a plurality of locks with said second machine as a function of said timestamp and said hardware characteristics; means for testing with said second machine whether said session key matches one of said plurality of locks; and means for granting access from said first machine to said second machine when said session key matches said one of said plurality of locks.
Claim 12
Independent Claim
183 words
An apparatus for providing masquerade protection in a computer network, comprising: means for executing a one way hash function having an output space with guaranteed output space duplicates, comprising: means for seeding a pseudo random number generator function with a number corresponding to said one or more hardware characteristics; and wherein said session key is generated from a number generated from said seeded pseudo random number generator function; means for generating a session key with a first machine as a function of a timestamp and one or more hardware characteristics unique to said first machine; means for transmitting said session key over said network from said first machine through intermediate machines without said masquerade protection to said second machine; means for generating a plurality of locks with said second machine as a function of said timestamp and said hardware characteristics; means for testing with said second machine whether said session key matches one of said plurality of locks; and means for granting access from said first machine to said second machine when said session key matches said one of said plurality of locks.
Claim 13
Dependent Claim
20 words
The apparatus of claim 10 wherein said session key is valid for a predetermined time functionally related to said timestamp.
Claim 14
Dependent Claim
26 words
The apparatus of claim 11 wherein said hardware characteristics include a central processing unit identification number associated with a central processor unit in said first machine.
Claim 15
Dependent Claim
21 words
The apparatus of claim 12 wherein said hardware characteristics include a checksum determined from multiple hardware aspects of said first machine.
Claim 16
Dependent Claim
25 words
The apparatus of claim 13 wherein said session key is a function of a product of said central processor unit identification number in said checksum.
Claim 17
Dependent Claim
61 words
The apparatus of claim 10 further including means for maintaining with said second machine a list of previously used said session keys; and wherein said apparatus further includes means for testing whether said session key is on said list, and, if so, inhibiting said testing of whether said session key matches said one of said plurality of locks, and denying access.
Claim 18
Dependent Claim
46 words
The apparatus of claim 10 including means for specifying at said first and second machines a COMPLEXITY number corresponding to a desired level of said masquerade protection; and wherein said pseudo random number generator function is seeded a number of times corresponding to said complexity number.
Claim 19
Dependent Claim
69 words
The apparatus of claim 10 further including means for maintaining on said second machine a list of machines on said network which have said masquerade protection and may be granted access to said second machine; wherein said transmitting occurs at a time corresponding to a timestamp generated with said first machine; and wherein said list includes a network address, and information for generating said time with said second machine.
Claim 20
Dependent Claim
61 words
The apparatus of claim 17 further including means for maintaining on said first machine a list of machines on said network to which said first machine will permit said session keys to be sent; and means for preventing said transmitting of said session key to said second machine when said second machine is not on said list on said first machine.
References Cited (Backward Citations)
US5319710A
Cited
US5136643A
Cited
GB2238636A
Cited
US5313521A
Cited
US5349642A
Cited
US5351293A
Cited
US5349643A
Cited
US5337357A
Cited
US5351295A
Cited
US5371794A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-02-09 | 2001-08-11 | 2002-02-10 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-02-09 | 2005-08-11 | 2006-02-10 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-02-09 | 2009-08-11 | 2010-02-10 | $7700.00 | Window Closed / Lapsed |