US5740361A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System for remote pass-phrase authentication
Assignee: Cranberry Properties LLC
•
Filing: 1996-06-03
•
Granted: 1998-04-14
•
Expires: 2016-06-03
Abstract
Abstract A system and method are disclosed for authenticating users and services communicating over an insecure network. Each user and service has a pass-phrase used for authentication. However, the pass-phrases are not revealed during the authentication process as challenge-response techniques are used to keep the pass-phrase secret. In addition, the users and services do not need to know nor do they learn each other's pass-phrases making the process useful in a distributed environment. Pass-phrases are known by an authentication entity with which the service communicates to authenticate both users and services. Users may have identities in and services may support a number of realms, each of which may be viewed as large collection of users (e.g., CompuServe.com). Users choose the realm in which they would like to be authenticated. In one embodiment of the present invention, the system and method are adapted for use with the HyperText Transfer Protocol of the World Wide Web so that secure transactions may be accomplished between users and services communicating via the Internet.
Inventors
- 👤 Gary S. Brown
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 11:12
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0407; H04L63/0414; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; H04L63/0428; H04L63/0435; H04L63/06; H04L63/062; H04L63/08; H04L9/00; H04L9/32; H04L9/3226; H04L9/3271; H04L9/40; G06F2221/00; G06F2221/21; G06F2221/2103; H04L2209/00; H04L2209/56
Claims Analysis
Total Claims: 31
Claim 1
Independent Claim
431 words
A method of authentication, said method comprising the steps of: (a) assigning a first identifier and a first pass-phrase to a first entity, said first identifier and said first pass-phrase associated with a realm; (b) assigning a second identifier and a second pass-phrase to a second entity, said second identifier and said second pass-phrase associated with said realm; (c) storing said first identifier, said first pass-phrase, said second identifier, and said second pass-phrase at an authentication entity; (d) requesting access to said second entity, said request initiated by said first entity and including said first identifier; (e) transmitting a first challenge from said second entity to said first entity; (f) transmitting a second challenge from said first entity to said second entity; (g) calculating a first response involving said realm, first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge, said first response calculated by said first entity; (h) calculating a second response involving said realm, said second identifier, said second pass-phrase, said second challenge, said first identifier, and said first challenge, said second response calculated by said second entity; (i) transmitting said first response to said second entity; (j) transmitting said realm, said first identifier, said first challenge, said first response, said second identifier, said second challenge, and said second response to said authentication entity; (k) verifying said first response, said verification involving said realm, said first identifier, said first pass-phrase, said first challenge, said first response, said second identifier, and said second challenge, and said verification performed by said authentication entity; (l) verifying said second response, said verification involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge, and said verification performed by said authentication entity; (m) generating a first authentication proof for said first entity, said first authentication proof generated by said authentication entity and involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge; (n) generating a second authentication proof for said second entity, said second authentication proof generated by said authentication entity and involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge; (o) transmitting said first authentication proof and said second authentication proof from said authentication entity to said second entity; and (p) verifying said second authentication proof, said verification performed by said second entity; (q) transmitting said first authentication proof from said second entity to said first entity; and (r) verifying said first authentication proof, said verification performed by said first entity.
Claim 2
Independent Claim
431 words
A method of authentication, said method comprising the steps of: (a) assigning a first identifier and a first pass-phrase to a first entity, said first identifier and said first pass-phrase associated with a realm; (b) assigning a second identifier and a second pass-phrase to a second entity, said second identifier and said second pass-phrase associated with said realm; (c) storing said first identifier, said first pass-phrase, said second identifier, and said second pass-phrase at an authentication entity; (d) requesting access to said second entity, said request initiated by said first entity and including said first identifier; (e) transmitting a first challenge from said second entity to said first entity; (f) transmitting a second challenge from said first entity to said second entity; (g) calculating a first response involving said realm, first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge, said first response calculated by said first entity; (h) calculating a second response involving said realm, said second identifier, said second pass-phrase, said second challenge, said first identifier, and said first challenge, said second response calculated by said second entity; (i) transmitting said first response to said second entity; (j) transmitting said realm, said first identifier, said first challenge, said first response, said second identifier, said second challenge, and said second response to said authentication entity; (k) verifying said first response, said verification involving said realm, said first identifier, said first pass-phrase, said first challenge, said first response, said second identifier, and said second challenge, and said verification performed by said authentication entity; (l) verifying said second response, said verification involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge, and said verification performed by said authentication entity; (m) generating a first authentication proof for said first entity, said first authentication proof generated by said authentication entity and involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge; (n) generating a second authentication proof for said second entity, said second authentication proof generated by said authentication entity and involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge; (o) transmitting said first authentication proof and said second authentication proof from said authentication entity to said second entity; and (p) verifying said second authentication proof, said verification performed by said second entity; (q) transmitting said first authentication proof from said second entity to said first entity; and (r) verifying said first authentication proof, said verification performed by said first entity.
Claim 3
Dependent Claim
21 words
The method of claim 1, wherein said first entity is a computer user and said second entity is an on-line service.
Claim 4
Dependent Claim
16 words
The method of claim 2, wherein said on-line service is available via the World Wide Web.
Claim 5
Dependent Claim
17 words
The method of claim 2, wherein communications with the on-line service are via the HyperText Transfer Protocol.
Claim 6
Dependent Claim
30 words
The method of claim 1, further comprising the steps of generating a session key for said first entity and said second entity, said session key generated by said authentication entity.
Claim 7
Dependent Claim
19 words
The method of claim 5, wherein said first authentication proof and said second authentication proof includes said session key.
Claim 8
Dependent Claim
26 words
The method of claim 1, further comprising the step of transmitting an authorization response for said first response from said authentication entity to said second entity.
Claim 9
Dependent Claim
26 words
The method of claim 1, further comprising the step of transmitting an authorization response for said second response from said authentication entity to said second entity.
Claim 10
Dependent Claim
36 words
The method of claim 1, wherein said first response is calculated by application of the MD5 function to said first pass-phrase, said first identifier, said second identifier, said realm, said first challenge, and said second challenge.
Claim 11
Dependent Claim
36 words
The method of claim 1, wherein said second response is calculated by application of the MD5 function to said second pass-phrase, said second identifier, said first identifier, said realm, said first challenge, and said second challenge.
Claim 12
Independent Claim
542 words
A method of authentication, said method comprising the steps of: (a) assigning a first identifier and a first pass-phrase to a first entity, said first identifier and said first pass-phrase associated with a realm; (b) assigning a second identifier and a second pass-phrase to a second entity, said second identifier and said second pass-phrase associated with said realm; (c) storing said first identifier, said first pass-phrase, said second identifier, and said second pass-phrase at an authentication entity; (d) requesting access to said second entity, said access request initiated by said first entity and including said first identifier; (e) transmitting a first challenge from said second entity to said first entity; (f) transmitting a second challenge from said first entity to said second entity; (g) calculating a first response involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge, said first response calculated by said first entity; (h) calculating a second response involving said realm, said second identifier, said second pass-phrase, said second challenge, said first identifier, and said first challenge, said second response calculated by said second entity; (i) transmitting said first response to said second entity; (j) transmitting said realm, said first identifier, said first challenge, said first response, said second identifier, said second challenge, and said second response to said authentication entity; (k) verifying said first response, said verification involving said realm, said first identifier, said first pass-phrase, said first challenge, said first response, said second identifier, and said second challenge, and said verification performed by said authentication entity; (l) verifying said second response, said verification involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge, and said verification performed by said authentication entity; (m) generating a session key for said first entity and said second entity, said session key generated by said authentication entity; (n) obscuring said session key for said first entity, said obscuring involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge, and performed by said authentication entity; (o) obscuring said session key for said second entity, said obscuring involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge, and performed by said authentication entity; (p) generating a first authentication proof for said first entity, said first authentication proof generated by said authentication entity and involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, said second challenge, and said obscured session key for said first entity; (q) generating a second authentication proof for said second entity, said second authentication proof generated by said authentication entity and involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, said second challenge, and said obscured session key for said second entity; (r) transmitting said first authentication proof and said second authentication proof from said authentication entity to said second entity; and (s) verifying said second authentication proof, said verification performed by said second entity; (t) transmitting said first authentication proof from said second entity to said first entity; and (u) verifying said first authentication proof, said verification performed by said first entity.
Claim 13
Independent Claim
542 words
A method of authentication, said method comprising the steps of: (a) assigning a first identifier and a first pass-phrase to a first entity, said first identifier and said first pass-phrase associated with a realm; (b) assigning a second identifier and a second pass-phrase to a second entity, said second identifier and said second pass-phrase associated with said realm; (c) storing said first identifier, said first pass-phrase, said second identifier, and said second pass-phrase at an authentication entity; (d) requesting access to said second entity, said access request initiated by said first entity and including said first identifier; (e) transmitting a first challenge from said second entity to said first entity; (f) transmitting a second challenge from said first entity to said second entity; (g) calculating a first response involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge, said first response calculated by said first entity; (h) calculating a second response involving said realm, said second identifier, said second pass-phrase, said second challenge, said first identifier, and said first challenge, said second response calculated by said second entity; (i) transmitting said first response to said second entity; (j) transmitting said realm, said first identifier, said first challenge, said first response, said second identifier, said second challenge, and said second response to said authentication entity; (k) verifying said first response, said verification involving said realm, said first identifier, said first pass-phrase, said first challenge, said first response, said second identifier, and said second challenge, and said verification performed by said authentication entity; (l) verifying said second response, said verification involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge, and said verification performed by said authentication entity; (m) generating a session key for said first entity and said second entity, said session key generated by said authentication entity; (n) obscuring said session key for said first entity, said obscuring involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge, and performed by said authentication entity; (o) obscuring said session key for said second entity, said obscuring involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, and said second challenge, and performed by said authentication entity; (p) generating a first authentication proof for said first entity, said first authentication proof generated by said authentication entity and involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, said second challenge, and said obscured session key for said first entity; (q) generating a second authentication proof for said second entity, said second authentication proof generated by said authentication entity and involving said realm, said first identifier, said first challenge, said second identifier, said second pass-phrase, said second challenge, and said obscured session key for said second entity; (r) transmitting said first authentication proof and said second authentication proof from said authentication entity to said second entity; and (s) verifying said second authentication proof, said verification performed by said second entity; (t) transmitting said first authentication proof from said second entity to said first entity; and (u) verifying said first authentication proof, said verification performed by said first entity.
Claim 14
Dependent Claim
139 words
The method of claim 11, further comprising the steps of: (a) transmitting a third challenge from said second entity to said first entity; (b) transmitting a fourth challenge from said first entity to said second entity; (c) calculating a third response involving said realm, said first session key, said first identifier, and said second identifier, said response calculated by said first entity; (d) transmitting said third response from said first entity to said second entity; (e) verifying said third response; said verification performed by said second entity; (f) calculating a fourth response involving said realm, said second session key, said first identifier, and said second identifier, said fourth response calculated by said second entity; (g) transmitting said fourth response from said second entity to said first entity; (h) verifying said fourth response, said verification performed by said first entity.
Claim 15
Dependent Claim
13 words
The method of claim 12, further comprising the step of repeating steps (a)-(h).
Claim 16
Dependent Claim
15 words
The method of claim 11, wherein said access request is a HyperText Transfer Protocol request.
Claim 17
Dependent Claim
42 words
The method of claim 14, wherein said HyperText Transfer Protocol request includes an authorization header with a response involving said first session key, said realm, said first identifier, said second identifier, said first challenge, said second challenge, and a Uniform Resource Identifier.
Claim 18
Independent Claim
341 words
A system for authentication comprising: a first entity; a second entity; an authentication entity; a first identifier and a first pass-phrase for said first entity, said first identifier and said first pass-phrase associated with a realm; a second identifier and a second pass-phrase for said second entity, said second identifier and said second pass-phrase associated with said realm; means for said authentication entity to retrieve according to said realm said first identifier, said first pass-phrase, said second identifier, and said second pass-phrase; means for said second entity to transmit a first challenge to said first entity; means for said first entity to transmit a second challenge to said second entity; means for said first entity to calculate a first response involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge; means for said second entity to calcite a second response involving said realm, said second identifier, said second pass-phrase, said second challenge, said first identifier, and said first challenge; means for transmitting said realm; said first identifier, said first challenge, said first response, said second identifier, said second challenge, and said second response to said authentication entity; means for said authentication entity to verify said first response, said verification involving said realms said first identifier, said first challenge, said second identifier, and said second challenge; means for said authentication entity to verify said second response, said verification involving said realms said first identifier, said first challenge, said first response, said second identifier, and said second challenge; means for said authentication entity to generate a first authentication proof for said first entity; means for said authentication entity to generate a second authentication proof for said second entity; means for transmitting said first and said second authentication proofs from said authentication entity to said second entity; means for said second entity to verify said second authentication proof; means for transmitting said first authentication proof from said second entity to said first entity; and means for said first entity to verify said first authentication proof.
Claim 19
Independent Claim
341 words
A system for authentication comprising: a first entity; a second entity; an authentication entity; a first identifier and a first pass-phrase for said first entity, said first identifier and said first pass-phrase associated with a realm; a second identifier and a second pass-phrase for said second entity, said second identifier and said second pass-phrase associated with said realm; means for said authentication entity to retrieve according to said realm said first identifier, said first pass-phrase, said second identifier, and said second pass-phrase; means for said second entity to transmit a first challenge to said first entity; means for said first entity to transmit a second challenge to said second entity; means for said first entity to calculate a first response involving said realm, said first identifier, said first pass-phrase, said first challenge, said second identifier, and said second challenge; means for said second entity to calcite a second response involving said realm, said second identifier, said second pass-phrase, said second challenge, said first identifier, and said first challenge; means for transmitting said realm; said first identifier, said first challenge, said first response, said second identifier, said second challenge, and said second response to said authentication entity; means for said authentication entity to verify said first response, said verification involving said realms said first identifier, said first challenge, said second identifier, and said second challenge; means for said authentication entity to verify said second response, said verification involving said realms said first identifier, said first challenge, said first response, said second identifier, and said second challenge; means for said authentication entity to generate a first authentication proof for said first entity; means for said authentication entity to generate a second authentication proof for said second entity; means for transmitting said first and said second authentication proofs from said authentication entity to said second entity; means for said second entity to verify said second authentication proof; means for transmitting said first authentication proof from said second entity to said first entity; and means for said first entity to verify said first authentication proof.
Claim 20
Dependent Claim
21 words
The system of claim 16, wherein said first entity is a computer user and said second entity is an on-line service.
Claim 21
Dependent Claim
36 words
The system of claim 16, wherein said first response is calculated by application of the MD5 function to said first pass-phrase, said first identifier, said second identifier, said realm, said first challenge, and said second challenge.
Claim 22
Dependent Claim
36 words
The system of claim 16, wherein said second response is calculated by application of the MD5 function to said second pass-phrase, said second identifier, said first identifier, said realm, said first challenge, and said second challenge.
Claim 23
Independent Claim
68 words
A system for authentication comprising: a realm identifier associated with a first identifier and a first pass-phrase for a first entity; a second identifier and a second pass-phrase for a second entity, said second identifier and said second pass-phrase associated with said realm; means for authenticating said first entity, said means including said realm identifier; and means for authenticating said second entity, said means including said realm identifier.
Claim 24
Independent Claim
68 words
A system for authentication comprising: a realm identifier associated with a first identifier and a first pass-phrase for a first entity; a second identifier and a second pass-phrase for a second entity, said second identifier and said second pass-phrase associated with said realm; means for authenticating said first entity, said means including said realm identifier; and means for authenticating said second entity, said means including said realm identifier.
Claim 25
Dependent Claim
35 words
The system of claim 20 wherein said first entity authentication means and said second entity authentication means includes authentication proofs for said first entity and said second entity, said authentication proofs including said realm identifier.
Claim 26
Independent Claim
200 words
A method of authentication for use with Hyper-Text Transfer Protocol, said method comprising the steps of: transmitting a connection request from a client to a server; creating a server security context and assigning an identifier to said server security context, said server security context created by and said identifier assigned by said server in response to said connection request from said client; transmitting a first authentication header from said server to said client, said first authorization header comprising a realm list, a status indicator, a service challenge, and said service security context; creating a client security context and assigning said identifier to said client security context, said client security context created by said client; transmitting an authorization header from said client to said server, said authorization header comprising a status indicator, said client security context, a realm selected from said realm list, a client identifier in said selected realm, a client challenge, and a client response to said service challenge; examining said client security context to determine an authentication state for said client security context, said examination performed by said server; and performing authentication if said client context identifier is recognized by said server, said authentication performed by said server.
Claim 27
Independent Claim
200 words
A method of authentication for use with Hyper-Text Transfer Protocol, said method comprising the steps of: transmitting a connection request from a client to a server; creating a server security context and assigning an identifier to said server security context, said server security context created by and said identifier assigned by said server in response to said connection request from said client; transmitting a first authentication header from said server to said client, said first authorization header comprising a realm list, a status indicator, a service challenge, and said service security context; creating a client security context and assigning said identifier to said client security context, said client security context created by said client; transmitting an authorization header from said client to said server, said authorization header comprising a status indicator, said client security context, a realm selected from said realm list, a client identifier in said selected realm, a client challenge, and a client response to said service challenge; examining said client security context to determine an authentication state for said client security context, said examination performed by said server; and performing authentication if said client context identifier is recognized by said server, said authentication performed by said server.
Claim 28
Dependent Claim
35 words
The method of claim 22 further comprising the step of transmitting from said server to said client a second authentication header including a status indicator indicating said client was successfully authenticated and a session key.
Claim 29
Dependent Claim
20 words
The method of claim 22 wherein said server security context identifier and said client security context identifiers are opaque strings.
Claim 30
Dependent Claim
27 words
The method of claim 22 wherein said server security context comprises a realm name, a server identifier, a session key, a server challenge, and a status indicator.
Claim 31
Dependent Claim
26 words
The method of claim 22 wherein said client security context comprises a realm, a client identifier, a session key, a client challenge, and a status indicator.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-04-13 | 2001-10-13 | 2002-04-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-04-13 | 2005-10-13 | 2006-04-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-04-13 | 2009-10-13 | 2010-04-14 | $7700.00 | Window Closed / Lapsed |