Secure two-piece user authentication in a computer network

Claim 1

A method for securely authenticating user identity in a computer network including a network server coupled to at least one network node capable of communicating with an external token that includes a cryptographic algorithm and an encryption key, the network node further incorporating a secure memory and an associated secure operating mode independent from the general memory and operating mode of the network node, the method comprising the steps of: placing the network node into the secure operating mode, and while in the secure operating mode, performing the steps of: receiving a user password from a user in the network node; communicatively coupling the external token to the network node; providing the user password to the cryptographic algorithm stored in the token; encrypting the user password with the cryptographic algorithm and the encryption key to produce a network password; storing the network password within the secure memory; and exiting the secure operating mode; and performing the following steps for network access: encrypting the network password stored in secure memory using a network server public key creating an encrypted network password; communicating the encrypted network password to the network server; decrypting the encrypted network password in the network server using a network server private key corresponding to the network server public key; and comparing the decrypted network password or portions thereof to information maintained by the network server in order to verify user identity and/or determine network privileges accorded to the network password.

Claim 2

A method for securely authenticating user identity in a computer network including a network server coupled to at least one network node capable of communicating with an external token that includes a cryptographic algorithm and an encryption key, the network node further incorporating a secure memory and an associated secure operating mode independent from the general memory and operating mode of the network node, the method comprising the steps of: placing the network node into the secure operating mode, and while in the secure operating mode, performing the steps of: receiving a user password from a user in the network node; communicatively coupling the external token to the network node; providing the user password to the cryptographic algorithm stored in the token; encrypting the user password with the cryptographic algorithm and the encryption key to produce a network password; storing the network password within the secure memory; and exiting the secure operating mode; and performing the following steps for network access: encrypting the network password stored in secure memory using a network server public key creating an encrypted network password; communicating the encrypted network password to the network server; decrypting the encrypted network password in the network server using a network server private key corresponding to the network server public key; and comparing the decrypted network password or portions thereof to information maintained by the network server in order to verify user identity and/or determine network privileges accorded to the network password.

Claim 22

A system capable of securely providing two-piece user authentication data over a computer network, the system including capabilities for operating in conjunction with an external token containing a cryptographic algorithm and an encryption key, the system comprising: a computer system including: a system bus; a secure memory coupled to said system bus, said secure memory independent from a general memory of the computer system; a processor coupled to said system bus, said processor having a secure operating mode associated with said secure memory and independent from a general operating mode of said processor; token interface circuitry coupled to said processor for communicating with the external token; network interface circuitry coupling said processor to the computer network; and a security code stored in a processor readable medium, said security code and said processor readable medium configured for access and execution during the secure operating mode, said security code when executed by said processor causing the processor to perform the steps of: receiving a user password; providing the user password to the external token; receiving a network password from the external token, wherein the network password is an encrypted version of the user password; storing the network password within said secure memory; encrypting the network password stored in said secure memory using a public key creating an encrypted network password; and communicating the encrypted network password to the computer network via said network interface circuitry; and a network resource comprising: an interface coupled to the computer network suitable for communicating with said computer system and receiving the encrypted network password; and executable code in readable media, the code, when executed, performing the steps of: decrypting the encrypted network password using a private key corresponding to the public key; and comparing the decrypted network password or portions thereof to information maintained by the network server to verify user identity and/or determine network privileges accorded to the network password.

Claim 23

A system capable of securely providing two-piece user authentication data over a computer network, the system including capabilities for operating in conjunction with an external token containing a cryptographic algorithm and an encryption key, the system comprising: a computer system including: a system bus; a secure memory coupled to said system bus, said secure memory independent from a general memory of the computer system; a processor coupled to said system bus, said processor having a secure operating mode associated with said secure memory and independent from a general operating mode of said processor; token interface circuitry coupled to said processor for communicating with the external token; network interface circuitry coupling said processor to the computer network; and a security code stored in a processor readable medium, said security code and said processor readable medium configured for access and execution during the secure operating mode, said security code when executed by said processor causing the processor to perform the steps of: receiving a user password; providing the user password to the external token; receiving a network password from the external token, wherein the network password is an encrypted version of the user password; storing the network password within said secure memory; encrypting the network password stored in said secure memory using a public key creating an encrypted network password; and communicating the encrypted network password to the computer network via said network interface circuitry; and a network resource comprising: an interface coupled to the computer network suitable for communicating with said computer system and receiving the encrypted network password; and executable code in readable media, the code, when executed, performing the steps of: decrypting the encrypted network password using a private key corresponding to the public key; and comparing the decrypted network password or portions thereof to information maintained by the network server to verify user identity and/or determine network privileges accorded to the network password.