US6061790A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Network computer system with remote user data encipher methodology
Assignee: Intellisync LLC
•
Filing: 1997-02-24
•
Granted: 2000-05-09
•
Expires: 2017-02-24
Abstract
Abstract Computer-implemented methodology is described which allows any user to access a "network client" machine (e.g., PC, ATM machine, cell phone, or the like) which is connected to a network but which does not know the authentication of the user. With only the user's password, the client machine is able to initiate a communication session with a server and identify the user to the server as the person who the server truly expects. The method allows both the client and the server to each identify the other as authentic (not a middle man or imposter)--that is, without compromise in security along the communication link. In this manner, the user can access information from the true server in a secure manner and bring that information down to the local client, for instance, for use in a JAVA application.
Inventors
- 👤 Eric O. Bodnar
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 03:11
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; H04L63/0869; G; G06; G06F; G06F21/00; G06F21/30; G06F21/44; G06F21/445; G06F21/60; G06F21/606; H04L51/00; H04L63/083; H04L63/16; H04L63/168; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/0844; H04L9/32; H04L9/3271
Claims Analysis
Total Claims: 42
Claim 1
Independent Claim
223 words
In a system having computing devices comprising at least a client connected to a server through a communication network, a method for establishing a secured communication session between the client and the server for enciphering data, the method comprising: receiving input at the client comprising user information, said input being received a point in time when it is desired to establish said secured communication session, said user information including a user identifier which uniquely identifies a particular user to the system and including a user password; transmitting a request from the client to the server for establishing a secured communication session between the client and the server, said request including said user identifier; retrieving at the server, based on said user identifier transmitted to the server, previously-stored user authentication information for authenticating the particular user; computing at the server a first public sub-key, said first public sub-key being based at least in part on said previously-stored user authentication information; transmitting said first public sub-key to said client; computing at the client a second public sub-key, said second public sub-key being based at least in part on said user password and said computed first public sub-key; computing at the client a secret session key, based at least in part on said computed second public sub-key; and enciphering data with said computed secret session key.
Claim 2
Dependent Claim
223 words
In a system having computing devices comprising at least a client connected to a server through a communication network, a method for establishing a secured communication session between the client and the server for enciphering data, the method comprising: receiving input at the client comprising user information, said input being received a point in time when it is desired to establish said secured communication session, said user information including a user identifier which uniquely identifies a particular user to the system and including a user password; transmitting a request from the client to the server for establishing a secured communication session between the client and the server, said request including said user identifier; retrieving at the server, based on said user identifier transmitted to the server, previously-stored user authentication information for authenticating the particular user; computing at the server a first public sub-key, said first public sub-key being based at least in part on said previously-stored user authentication information; transmitting said first public sub-key to said client; computing at the client a second public sub-key, said second public sub-key being based at least in part on said user password and said computed first public sub-key; computing at the client a secret session key, based at least in part on said computed second public sub-key; and enciphering data with said computed secret session key.
Claim 3
Dependent Claim
13 words
The method of claim 1, wherein said user identifier comprises a user name.
Claim 4
Dependent Claim
20 words
The method of claim 1, wherein said computing at the server a first public sub-key includes computing a prime modulus.
Claim 5
Dependent Claim
20 words
The method of claim 1, wherein said computing at the server a first public sub-key includes computing a random exponent.
Claim 6
Dependent Claim
49 words
The method of claim 1, wherein said computing at the server a first public sub-key includes computing a server component k by: k=(g.sup.e mod m)⊕h.sub.1 where m represents a prime modulus, e represents a random exponent, g represents a generator value, and h 1 represents said user authentication information.
Claim 7
Dependent Claim
20 words
The method of claim 1, wherein said computing at the client a second public sub-key includes computing a random exponent.
Claim 8
Dependent Claim
46 words
The method of claim 1, wherein said computing at the server a first public sub-key includes computing a prime modulus and wherein said computing at the client a second public sub-key includes computing said second public sub-key based at least in part on said prime modulus.
Claim 9
Dependent Claim
44 words
The method of claim 1, wherein said computing at the client a second public sub-key includes: computing a hash value based at least in part on said user password; and computing said second public sub-key based at least in part on said hash value.
Claim 10
Dependent Claim
60 words
The method of claim 1, wherein said computing at the client a second public sub-key includes computing a client component k' by: k'=(g.sup.e' mod m)⊕h.sub.1 where m represents a computed prime modulus, e' represents a computed random exponent, g represents a generator value, and h 1 represents a computed hash value based at least in part on said user password.
Claim 11
Dependent Claim
27 words
The method of claim 9, wherein said prime modulus is transmitted from the server to the client prior to the client's determination of said client public sub-key.
Claim 12
Dependent Claim
19 words
The method of claim 9, wherein said generator value is previously stored at both the client and the server.
Claim 13
Dependent Claim
17 words
The method of claim 9, wherein said generator value is exchanged between the client and the server.
Claim 14
Dependent Claim
61 words
The method of claim 1, wherein said computing at the client a secret session key includes computing a secret session key K by: K=(k⊕h.sub.1).sup.e' modm where k represents said second public sub-key, h 1 represents a computed hash value based at least in part on said user password, e' represents a computed random exponent, and m represents a computed prime modulus.
Claim 15
Dependent Claim
23 words
The method of claim 1, wherein said secret session key comprises a secret session key which is only valid during the current session.
Claim 16
Dependent Claim
52 words
The method of claim 1, further comprising: computing a hash value based at least in part on said user password, transmitting the hash value from the client to the server; and at the server, authenticating the client by comparing the hash value transmitted from the client with the previously-stored user authentication information.
Claim 17
Dependent Claim
32 words
The method of claim 15, wherein said transmitting the hash value from the client to the server step includes: enciphering the hash value before transmitting it from the client to the server.
Claim 18
Dependent Claim
31 words
The method of claim 15, further comprising: after authenticating the client, transmitting a session identifier from the server to the client, said session identifier being valid only during the current session.
Claim 19
Dependent Claim
26 words
The method of claim 17, wherein said transmitting a session identifier step includes: enciphering said session identifier before transmitting it from the server to the client.
Claim 20
Dependent Claim
38 words
The method of claim 1, further comprising: transmitting said second public sub-key from the client to the server; and computing at the server said secret session key, based at least in part on said transmitted second public sub-key.
Claim 21
Dependent Claim
77 words
The method of claim 1, further comprising: computing a hash value based at least in part on said user password and which corresponds to second user authentication information stored at the server, said second user authentication information for authenticating the particular user; transmitting said second user authentication information from the server to the client; and at the client, authenticating the server by comparing the second user authentication information transmitted from the server with the computed hash value.
Claim 22
Dependent Claim
36 words
The method of claim 20, wherein said transmitting said second user authentication information from the server to the client step includes: enciphering said second user authentication information before transmitting it from the server to the client.
Claim 23
Dependent Claim
47 words
The method of claim 1, further comprising: computing at the server said secret session key, based at least in part on said computed second public sub-key; and enciphering data at the server with said computed secret session key and thereafter transmitting the enciphered data to the client.
Claim 24
Dependent Claim
44 words
The method of claim 22, wherein data of the particular user which is stored at the server is previously enciphered using said user password, such that any data of the particular user is twice enciphered before being transmitted from the server to the client.
Claim 25
Dependent Claim
44 words
The method of claim 23, further comprising: deciphering enciphered data of the particular user upon transmission from the server to the client by deciphering the transmitted data first with said secret session key and thereafter deciphering the once-deciphered transmitted data with said user password.
Claim 26
Dependent Claim
24 words
The method of claim 1, further comprising: receiving input at the client further comprising information from a user key-card for authenticating the particular user.
Claim 27
Dependent Claim
27 words
The method of claim 25, wherein said user key-card stores a private key of a private key/public key pair, said public key being stored at the server.
Claim 28
Dependent Claim
74 words
The method of claim 26, further comprising: computing a hash value based at least in part on said user password; enciphering said hash value with said private key stored by said key-card; transmitting the enciphered hash value from the client to the server; and authenticating the client to the server by: deciphering the enciphered hash value at the server, and comparing the deciphered hash value from the client with the previously-stored user authentication information.
Claim 29
Dependent Claim
27 words
The method of claim 26, wherein said key-card is employed for authenticating users without using it for enciphering or deciphering any user data stored at the server.
Claim 30
Dependent Claim
56 words
The method of claim 1, further comprising: computing at the server said secret session key, based at least in part on said computed second public sub-key; retrieving an e-mail private key for the particular user stored at the server; and transmitting to the client an enciphered copy of said e-mail private key for the particular user.
Claim 31
Dependent Claim
21 words
The method of claim 29, further comprising: transmitting an enciphered copy of an e-mail public key ring for the particular user.
Claim 32
Dependent Claim
140 words
A secured client/server system comprising: a client connected to a server through a communication network; an input means at the client for receiving user information at a point in time when it is desired to establish a secured communication session between said client and said server, said user information including a user identifier which uniquely identifies a particular user to the system and including a user password; means for computing at the server and at the client respective public sub-keys, based at least in part on a hash value derived from said user password; means for exchanging said respective public sub-keys; means for computing at the server and at the client a shared secret session key that is generated at least in part from said respective public sub-keys; and means for enciphering and deciphering data with said secret session key.
Claim 33
Dependent Claim
140 words
A secured client/server system comprising: a client connected to a server through a communication network; an input means at the client for receiving user information at a point in time when it is desired to establish a secured communication session between said client and said server, said user information including a user identifier which uniquely identifies a particular user to the system and including a user password; means for computing at the server and at the client respective public sub-keys, based at least in part on a hash value derived from said user password; means for exchanging said respective public sub-keys; means for computing at the server and at the client a shared secret session key that is generated at least in part from said respective public sub-keys; and means for enciphering and deciphering data with said secret session key.
Claim 34
Dependent Claim
187 words
The system of claim 31, wherein said means for computing at the server and at the client respective public sub-keys includes: means for transmitting a request from the client to the server for establishing a secured communication session between the client and the server, said request including said user identifier; means for retrieving at the server, based on said user identifier transmitted to the server, previously-stored user authentication information for authenticating the particular user; means for computing at the server a first public sub-key, based at least in part on said previously-stored user authentication information; means for transmitting said first public sub-key to said client; means for computing at the client a second public sub-key, based at least in part on said user password and said computed first public sub-key; means for transmitting said second public sub-key from the client to the server; and means for computing at the client a secret session key, based at least in part on said computed second public sub-key; and means for computing at the server said secret session key, based at least in part on said computed second public sub-key.
Claim 35
Dependent Claim
15 words
The system of claim 31, further comprising: means for authenticating the client to the server.
Claim 36
Dependent Claim
15 words
The system of claim 31, further comprising: means for authenticating the server to the client.
Claim 37
Dependent Claim
24 words
The system of claim 31, wherein said means for enciphering and deciphering data employs a selected one of IDEA, Blowfish, and DES block cipher.
Claim 38
Dependent Claim
19 words
The system of claim 31, wherein said previously-stored user authentication information comprises a one-way hash of said user password.
Claim 39
Dependent Claim
23 words
The system of claim 36, wherein said one-way hash employs a selected one of an MD4 one-way hash and an MD5 one-way hash.
Claim 40
Dependent Claim
17 words
The system of claim 31, wherein said password includes a pass phrase comprising one or more words.
Claim 41
Dependent Claim
26 words
The system of claim 31, further comprising: second input means at the client for receiving a user key-card for authenticating a particular user to the system.
Claim 42
Dependent Claim
36 words
The system of claim 39, wherein said user key-card stores a private key of a separate private key/public key pair, with the public key of said separate private key/public key pair being stored at the server.
References Cited (Backward Citations)
US4200770A
Cited
US4405829A
Cited
US4649233A
Cited
US4956863A
Cited
US5202921A
Cited
US5241594A
Cited
US5535276A
Cited
US5953420A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-05-09 | 2003-11-08 | 2004-05-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-05-09 | 2007-11-08 | 2008-05-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-05-09 | 2011-11-08 | 2012-05-09 | $7700.00 | Window Closed / Lapsed |