The present application is related to pending U.S. patent applications Ser. Nos. 09/844,246, 09/844,272 entitled, “METHOD AND SYSTEM FOR ESTABLISHING A REMOTE CONNECTION TO A PERSONAL SECURITY DEVICE,” and “METHOD AND SYSTEM FOR REMOTE MANAGEMENT OF PERSONAL SECURITY DEVICES” both filed on Apr. 30, 2001, having the same inventors as those of the present application and assigned to the assignee of the present invention. Applicant hereby incorporates by reference the above-mentioned Co.-pending applications.
The present invention relates to a data processing method for end user authentication over a network for purposes of obtaining secure functions or data from one or more remote computer systems. More particularly, the invention relates to a method of authenticating an end user to multiple remote computer systems using a communications pipe and a personal security device.
One of the simplest and most commonly used authentication methods employed is the static password, whereby a client computer challenges an end user for a pre-determined password. Once the end user provides the correct password, access is permitted to secure functions or data available on one or more remote computer systems. A significant limitation of the current art is that localized authentication transactions are potentially vulnerable to compromise by unauthorized programs running on the local client or by other illicit means intending to monitor the password authentication process. In a single point authentication process, once a point of entry to a network is compromised, all locations using the same security codes are generally compromised as well.
One security method commonly used to overcome single point authentication failures employs the use of separate static passwords for each pre-determined secure resource, While this method is an improvement over a single multi-use password, this method is still vulnerable to illicit password monitoring, requires an end user to remember multiple passwords, and inefficiently ties up network resources by repeating the entire authentication process each time access to a different secure resource is requested.
Also, as a practical consideration. requiring an end user to remember several different passwords typically results in the same password being used for all secure resources, hence defeating the entire purpose of performing multiple authentications using static passwords.
A more sophisticated approach than the previously described methods, involves the use of personal security devices (PSD) such as smart cards, which allows storage of multiple credentials, passwords, certificates, private keys, etc. By implementing the use of smart cards, the ability to compromise passwords is significantly reduced. However, PSDs are still somewhat vulnerable to illicit monitoring during local client cryptographic key generation as described in the background of the invention section of cross-referenced patent application,09/844,246 OCL1, “Method and System for Establishing a Remote Connection To a Personal Security Device.” An additional limitation of this method becomes apparent when attempting to perform multiple authenticating transactions using a single PSD over a network connection. The PSD, beings a slow serial device, only allows one transaction to occur at a time. In addition, network contention and processor execution speed issues become particularly problematic when low bandwidth connections (e.g. dialup connections) are made between a client and a remote computer system during authentication with the PSD.
This invention resides in a method of authenticating an end user to one or more remote computer systems using a communications pipe to send authentication codes from a PSD to one or more secure remote computer systems. The remote computer system establishing and maintaining the communications pipe with the PSD performs an initial authentication, then acts as a secure hub and client authentication proxy for other remote computer systems requesting client authentication. In a multi-tasking operating environment, multiple authentications occur as background transactions, which are transparent to the end user, The remote computer system acting as a secure hub may form multiple communications pipes with other clients connected to a network.
In order to perform authentications, a communications pipe is established between a remote computer system and a PSD as previously described in cross-referenced patent application, 09/844,246 OCL-1, “Method and System for Establishing a Remote Connection To a Personal Security Device.” A remote computer system requiring client authentication sends an authentication challenge to either the client and is redirected to the remote computer system acting as a secure hub or using a pre-established address, sends an authentication challenge directly to the remote computer system maintaining the communications pipe.
In a one embodiment of this invention, the remote computer system assigned as a secure hub performs the initial client authentication then routes subsequent authentication challenges through the communications pipe to the PSD for, processing within the secure domain of the PSD, then returns the PSD generated authentication code back through the communications pipe over a network and to the challenging remote computer system.
In a second embodiment of this invention, the remote computer system established as a secure hub performs the initial client authentication then copies, if not already present, the PSD's authentication credentials through the communications pipe to a secure storage location within the secure hub. The secure hub using the transferred PSD credentials and equivalent algorithms authenticates the client to subsequent remote computer systems by emulating the PSD.
In both embodiments of this invention, communications between local clients and remote computers systems over one or more networks should employ secure communications protocols as is described in the cross-referenced patent application, 09/844,246 OCL-1, which further reduces the likelihood of unauthorized access or interception, For non-proprietary transactions with the PSD , secure communications are optional.
There are several advantages to this invention when used in conjunction with the communications pipe. First and most importantly, authentication transactions are only performed in highly secure and protected domains, which greatly reduces the chances of unauthorized access or interception. Secondly, authentication transactions will occur more rapidly and seamlessly, since remote computer systems are generally provided with greater network bandwidth and processing power than local clients.
Lastly, by relocating the authentication process to a remote computer system, a more simplified means to perform end-to-end authentication and maintain an audit trail of transactions by authenticated end users and transactions with other remote computer systems is readily accomplished since all authentication transactions are routed through a remote computer system designated as a secure hub.
Additional security improvements may be facilitated by incorporating the use of hardware security modules (HSM) at designated remote computer systems implementing the secure hub portion of the invention. End-to-end security is enhanced since authentications and related transactions occur within the highly secure domains of a PSD and HSM.
FIG. 1—is a general system block diagram for implementing present invention,
FIG. 2—is a detailed block diagram illustrating initial authentication challenge.
FIG. 3—is a detailed block diagram illustrating initial authentication.
FIG. 4—is a detailed block diagram illustrating remote authentication challenge.
FIG. 5—is a detailed block diagram illustrating remote authentication.
FIG. 6—is a detailed block diagram illustrating authentication credential transfer.
FIG. 7—is a detailed block diagram illustrating remote authentication challenge (Alternate inventive embodiment.)
FIG. 8—is a detailed block diagram illustrating remote authentication (Alternate inventive embodiment.)
The steps involved in performing authentication through a communications pipe are shown in
Referring now to
The remote computer system 150 is an example of a system requiring authentication when a request for secure functions or data is sent from client computer 10 over the networks 45 and 45A. The communications pipe 75 applies to authentication transactions but does not restrict nor control non-secure transactions occurring over either network 45 or 45A.
Networks 45 and 45A may be a common network as in a virtual private networking arrangement or separate networks such as private intranet and public internet arrangements. The networks 45 and 45A are depicted separately for illustrative purposes only. No limitation is intended in the number of PSDs and clients forming communications pipes 75 with one or more secure hubs 50; nor should any limitation on the number of remote computer systems 70 available for authentication be construed from the drawing. Transactions not involving authentications are not restricted to the secure hub.
The basic operation of the secure hub may be initiated when an end user at a client requests access to secure functions or data contained on one or more remote computer systems connected by a network. An available remote computer system, in which a communications pipe has been established as described in Co.-pending application OCL-1, authenticates the end user and client using the security mechanisms contained within the secure domain of the PSD. Alternatively, an external event such as a need to update information within a PSD may trigger a remote computer system other than the secure hub to initiate the authentication process.
Once an initial client authentication has been accomplished by the remote computer system, subsequent authentication challenges transmitted over a network 45 or 45A made by other remote computer systems are directed to the remote computer system 50 acting as a secure hub and depending on which embodiment of the invention employed, are either routed through the appropriate communications pipe 75 to PSD 40 or are directly authenticated by the remote computer system 50.
Referring to
Following processing. the messages are sent 250 to a pipe client 15 for separation of the encapsulated APDUs. The APDUs are then sent 260 through a hardware device port 5 assigned to a PSD Interface 25. PSD Interface 25 routes the incoming APDUs into the PSD 40 via connection 30, where it is subsequently decrypted and processed within its secure domain 35.
Referring to
The authentication response is sent in APDU format from PSD 40 through connection 30 and into PSD interface 25. The PSD secure response is then routed 370 through hardware device port 5 and sent 360 to the Pipe Client 15 for processing and encapsulation. The resulting message packets are then sent 350 to the Client-side Communications Programs 105 for processing, encryption using a pre-established secure communications protocol and incorporation into outgoing message packets 340. The message packets 340 containing the encapsulated APDUs are transmitted 75 over the network 45 via a network interface card (I/O) 130.
The Remote Computer System 50, receives the message packets 335 containing the encapsulated APDUs from the network 45 via a network interface card (I/O) 130 installed on the Remote Computer System. The incoming messages are processed and decrypted using the pre-established cryptography method employed in the secure communications protocol by the server-side Communications Programs 105 and routed 310 into the Pipe Server 70 for secure APDU extraction. The extracted secure APDUs are sent 330 to the Security Module 325 for decryption of the secure APDUs using the pre-established cryptography method. The decrypted APDUs are then routed to the APDU Interface 55 for processing and translation into a higher-level format and sent 300 to API Level programs 100 for processing. If authentication is successful, the remote computer system 50 allows access to secure functions or data and establishes itself as a secure hub. If authentication fails, the end user will be unable to access secure functions or data.
Referring to
To perform a remote authentication, a challenge 85 is issued by a second remote computer system 150. The challenge is routed over a network 45, into the secure hub 50. The incoming challenge is processed and decrypted in the secure hub 50 using the pre-established cryptography method employed in the secure communications protocol by the server-side Communications Programs 105 and routed 85 to an API level program 100 where it is processed and routed 400 to an APDU interface 55 for translation into an APDU format. The APDUs are then sent 420 to a Security Module 425 for encryption. The encrypted APDUs are then routed 430 to a Pipe Server 70 for encapsulation into outgoing messaging and sent 410 to the communications programs 105 for transmission over the communications pipe 75, through the network 45 into the network interface 130 of the client 10.
The incoming messages are then routed 440 to a communications programs 105 for processing. Following processing, the messages are sent 450 to a pipe client 15 for separation of the encapsulated APDUs. The APSUs are then sent 460 through a hardware device port 5 assigned to a PSD Interface 25. PSD Interface 25 routes the incoming APDUs into the PSD 40 via connection 30, where it is subsequently decrypted and processed within its secure domain 35.
Referring to
The Remote Computer System 50, receives the message packets 535 containing the encapsulated APDUs from the network 45 via network interface card (I/O) 130 installed on the Remote Computer System. The incoming messages are processed and decrypted using the pre-established cryptography method employed in the secure communications protocol by the server-side Communications Programs 105 and routed 510 into the Pipe Server 70 for secure APDU extraction. The extracted secure APDUs are sent 530 to the Security Module 525 for decryption of the secure APDUs using the pre-established cryptography method. The decrypted APDUs are then routed 520 to the APDU Interface 55 for processing and translation into a higher-level format and sent 500 to API Level programs 100 for processing. Authentication Module 65 within the secure hub remains inactive during the transfer of authentication information. The authentication response message is then routed 85 into the Communications Programs 105 where the response is sent over the network 45 in a pre-established secure communications protocol to the challenging remote computer system 150.
The incoming response message is decrypted and sent to an Authentication Module 95. If authentication is successful, the remote computer system 150 allows access to secure functions or data. If authentication fails, the end user will be unable to access secure functions or data.
Referring to
The credentials are generated using a pre-established cryptography method and sent in APDU format from PSD 40 through connection 30 and into PSD interface 25. The PSD secure response is then routed 670 through hardware device port 5 and sent 660 to the Pipe Client 15 for processing and encapsulation. The resulting message packets are then sent 650 to the Client-side Communications Programs 105 for processing, encryption using a pre-established secure communications protocol and incorporation into outgoing message packets 640. The message packets 640 containing the encapsulated APDUs are transmitted 75 over the network 45 via a network interface card (I/O) 130.
The Remote Computer System 50, receives the message packets 635 containing the encapsulated APDUs from the network 45 via network interface card (I/O) 130 installed on the Remote Computer System.
The incoming messages are processed and decrypted using the pre-established cryptography method employed in the secure communications protocol by the server-side Communications Programs 105 and routed 610 into the Pipe Server 70 for secure APDU extraction. The extracted secure APDUs are sent 630 to the Security Module 625 for decryption of the secure APDUs using the pre-established cryptography method. The decrypted APDUs are then routed 620 to the APDU Interface 55 for processing and translation into a higher-level format and sent 600 to API Level programs 100 for processing and subsequently sent 605 to the Authentication Module 65 for secure storage and future use. The transferred authentication information is shown in
In
Referring to
The foregoing described embodiments of the invention are provided as illustrations and descriptions. They are not intended to limit the invention to precise form described. In particular, it is contemplated that functional implementation of the invention described herein may be implemented equivalently in hardware, software, firmware, and/or other available functional components or building blocks. Other variations and embodiments are possible in light of above teachings, and it is not intended that this Detailed Description limit the scope of invention, but rather by the Claims following herein.
Number | Name | Date | Kind |
---|---|---|---|
5276735 | Boebert et al. | Jan 1994 | A |
5455863 | Brown et al. | Oct 1995 | A |
5499297 | Boebert | Mar 1996 | A |
5761309 | Ohashi et al. | Jun 1998 | A |
5778071 | Caputo et al. | Jul 1998 | A |
5917168 | Nakamura et al. | Jun 1999 | A |
5944821 | Angelo | Aug 1999 | A |
5991407 | Murto | Nov 1999 | A |
6005942 | Chan et al. | Dec 1999 | A |
6018779 | Blumenau | Jan 2000 | A |
6101254 | Thiriet | Aug 2000 | A |
6101255 | Harrison et al. | Aug 2000 | A |
6105008 | Davis et al. | Aug 2000 | A |
6108789 | Dancs et al. | Aug 2000 | A |
6128338 | Behaghel et al. | Oct 2000 | A |
6131811 | Gangi | Oct 2000 | A |
6144671 | Perinpanathan et al. | Nov 2000 | A |
6181735 | Sarat | Jan 2001 | B1 |
6192473 | Ryan, Jr. et al. | Feb 2001 | B1 |
6195700 | Bender | Feb 2001 | B1 |
6233683 | Chan et al. | May 2001 | B1 |
6279047 | Bublitz et al. | Aug 2001 | B1 |
6385729 | DiGiorgio et al. | May 2002 | B1 |
6434238 | Chaum et al. | Aug 2002 | B1 |
6481632 | Wentker et al. | Nov 2002 | B2 |
6575360 | Hagn | Jun 2003 | B1 |
6602469 | Maus et al. | Aug 2003 | B1 |
6694436 | Audebert | Feb 2004 | B1 |
6718314 | Chaum et al. | Apr 2004 | B2 |
6751671 | Urien | Jun 2004 | B1 |
6807561 | Lagosanto et al. | Oct 2004 | B2 |
6892301 | Hansmann et al. | May 2005 | B1 |
6944650 | Urien | Sep 2005 | B1 |
6993131 | Meyers | Jan 2006 | B1 |
7028187 | Rosen | Apr 2006 | B1 |
7046810 | Takada et al. | May 2006 | B2 |
20010039587 | Uhler et al. | Nov 2001 | A1 |
20010045451 | Tan et al. | Nov 2001 | A1 |
20020025046 | Lin | Feb 2002 | A1 |
20020040936 | Wentker et al. | Apr 2002 | A1 |
Number | Date | Country |
---|---|---|
19522527 | Jan 1997 | DE |
197.24901 | Dec 1998 | DE |
0911772 | Apr 1999 | EP |
0923211 | Jun 1999 | EP |
2779018 | Nov 1999 | FR |
9852161 | Nov 1998 | WO |
9962037 | Dec 1999 | WO |
9962210 | Dec 1999 | WO |
0116900 | Mar 2001 | WO |
0122373 | Mar 2001 | WO |
0159730 | Aug 2001 | WO |
Number | Date | Country | |
---|---|---|---|
20020162023 A1 | Oct 2002 | US |