Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Security kernel or utility
Reexamination Certificate
1999-05-05
2004-02-03
Morse, Gregory (Department: 2134)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Security kernel or utility
C713S152000, C713S168000, C713S182000, C713S159000
Reexamination Certificate
active
06687823
ABSTRACT:
FIELD OF THE INVENTION
This invention relates to use of more than one authentication mechanism in secure communications.
BACKGROUND OF THE INVENTION
During the last decade of the Twentieth Century, the Internet has become a vital communication medium for a variety of application domains, including simple e-mail, home banking, electronic trading of stocks, net-based telephonic communications and many other electronic commerce applications. Authentication of a user is becoming a key requirement in allowing or authorizing a legitimate user to execute the user's privileges in a particular network or sub-network.
Presently, many user authentication mechanisms are available, including simple user name/password, one-time password (e.g., S/Key), RSA-based digital signature authentication, Kerberos, challenge-and-response, and Secure Socket Layer SSL v3.0 with user/client authentication. Bruce Schneier, in
Applied Cryptography
, John Wiley & Sons, Inc., New York, Second Edition, 1996, pp. 34-74 and 566-572, discusses and characterizes several user and/or key authentication tests that are often based on, or associated with, an underlying encryption procedure.
One interesting authentication scheme is the Sun Pluggable Authentication Mechanism (PAM), discussed in more detail in the following, which facilitates integration of several authentication packages or tests without requiring change of the underlying application (e.g., login). Although a system such as PAM provides a framework for integration, such a system often deals with the plurality of authentication mechanisms as if all have the same cryptographic or authentication strength or priority. For example, one enterprise might require both Kerberos (relatively strong) and user password (relatively weak) to be used for user authentication. Use of several authentication modules can be accommodated within PAM, through the use of stacking. If the user fails to pass one of the authentication tests, among many that are applied in stacking, authentication is denied, without indicating which of the many tests the user has failed to pass. PAM treats all authentication tests in an integrated package as equally strong and equally suitable.
What is needed is a system that integrates one or more authentication tests but allows assignment of a priority or strength to each of such tests and allows authentication to be treated as a necessary, but not a sufficient, condition for user authorization. Preferably, where authentication tests are integrated, these tests should be executed based on an indicium that is a measure of priority and/or strength for each authentication test. Preferably, the system should allow identification of, and take account of, which authentication test or tests the user has failed to pass. Preferably, the system should be flexible enough to allow assignment of different priorities and/or strengths to tests within an integrated authentication package, based on the application and the current circumstances.
SUMMARY OF THE INVENTION
These needs are met by the invention, which provides a system that integrates one or more authentication tests and allows assignment of arbitrary (and changeable) relative priority and/or relative strength to each of these tests. In one embodiment, the system allows an integrated electronic authentication system to accept physical objects, such as drivers licenses, birth certificates, passports, social security cards and the like for partial or full authentication of a user, although each of these documents is used for a different primary purpose, and the purposes seldom overlap.
In a first embodiment, the system applies one or more authentication tests with increasing numerical priority or strength and requires the user to pass all or a majority of these tests up to at least a selected priority or strength, before access to the application is granted. The system requires the user to obtain a weighted average of the authentication test priorities or strengths at least equal to one or more selected threshold values before access to the application, or a subset of the application, is granted. In another embodiment, the system applies one or more authentication tests with possibly differing priority or strength, applies the user's test results to produce a weighted average of the authentication test priorities or strengths, and grants access to a subset of the application, depending upon how the user's weighted average compares with one or more of a sequence of threshold values.
The invention has the following advantages: (1) the invention strengthens an association or linkage between authentication and the authorization process; (2) the invention allows identification of which authentication test(s) is being used; (3) the invention extends an integration procedure, such as PAM, without distorting the procedure; (4) the invention enhances total security of the authorization process; (5) the invention preserves and deals with authentication mechanisms based on their relative merits and can allocate relative priority based on relative cryptographic strength; and (6) the invention allows an entity to classify those with whom it deals (customers, suppliers, etc.) for authorization purposes.
REFERENCES:
patent: 5229764 (1993-07-01), Matchett et al.
patent: 5365574 (1994-11-01), Hunt et al.
patent: 5774551 (1998-06-01), Wu et al.
patent: 6526512 (2003-02-01), Siefert et al.
patent: 0 534 679 (1992-09-01), None
patent: 0 582 989 (1993-08-01), None
patent: 2 634 570 (1988-07-01), None
patent: 2 229 305 (1990-09-01), None
V. Samar, “Unified Login with Pluggable Authentication Modules(PAM)”, XP 000620972, p. 1-10, Publ. Mar. 14, 1996, SunSoft, Inc., Mountain View, CA.
Al-Salqan Yayha
Ranganathan Aravindan
Varma Sangeeta
Brown Christopher J.
Martine & Penilla LLP
Morse Gregory
Sun Microsystems Inc.
LandOfFree
Cryptographic authorization with prioritized and weighted... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Cryptographic authorization with prioritized and weighted..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Cryptographic authorization with prioritized and weighted... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3280725