Electrical computers and digital processing systems: support – System access control based on user identification by... – Pin/password generator device
Reexamination Certificate
1998-07-20
2003-09-02
Smithers, Matthew (Department: 2134)
Electrical computers and digital processing systems: support
System access control based on user identification by...
Pin/password generator device
C713S170000, C713S182000
Reexamination Certificate
active
06615352
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to an authentication technique for authenticating user's access rights to resources.
2. Description of the Prior Art
As the prior art belonging to the same field as the present invention there is known a program execution control technique, which comprises:
(1) embedding a user authentication routine in an application program;
(2) the routine checking whether the user who is trying to execute the application possesses a regular key for authentication; and
(3) continuing the execution of the program only when the presence of the key for authentication has been confirmed, or stopping the execution of the program if the answer is negative.
By utilizing this control technique, only a regular user possessing an authentication key is allowed to execute the application program. This technique is in practical use in the software distribution business. As examples of products produced according to this technique are mentioned Sentinel Super Pro (trademark) of Rainbow Technologies, Inc. and HASP (trademark) of Aladdin Knowledge Systems Ltd.
The following is a more detailed explanation of the program execution control technique.
(1) The user who executes a software program possesses an authentication key as a user identifying information. The authentication key is a key for encryption, which is distributed to users by a person who permits the utilization of software, for example a software vender. The authentication key, for the prevention of duplication, is sealed firmly into memory or the like in hardware and is delivered to the associated user by physical means such as mail or the like.
(2) The user loads the hardware with the authentication key incorporated therein into a his or her work station/personal computer by a specified method. For example, the hardware is loaded into a printer port.
(3) When the user starts the application program and the execution of the program reaches the user authentication routine, the program communicates with the hardware which incorporates the user authentication key therein. On the basis of the communication the program checks whether the authentication key is correct or not, and if the key is correct, execution shifts to the next step. On the other hand, if the communication fails and the presence of the authentication key cannot be confirmed, the program itself stops to inhibit subsequent execution.
Identification of the authentication key in the authentication routine is performed in accordance with the following protocol.
(1) The authentication routine generates an appropriate number and transmits it to the key-containing hardware.
(2) The key-containing hardware, using the authentication key contained therein, encrypts the transmitted number and sends it back to the authentication routine.
(3) The authentication routine judges whether the replied number is an anticipated number or not, that is, whether it is a number obtained by encrypting the transmitted number to the hardware with the correct authentication key.
(4) In the case where the replied number coincides with the anticipated number, the execution of the program is continued, while otherwise, the execution of the program is stopped.
In this case, the communication between the application program and the authentication key-containing hardware must differ at every execution even if exchange is made with the same hardware at the same location in the same application. Otherwise, if the contents of communication in a normal execution process are once recorded and if subsequently a reply is made to the application program in accordance with the recorded contents at every execution of program, it becomes possible for even a user not possessing a correct authentication key to execute the program. Such an improper execution of the application program by the reproduction of communication contents is called a replay attack.
To prevent such a replay attack, a random number which is newly generated at every communication is used as the number sent to the key-containing hardware.
The prior art described above involves the problem that at the time of making an application program it is required for the programmer to assume an authentication key of a user in advance and then perform a program protection processing on the basis of the authentication key.
That is, the programmer is required to anticipate a correct reply from the key-containing hardware at the time of programming and then create a program so that the program is executed correctly only upon receipt of a correct reply.
The prior art described above is utilized basically in two ways, both of which, however, involves the following problems.
(1) According to the first method, different authentication keys are provided for different users. More particularly, a different authentication key is provided for each user such as authentication key A for user A and authentication key B for user B.
In this case, it is necessary for the programmer to make a program while changing the authentication routine in the program appropriately for each user. In more particular terms, since the authentication key differs for each user, it is required that the authentication routine in the program be prepared so as to identify the authentication key peculiar to the each user who utilizes the program. In other words, the programmer is required to make as many different programs as the number of users who utilize the program.
In the case where a large number of users are involved, the work for individualizing programs for each user requires intolerable labor for the programmer, and the list of user authentication keys to be managed becomes vast.
(2) According to the second method, the programmer prepares a different authentication key for each application, for example, like authentication key A for application A and authentication key B for application B. And each application program is prepared so as to identify a unique authentication key.
According to this second method, unlike the first method, it is no longer necessary to make a program individually for each user, but the user is required to possess authentication keys by the number of applications to be utilized.
Such a limitation gives rise to the following problems for both programmer and users.
As noted previously, it is necessary that authentication keys be delivered in a firmly sealed state to users. Thus, in contrast with the program itself which can be distributed easily through a network, the distribution of hardware which contains an authentication key must rely on physical means such as mail or the like. This limitation is a heavy burden on the programmer in all of cost, time and packing work.
There arises the inconvenience that even if a user wants to use a certain application, the user must wait for the arrival of hardware with an authentication key sealed therein and cannot use it at once.
To lighten this burden there is adopted a method wherein a plurality of authentication keys are sealed beforehand in hardware, and each time the user is permitted to use a new application, a password for making an unused authentication key in hardware utilizable is given to the user. However, it is apparent that the foregoing problems are basically not solved even by this method. Actually, in commercialization, a design is made so as to permit adjacent connection of plural hardware units.
Thus, even if either of the above two methods is adopted, there still remain problems in point of convenience on both programmer and user sides.
Considering external characteristics of the execution control, the prior art may also be applicable to the protection of mail privacy, access control for file and computer resources, and other ordinary access control for digital contents. However, due to the foregoing problems, it is impossible to apply the prior art to those fields.
SUMMARY OF THE INVENTION
The present invention has been accomplished in view of the above-mentioned circumstances and it is an object of the invention to provide a us
Kakehi Rumiko
Kyojima Masaki
Terao Taro
Fuji 'Xerox Co., Ltd.
Oliff & Berridg,e PLC
Smithers Matthew
LandOfFree
Device and method for authenticating user's access... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Device and method for authenticating user's access..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Device and method for authenticating user's access... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3092333