DE102011016150A1 - Method for authentication of code password based on algorithm, involves using authentication not only between processing system and user, but also between processing system and another processing system - Google Patents

Abstract

The method involves using the authentication not only between a processing system and a user, but also between a processing system and another processing system. The on algorithm based-password consists of an algorithm which represents clear action rule that consists of one or multiple stages. The password has modules which are described in the predetermined specification of the generation of the user results.

Description

1 technical area:

The present invention relates to an authentication method in which an algorithm-based password is used instead of the classical password. Therefore, the authentication method can be used almost anywhere authentication with the classic password is used today. This makes this authentication method very compatible with other known authentication technologies. In addition, the o. G. Not only for the authentication between the processing system and the user but also for the authentication between the processing system and other processing system.

2 Prior art:

The input of the password can be easily copied by a person from the other person, for example, by tracking the movements of the fingers or reading the input on the display of the input device.

Passwords can be intercepted by special computer programs, which are installed unnoticed on the PC, or other hardware, such as hidden cameras or transparent membrane keypad, or the keyboard input can be logged on an input device and transmitted to the hacker.

By logging the network traffic is also possible to determine the password. (eg telnet or http network traffic)

Since the password always remains the same, it can be decrypted using the brute-force attack, pass-the-hash attack or other attack methods.

The use in the authentication of smart cards, USB sticks and other devices also causes problems if they are lost. In addition, the chip cards or USB sticks can easily break. In addition, you need a card reader or a special interface to be able to authenticate to the remote system. This represents a serious disadvantage, especially when used with mobile devices.

In order to perform the authentication, special and expensive hardware and software are needed, which are not used everywhere, as in o. G. Case with the chip card is described.

3 Objects of the invention and advantages over the prior art

This invention is concerned with the object of overcoming disadvantages mentioned in the foregoing description of "prior art".

The introduction of the authentication method described below completely solves the problem of reading the password. Despite the password being read, the hacker can not gain access to the services and resources, because the input or the user result changes with each authentication and is only valid almost once.

The brute-force attacks or pass-the-hash attacks, as well as the special computer programs that are unnoticed on the PC or log the network traffic, can only work in conjunction with the fixed password.

Passing a password over the network and entering it becomes much more secure through the use of a password based on the algorithm.

The further advantage is that this authentication method requires no special and expensive devices.

Because it's an authentication method that uses an algorithm-based password instead of the classic password, the authentication method can be used anywhere a classic password is used today. This makes this authentication method very compatible with other known authentication technologies.

4 explanation of the present invention:

This invention is a method of identifying a party (a person / device / system) to a processing system (second party) using an algorithm-based password to give the first party access to the services and resources provided to enable. As with normal password authentication between two parties, one (one person / device / system) authenticates while the other (processing system) authenticates the former.

4.1 Authentication process:

The first step of authentication is that the processing system (the server) provides the authenticated party (the user) with a string of random data (sting with random data) ( 1a ). Each part of the string is uniquely identified (eg A1, A2 ... B1, B2, etc.). The string can be presented to the user as a table ( 1i ), a set of data ( 1j ) or otherwise displayed.

In the second step of the authentication, the authenticated party (user) has to generate a response (so-called result) based on the data received from the server and on the basis of the algorithm-based password (OABA-Password) ( 1b ).

The description of the generation of the user result will be explained later in more detail.

The result generated by the user is transmitted to the processing system (server) ( 1c ). This can be done, for example, by inputting the user generated result to an input device connected to the processing system. The input device transmits the data stream to the processing system containing the user result.

Since the algorithm-based password (OABA-Password) is also known to the processing system (server), the processing system (server) generates the server result ( 1d ). This process is performed as soon as the processing system (server) has received the user result.

In the fifth step, the processing system and the user generated results are compared by the processing system (server), whether they are identical ( 1e ).

Finally, the processing system sends a positive or negative response to the authenticated party (to the user) ( 1f ). The positive answer is only generated if both answers (server result and user result) are identical. If the user receives a positive response, he gets the rights to access the services and resources ( 1g ). If the answer is negative, access to the services and resources is denied ( 1h ).

4.2 Description of the generation of the user result

As mentioned above in the first and second steps of the description of the authentication process, the processing system (the server) provides the authenticated party (the user) with a random data string (Sting with Random Data) ( 1a ). Each part of the string is uniquely identified. The string can be presented to the user as a table ( 1i ), a set of data ( 1j ) or otherwise displayed. The string can contain not only numbers but also letters and special characters.

To simplify the explanation of the invention, only numbers are used in all examples and descriptions.

The user must generate a response (so-called result) based on the random data provided by the processing system ( 1b ). This he does with the help of the algorithm (so-called OABA-Password (on algorithm based password)). The algorithm-based password must be known not only to the authenticated party (user) but also to the processing system (server). The OABA password is a one-to-many clear action rule. The algorithm can be seen on the picture ( 2 ) (Algorithm Module). This system can also be extended with other modules. It is not necessary to use a very complicated OABA password to achieve high security. However, it is recommended to use several algorithm modules in the OABA password. Since all parts of the string are uniquely identified with the random data (for example, A1, A2 ... B1, B2, etc.), we must consider these as individual (separate) variables when generating the user result.

4.2.1 Formula Module

For the module "Module Module" ( 2 ) is a formula or calculation function that is used to generate the user result. The variables of the string represent the formula elements. For example: Take the picture ( 3a ) represented formula elements A1, B1 and D2 and the formula A1 + B1 + D2 = Result. When calculating with the formula element A1 with the number 5 (A1 = 5), formula element B1 with the number 3 (B1 = 3) and formula element D2 with the number 7 (D2 = 7) we get a result - the number 15 (formula: A1 + B1 + D2 = Result → 5 + 3 + 7 = 15) ( 3a ). The user result that the user must enter on the input device of the processing system will be the number 15 in this case.

4.2.2 Placement of Position Modules

The placement of position module is very versatile. The following examples attempt to explain the meaning of the Placement of Positions module.

Compilation of positions

The first use of the module is to use certain variables of the strings with the random data (string with the random data), the time or date variable (time and date variable will be explained later) or other variables. More specifically, each variable can be considered as one place (so-called position) of the entire result. As an example we take the following variables of the string (Sting with random data): A1, B1 and D2 ( 3b ) containing the following numbers A1 = 5, B1 = 3 and D2 = 7. The OABA password is A1 & B1 & D2 = Result. The result in this case is the number 537 (5 & 3 & 7 = 537) ( 3b ). But if the OABA password looks like this: A1 & D2 & B1 = Result, then we get the result 573 (5 & 7 & 3 = 573). That is, the positions can be put together to form a single number.

Distribution on positions

Not only the positions can form a number, but also a number can be divided into individual positions. For example: The number 15 can be split into two positions 1 and 5 (Po1 = 1 and Po2 = 5). The number 134 consists of three positions 1, 3 and 4 (Po1 = 1, Po2 = 3, Po3 = 4) and can form a result that can look like this: Po1 & Po2 & Po3 = result. (1, 3 and 4 = 134). In this example, a number that has multiple digits is almost a number that is completely independent of each other.

Displacement and placement of positions

Displacements and placement of positions can be very helpful, for example in combination with the Formula module. Take the formula from the Formula Module example described above (A1 + B1 + D2 = Result → 5 + 3 + 7 = 15) and combine them with the Placement of Positions module algorithm. The combined OABA password looks like this: A1 + B1 + D2 & C4 & A2 = Result and the result in this case is 1587 (5 + 3 + 7 = 15 & 8 & 7 = 1587) ( 3c ). Another example with the shift of positions is:
(Result (Po2) from A1 + B1 + D2) & (Result (Po1) from A1 + B1 + D2) = Result. The result is 51. The first step in calculating the algorithm calculates the sum of the variables A1, B1, and D2. (5 + 3 + 7 = 15 ( 3d )). Then the positions are rotated, 51 instead of 15 ( 3d )

Deletion of positions

The further use of the Placement of Position module is the deletion of the positions in the variables. For example: we take the same OABA password, namely (Result (Po2) from A1 + B1 + D2) & (Result (Po1) from A1 + B1 + D2) = Result, but we leave position 1 (Result (Po1 ) from A1 + B1 + D2) away. Then the OABA password would look like this: (Result (Po2) from A1 + B1 + D2). The result is only the number 5 (the second position of the number 15) ( 3e )

The Placement of Positions module is one of the most important tools of the complete system, because the OABA passwords based on this module are very easy to remember but not so easy to crack.

4.2.3 other variable module

As the name implies, this module provides other variables to the authenticated party (the user).

Time and Date Variables

The time and date variables are the variables that can arise from the time or date. The variables can be represented in the following form. When registering at the processing system, we assumed the following date and time: 10/02/2011 and 14:07. Thus we have the following variables available Date (dd) = 10, Date (mm) = 02, Date (yyyy) = 2011 and Time (hh) = 14, Time (mm) = 07. With the combination of Formula Modul we can create an OABA password. For example, the OABA password might look like this: A1 + B1 + D2 & Date (dd) = Result In this case, the result is 1510 (5 + 3 + 7 = 15 & 10 = 1510) ( 3f ). The advantage of the time and date variables is that the processing system does not necessarily have to transmit the time and date to the user. Therefore, it is very difficult for the hacker to determine which variables were used at logon.

Password variable

Password variable is a normal password that has already been defined in advance. This variable only makes sense in combination with other variables and modules. As an example we use the following OABA password: A1 + B1 + D2 & Password = Result with the password variable: 137. The result is the number 15137 (5 + 3 + 7 = 15 & 137 = 15137) ( 3g ). As a second example, we can use the following OABA password: A1 & Password (Po1) & Password (Po2) & D2 & Password (Po3) = Result. In this example we have the result 51337 (5 & 1 & 3 & 3 & 7 = 51337) ( 3h ).

4.2.4 Block of Numbers module

Block of Numbers module is a pool of variables that uses only a selectable variable for current logon. For the next example we define a pool consisting of variables A1, A2 and A3. Combine the Block of Numbers module with the Formula module and create the following OABA password:
Pool (A1, A2, A3) + B1 + D2 = Result. Here are three possible outcomes:
Result # 1: If we take the variable A1 from the pool, then we have the result 15 (Pool (A1, A2, A3) + B1 + D2 = Result → 5 + 3 + 7 = 15) ( 3i ).
Result # 2: If we take the variable A2 from the pool, then we have the result 17 (Pool (A1, A2, A3) + B1 + D2 = Result → 7 + 3 + 7 = 17) ( 3i ).
Result No. 3: If we take the variable A3 out of the pool, then we have the result 11 (Pool (A1, A2, A3) + B1 + D2 = Result → 1 + 3 + 7 = 11) ( 3i ).

When using the Block of Numbers Module, the authentication process, namely the server result ( 1d ) as well as the comparison between the server result and the user result ( 1e ). Since in the above example we have three results ( 3i ), the processing system (server) must perform the comparison three times to see if both results (server result and user result) are identical or not identical.

4.2.5 If-Then-Else module

This is a module that uses if-then operation

For example. we have an OABA password that looks like this: (If (A1 = even number) Then (Number: 3) Else (Number: 7)) + B1 + D2 = Result. The calculation in this case looks like this: The variable A1 (the number 5) is not an even number, so we have to take the number 7 instead of the number 3 for the calculation. Then we add the variable 61 (number 3) and the variable D2 (number 7) and get the result 13 (7 + 3 + 7 = 17). The final result is the number 17 ( 3y ).

In the second example we have the following OABA password:
(If (A1 ≤ 4) Then (Number: 10) Else (Number: 20)) & B1 & D2 = Result. From this OABA password we get the following compilation of the variable: The variable A1 (the number 5) is not smaller than or equal to the number 4, then we have to take the number 20 and not the number 10 for the calculation. Then we put all variables together: 20 & 3 & 7 = 2037. The result is: 2037 ( 3k ).

4.2.6 Search module

This module is one or more variables that are after or in front of the variable that corresponds to a search criterion. For example: (Search (for next number 0) (between A1 and D4) and B1 & D2 = Result. Here, in a pool of variables (from A1 to D4), a variable is searched for which contains the number 0 first. This is the variable C3 ( 3l ). The closest variable is D3. This contains the number 2. Then other variables (B1 with the number 3 and D2 with the number 7) put together: 2 & 3 & 7 = 237. Therefore we get as a result the number 237 ( 3l ).

Claims (9)

Authentication method using an algorithm-based password (OABA (on algorithm based password)) password used instead of the classical password and identifying the first party (a person / device / system) to a processing system (second party) serves to give the first party access to the services and resources provided. Authentication method according to claim 1, characterized in that the authentication can be used not only between a processing system and a user but also between a processing system and another processing system. Authentication method according to claim 1, characterized in that this authentication method can not only be used independently, but can also be combined with other already known authentication technologies. Authentication method according to claim 1, characterized in that the OABA password consists of an algorithm that represents a one-or-more-step unique action rule. Authentication method according to claim 1, characterized in that the OABA password consists of the modules described in the previous description of the generation of the user result and in the figure ( 2 ), wherein the scheme with the modules shown can be extended by further modules, the modules can be used alone or combined with each other. Authentication method according to one of the preceding claims, characterized in that in generating the user result the uniquely identified variables are used which have arisen from one or more strings supplied by the processing system with the random data or from other sources independent of the processing system, originating from one or more multiple numbers, letters or other special characters. Authentication method according to one of the preceding claims, characterized in that the user result is not a fixed password but by means of the OABA password from a character string with the random data that the user from the processing system as a table ( 1i ), a set of data ( 1j ) or otherwise obtained, is generated and then sent to the processing system for correctness check ( 1a to 1c ). Authentication method according to one of the preceding claims, characterized in that the server result by means of the algorithm known to the user (OABA password) from a string with the random data that the processing system has sent to the user, or from other variables that originated from independent sources are, generated and prepared for correctness testing ( 1d ). Authentication method according to one of the preceding claims, characterized in that the processing system compares the server result with the user result and the user either with identical results, the access to the delivered services and resources allowed or denied access to the delivered services and resources for different results ( 1e to 1h ).

Images