US 5,706,347 AGranted

Method and system for authenticating a computer network node

AssigneeInternational Business Machines Corporation

InventorsAndrew Stephen Burke, Dale Carl Gugliotta

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method and system for verifying the identity of a computer network node is provided. As part of the session initiation process between two partner nodes planning to exchange sensitive encrypted data, the node receiving data generates and encrypts a session key which is transmitted to the node sending data. At the sending node, the low order four bytes of the encrypted session key are saved for authentication of the receiving node. The encrypted session key is returned to the receiving node as session set-up continues. The receiving node concatenates the low order four bytes of the encrypted session key with four bytes of pseudorandom data to form an initial chaining value which is then encrypted and transmitted to the sending node. The sending node recovers the initial chaining value and compares the low order four bytes of this value with the low order four bytes of the encrypted session key previously saved. If the values are the same, authentication of the receiving node is established.

Claims13

Dependent claims

In a data communication network having a plurality of network nodes and providing data security for a communication session between a sending network node and a receiving network node wherein each network node has cryptographic apparatus for encrypting and decrypting communication keys, a method for authenticating the receiving network node during session initiation comprising the steps of:

sending a session initiation request from the sending network node to the receiving network node;
generating a session key and encrypting said session key under a master encrypting key at the receiving network node;
sending a session initiation reply from said receiving network node to said sending network node containing the encrypted session key;
upon receiving the session initiation reply, decrypting the session key at the sending network node and saving a first selected portion of the encrypted session key;
sending a session set-up message from the sending network node to the receiving network node, said session set-up message containing the encrypted session key;
upon receiving the session set-up request at the receiving network node, decrypting the session key and concatenating a second selected portion of the encrypted session key with a pseudorandom portion to obtain an initial chaining value which is encrypted using the session key;
sending a session set-up response from the receiving network node to the sending network node containing the encrypted initial chaining value;
decrypting the initial chaining value at the sending network node and comparing the second selected portion in the initial chaining value with the first selected portion of the encrypted session key to verify that the receiving network node has a correct session key.

5 more elements

In a data communication network having a plurality of network nodes and providing data security for a communication session between a sending network node and a receiving network node wherein each network node has cryptographic apparatus for encrypting and decrypting communication keys, a system for authenticating the receiving network node during session initiation comprising:

means at the receiving network node, responsive to the receipt of a session initiation request from the sending network node, for generating a session key and encrypting said session key under a master encrypting key;
means at the sending network node, responsive to the receipt of a session initiation reply containing the encrypted session key, for decrypting the session key and saving a first selected portion of the encrypted session key;
means at the receiving network node, responsive to the receipt of a session set-up message containing the encrypted session key, for decrypting the session key and concatenating a second selected portion of the encrypted session key with a pseudorandom portion to obtain an initial chaining value which is encrypted using the session key;
means at the sending network node, responsive to the receipt of a session set-up response containing the encrypted initial chaining value, for decrypting the initial chaining value and comparing the second selected portion in the initial chaining value with the first selected portion of the encrypted session key to verify that the receiving network node has a correct session key.

1 more element

Dependencies are inferred from the claim text.

Facts

Application: 08/552,893Filed 3 Nov 1995
Granted: 6 Jan 1998
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06Q 20/3829
Insuring higher security of transaction: involving key management
H04L 9/0838
Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for…:…
H04L 9/3271
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…: using…

Family

No related US applications are recorded in the indexed filing history.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key