US 6,185,685 B2 · Security method and system for persistent storage and communications on computer network systems and computer network systems employing the same

Abstract

A multi-stage login procedure and system involves a first stage in which a login ID and a public key (encrypted) is transmitted from a client computer to a server computer and a key-exchange key (encrypted) is provided from the server computer to the client computer. In a second stage, a first split symmetric key and a server authentication string is generated and encrypted by the client computer and then transmitted to the server computer. In addition, the server computer generates a second split symmetric key and combines the same with the first split symmetric key to obtain a complete symmetric key for encrypting further communications from the server to the client computer. The server also generates a client authentication string, encrypts the same and transmits the encrypted string, the server authentication string (encrypted and incremented) and the second split symmetric key (encrypted) to the client computer. In a third stage, the client computer uses the server authentication string to authenticate the server. In addition, the client computer combines the second split symmetric key with the first split symmetric key to obtain the complete symmetric key for encrypting further communications from the client computer to the server computer. The client computer also decrypts, increments and encrypts the client authentication string and transmits the same to the server. The server then uses the client authentication string (after decryption and decrementation) to authenticate the client computer. Thereafter, the server provides the client computer with a first split symmetric persistent storage key (encrypted), which the client computer combines (after decryption) with a one-way hash value to obtain a persistent storage key for use by the client computer to communication information to and from persistent storage.

A login method to enhance security in a network computer system having at least one server computer coupled over a communication network to a plurality of client computers, wherein each client computer is coupled to directly access a persistent storage device and wherein each client computer is operated by a control program after login, the method comprising the steps of:

receiving a login ID and password PW from a user at a first one of said client computers;
computing, at said first client computer, a hash value H1PW of the password PW;
transmitting a first-stage login request including ID from said first client computer to a first one of said server computers;
receiving said first-stage login request at said first server computer;
providing, at said first server computer, a key-exchange key KEK;
encrypting KEK at said first server computer;
transmitting a first-stage login response, including the encrypted KEK, from said first server computer to said first client computer;
receiving said first-stage login response at said first client computer;
decrypting, at said first client computer, the encrypted KEK, to yield KEK;
providing, at said first client computer, a first split key SK1;
encrypting, at said first client computer, key SK1, using KEK as an encryption key, to yield ESK1;
transmitting a second-stage login request, including ESK1, from said first client computer to said first server computer;
receiving said second-stage login request at said first server computer;
decrypting, at said first server computer, ESK1, using KEK as a decryption key, to yield SK1;
providing, at said first server computer, a second split key SK2;
combining, at said first server computer, the first and second split keys SK1 an SK2, to yield session key SK;
encrypting, at said first server computer, the second split key SK2, using KEK as an encryption key, to yield ESK2;
transmitting a second-stage login response, including ESK2, from said first server computer to said first client computer;
receiving the second-stage login response at said first client computer;
decrypting, at said first client computer, ESK2 received with the second-stage login response, using KEK as a decryption key, to yield SK2;
combining, at said first client computer, the first and second split keys SK1 and SK2, to yield sessions key SK;
encrypting further transmissions between said first client computer and said first server computer, using sessions key SK as an encryption key;
transmitting a third-stage login request from said client computer to said first server computer, following said step of combining, at said first client computer, the first and second split keys SK1 and SK2;
receiving the third-stage login request at said first server computer;
looking up, at said first server computer, a first split persistent storage key PK1 associated in a database with the ID received with said first-stage login request;
encrypting, at said first server computer, key PK1, using SK as an encryption key, to yield EPK1;
transmitting a third-stage login response, including EPK1, from said first server computer to said first client computer;
receiving the third-stage login response at said first client computer;
decrypting, at said first client computer, EPK1 received with said third-stage login response, using SK as a decryption key;
providing, at said first client computer, a second split persistent storage key PK2;
combining, at said first client computer, the first and second split persistent storage keys PK1 and PK2, to yield persistent storage key PK;
and
encrypting further data stored in the persistent storage device operatively coupled to said first client computer, using PK as an encryption key.

30 more elements

Facts

Application

08/988,850Filed 11 Dec 1997

Granted

6 Feb 2001

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 9/0841
Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or…:…
H04L 9/3271
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…: using…
Y10S 707/99939
Database or file accessing: privileged access
Y10S 707/99952
File or database maintenance: coherency, e.g. same view to multiple users

Security method and system for persistent storage and communications on computer network systems and computer network systems employing the same

Life of this patent

Security method and system for persistent storage and communications on computer network systems and computer network systems employing the same

Life of this patent

Abstract

Claims16