Laddered authentication security using split key asymmetric cryptography

RELATED APPLICATIONS

0001This application is a continuation of pending U.S. application Ser. No. 09/739,118 (now U.S. Pat. No. ______), the contents of which are incorporated herein by reference.

0002This application is also related to U.S. application Ser. No. 09/739,260 (now U.S. Pat. No. 6,970,562), U.S. application Ser. No. 10/849,818 (now U.S. Pat. No. 7,055,032), U.S. application Ser. No. 09/739,113 (now U.S. Pat. No. 7,017,041), U.S. application Ser. No. 09/739,112 (now U.S. Pat. No. 6,940,980), U.S. application Ser. No. 09/739,119 (now U.S. Pat. No. ______), and U.S. application Ser. No. 09/739,111 (now U.S. Pat. No. 7,065,642), the contents of which are incorporated herein by reference.

TECHNICAL FIELD

0003This invention relates to cryptography. More particularly, the present invention relates to split key asymmetric cryptography.

BACKGROUND ART

0004Today, computing devices are almost always interconnected via networks. As these networks can be large closed networks, as within a corporation, or truly public networks as the Internet is, the network itself might have hundreds, thousands or even millions of potential users. Consequently it is often required to restrict access to any given computer or service, or a part of a computer or service to a subset of the users on the public or closed network. For instance, a brokerage might have a public website accessible to all, but would like to only give Ms. Alice Smith access to Ms. Alice Smith's brokerage account.

0005This is an old problem, tracing its roots to the earliest days of computers, and passwords were among the first techniques used, and to this day remain the most widely used technique for protecting resources on a computer or service.

0006In its simplest form, every user has a unique password and the computer has knowledge of the user password. When attempting to log on Alice would enter her userid, say alice, and password, say apple23, the computer would compare the pair, i.e. alice, apple23, with the pair it had stored for Alice, and if there is a match would establish a session and give Alice access.

0007This simple scheme suffers from two problems. First, the table containing the passwords is stored on the computer, and represents a single point of compromise. If Eve could somehow steal this table, she would be able to access every user's account. A second problem with this approach is that when Alice enters her password it travels from her terminal to the computer in the clear, and Eve could potentially eavesdrop. For instance the “terminal” could be Alice's PC at home, and the computer could be a server on the Internet, in which case her password travels in the clear on the Internet.

0008Various solutions have been proposed and implemented to solve these two issues. For instance, to solve the first problem of storing the password on the computer, the computer could instead store a one way function of the password. E.g. F(apple23)=XD45DTY, and the pair {alice, XD45DTY}. In this example as F( ) is a one way function, computing XD45DTY from apple23 is easy, but as it is a “one way function”, the reverse is believed to be difficult or close to impossible. So when Alice logs on and sends the computer {alice, apple23}, the computer can compute F(apple23) and compare the result with XD45DTY. The UNIX operating system was among the first to implement such a system in the late 1970's.

0009Before discussing more sophisticated conventional techniques for solving this problem, let us briefly describe symmetric, asymmetric and ‘split private key’ cryptography.

0010In symmetric key cryptography, the two parties who want to communicate in private share a common secret key, say K. the sender encrypts messages with K, to generate a cipher, i.e. C=Encrypt(M,K). The receiver decrypts the cipher to retrieve the message, i.e. D=Decrypt(C,K). An attacker who does not know K, and sees C, cannot successfully decrypt the message, if the underlying algorithms are strong. Examples of such systems are DES and RC4. Encryption and decryption with symmetric keys provide a confidentiality, or privacy service.

0011Symmetric keys can also be used to provide integrity and authentication of messages in a network. Integrity and authentication means that the receiver knows who sent a message and that the message has not been modified so it is received as it was sent. Integrity and authentication is achieved by attaching a Message Authentication Code (MAC) to a message M. E.g., the sender computes S=MAC(M,K) and attaches S to the message M. When the message M reaches the destination, the receiver also computes S′=MAC(M,K) and compares S′ with the transmitted value S. If S′=S the verification is successful otherwise verification fails and the message should be rejected. Early MACs were based on symmetric encryption algorithms such as DES whereas more recently MACs are constructed from message digest functions, or “hash” functions, such as MD5 and SHA-1. The current Internet standard for this purpose is known as hash-based MAC (HMAC).

0012By combining confidentiality with integrity and authentication, it is possible to achieve both services with symmetric key cryptography. It is generally accepted that different keys should be used for these two services and different keys should be used in different directions between the same two entities for the same service. Thus if Alice encrypts messages to Bob with a shared key K, Bob should use a different shared key K′ to encrypt messages from Bob to Alice. Likewise Alice should use yet another key K″ for MACs from Alice to Bob and Bob should use K′″ for MACs from Bob to Alice. Since this is well understood by those skilled in the art, we will follow the usual custom of talking about a single shared symmetric key between Alice and Bob, with the understanding that strong security requires the use of four different keys.

0013Symmetric key systems have been in use for literally thousands of years, and have always suffered from a major problem—namely how to perform key distribution. How do Bob and Alice agree on K? Asymmetric key cryptography was invented to solve this problem. Here every user is associated with two keys, which are related by special mathematical properties. These properties result in the following functionality: a message encrypted with one of the two keys can then only be decrypted with the other.

0014One of these keys for each user is made public and the other is kept private. Let us denote the former by E, and the latter by D. So Alice knows Dalice, and everyone knows Ealice. To send Alice the symmetric key K, Bob simply sends C=Encrypt(K,Ealice). Alice, and only Alice (since no one else knows Dalice), can decrypt the ciphertext C to recover the message, i.e. Decrypt(C,Dalice)=K. Now both Alice and Bob know K and can use it for encrypting subsequent messages using a symmetric key system. Why not simply encrypt the message itself with the asymmetric system? This is simply because in practice all known asymmetric systems are fairly inefficient, and while they are perfectly useful for encrypting short strings such as K, they are inefficient for large messages.

0015The above illustrates how asymmetric cryptography can solve the key distribution problem. Asymmetric cryptography can also be used to solve another important problem, that of digital signatures. To sign a message M, Alice encrypts it with her own private key to create S=Encrypt(M,Dalice). She can then send (M,S) to the recipient who can then decrypt S with Alice's public key to generate M′, i.e. M′=Decyrpt(S,Ealice). If M′=M then the recipient has a valid signature as only someone who has Dalice, by definition only Alice, can generate S, which can be decrypted with Ealice to produce M. To convey the meaning of these cryptographic operations more clearly they are often written as S=Sign(M,Dalice) and M′=Verify(M,S,Ealice). It is worth noting that asymmetric key digital signatures provide non-repudiation in addition to the integrity and authentication achieved by symmetric key MACs. With MACs the verifier can compute the MAC for any message M of his choice since the computation is based on a shared secret key. With digital signatures this is not possible since only the sender has knowledge of the sender's private key required to compute the signature. The verifier can only verify the signature but not generate it.

0016The RSA cryptosystem is one system that implements asymmetric cryptography as described above. In particular the RSA cryptosystem allows the same public-private key pair to be used for encryption and for digital signatures. It should be noted there are other asymmetric cryptosystems which implement encryption only e.g., ElGamal or digital signature only, e.g., DSA.

0017Finally, the above description does not answer the important question of how Bob gets Alice's public key Ealice. The process for getting and storing the binding [Alice, Ealice] which binds Ealice to Alice is tricky. The most practical method appears to be to have the binding signed by a common trusted authority. So such a “certificate authority” (CA) can create CERTalice=Sign([Alice, Ealice], Dca). Now CERTalice can be verified by anyone who knows the CA's public key Eca. So in essence, instead of everyone having to know everyone else's public key, everyone only need know a single public key, that of the CA. More elaborate schemes with multiple Certificate Authorities, sometimes having a hierarchical relationship, have also been proposed.

0018Asymmetric key cryptosystems have been around for a long time, but have found limited use. The primary reasons are twofold: (a) the private key D in most systems is long, which means that users cannot remember them, and they have to either be stored on every computer they use, or carried around on smart cards or other tokens; and (b) the infrastructure for ensuring a certificate is valid, which is critical, is cumbersome to build, operate and use. The first technique proposed to validate certificates was to send every recipient a list of all certificates that had been revoked. This clearly does not scale well to an environment with millions of users. The second method proposed was to require that one inquire about the validity of a certificate on-line, which has its own associated problems.

0019A system based on split private key cryptography has been developed to solve these two issues, among others. In this system the private key for Alice, i.e. Dalice, is further split into two parts, Daa which Alice knows, and a part Das which is stored at a security server. To sign a message, Alice could perform a partial encryption to generate a partial signature, i.e. PS=Sign(M,Das). Alice then sends the server PS which ‘completes’ the signature by performing S=Sign(PS,Dss). This completed signature S is indistinguishable from one generated by the original private key, so the rest of the process works as previously described. However, Daa can be made short, which allows the user to remember it as a password, so this system is consumer friendly. Further, if the server is informed that a particular ID has been revoked, then it will cease to perform its part of the operation for that user, and consequently no further signatures can ever be performed. This provides for instant revocation in a simple highly effective fashion.

0020Let us return now to password based systems. Challenge-response systems solve the issue of having to send passwords in the clear across a network. If the computer and Alice share a secret password, P, then the computer can send her a new random challenge, R, at the time of login. Alice computes C=Encrypt(R,P) and sends back C. The computer decrypts Decrypt(C,P)=C′. If C=C′, then the computer can trust that it is Alice at the other end. Note however that the computer had to store P. A more elegant solution can be created using asymmetric cryptography. Now Alice has a private key Dalice, or in a split private key system she has Daa. The computer challenges her to sign a new random challenge R. She signs the challenge, or in the split private key system she interacts with the security server to create the signature, and sends it back to the computer which uses her public key, retrieved from a certificate, to verify the signature. Observe that the computer does not have to know her private key, and that an eavesdropper observing the signature on R gains no knowledge of her private key.

0021The SSL system, which is widely used on the Internet in effect implements a more elaborate method of exactly this protocol. SSL has two components, ‘server side SSL’ in which a server proves its identity by signing a particular message during connection set-up. As browsers such as Netscape and Microsoft Internet Explorer come loaded with the public keys of various CAs, the browser can verify the signature of the server. This authenticates the server to the client, and also allows for the set-up of a session key K, which is used to encrypt all further communications. Server side SSL is widely used, as the complexity of managing certificates rests with system administrators of web sites who have the technical knowledge to perform this function. The converse function in SSL, client side SSL, which lets a client authenticate herself to a server is rarely used, because although the technical mechanism is exactly the same, it now requires users to manage certificates and long private keys which has proven to be difficult, unless they use the split private key system. So in practice, most Internet web sites use server side SSL to authenticate themselves to the client, and to obtain a secure channel, and from then on use Userid, Password pairs to authenticate the client.

0022So far from disappearing, the use of passwords has increased dramatically. Passwords themselves are often dubbed as inherently “weak” which is inaccurate, because if they are used carefully passwords can actually achieve “strong” security. As discussed earlier passwords should not be sent over networks, and if possible should not be stored on the receiving computer. Instead, in a “strong” system, the user can be asked to prove knowledge of the password without actually revealing the password. And perhaps most critically passwords should not be vulnerable to dictionary attacks.

0023Dictionary attacks can be classified into three types. In all three cases the starting point is a ‘dictionary’ of likely passwords. Unless the system incorporates checks to prevent it, users tend to pick poor passwords, and compilations of lists of widely used poor passwords are widely available. <ul id="ul0001" list-style="none"><li id="ul0001-0001" num="0000"><ul id="ul0002" list-style="none"><li id="ul0002-0001" num="0024"> 1) On line dictionary attack. Here the attacker types in a guess at the password from the dictionary. If the attacker is granted access to the computer they know the guess was correct. These attacks are normally prevented by locking the user account if there are an excessive number of wrong tries. Note that this very commonly used defense prevented one problem, but just created another one. An attacker can systematically go through and lock out the accounts of hundreds or thousands users. Although the attacker did not gain access, now legitimate users cannot access their own accounts either, creating a denial of service problem. </li><li id="ul0002-0002" num="0025"> 2) Encrypt dictionary attacks: If somewhere in the operation of the system a ciphertext C=Encrypt(M,P) was created, and the attacker has access to both C and M, then the attacker can compute off-line C<b>1</b>=Encrypt(M,G<b>1</b>), C<b>2</b>=Encrypt(M,G<b>2</b>), . . . where G<b>1</b>, G<b>2</b>, . . . etc. are the guesses at the password P from the dictionary. The attacker stops when he finds a Cn=C, and knows that Gn=P. Observe that the UNIX file system, which uses a one way function F( ) instead of an encryption function E( ), is vulnerable to this attack. </li><li id="ul0002-0003" num="0026"> 3) Decrypt dictionary attacks: Here the attacker, does not know M, and only sees the ciphertext C (where C=Encrypt(M,P). The system is only vulnerable to this attack IF it is true that M has some predictable structure. So the attacker tries M<b>1</b>=Decrypt(C,G<b>1</b>), M<b>2</b>=Decrypt(C,G<b>2</b>) . . . , and stops when the Mi has the structure he is looking for. For instance Mi could be known to be a timestamp, English text, or a number with special properties such as a prime, or a composite number with no small factors. </li></ul></li></ul>

0027It is possible to design strong password based systems but the password should not be stored on the computer in any form, ever communicated to it, and should be protected from all three types of dictionary attacks.

0028<figref idref="DRAWINGS">FIG. 1</figref> depicts the operations of Server-Side-Authentication during a communications session between network users, in this instance a client device such as a personal computer and a host device such as a server. It will be understood that software is resident on the client device and this software directs communications on the client side of the communication session. It will also be understood that software is resident on the server and that this software directs communications on the server side of the communication session. Furthermore, it should be understood that while in this example the server is associated with a merchant, the server could be associated with any type of entity. As used here, server designates any networked device capable of presenting information to another network device via the network. Also, it should be understood that while the client device in this example is associated with an individual user, the client device may be associated with an entity other than an individual user. Also, a client device may be any networked device capable of accessing information via a network.

0029At step <b>100</b> the client device transmits a message to the server. This message includes a first random number generated by the software and an indication of the types of cryptography the client device is capable of supporting. This message can be called a ‘hello’ message. The server then selects one of the types of cryptography and includes a second random number and the server's certificate in a transmission to the client device, step <b>110</b>. This transmission can be called ‘message two’. A certificate contains information certifying that an entity is who that entity claims to be. The client device then obtains the public portion of the server's asymmetric key from the certificate and verifies the certificate by verifying the certificate issuer's signature on the certificate, step <b>115</b>. The client device then generates and encrypts a symmetric session key with the public portion of the server's asymmetric key and transmits the encrypted symmetric session key to the server, step <b>120</b>. The server then decrypts the symmetric session key with the private portion of the server's asymmetric key and encrypts the first random number using the symmetric key and transmits the encrypted random number to the client device, step <b>125</b>. The client device then decrypts the random number using its copy of the symmetric key, step <b>130</b>. If the original first random number is recovered, the server has authenticated itself to the client device. All further communication between the server and client device are secured using the symmetric session key. It will be recognized that SSL server-side-authentication in current use does not actually follow steps <b>125</b> and <b>130</b>. Rather these steps are representative of how the shared symmetric key could be used for server to client authentication.

0030Client-Side-Authentication is designed to operate similar to Server-Side-Authentication as is depicted in <figref idref="DRAWINGS">FIG. 2</figref>. At step <b>200</b>, the server transmits a 36 byte hash to the client device and requests the client device to sign it with the private portion of the client device's asymmetric key. Also, the server will request that the client device return the client device's certificate. The client device signs the 36 byte hash and sends the signed 36 byte hash and the client device certificate to the server, step <b>210</b>. The server then verifies that the client device's certificate is valid and obtains the public portion of the browser's asymmetric key from the authority issuing the certificate, step <b>215</b>. The server then uses the public portion of the client device's asymmetric crypto-key to verify the client device signature, step <b>220</b>. If the server recovers the original 36 byte hash, the client device has authenticated itself to the server. It will be recognized here also that SSL client-side-authentication currently in use does not actually follow these precise steps. Rather these steps are representative of how the user's asymmetric public and private keys could be used for client to server authentication.

0031In practice, only Server-Side-Authentication is generally implemented today. Most servers which require authentication of other network users utilize passwords. As discussed above, after Server-Side-Authentication is completed, both the server and the client device are in possession of a symmetric session key. All subsequent communications between the parties during the present communication session are secured with the symmetric session key. Typically, the server requests the client device to supply a valid user ID and password. This information is provided by the user and transmitted from the client device to the server, encrypted with the symmetric session key. Each server must maintain a database of associated users. These databases contain passwords and information identifying the holders of the passwords. This requires the server to gather or dispense passwords and to manage stored passwords. If the password is valid, that is, it is included in the database, the client device has authenticated itself to the server.

0032Accordingly, a need exists for a technique whereby a first network user can obtain verifiable authentication from a second network user without the first network user having to maintain, process and utilize a password system.

0033A certificate issuing authority includes information about the user in the user's certificate. This information may include associations the user maintains, personal information, or even financial information. A certificate issuing authority may include information that a user does not want disclosed. Or, user information included in a certificate may change. Presently, a user cannot update or change information in an issued certificate. A user can at best revoke a certificate and obtain a new one which includes the changed information. When a new certificate is obtained, new keys must be generated. Any entity who has previously obtained the user's certificate and public key must now reobtain the new certificate and key. Thus, there is no way to modify a certificate without revoking the corresponding key pair.

0034Accordingly, a need exists whereby a certificate can be modified, while retaining the associated key pair.

0035A single user may have associations with multiple servers. Each of the multiple servers may require the user to maintain a password and client ID. Thus, a single user may be required to remember a plurality of passwords.

0036Oftentimes a user may attempt to establish the same client ID and password with several unrelated servers. This cannot always be accomplished. Some servers require a password to meet certain quality standards not be a ‘bad’ password, as discussed above. Thus a password that the user may wish to use may not be acceptable to certain servers. Also, a password that a user may wish to use may already be in use by another user of a server, and the server may not allow more than one user to use the same password.

0037Even if a user is able to use the same client ID and password for access to multiple servers, other problems with using passwords for authentication arise. For instance, a user's password may become compromised. That is, the password may become known to another individual. That individual can then impersonate the user to multiple servers. The user must obtain a new password with each server with which the user uses the now compromised password. Furthermore, if a user's password is compromised and a first server recognizes this fact, there is currently no method whereby this first server can notify other servers at which the user uses this same password that the password has been compromised.

0038Yet another problem with the use of passwords in providing authentication is that a user must provide a password to each and every server requiring authentication. If a user is fortunate enough to obtain the same password with several servers, the user still must provide the password to each server to which the user seeks access. Thus, every time a user wishes to perform communications with a server, that user must cause his or her password to be transmitted to the server. Furthermore, when a user ends an authenticated communication with a server and immediately attempts to reestablish an authenticated communication, the user must again provide his or her password to the server for authentication.

0039Accordingly, a need exists for a technique whereby a network user can utilize a single password to access a plurality of networked devices and enter that single password only once to gain access to any of the plurality of networked devices.

0040SSL as deployed in current systems is based upon the RSA public key cryptosystem. As introduced above, RSA relies upon the use of products of large prime numbers which are not easily factorable. If the RSA technique should be broken, that is, if an algorithm for factoring large prime numbers is found, SSL and any cryptosystem based on RSA would be useless. An attacker would have access to communications in any RSA based cryptosystem. Secure and trusted communications in SSL and other public key cryptosystems would become impossible. Accordingly, a need exists for a technique whereby a public key based cryptosystem could provide secure communications if RSA were to become unusable.

OBJECTIVES OF THE INVENTION

0041It is an object of the present invention to provide a system and method for improving conventional public key cryptography to afford multiple levels of authentication security.

0042Additional objects, advantages, novel features of the present invention will become apparent to those skilled in the art from this disclosure, including the following detailed description, as well as by practice of the invention. While the invention is described below with reference to preferred embodiment(s), it should be understood that the invention is not limited thereto. Those of ordinary skill in the art having access to the teachings herein will recognize additional implementations, modifications, and embodiments, as well as other fields of use, which are within the scope of the invention as disclosed and claimed herein and with respect to which the invention could be of significant utility.

SUMMARY DISCLOSURE OF THE INVENTION

0043In accordance with the invention a network station provides multiple different levels of authentication security for a user. The user, is associated with a first asymmetric crypto-key including a first private key and a first public key, with the first private key split into a first private key portion corresponding to a password of the user and to a first computation having a first level of complexity, and a second private key portion. The first asymmetric crypto-key is use to authenticate the user at one, e.g. a first, level of authentication security. The user is also associated with a second asymmetric crypto-key including a second private key and a second public key, with the second private key split into a first private key portion corresponding to the password and a second computation having a second level of complexity greater than the first level of complexity, and a second private key portion. The second asymmetric crypto-key is use to authenticate the user at another, e.g. a second, greater level of authentication security.

0044Typically, the first and the second levels of complexity correspond to a factor. For example, the factor might represent a type of user, and the user, at the time of receipt of the first message, is a user of one type, and, at the time of receipt of the second message, is a user of a different type. The factor might alternatively represent a type of information accessible based on the authentication, and the received first message could be associated with authentication to access a first type information, and the received second message could be associated with authentication to access a second type information different than the first type information. In such a case the first type information would be normally be of a less sensitive information type than the second type information. In still another exemplary alternative, the factor might represent a type of location, and the first message could be received for a location of a first type, and the second message could be received from a location of a second, different type.

0045For example, the first computation may be based on a one-way-function and a first iteration count and the second computation may be based on the one-way-function and a second, greater iteration count. Another exemplary alternative is for the first computation to be based on a first one-way-function and the second computation is based on a second, different one-way-function.

0046The station includes a communications network interface configured to receive, for example via the Internet, a first message from the user, e.g. represented by a user network device, encrypted with the first private key portion of the first private key, and a second message from the user encrypted with the first private key portion of the second private key. The station also includes a processor configured to apply the second private key portion of the first private key to the received first message, to authenticate the first user at the first level of authentication security, and the second private key portion of the second private key to the received second message, to authenticate the second user at the second greater level of authentication security.

0047Preferably, the processor is further configured to generate the first asymmetric crypto-key including the first private key and first public key, and the second asymmetric crypto-key including the second private key and second public key. Beneficially, the processor is also configured to compute the first private key portion of the first private key by performing the first computation, and the first private key portion of the second private key by performing the second computation, and to split the first private key based on the computed first private key portion of the first private key, and the second private key based on the computed first private key portion of the second private key. After splitting the applicable private key, the processor preferably destroys the applicable private key and the computed first private key portion of that private key.

0048Accordingly to another preferred, but optional, aspect of the invention, the user can also be associated with a symmetric crypto-key corresponding to the first private key portion of one, or both, of the first and the second private keys. In such a case, advantageously the communications network interface is further configured to receive a third message from the user encrypted with the symmetric crypto-key, and the processor is further configured to apply the symmetric crypto-key to the received third message, to authenticate the user. For example, this symmetric crypto-key might be used, and hence the third message might be received after the public key crypto-system associated with the asymmetric keys has been compromised.

0049If the user is associated with such a symmetric crypto-key the processor is also preferably further configured not only to generate the first and second asymmetric crypto-keys, and perform the computations, splits and destruction discussed above, but also to compute the symmetric crypto-key corresponding to the first private key portion of the one private key by performing a modified version of the one of the first and the second computations performed to compute the first private key portion of the one private key. In this later regard, the one computation could, for example, have a first iteration count and the modified version of the one computation could have a second iteration count different than the first iteration count.

BRIEF DESCRIPTION OF DRAWINGS

0050<figref idref="DRAWINGS">FIG. 1</figref> is a flow chart showing the operations of a prior art cryptograhic system in performing authentication of a server to a client.

0051<figref idref="DRAWINGS">FIG. 2</figref> is a flow chart showing the operations of a prior art cryptograhic system in performing authentication of a client to a server.

0052<figref idref="DRAWINGS">FIG. 3</figref> depicts an exemplary network of the present invention, including networked devices of the present invention.

0053<figref idref="DRAWINGS">FIGS. 4</figref><i>a</i>-<b>4</b><i>c </i>is a flow chart showing the operations which are performed by a user and the sponsor station of the present invention for the user to log on with the sponsor station

0054<figref idref="DRAWINGS">FIGS. 5</figref><i>a</i>-<b>5</b><i>b </i>is a flow chart showing the operations which are performed by a user and the sponsor station of the present invention for a user to authenticate himself or herself to a server.

0055<figref idref="DRAWINGS">FIGS. 6</figref><i>a</i>-<b>6</b><i>c </i>is a flow chart showing the operations which are performed by a user and a distinguished server and sponsor station of the present invention in associating an asymmetric key pair with the user.

0056<figref idref="DRAWINGS">FIG. 7</figref> depicts the exemplary network and networked devices of <figref idref="DRAWINGS">FIG. 1</figref>, in addition to another network, including networked devices according to the present invention present on the other network.

0057<figref idref="DRAWINGS">FIG. 8</figref> depicts the exemplary network of <figref idref="DRAWINGS">FIG. 3</figref>, including alternative networked devices according to the present invention.

0058<figref idref="DRAWINGS">FIG. 9</figref> depicts a computer suitable for use by a user to access a network in accordance with the invention.

0059<figref idref="DRAWINGS">FIG. 10</figref> is an exemplary block diagram of components of the computer depicted in <figref idref="DRAWINGS">FIG. 9</figref>.

0060<figref idref="DRAWINGS">FIG. 11A</figref> depicts a server suitable for use by the sponsor station, distinguished entities, and merchants in accordance with the present invention.

0061<figref idref="DRAWINGS">FIG. 11B</figref> is an exemplary block diagram of components of the server depicted in <figref idref="DRAWINGS">FIG. 11A</figref>.

BEST MODE FOR CARRYING OUT THE INVENTION

0062<figref idref="DRAWINGS">FIG. 3</figref> illustrates a network <b>10</b>, which could be the Internet. As shown, the network <b>10</b> is an interconnection of networked devices in communication with each other. These networked devices include networked devices <b>30</b>-<b>33</b> associated with individual network users, networked device <b>40</b>-<b>41</b> associated with a merchant network user, a sponsor station <b>50</b> associated with a sponsor, and networked devices <b>60</b>-<b>62</b> associated with entities known to and trusted by the sponsor.

0063Networked devices <b>30</b>-<b>33</b> will be referred to as user devices. These network devices are typically personal computers. Networked devices <b>40</b>-<b>41</b> will be referred to as merchant servers. Networked devices <b>60</b>-<b>62</b> will be referred to as distinguished servers. It will be understood that a network may consist of more networked devices than depicted in <figref idref="DRAWINGS">FIG. 3</figref>.

0064<figref idref="DRAWINGS">FIGS. 9 and 10</figref> depict an exemplary personal computer suitable for use by individual users to access the network <b>10</b> in the below-described invention. The computer is preferably a commercially available personal computer. It will be recognized that the computer configuration is exemplary in that other components (not shown) could be added or substituted for those depicted and certain of the depicted components could be eliminated if desired.

0065The computer functions in accordance with stored programming instructions which drive its operation. Preferably, the computer stores its unique programming instructions on an EPROM, or hard disk. It will be recognized that only routine programming is required to implement the instructions required to drive the computer to operate in accordance with the invention, as described below. Further, since the computer components and configuration are conventional, routine operations performed by depicted components will generally not be described, such operations being well understood in the art.

0066Referring to <figref idref="DRAWINGS">FIG. 9</figref>, the computer <b>1000</b> includes a main unit <b>1010</b> with slots <b>1011</b>, <b>1012</b>, and <b>1013</b>, respectively provided for loading programming or data from a floppy disk and/or compact disk (CD) onto the computer <b>1000</b>. The computer <b>1000</b> also includes a keyboard <b>1030</b> and mouse <b>1040</b> which serve as user input devices. A display monitor <b>1020</b> is also provided to visually communicate information to the user.

0067As depicted in <figref idref="DRAWINGS">FIG. 10</figref>, the computer <b>1000</b> has a main processor <b>1100</b> which is interconnected via bus <b>1110</b> with various storage devices including EPROM <b>1122</b>, RAM <b>1123</b>, hard drive <b>1124</b>, which has an associated hard disk <b>1125</b>, CD drive <b>1126</b>, which has an associated CD <b>1127</b>, and floppy drive <b>1128</b>, which has an associated floppy disk <b>1129</b>. The memories, disks and CD all serve as storage media on which computer programming or data can be stored for access by the processor <b>1100</b>. The memory associated with a personal computer here after will collectively be referred to as Memory <b>1170</b>. A drive controller <b>1150</b> controls the hard drive <b>1124</b>, CD drive <b>1126</b> and floppy drive <b>1128</b>. Also depicted in <figref idref="DRAWINGS">FIG. 10</figref> is a display controller <b>1120</b> interconnected to display interface <b>1121</b>, a keyboard controller <b>1130</b> interconnected to keyboard interface <b>1131</b>, a mouse controller <b>1140</b> interconnected to mouse interface <b>1141</b> and a modem <b>1160</b> interconnected to I/O port <b>1165</b>, all of which are connected to the bus <b>1110</b>. The modem <b>1160</b> and interconnected I/O port <b>1165</b> are used to transmit and receive signals via the Internet <b>100</b> as described below. It will be understood that other components may be connected if desired to the bus <b>1110</b>. By accessing the stored computer programming, the processor <b>1100</b> is driven to operate in accordance with the present invention.

0068Sponsor station <b>50</b>, the merchant users and the distinguished entities are preferably represented on network <b>10</b> by an Internet server of the applicable type shown in <figref idref="DRAWINGS">FIGS. 11A and 11B</figref>, as will be described further below. However, here again, any network compatible device which is capable of functioning in the described manner could be substituted for the servers shown in <figref idref="DRAWINGS">FIGS. 11A and 11B</figref>.

0069<figref idref="DRAWINGS">FIGS. 11A and 11B</figref> depict an exemplary network server suitable for use by the sponsor, merchants, and distinguished entities to access the network <b>10</b> in the below-described invention.

0070The server is preferably a commercially available high power, mini-computer or mainframe computer. Here again, it will be recognized that the server configuration is exemplary in that other components (not shown) could be added or substituted for those depicted and certain of the depicted components could be eliminated if desired.

0071The server functions as described below in accordance with stored programming instructions which drive its operation. Preferably, the server stores its unique programming instructions on an EPROM or hard disk. It will be recognized that only routine programming is required to implement the instructions required to drive the server to operate in accordance with the invention, as described below. Further, since the server components and configuration are conventional, routine operations performed by depicted components will generally not be described, such operations being well understood in the art.

0072Referring to <figref idref="DRAWINGS">FIG. 11A</figref>, the server <b>1000</b>′ includes a main unit <b>1010</b>′ with slots <b>1011</b>′, <b>1012</b>′, <b>1013</b>′and <b>1014</b>′, respectively provided for loading programming or data from a floppy disk, CD and/or hard disk onto the server <b>1000</b>′. The server <b>1000</b>′ also includes a keyboard <b>1030</b>′ and mouse <b>1040</b>′, which serve as user input devices. A display monitor <b>1020</b>′ is also provided to visually communicate information to the user.

0073As depicted in <figref idref="DRAWINGS">FIG. 11B</figref>, the server <b>1000</b>′ has a main processor <b>1100</b>′ which is interconnected via bus <b>1110</b>′ with various storage devices including EPROM <b>1122</b>′, RAM <b>1123</b>′, hard drive <b>1124</b>′, which has an associated hard disk <b>1125</b>′, CD drive <b>1126</b>′, which has an associated CD <b>1127</b>′, and floppy drive <b>1128</b>′, which has an associated floppy disk <b>1129</b>′. The memories, disks and CD all serve as storage media on which computer programming or data can be stored for access by the processor <b>1100</b>′. The stored data includes one or more databases containing information associated with network users. The memories associated with a server hereafter will be collectively referred to as memory <b>1170</b>′. A drive controller <b>1150</b>′ controls the hard drive <b>1124</b>′, CD drive <b>1126</b>′ and floppy drive <b>1128</b>′. Also depicted in <figref idref="DRAWINGS">FIG. 11B</figref> is a display controller <b>1120</b>′ interconnected to display interface <b>1121</b>′, a keyboard controller <b>1130</b>′ interconnected to keyboard interface <b>1130</b>′, a mouse controller <b>1140</b>′ interconnected to mouse interface <b>1141</b>′ and a modem <b>1160</b>′ interconnected to I/O port <b>1165</b>′, all of which are connected to the bus <b>1110</b>′. The modem <b>1160</b>′ and interconnected I/O port <b>1165</b>′ are used to transmit and receive signals via the network <b>10</b> as described above. It will be understood that other components may be connected if desired to the bus <b>1110</b>′. By accessing the stored computer programming, the processor <b>1100</b>′ is driven to operate in accordance with the present invention.

0074An asymmetric crypto-key is associated with at least each individual network user, and each distinguished server. If desired, an asymmetric crypto-key can also be associated with each merchant user. Each asymmetric crypto-key consists of two portions, a public portion and a private portion. The public portion of each asymmetric crypto-key is known to at least each merchant user. If desired, the public portion of each asymmetric crypto-key can also be known to each individual user. Each of these public portions can be stored on each merchant server, or on each merchant server and each individual device. The private portion of each asymmetric crypto-key consists of at least a first private portion and a second private portion. The first private portion is retained by the individual or merchant user with whom the asymmetric crypto-key is associated. The first private portion of the asymmetric crypto-key will be referred to as Dxx and is derived from the user's password, as will be discussed below. The second private portion of each asymmetric crypto-key is retained by the sponsor station <b>50</b> and will be referred to as Dxs.

0075The asymmetric crypto-keys are used in transforming information. Preferably, the asymmetric crypto-keys are used in providing trusted authentication of an individual user to a merchant user. Also, the asymmetric crypto-keys can be used in providing trusted authentication of an individual user to another individual user, or of a merchant user to another merchant user.

0076In the case of providing trusted authentication of an individual user, in this instance, the individual user associated with user device <b>30</b>, to a merchant user, in this instance, the merchant user associated with merchant server <b>40</b>, the following operations, as shown in <figref idref="DRAWINGS">FIGS. 4 and 5</figref>, are performed by networked devices <b>30</b> and <b>40</b>.

0077A communication session between user device <b>30</b> and merchant server via network <b>10</b> is established, step <b>401</b> of <figref idref="DRAWINGS">FIG. 4</figref>. Merchant server <b>40</b> transmits a request via network <b>10</b> to user device <b>30</b> requesting that the individual user authenticate himself or herself to the merchant user, step <b>410</b>. As described above, this request typically is a request for the party being authenticated to sign a 36 bit hash provided by the authenticating party or otherwise determined by the user-merchant communication.

0078In response to this request, the user device <b>30</b> determines if a logged-in ticket is stored on memory <b>1170</b> at the user device <b>30</b>, step <b>415</b>. If so, operations continue as described below and shown at step <b>510</b> of <figref idref="DRAWINGS">FIG. 5</figref><i>a. </i>If not, user device <b>30</b> requests the individual user to enter his or her user ID and password into the user device <b>30</b> to begin a log on protocol, step <b>420</b>.

0079Alternatively, a user associated with an asymmetric crypto-key may contact the sponsor station <b>50</b>, via the network <b>10</b>, to log on prior to establishing a communications session with another network station. In this instance, processing begins with establishing a communications session between the user device and the sponsor station <b>50</b>, step <b>405</b>. Processing in this instance continues with step <b>420</b> as herein described.

0080User device <b>30</b> processes the entered password to obtain Dxx, the first private portion of the asymmetric crypto-key, step <b>425</b>. Processing of the entered password to obtain Dxx is discussed below. User device <b>30</b> then transmits a log-in request to sponsor station <b>50</b>, step <b>430</b>. The log-in request includes at least the user's user ID. It should be understood that step <b>425</b> can occur previous to step <b>430</b>, concurrent with step <b>430</b>, or subsequent to step <b>430</b>, though it is shown previous to step <b>430</b> in <figref idref="DRAWINGS">FIG. 4</figref><i>a. </i>

0081Sponsor station <b>50</b> receives and processes the log-in request to generate a challenge to the user device <b>30</b>, step <b>435</b>. Use of a challenge will be understood by one skilled in the art. The challenge is transmitted to the user device <b>30</b>, step <b>440</b>. The log-in request and challenge are preferably each transmitted in the clear. That is, neither of these messages are protected. However, as will be discussed below, optional operations can be performed to protect these messages.

0082The user device <b>30</b> receives the challenge and generates a random number R<b>1</b> and a time stamp, step <b>445</b>. Preferably, R<b>1</b> is a 192 bit number. Next, the user device <b>30</b> encrypts the challenge, time stamp and R<b>1</b> with Dxx, forming a first encrypted message, step <b>450</b>. User device <b>30</b> transmits the first message to sponsor station <b>50</b>, step <b>451</b>.

0083Sponsor station <b>50</b> decrypts the first encrypted message using the second portion of the user's private key and the user's public key to recover the challenge, time stamp and R<b>1</b>, step <b>455</b>. This operation authenticates the user device <b>30</b> to the sponsor station <b>50</b>. If this authentication fails, that is, the challenge, time stamp and R<b>1</b> are not encrypted with Dxx and therefore are unrecoverable using the second portion of the user's private key and the user's public key, sponsor station <b>50</b> transmits a notice to the user device <b>30</b> causing the user device <b>30</b> to prompt the user to reenter his or her password, and user ID, step <b>460</b>, and operations continue with step <b>420</b>.

0084If authentication is successful, the sponsor station <b>50</b> generates a second random number R<b>2</b>, computes the function XOR of R<b>1</b> and R<b>2</b>, generates a time stamp, and determine a lifetime-value, step <b>465</b>. As with R<b>1</b>, R<b>2</b> is preferably a 192 bit number. The lifetime-value is the life span of the logged-in ticket. This value may be a finite time period, such as 1 hour or any other finite time period so desired, or this value may be an end time such that the logged-in ticket expires upon that time being reached. Next, the sponsor station <b>50</b> encrypts R<b>2</b>, the time stamp, and the lifetime-value with R<b>1</b>, forming a second encrypted message, step <b>470</b>. The sponsor station <b>50</b> transmits this second encrypted message to the user device <b>30</b>, step <b>471</b>.

0085The user device <b>30</b> decrypts the second encrypted message using R<b>1</b>, recovering R<b>2</b>, the time stamp, and the lifetime-value, step <b>475</b>. This operation authenticates the sponsor station <b>50</b> to the user device <b>30</b>. The user device <b>30</b> computes function XOR of R<b>1</b> and R<b>2</b> which is called R<b>12</b>, encrypts Dxx with R<b>1</b>, and then destroys R<b>1</b> and the unencrypted Dxx, step <b>480</b>. The user device <b>30</b> then stores the encrypted Dxx, user ID, time stamp, and the lifetime-value on memory <b>1170</b>, forming the logged-in ticket, step <b>485</b>. The user device <b>30</b> then transmits a message to the sponsor station <b>50</b> which includes a ‘done’ indication and a time stamp which are encrypted using R<b>12</b>, step <b>490</b>. The sponsor station <b>50</b> stores an indication in memory <b>1170</b>′ that the user is logged in. The user has now successfully logged in and can use the services of the sponsor station <b>50</b> to sign the 36 byte hash. As will be shown below, if the user has an unexpired logged-in ticket, the user need not provide the user's client ID or password again to provide authentication to another network station requesting authentication.

0086Once the user is successfully logged in, to complete the authentication of user to the merchant, the user device <b>30</b> transmits an authorization request to the sponsor station <b>50</b>, step <b>510</b> of <figref idref="DRAWINGS">FIG. 5</figref>. The authorization request includes the user's user ID which is stored as part of the logged-in ticket on memory <b>1170</b>. The user device <b>30</b> retrieves the user ID from memory <b>1170</b>, the user device <b>30</b> does not prompt the user to enter the user ID. This transmission is sent using a Message Authentication Code (MAC) using R<b>12</b>. As will be understood by one skilled in the art, a MACed message is not encrypted, rather it includes a number string appended to the message which authenticates the sender of the message to the receiver of the message and assures integrity of the message content. The user device <b>30</b> MACs the authorization request with R<b>12</b>. The sponsor station <b>50</b> processes the received message to authenticate the user based upon the MACed message, step <b>515</b>. Then, the sponsor station <b>50</b> generates and transmits an acknowledgement message to the user device <b>30</b>. This is also MACed with R<b>12</b>, step <b>516</b>.

0087The user device <b>30</b> authenticates the received acknowledgment and encodes a 36 byte hash, provided by the merchant server <b>40</b>, step <b>520</b>. Preferably, the 36 byte hash is encoded using the PKCS1 algorithm, though other well known algorithms could be used. Next, the user device <b>30</b> encrypts the 36 byte hash and a time stamp with R<b>12</b> and transmits both to the sponsor station <b>50</b>, step <b>525</b>.

0088The sponsor station <b>50</b> decrypts encoded 36 byte hash and time stamp using R<b>12</b>, step <b>530</b>. Next, the sponsor station <b>50</b> signs the encoded 36 byte hash with Dxs, the second private portion of the asymmetric crypto-key, step <b>535</b>. The sponsor station <b>50</b> generates a fresh time stamp, recalls R<b>1</b> from memory <b>1170</b>′, and transmits the time stamp, the signed encoded 36 byte hash, and R<b>1</b> to the user device <b>30</b>, all encrypted with R<b>12</b>, step <b>540</b>.

0089The user device <b>30</b> decrypts the time stamp, the signed encoded 36 byte hash, and R<b>1</b> using R<b>12</b>, step <b>545</b>. Then, the user device <b>30</b> recalls encrypted Dxx from the memory <b>1170</b> and decrypts Dxx using R<b>1</b> obtained from the sponsor box <b>50</b>, step <b>550</b>. The user device <b>30</b> then uses Dxx to complete the signature of the encoded 36 byte hash and transmits the fully signed 36 byte hash to the merchant server <b>40</b>, step <b>555</b>. To complete the transaction, the user device <b>30</b> transmits a ‘done’ message to the sponsor station <b>50</b>, step <b>560</b>.

0090Alternately the encoded 36 byte hash could be first signed on the user device <b>30</b> using Dxx decrypted via R<b>12</b> and the signature completed on the sponsor station <b>50</b> using Dxs.

0091It will be understood by one skilled in the art that any or all of the communications depicted in <figref idref="DRAWINGS">FIGS. 4</figref><i>a </i>-<b>4</b><i>c </i>and <b>5</b><i>a </i>-<b>5</b><i>b </i>between the user device <b>30</b> and sponsor station <b>50</b> could include a sequence number. It also will be understood that any or all of the communications depicted in <figref idref="DRAWINGS">FIGS. 5</figref><i>a </i>-<b>5</b><i>b </i>could be encrypted with R<b>12</b>, MACed with R<b>12</b>, or both encrypted and MACed with R<b>12</b>. Also, further protection of encrypted messages can be obtained by use of a Salt, which will be understood by one skilled in the art.

0092To provide trusted authentication to yet another merchant server, or perhaps to merchant server <b>40</b> at a later time, operations continue as depicted in <figref idref="DRAWINGS">FIG. 4</figref><i>a, </i>step <b>401</b>, and as discussed above. If, as depicted in step <b>415</b>, the user device <b>30</b> determines that an unexpired log-in ticket is stored in memory <b>1170</b>, operations continue as depicted in <figref idref="DRAWINGS">FIG. 5</figref><i>a, </i>step <b>510</b>. Thus, the user associated with network station <b>30</b> need only enter his or her user ID and password once, while the user is able to provide trusted authentication to more than one merchant user.

0093The sponsor station <b>50</b> is responsible for creating the association between users and asymmetric crypto-keys. For a user to obtain an association with an asymmetric crypto-key, the user must have a relationship with an entity associated with a distinguished server. A distinguished server and sponsor station <b>50</b> maintain a trusted relationship. The sponsor station <b>50</b> will provide an asymmetric crypto-key only for those users referred to it by a distinguished server.

0094For instance, if the individual user associated with user device <b>31</b> wishes to obtain an association with an asymmetric crypto-key, yet does not have a preexisting relationship with any distinguished server, that user may choose to contact distinguished server <b>60</b> via the network <b>10</b> and provide identity information to the distinguished server <b>60</b>. In this case, the distinguished server <b>60</b> has the capabilities to verify identity information. This capability may be any well known method of verifying identify information, such as a database of credit information, a database of telephone account information, or a database of address information. If the distinguished server <b>60</b> verifies the provided information, the distinguished server <b>60</b> can refer the user to the sponsor station <b>50</b>.

0095If an individual user associated with user device <b>32</b> wishes to obtain an association with an asymmetric crypto-key and has a relationship with the distinguished server <b>61</b>, the individual user must request that the distinguished server <b>61</b> initiate the process of associating an asymmetric crypto-key with the individual user. Operations as described below and depicted in <figref idref="DRAWINGS">FIG. 6</figref> will be performed.

0096Also, in yet another instance of initiation of asymmetric crypto-key association, distinguished server <b>62</b> may be associated with an entity wishing to associate an asymmetric crypto-key for each of a plurality of individuals already known to it. For instance, a merchant or bank may wish to provide to customers the opportunity to use the services of the sponsor station <b>50</b>. Or, an organization may wish to provide to its members the opportunity to use the services of the sponsor station <b>50</b>.

0097In any event, association of an asymmetric crypto-key is a three party process. As shown in step <b>601</b> of <figref idref="DRAWINGS">FIG. 6</figref><i>a, </i>a distinguished server, in this instance distinguished server <b>62</b> logs in with the sponsor station <b>50</b>, as described above. Then, the distinguished server <b>62</b> transmits to the sponsor station <b>50</b> information identifying a new user with whom an asymmetric crypto-key will be associated, in this instance the individual user associated with user device <b>33</b>, step <b>605</b>. The sponsor box then generates a symmetric key pair and a user ID which will be associated with the new user, step <b>610</b>. This symmetric key pair will serve as a one time activation code. Preferably, the symmetric key is a short pronounceable word. This symmetric key and user ID is stored in the memory <b>1170</b>′ and is also transmitted to the distinguished server <b>62</b>, step <b>615</b>. The distinguished server <b>62</b> then causes the symmetric key and user ID to be delivered to the new user. This delivery may be via traditional postal delivery, via e-mail, or via other electronic delivery, such as via a web-page, step <b>617</b>. Preferably electronic or hard-copy delivery will be secured using techniques familiar to those skilled in the art.

0098The new user, after receiving the user ID and symmetric key, establishes a communication session with the sponsor station <b>50</b>, step <b>620</b>. The new user enters the user ID into his or her user device and transmits the same to the sponsor station <b>50</b>, step <b>625</b>.

0099The sponsor station <b>50</b> matches the received user ID with the user ID and symmetric key stored in memory <b>1170</b>′, step <b>630</b>. If the received user ID has a match, the sponsor station <b>50</b> generates a challenge and encrypts the challenge with the symmetric key/one time activation code, step <b>635</b>. The sponsor box transmits the encrypted challenge and a request for the new user to select a password to the user device <b>33</b>, step <b>638</b>. The user device <b>33</b> decrypts the challenge using the new user's symmetric key/one time activation code, step <b>640</b>.

0100The new user selects and enters a password which is then encrypted by the user device <b>33</b> using the symmetric key/one time activation code, and this is then transmitted to the sponsor station <b>50</b>, step <b>645</b>. The sponsor station <b>50</b> decrypts the password using the symmetric key/one time activation code, step <b>650</b>. The sponsor station <b>50</b> generates a new key set, step <b>651</b>. The new key set is keys Dx and Ex, the entire private and public portions of the asymmetric crypto-key. Then, the sponsor station <b>50</b> splits Dx into Dxx and Dxs, the first and second portions of the private portion, step <b>655</b>. Computation of Dxx will be further discussed below, as well as generation of yet another key, Dxx++, which is generated after Dxx is obtained. However, it should be understood that the sponsor station <b>50</b> bases Dxx on the password. After generating the keys, the sponsor station stores Dxs, Dxx++, and Ex in the memory <b>1170</b>′ and destroys the password, Dxx and Dx, step <b>660</b>. As a result, the user's entire private key is not stored at the sponsor station <b>50</b>.

0101It should be noted that sponsor station <b>50</b> does not distribute or otherwise supply Dxx to any user, including the user with whom it is associated, yet the associated user will be able to transform messages using Dxx. According to the present invention, Dxx is a long key for use by a system user, yet the system user need not store this long key, obviating the problems with long keys discussed above. Furthermore, because Dxx is generated each instance it is used from a short password, a user need only memorize a short password. Thus the present invention includes not only the benefits of short keys, but the protection of long keys.

0102It should also be noted that when a new user establishes his or her password with the sponsor station <b>50</b>, the new user is also prompted for information to be included in a certificate to be associated with the asymmetric crypto-key. <ul id="ul0003" list-style="none"><li id="ul0003-0001" num="0000"><ul id="ul0004" list-style="none"><li id="ul0004-0001" num="0103"> Each time a user desires to log on to the sponsor station <b>50</b>, the user enters his or her password into his or her network device and the network device then computes Dxx from the password, as introduced above. This computation is a computation based upon a one way function, preferably using the PKCS-5 algorithm. A one way function is a function that it is very difficult to reverse. Thus, it is difficult, if not impossible, to take a computed Dxx and determine the password from which it was computed. The computation performed by a user's networked device to obtain Dxx is the same computation performed by the sponsor station <b>50</b> to obtain Dxx during key association. At least one one-way function is stored on memory <b>1170</b> of each networked device. Each one way function stored on a networked device is also stored on memory <b>1170</b>′ at the sponsor station <b>50</b>. </li></ul></li></ul>

0104The user password is preferably a short password which is easily remembered by the user, ideally approximately 8 characters in length. An eight character password is approximately between 56 and 72 bits in length. The one way computation takes this short password and transforms it into a long key, preferably 1024 bits long, but at least 257 bits long. Thus, the effective length of the first portion of the private key is not the bit length of the password, but the bit length of the computed Dxx. It will be recognized that advantages of generation of a long key from a short key, that is, a password, are equally beneficial to any cryptosystem, including symmetric and asymmetric cryptosystems.

0105The processing to obtain the long Dxx, whether it be PKCS-5 or some other processing, requires a time period for the computation to be completed. This time period, which can referred to as a system delay, serves to defend against dictionary attacks, which have been described above. For instance, if an attacker were to obtain a message M encrypted with Dxx, and even if the intruder had knowledge of the one way computation algorithm, the intruder would be required compute Dxx for each bad password in her arsenal of bad passwords and attempt to decrypt S using the Dxx obtained from each of the bad passwords. If the arsenal consisted of 40,000 bad passwords, and if the system delay to obtain Dxx is 10 seconds, at a minimum the attacker would have to invest over 111 hours of computing time to attack with each bad password in her arsenal.

0106The use of a computed Dxx also aids in defending against on-line guessing attacks for the same reason discussed above. An attacker would have to choose a user ID and a password with which to attempt to log in, establish a communication session with the sponsor station <b>50</b> and enter the selected user ID and password. The networked device the attacker is using would then have to compute Dxx from the password and transmit the same to the sponsor station <b>50</b>. The added computation time in obtaining Dxx would decrease the number of guesses an attacker could attempt in any time period. As will be understood by one skilled in the art, the sponsor station <b>50</b> may be configured to allow only a limited number password attempts.

0107The time for completion of the one way function computation can be varied. That is, the one way computation can be made more or less complex depending upon a number of factors. This complexity may be based on the number of iterations performed by a one way computation. Or, the complexity may be varied based upon selection of the one way function.

0108A first factor may be the user with whom the password is associated. For instance, a system administrator's password may be required to be processed by the one way computation such that a longer time delay is introduced.

0109A second factor may be the password itself. For instance, a password which meets certain prescribed criteria for quality, as discussed above, may not require a complex computation, as a quality password is less likely to be vulnerable to a dictionary attack.

0110A third factor may be type of system being accessed. For instance, operators of a system which provides access to sensitive financial data may wish to make compromising their system's integrity very difficult, thus requiring a long system delay for password conversion.

0111A fourth factor, which also focuses on the identity of the user, may be the location of the user, or networked device used by the user, seeking access to a given resource. For instance, <figref idref="DRAWINGS">FIG. 7</figref> depicts the network of <figref idref="DRAWINGS">FIG. 3</figref>, with the addition of another network <b>70</b> in communication with network <b>10</b>. The other network <b>70</b> may be an intranet, a LAN, a WAN, or any other type of network. The other network <b>70</b> includes a second sponsor station <b>71</b> and a plurality of networked devices <b>72</b>-<b>74</b>. Sponsor station <b>71</b> may mandate a longer system delay for user devices <b>30</b>-<b>33</b> than for user devices <b>72</b>-<b>74</b>, as networked devices <b>30</b>-<b>33</b> are not a part of the other network <b>70</b>.

0112If the time of computation of the one way function is varied, stored on memory <b>1170</b>′ at sponsor station <b>50</b> is an indication of which one way function is associated with each user and/or the number of iterations of a one way function a particular user is required to perform.

0113The present invention also enables a user to manage his or her information with the sponsor station <b>50</b>. This includes changing the password should the user so desire. This may be due to the password becoming compromised, or for any other reason. A user is also able to change, delete or otherwise modify the information included in the user's certificate. Communications between a user and the sponsor station <b>50</b> to manage user information may be encrypted with R<b>12</b>, due to the sensitive nature of this operation.

0114It should be recognized that a user, prior to accessing any given networking device, may establish a communications session with the sponsor station <b>50</b> and change, delete or otherwise modify information included in the user's certificate. After accessing the given networking device, the user can reestablish a communication session with the sponsor station <b>50</b> and once again change the information included in the certificate. Thus, a user is able to access a plurality of networking devices using the same public crypto-key, while controlling information disclosed to each networking device about the user in the user's certificate.

0115The key Dxx++ was introduced above. Dxx++ is a key which is obtained by performing a predetermined number of additional iterations of a one way function on a password. As an example, if five iterations of a one way function are designated to obtain Dxx, seven iterations of the same one way function may be designated to obtain Dxx++. It should be remembered that it is difficult or impossible to reverse a one way function. The Dxx++ associated with each user is stored in memory <b>1170</b>′ at the sponsor station <b>50</b>. Dxx++ can be computed at each user's networked device from a user's password.

0116As discussed above, most public cryptosystems are based upon RSA. If RSA should become compromised, Dxx++ will be used to encrypt information between network users and the sponsor station <b>50</b> and between network users themselves. It will be apparent from the above discussion that Dxx++ is a shared secret symmetric key. Both the user and the sponsor station hold, or can easily obtain, Dxx++. Dxx++ provides a fall back symmetric cryptographic system.

0117If the sponsor station <b>50</b> determines that RSA has become compromised, the sponsor station <b>50</b> will direct that communications will be performed using symmetric key encryption. Thus, when a user establishes a communication session with the sponsor station <b>50</b>, the sponsor station <b>50</b> will transmit a message to the user device causing the user device to compute Dxx++ and to encrypt all further communications with the sponsor device using Dxx++. Thus even though RSA may become compromised the sponsor station <b>50</b> and a networked device can still conduct secure communications. A user will be able to use the same password created for use in an asymmetric cryptosystem in what may become a symmetric cryptosystem. In a fall back situation, the sponsor station, which holds Dxx++ for each user, can serve as a distributing agent for symmetric keys, enabling users to have secure communications with one another. It should be understood that use of Dxx++ as a fall back scheme is applicable to any cryptosystem based upon RSA. It is also applicable to public-key cryptosystems which are not based on RSA.

0118As shown in <figref idref="DRAWINGS">FIG. 8</figref>, the sponsor station <b>50</b> of <figref idref="DRAWINGS">FIG. 3</figref> may be replaced by a plurality of sponsor stations. In this instance, 3 sponsor stations are shown, sponsor stations <b>80</b>, <b>81</b>, and <b>82</b>. Though these sponsor stations are shown communicating with networking devices via the network <b>10</b>, it should be understood that the plurality of sponsor stations may also communicate with one another via separate communications channels. Furthermore, the plurality of sponsor stations may be located in the same physical location, or they may be located in separate physical locations.

0119One or more sponsor stations may be used as back up for a failed sponsor station. Or, the operation of signing a 36 byte hash, as described above, may be performed by multiple sponsor stations. In such a case, alternative operations are set forth below.

0120In each alternative, the private key portion of the asymmetric key is split into more than two portions. That is, each of the multiple servers holds a Dxs. Thus, sponsor station <b>80</b> holds key Dxs₁, sponsor station <b>81</b> holds key Dxs₂, and sponsor station <b>82</b> holds key Dxs₃. In such an alternative, any one of the sponsor stations can associate the keys with users, as described above. That sponsor station then must distribute the appropriate Dxs portion to each of the other sponsor station.

0121In the first alternative, which could be called a parallel method, to obtain a signature on a 36 byte hash, a user device must transmit a copy of the hash to each of the multiple sponsor stations. Each station applies that sponsor station's Dxs to the hash and transmits the signed hash back to the user device. The user device then multiplies each of the signed hashes together, relying on the commutative property of RSA, and signs this result with the user's portion of the private key. The user device can then transmit the signed 36 byte hash to the requesting merchant server, as described above.

0122In a second alternative, authentication of the user to each of the multiple sponsor stations can be provided. In this alternative a temporary shared secret key is established between the multiple sponsor stations and the user.

0123A user initiates a log-in with any of the multiple sponsor stations as described above, and in this instance with sponsor station <b>80</b>. The sponsor station <b>80</b> generates a challenge C<b>1</b> and signs C<b>1</b> with a private key associated with sponsor station <b>80</b>. This private key is verifiable by each of the other sponsor stations. That is, they each have the corresponding public key. Then, sponsor station <b>80</b> encrypts the challenge with its portion of the user's private key. The sponsor station <b>80</b> also encrypts a copy of C<b>1</b> with the public key of sponsor station <b>81</b> and encrypts a copy of C<b>1</b> with the public key of sponsor station <b>82</b>. The sponsor station <b>80</b> then transmits C<b>1</b> to the appropriate other sponsor station. Sponsor station <b>81</b> obtains C<b>1</b> using its private key, and sponsor station <b>82</b> obtains C<b>1</b> using its private key. At this point, each of the sponsor stations knows C<b>1</b>.

0124Sponsor station <b>80</b> encrypts C<b>1</b> with its portion of the user's private key and transmits the same to the user device. Sponsor station <b>81</b> encrypts C<b>1</b> with its portion of the user's private key and transmits the same to the user device. And, sponsor station <b>82</b> encrypts C<b>1</b> with its portion of the user's private key and transmits the same to the user device. The user device then multiplies each of the received encrypted C<b>1</b>s together and then recovers C<b>1</b> using the user's portion of the private key. C<b>1</b> can than be used as a shared secret key between the user and the sponsor stations. Thus, by demonstrating knowledge of C<b>1</b>, the user device can authenticate itself to each of the multiple sponsor stations. The user can then obtain the required signatures from each of the multiple sponsor stations, such communications being protected by C<b>1</b>.

0125In a third alternative, which could be called a series alternative, to obtain a signature on a 36 byte hash, a user device transmits the 36 byte hash to a sponsor station <b>80</b>, sponsor station <b>80</b> in this example. That sponsor station signs the hash and forwards it to sponsor station <b>81</b>. Sponsor station <b>81</b> signs the hash and forwards it sponsor station <b>82</b>. Sponsor station <b>82</b> signs the hash and returns it to the user. The user then applies his portion of the private key to the hash and transmits it to a merchant server.

0126This second alternative can be modified. The user could first be required to sign the hash and then forward it to sponsor station <b>80</b>. Operations continue at sponsor station <b>80</b> as described above. After sponsor station <b>82</b> signs the hash, the hash would have a complete private portion. The sponsor station <b>82</b> could verify the signature by using the user's public key. This adds an additional element of authentication to the process.

0127It will also be recognized by those skilled in the art that, while the invention has been described above in terms of one or more preferred embodiments, it is not limited thereto. Various features and aspects of the above described invention may be used individually or jointly. Further, although the invention has been described in the context of its implementation in a particular environment and for particular purposes, e.g. in providing security for Internet communications, those skilled in the art will recognize that its usefulness is not limited thereto and that the present invention can be beneficially utilized in any number of environments and implementations. Accordingly, the claims set forth below should be construed in view of the full breath and spirit of the invention as disclosed herein.