System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens

Claims

What is claimed is:

1. A method for securely accessing a computing system, comprising the steps of:

(a) a workstation receiving a token from a first passive authentication token generator and receiving a secret password associated with a user;

(b) the workstation generating a transmission code by performing a first hashing algorithm upon data comprising:

(1) the token and

(2) the secret password;

(c) the workstation sending the transmission code to an authentication server;

(d) the server receiving and verifying the validity of the transmission code;

(e) if the transmission code is valid, the server transmitting to the workstation a message encrypted with a session code generated by performing a second hashing algorithm upon data comprising the token and the password, the second hashing algorithm being substantially different than the first hashing algorithm;

(f) the workstation receiving the message;

(g) the workstation computing the session code by performing the second hashing algorithm on the password and the token; and

(h) the workstation using the session code to decrypt the message.

2. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:

(1) hashing the password according to a selected one-way hashing equation;

(2) concatenating the token onto the hashed password to form a concatenation; and

(3) hashing the concatenation according to the selected one-way hashing equation.

3. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:

(1) hashing the password according to a selected one-way hashing equation;

(2) concatenating the hashed password onto the token to form a concatenation; and

(3) hashing the concatenation according to the selected one-way hashing equation.

4. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:

(1) concatenating the token onto the password to form a concatenation; and

(2) hashing the concatenation according to the selected one-way hashing equation.

5. The method of claim 1, wherein the step of generating the transmission code comprises the steps of:

(1) concatenating the password onto the token to form a concatenation; and

(2) hashing the concatenation according to the selected one-way hashing equation.

6. The method of claim 1, wherein the step of verifying the validity of the transmission code comprises the steps of:

(1) the server utilizing a second passive authentication token generator that simultaneously supplies tokens substantially identical to those of the first passive token generator to identify possible tokens occurring at the time the workstation sent the transmission code to the server;

(2) the server identifying one or more passwords from a stored list; and

(3) the server attempting to reproduce the transmission code by performing the first hashing algorithm on the identified one or more passwords and different identified possible tokens in turn.

7. The method of claim 6, wherein step (2) comprises the step of utilizing a user name received from the workstation to identify a single password from a cross-referenced list of user names and passwords.

8. The method of claim 1, wherein the step of verifying the validity of the transmission code comprises the steps of:

(1) the server utilizing a second passive authentication token generator that simultaneously supplies tokens substantially identical to those of the first passive token generator to identify possible tokens occurring at the time the workstation sent the transmission code to the server;

(2) the server identifying one or more hashed passwords from a stored list; and

(3) the server attempting to reproduce the transmission code by performing the first hashing algorithm on the identified one or more hashed passwords and different identified possible tokens in turn.

9. The method of claim 8, wherein step (2) comprises the step of utilizing a user name received from the workstation to identify a single hashed password from a cross-referenced list of user names and hashed passwords.

10. The method of claim 1, wherein the step of generating the session code comprises the steps of:

(1) hashing the password according to a selected one-way hashing equation;

(2) concatenating the token and the hashed password to form a concatenation; and

(3) hashing the concatenation according to the selected one-way hashing equation.

11. The method of claim 1, wherein the step of generating the session code comprises the steps of:

(1) hashing the token according to a selected one-way hashing equation;

(2) concatenating the hashed token and the password to form a concatenation; and

(3) hashing the concatenation according to the selected one-way hashing equation.

12. The method of claim 1, wherein the step of generating the session code comprises the steps of:

(1) concatenating the token onto the password to form a concatenation; and

(2) hashing the concatenation according to the selected one-way hashing equation.

13. The method of claim 1, wherein the step of generating the session code comprises the steps of:

(1) concatenating the password onto the token to form a concatenation; and

(2) hashing the concatenation according to the selected one-way hashing equation.

14. The method of claim 1, further comprising the step of the workstation using the message to encrypt subsequent communications between the workstation and a desired computing system.

15. The method of claim 1, further comprising the step of the workstation using the session code to decrypt subsequent communications between the workstation and a desired computing system.

16. The method of claim 1, additionally including the step of the authentication server maintaining a log of verified transmission codes.

17. The method of claim 1, wherein the step of the workstation receiving the password is accomplished by a user typing the password upon keys of a data entry device.

18. The method of claim 1, wherein the step of the workstation receiving the token is accomplished by a user typing the token upon keys of a data entry device.

19. The method of claim 1, wherein the token is generated by the first authentication token generator based upon an external reference.

20. The method of claim 1, wherein the step of the workstation receiving the token is accomplished by an electrical link.

21. The method of claim 1, wherein the step of the workstation receiving the token is accomplished by the workstation reading a bar code provided by the first authentication token generator.

22. A secure method for obtaining access to a computing system, wherein a workstation performs steps comprising:

(a) receiving an initial password and an initial token, wherein the initial password is supplied by a user and the initial token is supplied by a first authentication token generator;

(b) generating a transmission code by performing a first hashing algorithm upon the password and the token;

(c) sending the transmission code to an authentication server having a second authentication token generator that simultaneously supplies tokens substantially identical to those provided by the first authentication token generator;

(d) if the authentication server successfully reproduces the transmission code by performing successive calculations utilizing different combinations of possible tokens occurring at the time the transmission code was sent and one or more passwords identified from a list of passwords accessible by the authentication server, then receiving a message from the authentication server that is encrypted with a selected secret key routine using a session code obtained by performing a second hashing algorithm upon data comprising the initial token and the initial password, the second hashing algorithm being substantially different than the first hashing algorithm.

23. The method of claim 22, wherein the workstation additionally performs steps comprising:

(1) decrypting the message; and

(2) utilizing the message to encrypt subsequent communications with a desired computing system.

24. The method of claim 22, wherein the workstation additionally performs steps compris