Abstract:
A hardware device connected to a network access point to authenticate itself to a server is disclosed. The device stores authentication software, and applicative data. The device is used to generate a one-time password to uniquely identify itself to a server.

Description:
REFERENCE TO RELATED APPLICATION 
       [0001]    This application claims priority to U.S. Provisional Application No. 61/208,021, filed Feb. 18, 2009. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The invention relates to the field of authentication, and in particular to a hardware device implementing authentication. 
       PRIOR ART 
       [0003]    Internet is used to perform a growing number of critical tasks, such checking emails, paying bills, online trading, and managing bank accounts. All these critical tasks require a user identification, but most often, this authentication is poorly performed using a login name/password pair. Once maliciously obtained using phishing, spy-ware techniques, or other means, the login/password pair can provide access to your identity and private information. 
         [0004]    Protecting software against illegal copy usage is a also major issue in the computer industry. But most often copy protection is performed using serial numbers enforced in a software only solution. Serial number protection system is not secure since serial numbers can be propagated using peer to peer networks and are readily found on many web sites. 
         [0005]    A uniquely identifiable hardware key that can be authenticated but that can&#39;t be copied would solve the user authentication and software protection issues. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0006]      FIG. 1  is a diagram illustrating how a remote web server can authenticate a user using the present invention. 
           [0007]      FIG. 2  is a flow diagram illustrating the steps associated with the authentication of the present invention. 
           [0008]      FIG. 3  is a flow diagram illustrating the steps associated with the protection of software. 
       
    
    
     DETAILED DESCRIPTION 
       [0009]    An authentications server and method are described for providing a means to uniquely identify a remotely connected hardware device. The hardware device can be compared to a physical key which allows its owner to gain access to secured web pages. As a direct extension, the device can of course be used to validate and authorize use of software. In the following description, numerous specific details are set forth such as specific connectors and implementing steps. It will be apparent to one skilled in the art, that the present invention may be practiced without these specific details. In other instances, well-known software code and other details are not described in detail in order to not unnecessarily obscure the present invention. 
         [0010]    Referring first to  FIG. 1 , a computer system is illustrated having a central processing unit (CPU)  10 , a display  15 , keyboard  16 , and the device  12 . The device  12  of the present invention is illustrated connected within a cable  13 . The cable  13  connects the CPU  10  with the device  12 . Any software or service for which online authentication is needed, may employ the device  12 . 
         [0011]    While in  FIG. 1  the device  10  is shown as being a computer, the device  10  may be any device connected to a network, hereafter to be referred to as a network access point, such as a phone. 
         [0012]    While in  FIG. 1  the device  12  is shown as being connected into the cable  13 , the device  12  may be embedded within a connector which connects to the network access point, or a wireless device which communicates with the network access point using any short-distance wireless connection method. 
         [0013]    In practice, the device  12  receives power for its operation from the network access point. Power may be provided on dedicated lines, or the power may be phantom fed over communication lines. The device  12  may alternatively receive power from its own power source. 
         [0014]    As will be discussed, when the device is connected to the network access point  33 , the network access point can operate the device to perform authentication services. 
         [0015]    Referring to  FIG. 2 , the server  35  that wants to provide secure access to its information or services, requests the public unique identification stored in the device  31  connected to the network access point  33 . 
         [0016]    The server  35  requests a random token from the authentication server  37 , which is forwarded to the network access point  33 . 
         [0017]    The network access point  33  transmits the random token to the device  31  in order for the device to calculate a one-time password. This computed one-time password is sent to the server  35  for validation. 
         [0018]    The server  35  forwards this one-time password, along with the random token and the public unique identifier of device  31  to the authentication server  37  for validation. Once the authentication server  37  confirms the validity of the one-time password, the server  35  is guaranteed that the uniquely identified hardware device  31  is effectively connected to the network access point  33 . At this time access to the application, web service, or other protected service can be granted. 
         [0019]    Referring to  FIG. 3 , the operation of the device of  FIG. 1  is described. At step  50 , the network access point reads the public unique identification from the hardware device  12  of  FIG. 1 , which is connected to the host USB port of the computer such as the CPU  10  of  FIG. 1 . 
         [0020]    The network access point  33  of  FIG. 2  transmits the device&#39;s public unique identifier to the server  35  of  FIG. 2 , as indicated in step  51 . 
         [0021]    As indicated by step  52  the server  35  of  FIG. 2  asks the authentication server  37  of  FIG. 2  to generate a random token. 
         [0022]    The server transmits the random token returned by the authentication server to the network access point, as indicated in step  53 . 
         [0023]    The network access point asks the hardware device to generate a one-time password. It does this by providing the random token to the hardware device, which in return transmits the computed one-time password. This is indicated by step  54 . 
         [0024]    The network access point transmits the generated one-time password to the authentication server, as indicated at step  55 . 
         [0025]    The server transmits the one-time password, the public unique identification, and the random token for validation to the authentication server. This is indicated be step  56 . 
         [0026]    The authentication server verifies the validity of the one-time password, and returns the result to the server, as indicated in step  58 . 
         [0027]    As indicated by step  59 , at this stage the server knows if the uniquely identified hardware device  12  of  FIG. 1  is effectively connected to the network access point  10  of  FIG. 1 .