System, method, apparatus and computer program product for facilitating digital communications

Abstract

A computer-implemented method and apparatus authenticates a user of a remote computer over a network. In one aspect of the present invention, an authentication challenge is received at said remote computer an authentication challenge message from an authentication server over a network, at least a portion of the network including an Internet communication link. A passcode is received at the remote computer. A response message to the authentication challenge is created, the response message including the passcode. The response message is transmitted from the remote computer to the authentication server over the network. The remote computer receives a verification message from the authentication server that the response message is verified.

Description

CROSS REFERENCE TO RELATED APPLICATIONS [0001] This application claims the benefit of the earlier filing date of U.S. Provisional Application No. 60 / 495,131, filed Aug. 15, 2003, entitled “System, Method, Apparatus and Computer Program Product for Facilitating Digital Communications” and U.S. Provisional Application No. 60 / 581,729, filed Jun. 23, 2004, entitled “System, Method, Apparatus and Computer Program Product for Facilitating Digital Communications,” the entirety of both of which being incorporated herein by reference.FIELD OF THE INVENTION [0002] The present invention generally relates to systems and methods for providing secure digital communications over a computer network. BACKGROUND OF THE INVENTION [0003] A Virtual Private Network (VPN) is a private network created over a public network where exclusive client and host communications occur. A conventional VPN connects users or sites over a public network, usually the Internet. Virtual privacy is derived from secure tunne...

AI Technical Summary

Problems solved by technology

However, the conventional protocol for a remote access (RA) client (a client for creating an Internet connection) communicates the login credentials of the users in an unsecured fashion.

If a user maintains identical login credentials for RA authentication and VPN authentication, then the VPN is compromised if the user's RA credentials are stolen.

Accordingly, a VPN using a conventional VPN client is vulnerable to the extent the user's RA credentials are vulnerable.

Thus even in these situations, encrypted user ID and passwords are not necessarily protected from theft.

In fact, the user ID and password are subject to theft whenever they are communicated in clear text, whether by unscrupulous ISP employees, or others who have hacked into the ISP network.

Accordingly, RA credentials are vulnerable to compromise, potentially leading to theft of Internet access services, and compromise of a VPN accessed by credentials identical to the RA credentials.

Conventional dial-up Internet networks and networking protocols (e.g. PAP and CHAP) do not support the notion of sending challenges to the user.

If either of these message types were returned from the ACESERVER to the dial in server, authentication would fail, as they are unrecognized message types.

By permitting remote users to bypass the network security perimeter, enterprises run a significant risk that a user establishing a VPN connection to the corporate network is doing so from an unsafe and / or already “infected” machine.

This connectivity from an unsafe computer creates a risk that the computer could be used as source of an attack on the network without the end user being aware of it.

Images