The problem of authentication is examined briefly. A new authentication technology called the token is introduced. The token is an inexpensive hardware device which provides a cos-time teenage to a validating processor. This message is in the form of a response to a random query. The token's response can be predicted by the validating processor. Forgery of a valid token (or simulation of its function) is virtually impossible. Observation of a valid token query/response sequence yields insufficient data to respond to a different query. Since the response is a function of both the query and the specific token being tested, observation of many valid sequences is of no we in attempting to simulate its function as each token will yield only one valid response and each token is different (That is, the correct response for one token will probably not be correct for another token). The query/response transaction involves no cryptography and the token contains neither cryptographic keys nor cryptographic facilities. Application of this new technology to the ABYSS system is discussed as well as the me of tokens in a generic fashion. A schematic implementation of the token is given and discussed, followed by a quantitative analysis of the security of this new technology.

By: Bill Strohm, Liam Comerford, Steve R. White

Published in: RC12402 in 1986

rc12402.pdf

Questions about this service can be mailed to reports@us.ibm.com .