DE102006008318A1 - Method for automatic producing of number of application-specific passwords, involves using pseudorandom signal sequence obtained by coding for creating password - Google Patents

Abstract

The method involves forming a character string to generate one of the password (PW), which is assigned a certain application, from one of the input value which is assigned same application. A pseudorandom signal sequence obtained by a coding is used for creating the password. Another input value assigned to this application defines application specific password rules. Independent claims are also included for the following: (1) a program for executing the method (2) a device comprising a unit for automatic producing of passwords.

Description

The The present invention relates to a method for automatic generation a plurality of application-specific passwords from only one main password and a plurality of application-specific input quantities, wherein the latter do not necessarily have to remain secret.

Password methods are the most prevalent Method for identifying persons. Meanwhile, people use such a large number of applications, e.g. such applications, which over the World Wide Web are offered that they have problems in practice in dealing with their passwords to get. In this context, the use of passwords in In practice, a series of manners crept in, which the Security of password procedures affect, although password procedure basically one adequate Security level. As examples of such manners are the selection of easily guessable passwords, the easy one Access to recorded passwords or the reuse of passwords for different applications called. Such practices have prevailed because User the security requirements when handling passwords in not convenient to practice can. difficult will be dealing with passwords in practice still by the fact that applications each different Establish rules for selecting accepted passwords (e.g. allowed character type or password length) to which a user must hold. These rules can Depending on the provider also be more complex type, such. at a rule, in which in an application-specific password at least a representative of three character types from a set of a total of four character types (uppercase letters, lowercase letters, Numbers, special characters) must be included. In addition to these rules can An operator requires that users have theirs within certain time periods need to change application-specific passwords.

at Users can about it the concern is the applications of different ones terminals from being able to use. In this respect, technical solutions such as saving passwords on end devices the disadvantage that current data stocks are not always resorted to can be. A conceivable alternative to this, with the passwords of a User as part of a service on a via a communication network accessible computer would be stored, has the disadvantage that a user Be the service provider regarding the agreed handling of the stored passwords.

It shows up in many places that users through in practice the demands of a good password management overwhelmed are. Therefore, a procedure is helpful based on one Users at any time and on all devices all its strong, compliant, application-specific passwords to disposal stand without users having to remember their passwords.

There are now a number of approaches and solutions that aim to help users with their passwords. In this context, for example, technical solutions were developed in which application-specific passwords are generated and stored. Access to the stored passwords is usually also controlled by means of a central secret or by means of biometric methods. However, all these approaches require the availability of persistent storage, which implies either the availability of each user's own device (eg password storage in the web browsers such as Firefox or Internet Explorer) or the availability of a database accessible via a communications network, in the latter case the database operator also has access to all application-specific passwords of the user. A method for centrally storing application-specific passwords and master password-protected access is disclosed in the document US 6,006,333 A described.

Other with passwords related approaches provide feedback to users regarding the strength the one chosen by you Passwords. These are the ones chosen Passwords to that effect tested if they contain in dictionaries and are therefore advised by third parties with reasonable effort can. Will be a selected Password identified as too weak, the user is prompted to select a new password. Other methods aim to assassinate the execution of Dictionary attacks aggravated by the user in addition to password entry is still involved in such an interactive protocol, wherein user interaction can not be successfully performed by a machine, so that the probability of success for an attacker at a automated dictionary attack enough is small.

The described prior art methods have the disadvantage of being either uncomfortable and therefore of users to be avoided or not sufficiently high security requirements to suffice, because the passwords permanently stored, usually even in one too for accessible to other users Database.

Of the The present invention is therefore based on the technical object with a method to be specified and a corresponding device the security of a (typically a terminal and a plurality of this connectable further computers comprehensive) system, the different password-protected and different Users include usable applications to increase, provided that a single user does not remember a multitude of passwords and if necessary, change regularly.

These The object is achieved by a method having the features of claim 1 and by a device with the features of claim 18. Advantageous embodiments and further developments of the invention will become apparent with the features the dependent claims.

• • aus mindestens einer der Eingabegrößen, die der selben Anwendung zugeordnet ist, eine Zeichenkette gebildet wird,
• • wonach diese Zeichenkette mittels eines aus dem Hauptpasswort gebildeten Schlüssels verschlüsselt wird
• • und eine durch dieses Verschlüsseln gewonnene pseudozufällige Signalfolge zur Bildung des Passworts verwendet wird
• • unter Berücksichtigung mindestens einer weiteren der derselben Anwendung zugeordneten Eingabegrößen, durch welche anwendungsspezifische Passwortregeln definiert werden,

ergeben sich insbesondere folgende Vorteile: Für einen Nutzer ergibt sich ein komfortabler Zugang zu einer Mehrzahl von Anwendungen mit nur einem Hauptpasswort, welches sich der Nutzer merken muss, wobei nur dieses Hauptpasswort, dass auch nicht regelmäßig geändert werden muss, geheim gehalten werden muss. Zugleich ergibt sich eine Systemsicherheit, die der durch eine Verwendung einer Vielzahl von womöglich regelmäßig zu ändernden starken Passwörtern erreich baren Systemsicherheit entspricht. Eine Steigerung der Systemsicherheit ergibt sich insbesondere auch dadurch, dass ein Speichern der einzelnen Passwörter nicht erforderlich ist, wobei sich der Nutzer nur das Hauptpasswort zu merken hat. Typischerweise wird das vorgeschlagene Verfahren auf einem Endgerät des Nutzers durchgeführt. Dabei ist das Verfahren allerdings vorteilhafterweise unabhängig vom jeweils verwendeten Endgerät.By virtue of the fact that in the proposed method of automatically generating one of the passwords associated with a particular application, respectively

• From at least one of the input variables associated with the same application, a string is formed,
• • after which this string is encrypted by means of a key formed from the main password
• And a pseudo-random signal sequence obtained by this encryption is used to form the password
• Taking into account at least one further input variable assigned to the same application, by which application-specific password rules are defined,

In particular, the following advantages result: A user has comfortable access to a plurality of applications with only one main password, which the user must remember, whereby only this main password, which does not have to be changed regularly, must be kept secret. At the same time there is a system security that corresponds to the achievable by using a variety of possibly regularly changing strong passwords ble system security. An increase in system security results in particular from the fact that storing the individual passwords is not required, the user has to remember only the main password. Typically, the proposed method is performed on a user's terminal. However, the method is advantageously independent of the particular device used.

Preferably becomes the key thereby by means of a key derivation function formed by which each point of the key, one of a length of the Main password independent Length has, from depends on each character of the main password. Such key derivation functions are known per se. As an example, in the PKCS # 5 standard (Password Based Cryptography Standard) of the RSA Laboratories (Version 2.0, March 1999) proposed methods PBKDF2 (Password Based Key Derivation Function) or its predecessor PBKDF1 called. So have to no specific requirements are placed on the main password, However, the main password expediently as a strong password to choose is to ensure a high level of security.

A particularly expedient embodiment of Method results if the string consists of at least two Input sizes that are associated with the corresponding application is formed, preferably by concatenating. The can individual input variables for Formation of the string are simply hung together, possibly with the insertion of the input variables connecting filler characters. Preferably, the formation of the string is done by a Assignment of the input sizes forming Characters to a respective character-specific bit sequence (e.g. a usual Code), so that the string itself is given by a bit string is. Finally, the string can be padding (Complete another character) to a predetermined, suitable for subsequent encryption chain length to be brought.

at the input sizes used to form the string it is in a particularly advantageous embodiment of the invention to a user-specific application identity, an application-specific one user identity (user name) and an application-specific version or a selection of the mentioned input sizes. Of special The advantage is in particular the use of an application-specific Version information as input size. This will it is possible that password for a particular application by simply changing the corresponding one Change version, without the rest passwords and especially the main password would have to be changed. A change in the application-specific passwords without change the main password would be even then possible, if only a single version specified as the input size becomes. It would be conceivable after all also, as such, to define application-specific password rules serving input size in addition to use the formation of the string.

In a preferred embodiment of the method, the signal sequence obtained by the encryption to a likewise pseudo-random white extended signal sequence of multiple length and uses the latter extended signal sequence to form the password. Various methods can be used to obtain the extended, likewise pseudo-random, further signal sequence from the first signal sequence obtained by the encryption. A simple implementation provides that the signal sequence obtained by the encryption is extended by running through a loop in which the first-mentioned signal sequence is linked to a counter value in each case-preferably by a bitwise XOR operation-and a result of this linkage again by means of the key is encrypted, whereby the counter value is changed once each loop cycle. (Hereinafter, the term XOR operation is always referred to as a bitwise XOR operation.) It is equally possible to extend the signal sequence obtained by the encryption by passing through a loop in which a counter value changed once for each loop cycle is first used by means of the Key is encrypted and thereby obtained at each loop cycle cipher is linked to the first-mentioned signal sequence, preferably again by an XOR operation.

In described or similar Way can therefore be dependent of the main password and the input variables, a pseudo-random signal sequence of arbitrary Length generated become. This is advantageous because it is independent of a required Password Length or other password rules always enough random material to generate the corresponding password is available.

The especially when considering the password rules by an embodiment of the method in which the at least because of an application-specific password rules defining input size considered is that a password formed in the manner described as a candidate just then rejected and by a suitably formed further Candidate is replaced if it is not compatible with the password rules. Such consideration The password rules is particularly beneficial because it ensures that in terms of the theoretically achievable with the password rules used passwords an equal distribution is realized, which in turn is achievable Safety optimized.

The consideration The input variable or sizes defining the password rules may also be alternatively or additionally done in a different way. This is especially true for an input size that for defining a password length can be provided and be taken into account in a simple manner may be that generating password characters from the corresponding Signal sequence is aborted as soon as the password length is reached is. Other conceivable password rules, e.g. in one of the described Ways to consider can be, can refer to the approved or required password characters and / or insist that in certain passwords only certain characters allowed to stand and / or whether to distinguish between uppercase and lowercase letters is. It is conceivable, after all also to provide a default setting of the password rules that authoritative is when no value is assigned to the corresponding input size.

typical versions of the proposed method provide that from the input size or won the input variables Character string symmetric, preferably block by block symmetrically encrypted. Such encryption methods guarantee currently a particularly high level of security. The encryption in particular by means of an AES (Advanced Encryption Standard) method respectively. Of course, other symmetrical ones are also conceivable encryption method such as DES (Data Encryption Standard), 3DES (Triple-DES), Blowfish, Twofish, IDEA (International Data Encryption Algorithm) or CAST (named after C. Adams and S. Tavares).

Block-by-block encryption can be realized, for example, by dividing the character string into a certain number of blocks of a specific length and, starting with a second block, linking each block to a ciphertext obtained from the preceding block by means of an XOR operation and a result of this linking by means of the XOR operation Key is encrypted. Similarly, a string forming the first block may be first linked to an initial string by an XOR link before a result of that link is encrypted. This initial string should be fixed so that the procedure remains independent of the terminal being used. The aforementioned XOR link is a link by an exclusive-or, which corresponds to a bitwise modulo-2 addition. The described type of blockwise encryption corresponds to a Cipher Block Chaining (CBC) mode. Of course, other types of blockwise encryption are possible, for example, by first encrypting each block with the key and ciphers obtained by these encryptions are then subsequently linked, for example, again by a modular modulo-2 addition of said cipher. Such and similar types of blockwise encryption have the advantage that any change in the main password or in an input used to form the string It can affect any part of the generated password. Finally, encryption in CFB mode (cipher feedback mode) or in OFB mode (output feedback mode) is also conceivable.

alternative could after all another way of encryption be provided, in which the key initially in the form of a key stream (with a key-stream generator) is generated from the main password, according to which the pseudorandom Signal sequence by encryption the one obtained from the input variables String generated by means of this key stream to a stream cipher becomes.

A typical design of the method provides that the password or a password candidate is formed by that used to form the password Signal sequence in blocks defined length divided and each of a predetermined by a password length number of these blocks is assigned to a password character after a predetermined code. This results in a technically particularly easy to implement Password generation. It must for a given password length of n characters are not necessarily taken into account n consecutive blocks become. Rather, it may be at the predetermined number of blocks to a selection of blocks generated in succession, some of which blocks be omitted, for example, if they have a block occupancy show that is not assigned to a password character. In some circumstances, the called blocks the signal sequence for different places to fill the password also different Have length, if password rules are taken into account according to which in certain places of the password only certain characters consist of a subset of the total available characters allowed to.

It can be provided that after entering the main password password generated by a user in the manner described to answer a password request of the corresponding application entered or in a clipboard of a terminal - preferably for security reasons only for a limited time (after which an automatic deletion can occur) - cached becomes. In the latter case, a carry in an interrogation field done manually without the generated password character by character must be entered. In any case, this will be a special comfortable access to the applications without loss of security possible.

For one Password change due to a change an application-specific version specification can be provided that the corresponding old password for a limited time stored in a clipboard before the new password is generated. Then it is conceivable both the old password as also the new password to answer the corresponding password requests to enter automatically or (for a manual transfer) to cache in a clipboard while only the main password and the new version by the user manually character by character are to be entered.

It can be provided that the input sizes in a database serving memory stored by the terminal spatially separated server are and are read from there while the procedure itself on a terminal carried out becomes. This will do it for you the user possible that Performing procedures on different devices, without each time to enter the input sizes. compromising security are not connected with it, because of the secret Main password and not publicly accessible key not of the input sizes alone on the passwords or close to the main password. Especially advantageous is again an evolution of the process with on one Server stored input sizes in which one to dial in in the server required server password in the terminal automatically is generated from the main password, preferably by a Method for generating the application-specific passwords corresponding Method in which the input variables assigned to the server password are set could be. This requires one Users also to download the required to generate the other passwords Input sizes only his only main password.

typically, For example, the input sizes stored on the server will be one application identity for every registered application to customize one for each application definable user identity, by one version for each each application and one or more input sizes for Definition of password rules for each Application act. It can be provided that by the server downloaded input sizes in one cached as the local profile storage memory of the terminal to generate passwords even during a subsequent offline operation available too stand.

In order to achieve the greatest possible independence from the particular terminal used, it may be provided that a program required for carrying out the method on the terminal is downloaded from a server (the server already mentioned or another server). It is conceivable, the program thereby on the Endge advises to install. However, even greater independence can be achieved if the program is made available only temporarily as an applet (eg a Java applet), preferably signed and therefore verifiable for integrity, on the terminal without having to be installed there.

• • Mittel zum Ausführen einer Schlüsselableitungsfunktion zur Bildung eines Schlüssels vorgegebene Länge aus einem eingegebenen Hauptpasswort,
• • Konkatenationsmittel zur Bildung einer Zeichenkette aus jeweils eingelesenen oder eingegebenen Eingabegrößen,
• • Verschlüsselungsmittel zur Bildung einer pseudozufälligen Signalfolge aus der von der Konkatenationseinheit gebildeten Zeichenkette mittels des von den Mitteln zum Ausführen der Schlüsselableitungsfunktion ausgegebenen Schlüssels,
• • einen Signalfolgengenerator zur Erzeugung einer verlängerten, ebenfalls pseudozufälligen Signalfolge aus der von den Verschlüsselungsmitteln ausgegebenen erstgenannten Signalfolge und
• • Mittel zum Ausführen einer Passwortableitungsfunktion zur zeichenweisen Bildung des anwendungsspezifischen Passworts aus der letztgenannten Signalfolge unter Berücksichtung der Passwortregeln.

A device suitable for carrying out a method of the type described can easily be implemented by a person skilled in the art, for example, by means of a corresponding program-technical device of a computer. Typically, a corresponding apparatus includes automatically generating a plurality of application-specific passwords from only one main password

• Means for executing a key derivation function for forming a key of predetermined length from an input main password,
• • concatenation means for forming a character string from respectively read-in or input input variables,
• Encryption means for forming a pseudo-random signal sequence from the string formed by the concatenation unit by means of the key issued by the means for executing the key derivation function,
• A signal sequence generator for generating an extended, likewise pseudo-random signal sequence from the first-mentioned signal sequence output by the encryption means and
• • means for executing a password derivation function for character-forming the application-specific password from the last-mentioned signal sequence, taking account of the password rules.

In addition, can the device comprises a memory serving as a local profile storage for read or entered input sizes and from which the input quantities in the Koncationationsmittel and / or in the means for performing the Password derivation function are readable (the latter should apply to the input variables, which defines the application-specific password rules become).

In addition to a device comprising the aforementioned features (client), the device one from this terminal comprise a separate server comprising a memory (a database), from which the input variables can be read out are. additionally or alternatively, the device may eventually have one or more more with the terminal over one Network connected computers on which the applications are available and to which the automatically generated passwords can be entered via the network.

in the Case of storing the input sizes on a server, the terminal further means for execution a password-forming function for forming a server password from the main password, the server password of an access control unit of the server is entered. The means for performing said password-forming function can It should be designed so that the server password in the same way is generated from the main password as the other passwords with the proviso that the appropriate input sizes are specified.

Finally, can the device also means for performing a one-way function for Calculation of an optical marking from the main password as well Means for displaying this optical marking include a more detailed below described feedback for the user to enable which allows it to recognize if it is the correct master password entered. The means for displaying the optical mark this can be a screen, for example dependent of a result of the one-way function at a certain place and / or a symbol appears in a particular color. The others so far may be mentioned in a simple way, for example, by hardware components, with programs or Collaborate program parts, be realized.

Finally, can it may also be provided that the device has a buffer for temporary storage by the encryption the string obtained signal sequence, from which this signal sequence can be read several times in the signal sequence generator. This will it is possible in a particularly simple manner, by means of the signal sequence generator a pseudorandom Signal sequence of any length by the encryption to generate the first signal sequence obtained.

The invention proposed here relates, in a particularly advantageous embodiment described in more detail below, to a method for generating passwords for various applications, which in turn can be offered by different providers. This method is executed on a terminal available to the user. In this method, the passwords of a user required for the respective applications are generated on the basis of a user-selectable central secret, the so-called main password. This has the advantage for the user that this only has to remember a central secret in order, if necessary, using the method underlying the invention, the desired passport to have the word calculated. However, in practice, based on such a password, it is not possible to go back to the main password nor to calculate a password for another application that was generated using the underlying method. Without knowledge of the main password, generation of the application-specific passwords is not possible. The security of the method on which the invention is based is based on the secrecy of the main password by the user. Neither the main password nor the application-specific passwords are stored persistently on the user's terminal. Moreover, the master password is never sent from the terminal to other technical systems via a communication network.

For that up the user terminal executed Procedure exists additionally the opportunity to become to connect to the database offered by a server service, from which the user a profile as a list of registered by him Applications or accesses and also the rules for the Generation of the application-specific passwords can download. For this belong for example, the types of password characters required by a provider and information about the password length. A user's profile can be either from the user himself or created or managed by the provider of the database. The profile data is for the respective users by means of a login password mechanism (Database login and database password of the user) restricted access, so that unauthorized users can neither read nor modify this data. For registration For this Database service becomes a password starting from the main password calculated in a special way, which allows the operator of the Database impossible in practice is to calculate the main password.

The Calculation of a password by that described in this invention Procedure depends on several input sizes. These input sizes include the Main password, a user-definable identity description for the respective Application, the identity the user for the respective application, the password rules for the particular application and a version for the application specific password. Except for the main password can all of these input sizes in the Database are saved. If necessary, these values can be used for the calculation the application-specific passwords by the method carried out in the invention after successful database login be loaded from the database. Even with unauthorized use the data stored in the database is by secrecy the main password is not possible application-specific passwords to create. If not available Database, it is also possible for the user to manually enter the values for the calculation the application-specific password or from a possibly read out local profile storage provided.

If a user needs an application-specific password, this leads the underlying of the invention method by the main password and then loads the other input variables from the database and the desired Select application from the list. If he does not access the database, then he has to enter all input variables himself if they are not already in a local profile storage to disposal stand. After its calculation, the method described here the application-specific password of the UI respective application available such as by the automated filling in of form fields or the copy and paste from a temporary described clipboard.

Certain Applications require users to do this within certain Their periods change application-specific passwords, e.g. once a month. The underlying method of the invention supports the User in this process. About that In addition, the modification of the version specification allows the change an application-specific password without changing any other input variables have to. Even for the case of change of the main password, which is a change of all application specific passwords that helps Proceed the user by progressively including all in the profile Applications the old and new passwords are calculated and in efficiently the user interface of the respective application via a Clipboard available be put.

There the master password is not stored persistently anywhere, there is no possibility for the user check the correctness of the entered main password. Therefore was in the underlying method of the invention, a return channel provided in the form of an optical marking, in which colors, Positions and icon to be displayed on the user interface dependent on of the main password are calculated so that the user can recognize can, whether typed in typing the main password typing to have.

The pseudo-random process on which the application-specific password generation is based uses a symmetric block encryption method. The main password will be is processed by means of a key derivation function for the conversion of passwords into cryptographic keys and the result of this processing is used as key in the symmetric encryption. The input variables Application Identity, the application-specific identity of the user, and the version-specific password for the application-specific password are symmetrically encrypted block by block in plain text. The pseudo-random material contained by using this pseudo-random process is encoded according to the password rules to be applied. For its part, the coding unit successively requests new pseudo-random material until the rule-compliant password generation has been completed. The passwords generated by using the method on which the invention is based meet the security requirements for strong passwords. These passwords can be generated whenever a user has access to and can apply the described method to a terminal accessible to him.

The Invention solves thus in particular in the last-described embodiment the Task to provide users with a technical facility by which the users are independent of the terminal based on a single If necessary, create strong application-specific passwords can, and thus at any time, from any location and from any device from access to have all their application-specific passwords without them must be deposited or stored at any point.

Embodiments of the invention are described below with reference to the 1 to 9 described. It shows

1 1 is a schematic representation of a device according to the invention for automatically generating a plurality of passwords from a main password,

2 a schematic representation of a corresponding device, which additionally comprises means for performing a one-way function for calculating an optical mark from the main password and means for displaying the optical mark,

3 a corresponding representation of a device according to the invention in another embodiment of the invention, which includes a server in addition to a terminal,

4 in a corresponding representation, a further development of the 3 shown device, which additionally has a local profile storage for input variables,

5 in a corresponding representation of the terminal of the device 4 in offline mode,

6 a graphical representation of an extraction of k-blocks used to define password characters from a signal sequence used to form the password,

7 in tabular form an exemplary coding of the password characters (rules: distinction case-sensitive, digits allowed / required, special characters allowed / required),

8th in a corresponding representation, another encoding of password characters (rules: case distinction, digits allowed / required, no special characters allowed) and

9 again in tabular form another exemplary encoding of the password character (rules: no distinction case-sensitive, digits allowed / required, special characters allowed / required).

In the 1 shown, suitable for carrying out a method according to the invention device PF comprises means 1 for carrying out a key derivation function for forming a key s of predetermined length sl from an input main password HPW, concatenation means 2 for forming a string from respectively read or input input quantities bid (application-specific user identity), aid (user-specific application identity) and v (application-specific version specification), encryption means for forming a pseudo-random signal sequence prandom 'from that from the concatenation unit 2 formed string by means of the means 1 for executing the key derivation function key s, a burst generator 5 for generating a prolonged, likewise pseudo-random signal sequence prandom from the first-mentioned signal sequence prandom 'output by the encryption means and means 6 for carrying out a password derivation function for the character-specific formation of the application-specific password PW from the last-mentioned signal sequence prandom, taking account of password rules, which in turn are defined by an input variable r.

The encryption means in the embodiments shown comprise a number of XOR links 3 and encryption units 4 , the latter encryption units 4 each encrypt a block of length bl symmetrically by means of the key s, in the present example by an AES method, wherein the encryption units 4 through the XOR 3 in CBC mode are connected for a block symmetric encryption of the said string. The signal sequence generator 5 in turn, one comprises the encryption units 4 corresponding encryption unit 7 that with the means 6 to execute the password function, a counter 8th and another XOR link 3 interacts. The funds are changing 6 to execute the password function whenever a current part prandom _{i of} the signal sequence prandom is used up, one from the counter 8th counter value i by incrementing the counter value i by a step of 1, followed by a binary representation of the counter value i by means of the corresponding XOR operation 3 is linked to the signal sequence prandom 'and a result of this link back into the encryption unit 7 is entered. The signal sequence prandom is thus obtained by connecting the parts prandom _i , where i increases by steps of 1 (ie prandom = prandom ₁ || prandom ₂ || ... || prandom _i || ... with "||" as concatenation operator). In particular, individual bits can be disregarded at the end of each part prandom _{i of} the signal sequence prandom if prandom _i can not be completely divided into blocks used to form password characters.

From a signal sequence generator 5 upstream buffer 9 for temporarily storing the signal sequence prandom 'obtained by encoding the character string, this signal sequence prandom' can be used as often as desired in the signal sequence generator 5 be read.

At the in 2 shown embodiment of the invention, the device is made of PF 1 for funds 10 for performing a one-way function for calculating an optical marking OM from the main password HPW and for not expressly shown means for displaying this optical marking OM added. The input quantities aid, bid, v and r are entered here manually by a user.

3 shows a further development of the invention, in which a terminal (client) in addition to one of in 1 apparatus shown corresponding device PF and the means 10 for generating the optical mark OM, means PF 'for performing a password-forming function for forming a server password SPW from the master password HPW, the server password SPW of an access control unit 12 a server can be entered. This server also has memory serving as a database for user profiles 11 on which the input variables bid, aid, v, r are stored and from where they can be read into the terminal.

At the in 4 shown modification of the device 3 the terminal further has a memory 13 which acts as a local profile store for the input variables bid, aid, v, r.

5 finally the terminal shows off 4 in offline mode, where the previously in memory 13 stored input sizes bid, aid, v, r from the memory 13 can be read into the device PF, so that a user must also enter only the main password HPW here to generate the respective application-specific password PW.

The in the 1 to 5 The devices shown can also be connected to one or more devices (not shown in the figures) on which the applications protected by the application-specific passwords are available and which in particularly advantageous embodiments of the invention automatically enter the passwords PW automatically generated after entry of the main password HPW can be done without requiring manual entry of these passwords. Alternatively, the passwords PW can also be temporary stored in a clipboard and be transferred from there manually.

6 shows in which way the signal sequence prandom or its part prandom _{i is divided} into blocks, in the application of codes, as exemplified in the 7 to 9 shown in the media 6 for executing the password derivation function individual password characters are assigned, whereby a password candidate is generated. The input size r finally defines password rules. If a password candidate does not fulfill these password rules, it is discarded and a new password candidate is formed from a continuation of the string prandom in the same way.

After in the 7 shown code are each 7-bit blocks extracted from prandom _i and assigned a password character. After the in the 8th and 9 the same applies to 6-bit blocks.

The described embodiments of the invention include a method in which an application-specific password PW is calculated on demand in dependence on a main password HPW, an application specific user identity bid, a user specific application aid, a version indication v, and application specific password rules (corresponding to the input size r). The calculation of an application-specific password is shown schematically in 1 shown. In the calculation a symmetric encryption is used, wel The input values passed to the procedure play different roles. A suitable method for the symmetric encryption is called the encryption method AES.

Out the main password HPW is provided by means of a suitable key derivation function the cryptographic key s calculated with key length sl. For AES, sl = 128 bits, sl = 192 bits or sl = 256 bits. As an an example for the Key derivation function here is one with the proposed in PKCS # 5 method PBKDF2 suitable variant known as the de facto standard. The usage such a key derivation function is for several reasons advantageous: First, you can make sure that yourself at home passwords different length every single character affects the key and thus at the encryption considered becomes. In particular, a change a single character of the main password, a change every single bit of the key s effect. Would you to use a main password HPW directly as a key, then single would be Bits of the key s much more likely predictable as 0.5. additionally be in the key derivation function time-consuming Steps provided so that automated debugging different master passwords for one potential attackers greater effort requires.

The application-specific user identity bid, the user-specific Application identity aid and the version information sets the encryption method to be handed over Plain text. Before the encryption is made, bid, aid and v are first concatenated. They can do this Values are either merged directly (e.g., bid || aid || v with "||" as concatenation operator) or it can be an extra Separator T inserted (e.g., bid || T || aid || T || v). For example, you can use T use a tabulator. After these characters become a string have been concatenated, the string is again decomposed into blocks, their length the block length bl of the encryption process equivalent. For AES bl = 128 bits, bl = 192 bits or bl = 256 bit, preferably bl = 128 bits. At last block after segmentation padding bits are used to achieve a block length bl. After that will be the blocks thus obtained in CBC mode Application of the key s encrypted. in this connection is the result of a bitwise XOR operation of the current plaintext block with the cipher of the previous block encrypted. The first plaintext block is initialized with an init value bitwise XOR linked, where init does not necessarily have to be kept secret and for all Users can be fixed and identical. The cipher, which through encryption with the last plaintext block, is called with prandom '. outgoing from the value prandom 'becomes in the next Steps as much pseudorandom material as it generates an application-specific password PW is required.

In order to generate enough pseudo-random material for the generation of PW, the value prandom 'is bit-wise XORed with a counter value i represented as block with length bl, before the result is encrypted using the encryption key-s method. At the beginning of the calculation process for an application-specific password PW, i = 1 is set in each case. The result of the encryption at counter value i is called prandom _i . From this pseudo-random material prandom _i is taking into account the application-specific password rules (defined by the input size r - in the present application, the term "password rules" is always used in the plural, even if this may only a single password rule is called) eventually PW formed. If the pseudo-random material is either unsuitable or insufficient to generate PW, the counter is incremented by 1 and a new value prandom _{i + 1 is} calculated.

The generation of an application-specific password PW from the present pseudo-random material and the control for generating further pseudo-random material is the task of the password derivation function PAF. A PW generated by PAF must take account of the password rules defined by r for each application. These include in particular the number A of the characters available for the generation of PW and the number L of characters in the password PW to be generated. The value. For example, A may depend on whether upper and lower case letters are differentiated in the application, whether numbers are allowed or required or prohibited, or whether special characters are permitted or required or prohibited. As in picture 7 is shown as an example, results in distinction of uppercase and lowercase letters, allowed / required digits and allowed / required special characters (in the present example from a supply of 10 special characters) a value of A = 72. In the case of a distinction between uppercase and lowercase letters , allowed / demanded digits and forbidden special characters results in a value of A = 62, as in 8th is shown. If, however, passwords do not distinguish between uppercase and lowercase letters, digits are allowed / required and if special characters (from a supply of 10 special characters) are allowed / required, the result is a value A = 46, as in 9 is shown. To generate a single password character z _j extra The password derivation function hangs a k-block from the pseudorandom material prandom _i . Such a k-block consists of k bits. The value of k depends on the extent A of the available character set; it holds that k is the integer following log ₂ A. Each character of the character set available for an application-specific password, as in the 7 . 8th and 9 shown is assigned exactly one k-block assignment. On the basis of the present pseudo-random k-blocks and a suitable assignment of k-blocks to the character set, the coding of individual password characters is finally carried out. However, some combinatorial possible value allocations of k-blocks is not assigned a character, which always occurs when the A belonging to the respective character set is not equal to a power of two.

For security reasons it is important that all password candidates of given length L that can be generated by the method, which in turn satisfy the password rules defined by r, occur with equal probability for randomly selected main passwords. A favorable for the vorschlagene method approach is that the password derivation function for one to forming password character z _j ex tracted an even discarded k-block not previously used in the present pseudo random material and makes according to the present mapping a corresponding coding. If an extracted k-block contains a binary pattern for which there is no mapping to an element of the character set, then that k-block is discarded and a new k-block is extracted. This is repeated until the extracted k-block contains a binary occupancy for which an assignment to an element of the given character set is defined. If all k blocks are extracted from prandom _i , then the password derivation function initiates incrementing of the counter and generation of new pseudorandom material prandom _{i + 1} , from which new k blocks can then be extracted for encoding password characters. This process is performed for all password characters z _j for j = 1, ..., L.

Even if, in the manner described above, a character combination z ₁ || ... || z _L can be generated over a character set described by r, it is not guaranteed that the generated combination z ₁ || ... || In fact, _L satisfies all the requirements that are contained in r. For example, with the procedure described so far it can not be guaranteed that representatives of certain required character classes (eg special characters) are contained in the character string. In order to fulfill this requirement in addition, the following procedure is advantageous. After the string z ₁ || ... || z _{L is} generated, it is tested for compliance with the requirements set out in r. If the test is positive, the calculated string z ₁ || ... || z _{L is used} as the application-specific password PW. If, on the other hand, the result of the test is negative, then the calculated character string is deleted and completely recalculated by extracting new k-blocks according to the above-described procedure and performing the corresponding coding. The entire process is repeated until the test leads to a positive result.

at Special application-specific password rules may be required be that at certain positions in the password PW a representative of a certain character type, e.g. the first character of an application-specific Passwords must be a letter. In this case, too, an equal distribution of passwords to be able to reach it is advantageous to work with different character inventories position-related. Depending on the size of the character set, it may be beneficial to for calculating individual password characters with different values for k too work. In the example in which in a password between uppercase and lowercase letters is not distinguished, digits allowed and special characters required are and the first character must be a letter, arise with an assumed supply of 10 special characters for the assignment at the first position a value k = 5 and for the assignment at the remaining one Positions a value k = 6.

The The method described above should in practice a terminal accomplished which the user has access to. This can happen both acting on and around a user's computer mobile terminal or even a foreign computer, such as a computer in an internet cafe. For this, the calculation method should either be available in the form of an installed computer program on the terminal or it should be over if needed a communication network are loaded and executed, for example in the form of a signed applet which is loaded over the internet and within a web browser.

For better usability of the method, it is advantageous to carry out the method on a client and to provide it with the input values bid, aid, v and r required for the calculation of application-specific passwords via a server service. This is in the 3 shown. To do this, the user first has to provide these input values to the server, where these values are stored in a database. From the perspective of a user, the database may contain the complete user profile which includes the input values for all applications in which the user has an access account. On the server, a separate user account with associated user identity SBID is created for the user, under which the user can access his own user profile. To secure the user profile on the server against unwanted access by others, the server transmits a server-specific password SPW of the user to the server. So that the user does not have to remember the server-specific password SPW in addition to the main password HPW and also does not have to enter an additional password in addition to the main password HPW, the server-specific password SPW is calculated in the client-executed method from the main password HPW by means of a password function PF '. The password function PF 'here has the property that the server from the server-specific password SPW can not refer back to the main password HPW. As a password function PF ', for example, a variant of the method can be used, which presented in the foregoing and in 1 was sketched. The variant differs from the method in 1 in that the input values bid ', aid', v 'and r' are the same and constant for all users. Therefore, it is advantageous to hard-code the input values bid ', aid', v 'and r' into the execution of PF '.

The Use of the server service brings specific to a user Benefits in the operation. He is thus able to get away from any terminal with network access to connect to the server, to load its profile data and be If necessary, calculate application-specific password and therefore available to have. This profile data contains the input values bid, aid, v and r for all applications, for which a user based on the method proposed here passwords must generate. To calculate a single application-specific Password dials a user from the list of applications included in his profile the respective application, so that the corresponding input values bid, aid, v and r for calculation to the password function (ie the means 6 to execute the password function) can be.

at the method proposed by this invention, it is advantageous if a user logs in to the server after logging in successfully on the database of the client running on the terminal being used can manage from. For this, the user can see the list of applications change, for example, creating new applications in the list, i. new for the application Enter values bid, aid, v and r and save them to the database, o modify existing applications in the list or delete from the list.

to increase the availability the server-side stored profile data may be advantageous store the profile data on multiple servers whose stored Profile data automatically mirrored by the operator of the server service (i.e., synchronized). The client owns in this embodiment of the method a list of all existing server addresses, the profile data saved. In the application of the invention underlying Procedure, the client tries to first with one on the list server to connect. Does not answer this server within a certain period of time, the client contacts successively one more server on the list. In a advantageous embodiment of the method, the client already contains the list the existing server addresses. The order in which the Client which addresses server can be either sequential Working out the list, or it may also depend on the result of a random process.

In certain cases, it is helpful to a user if he does not necessarily have to load his profile data from the server and instead can be read in otherwise for processing by the password function (the device PF). This is the case, for example, when the server is not available or when the password is needed for a local application and access to a communication network is not available. Therefore, it is advantageous for the user to implement the method such that either the server can be used to input the values bid, aid, v and r (see 3 ), or they can be entered without using a server service in an offline mode (see 2 and 5 ). For offline operation, you can distinguish two variants. In the first variant, the user independently inputs the values bid, aid, v and r required in addition to a main password for generating an application-specific password. This will be in 2 shown. In the second variant, the user reads the values bid, aid, v and r from a local profile storage as in 5 , This may be, for example, a file containing the user profile and stored on the user's terminal. The local profile filing can be created by the user by transferring his user profile from the database of the server to his terminal and storing this in the local profile filing, eg a file, as in 4 will be shown.

In order to provide feedback to the user that he has entered the main password HPW correctly, it is advantageous in the proposed method to provide a return optical channel. In this case, the value of the input main password HPW is mapped to a special optical marking OM. The calculation and output of the optical marking is particularly in the 2 and 5 shown. The optical mark OM is displayed to the user at the operation interface. If the user makes a mistake when entering the main password HPW, it is very likely that the optical mark OM displayed to him differs from the optical mark familiar to him and belonging to the correct main password HPW. The mapping of the main password HPW to the optical mark OM can be implemented in the present invention by means of a one-way function. For example, it may be advantageous to pass the input main password HPW to a hash function and map its result to a set of user distinguishable optical markers. In this case, it can generally be assumed that the amount of distinguishable optical markings is significantly smaller than the amount of results of the hash function. Therefore, different hash values can be mapped to the same optical mark OM. In the invention to be executed, it is important that the hash function is first applied and the optical tag OM is displayed when the input of the main password HPW is completed. For example, the optical mark may be a special symbol displayed in a particular color in front of a particular background color at a particular position, with a fixed set of symbols, symbol colors, background colors, and positions. It is also advantageous for the user to be permanently notified of the optical marking OM belonging to his main password HPW after he has completely entered his main password HPW. This assists the user in memorizing the optical tag OM associated with his main password HPW.

• • keine Unterscheidung zwischen Groß- und Kleinbuchstaben (d.h. das zu erzeugende Passwort enthält keine Großbuchstaben)
• • Passwortlänge (d.h. es kann eine vom Standardwert abweichende Passwortlänge gewählt werden)
• • keine Sonderzeichen (d.h. das zu erzeugende Passwort enthält keine Sonderzeichen)
• • erstes Passwortzeichen soll Buchstabe sein (d.h. an der ersten Position im Passwort steht weder Sonderzeichen noch Ziffer)

The password rules given for an application induce a set M containing all the passwords accepted by the application. In practice, the quantities M differ greatly for different applications. Therefore, in the invention presented here, it is advantageous not to formulate the password rules r used for the password generation in such a way that all elements of the set M can be achieved for each application. It is only to be ensured that sufficient elements of the set M can be generated for each application as application-specific passwords. As a result, the method can meet the password requirements of a large number of applications with only very little interaction effort of the user, ie by configuring only very few rules (eg when creating a profile entry or when entering rules in offline mode). In an advantageous embodiment of the proposed method, a default setting of the password rules is selected in which passwords are generated with 16 password characters, the passwords containing both uppercase and lowercase letters, numbers and special characters guaranteed. In this advantageous embodiment, the following configuration options differing from the standard setting are offered, which in turn are recorded in the application-specific password rules r:

• • no distinction between uppercase and lowercase letters (ie the password to be generated does not contain uppercase letters)
• • Password length (ie a password length different from the default value can be selected)
• • no special characters (ie the password to be generated contains no special characters)
• • first password character should be letter (ie at the first position in the password there is neither special character nor number)

In an exemplary form of practical implementation starts the user to generate an application-specific password, a computer program, which carries out the method described here.

If the user decides to use the server service, he enters his server-specific user identity SBID and the main password HPW in the designated fields of the client and initiates the transmission of SBID and SPW to the server. If the server password SPW is correct, the profile is transferred to the client. All applications are presented to the user on the client's operator interface. After selecting an application (eg by clicking on an application in the selection list), the application-specific password is calculated and copied to the clipboard of the computer so that the user can easily transfer the password to the application. After a short time (eg 60 seconds), the computer's clipboard will be deleted. If the user has logged in to the server, he can change the entries in his profile as needed. If an application requires, for example, that the application-specific password must be changed within certain periods of time, this is done via a modification of the version information v. The version specification can, for example, include integer values or values that are composed of month and year, eg "January 2006". If the user decides to change his main password, he is forced to change the application-specific password for all applications. In an advantageous embodiment tion of the method described here, it is possible for the user to notify the server of the new server password by correct input of the old main password and twice correct specification of the new main password and activate this. Thereafter, the method prepares the old and new application-specific passwords for all the applications contained in the list and provides them to the user for easy transfer to the respective application via the clipboard one after the other.

Decides the user for the in 2 offline operation, it must pass its main password to the program, as well as the application-specific user identity bid, the user-specific application identity aid and the version indication v by hand. If the application-specific password meets requirements that can not be met with the default, then the user must also manually modify the password rules r. Once all values have been entered, the application-specific password calculation can be started by the user. After the calculation, the application-specific password is stored for a short time in the clipboard of the computer, so that it can be easily transferred by the user in the respective application. After a set time has elapsed, the application-specific password is deleted from the computer's clipboard.

Claims (25)

Method for automatically generating a plurality application-specific passwords (PW) consisting of only one main password (HPW) and a majority of application-specific Input variables, at to generate one of the passwords (PW) which corresponds to a particular one Application is assigned, in each case from at least one of the input variables, the associated with the same application, a string is formed, which this string is formed by means of one of the main password (HPW) key (s) encrypted becomes and a pseudo-random signal sequence obtained by this encryption (prandom ') for the formation of the Password (PW) is used considering at least one other input variables assigned to this application which application-specific password rules are defined. Method according to claim 1, characterized in that that the string consists of at least two input sizes, the are associated with the corresponding application is formed, preferably by concatenating. Method according to claim 2, characterized in that that the input sizes used to form the string are one user-specific application identity (aid), an application-specific one user identity (bid) and an application-specific version (v) or a selection from the mentioned input variables. Method according to one of claims 1 to 3, characterized that the character string is encrypted symmetrically and / or block by block. Method according to claim 4, characterized in that that the string is specific to a certain number of blocks Length (bl) is divided, with a plain text and / or ciphertext of each of the blocks respectively is bit-wise XORed with the plaintext or cipher of another block. Method according to one of Claims 4 or 5, characterized in that the character string is divided into a specific number of blocks of a specific length (bl) and, starting from a second block, each block is coded with a cipher obtained from the preceding block by a bitwise XOR operation ( 3 ) and a result of this association is encrypted using the key (s). Method according to one of claims 1 to 6, characterized that the key (s) by means of a key derivation function is formed, by which each point of the key (s), one of a Length of the Main passwords (HPW) independent Length (sl) has, depends on each character of the main password (HPW). Method according to one of claims 1 to 7, characterized that by encrypting obtained signal sequence (prandom ') to a likewise pseudo-random one further signal sequence (prandom) of multiple length is extended and the latter extended Signal sequence (prandom) is used to form the password (PW). Method according to claim 8, characterized in that that by encrypting obtained signal sequence (prandom ') extended is done by looping through the first-mentioned signal sequence (prandom ') respectively with a counter value (i) connected and a result of this linkage again by means of the key (s) encrypted where is the counter value (i) is changed once for each loop cycle. Method according to Claim 8, characterized in that the signal sequence (prandom ') obtained by the encryption is lengthened by passing through a loop, one at each time Once the counter cycle (i) has been changed in the loop cycle, it is first encrypted by means of the key (s) and a ciphertext thus obtained during each loop cycle is linked to the first-mentioned signal sequence (prandom '). Method according to one of claims 1 to 10, characterized that the signal sequence used to form the password (PW) (prandom) in blocks defined length (k) is divided and each one dependent on a password length number of blocks is assigned to a password character after a predetermined code. Method according to one of claims 1 to 11, characterized that the at least one application-specific password rules defining Input size (r) thereby is taken into account that a password (PW) formed in the described manner as a candidate just then rejected and by a suitably formed further candidate replaced if it is not compatible with the password rules. Method according to one of claims 1 to 12, characterized that after entering the main password (HPW) by a user in described password (PW) automatically to answer a password request of the corresponding application is entered or is cached in a clipboard of a terminal. Method according to one of claims 1 to 13, characterized in that it is carried out on a terminal, wherein the input quantities in a memory ( 11 ) are stored by a server different from the terminal and are read from there. Method according to claim 14, characterized in that that one to dial in the server required server password (SPW) in the terminal automatically from the main password (HPW) is generated, preferably by a the method for generating the application-specific passwords (PW) corresponding method in which the server password (SPW) associated Input quantities (aid ', bid', v ', r') are defined. Method according to one of Claims 14 or 15, characterized in that the input variables are stored in a memory ( 13 ) of the terminal are cached. Method according to one of claims 1 to 16, characterized that one to carry the procedure on a terminal needed program downloaded from a server and installed on the device or as a signed applet is only temporarily available on the terminal. Programmtechnisch for performing a method according to one of the claims 1 to 17 equipped device. Device according to claim 18, comprising means ( 1 ) for executing a key derivation function for forming a key (s) of predetermined length (sl) from an input main password (HPW), concatenation means ( 2 ) for forming a character string from respectively read-in or input input variables, encryption means for forming a pseudo-random signal sequence (prandom ') from that of the concatenation means ( 2 ) formed by the means ( 1 ) for executing the key derivation function key (s), a signal sequence generator ( 5 ) for generating an extended, also pseudo-random signal sequence (prandom) from the first-mentioned signal sequence (prandom ') output by the encryption means and means ( 6 ) for performing a password derivation function for character-wise formation of the application-specific password (PW) from the latter signal sequence (prandom) taking into account the password rules. Apparatus according to claim 19, comprising a memory ( 13 ), which serves as a local profile store for input or input input variables, and from which the input variables into the concatenation means ( 2 ) and / or into the funds ( 6 ) for executing the password derivation function are readable. Device according to one of claims 19 or 20, characterized in that, in addition to a terminal comprising said features, it comprises a server separate from said terminal and having a memory ( 11 ), from which the input variables are readable. Apparatus according to claim 21, characterized in that the terminal further comprises means (PF ') for performing a password-forming function for forming a server password (SPW) from the main password (HPW), wherein the server password (SPW) of an access control unit (SPW) 12 ) of the server is input. Device according to one of claims 18 to 22, additionally comprising means ( 10 ) for performing a one-way function for calculating an optical mark (OM) from the main password (HPW) and means for displaying the optical mark (OM). Device according to one of claims 19 to 23, comprising a buffer ( 9 ) for intermediate sampling the signal sequence (prandom ') obtained by encoding the character string, from which this signal sequence (prandom') is written several times into the signal sequence generator ( 5 ) is read. Use of a device according to one of the claims 18 to 24 to carry A method according to any one of claims 1 to 17.