Use of a processor identification for authentication

[0002] The present invention relates to use of a processor identification and, in particular, to use of a processor identification for authentication across a network.

[0003] System identification, is self-defined as a way to uniquely identify a particular system (e.g., a computer). Two examples of the use of system identification include asset tracking and network (e.g., Internet) authentication. Currently in order to perform asset tracking or inventory control of systems, such as computers, different solutions have been implemented. One solution is the use of asset tags attached to each asset. Persons with hand-held scanning devices physically visit the different sights where the assets are located to scan in the asset tag for tracking each asset. The problem with the use of asset tags, however, is that these tags can be easily removed and/or switched and persons have to physically visit each asset location to perform the asset tracking.

[0004] Another solution is the assignment of addresses over a network using a global database. This database assigns a unique address to some software module running locally on the particular machine being given the unique address. This solution, however, assumes that the machine is running at the time of the address assignments and that the software is untampered. One other solution is the placement of a peripheral card (e.g., a network interface card) inside a computer which includes a network card address. This allows remote asset tracking over a network using this network card address. The problem with the use of a network interface card, however, is that these cards are relatively easy to switch out as they are typically changed throughout the life of a computer.

[0005] System identification is also used for network authentication. For example, the Internet provides the ability to reach a large number of customers for post-purchase communication. Recent developments for web sites on the Internet have seen the creation of owner's clubs allowing the target-marketing to members of a club which can include offers of substantial value (e.g., free software and books). Through cross-company agreements, these owner's clubs can include multiple companies. For example, buying merchandise from one company's web site can allow for free merchandise from a different company through this different company's web site.

[0006] Currently, owner's clubs use cookie files which are an Internet browser feature whereby Internet web sites record information about the computer user on the computer user's local computer. On subsequent visits by the computer user upon validation of this information, the web site allows the computer user to access the web site. Using these cookie files, members of these owner's clubs are immediately recognizable on return to that particular club web site. Cookie files, however, are limited in that they are not sharable across affiliate sites as all of the club web pages would have to be in the same domain of the Internet to allow the cookie files to reside in a database accessible by all the affiliate web sites. Having affiliate web sites in different domains of the Internet precludes this common accessibility to the cookie files.

[0007] One current solution to this limitation is to have the club web site pass its authenticated users off to the affiliate web site. This solution, however, requires that the club members log in to the main club site first, not allowing them to go directly to the affiliate web site.

[0008] Moreover, a second limitation involving these cookie files are the inherent security concerns associated therewith as these files can be copied to other machines for other users. Because of this lack of security, the cookie is often coupled with a user name and password. This information can be lost and/or easily forgotten and contains its own set of security issues. Credit card numbers have been used to transfer valuable items.

[0009] Additionally, peripheral devices are currently being attached to personal computers to account for some of the aforementioned shortcomings of cookie files. These devices allow a user to enter confidential data (e.g., a Personal Identification Number (PIN)) which is thereafter encrypted by the peripheral module before transmitting the data across the Internet. These solutions involving peripheral devices, however, require additional costs for hardware for a user's personal computer. Therefore, for these and other reasons there is a need for the present invention.

[0010] In one embodiment, a system includes a first computer having a unique processor identification. Additionally, a first application is operatively coupled to the first computer across a network. The first computer provides the unique processor identification to the first application with the first application identifying the first computer based on the unique processor identification.

[0011] FIG. 1 is a block diagram of a system in accordance with an embodiment of the invention.

[0012] FIG. 2 is a block diagram of a system in accordance with another environment in which the invention may be practiced.

[0013] FIG. 3 is a diagram of an identification process for use with an embodiment of the invention.

[0014] FIG. 4 is a block diagram of a complete environment for hosting an embodiment of the invention.

[0015] FIG. 5 is a diagram of a process in accordance with another embodiment of the invention.

[0016] FIG. 6 is a digram of a process in accordance with another embodiment of the invention.

[0017] FIG. 7 is a block diagram an embodiment of the invention operating in the environment of FIG. 4.

[0018] FIG. 8 is a block diagram another embodiment of the invention operating in the environment of FIG. 4

[0019] FIG. 9 is a diagram of a computer in which embodiments of the invention may be practiced.

[0020] In the following detailed description of the exemplary embodiments, reference is made to the accompanying drawings that form a part hereof, and in which are shown by way of illustration specific embodiments in which the invention may be practiced. It is to be understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention. For sake of clarity, the numbering of elements across the different figures will be uniform for those elements which coincide.

[0021] Some portions of the detailed descriptions which follow are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussions, it is appreciated that throughout the present invention, discussions utilizing terms such as “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

[0022] The following description includes the terms agent and digital wallet, which, in one embodiment, are defined generally as software modules or scripts being downloaded from one system to another to be executed on the latter. Additionally, a digital wallet is used to limit the distribution of digital membership cards to those verified club affiliates through the below-described public/private key mechanism.

[0023] FIG. 1 is a block diagram showing how a computer employed in the invention can be connected to a network. The system of FIG. 1 includes computer 102, first application 104 and network 108. The invention adds to computer 102 a processor which includes a unique processor identification. In one embodiment, this unique processor identification is a unique number tied to or associated with an individual processor on a computer such that, but for possible processor manufacturing errors, no two processors have the same processor identification. In another embodiment, the processor is a central processing unit (CPU). Network 108 is a network which is defined as a group of two or more computer systems linked together. Examples of networks include local area networks (LAN) and wide area networks (WAN) or the Internet.

[0024] Computer 102 is operatively coupled to first application 104 through network 108. Computer 102 includes a unique processor identification associated with its particular processor. Computer 102 provides this unique processor identification associated with the processor of computer 102 to first application 104 through network 108 allowing first application 104 to identify computer 102 based on the unique processor identification.

[0025] FIG. 2 is a block diagram showing how multiple computers can be connected to a server for use in the invention.

[0026] The system of FIG. 2 includes server 202, computer 204, computer 206, computer 208, computer 210 and network 212. FIG. 2 illustrates only one server and four connecting computers; however, the invention is not so limited. More servers and computers may be added to the configuration of FIG. 2, but has been limited for sake of clarity. Server 202 is operatively coupled to computer 204, computer 206, computer 208 and computer 210 through network 212. Computer 204, computer 206, computer 208 and computer 210 includes unique processor identifications associated with their particular processors allowing them to uniquely identify themselves.

[0027] FIG. 3 is a diagram of one embodiment of this identification process that can be employed in the present invention. FIG. 3 includes one of the computers and the server from FIG. 2 to illustrate this process. In particular, FIG. 3 includes server 202, computer 204, and additionally includes application 302, session manager 304, agent database 306, agent 308, unique processor identification 310 and processor 312. In one embodiment, agent 308 is a software module that accesses unique processor identification 310 and transmits it back to server 202. In one embodiment, application 302, session manager 304, agent database 306 reside on server 202. In another embodiment, processor 312 resides on computer 204. Using agent database 306, session manager 304 through application 302 sends agent 308 to computer 204. In one embodiment, agent 308 is a software module or script that accesses unique processor identification 310 from processor 312 of computer 204 by executing a supervisory instruction from a set of instructions on computer 204 to provide unique processor identification 310 to application 302. From computer 204, agent 308 digitally signs and sends unique processor identification 310 back to session manager 304 through application 302.

[0028] A digital signature is used in public-key cryptography, which is a method used on networks (e.g., the Internet) to maintain secure communications. To use this form of cryptography, a computer user must have a pair of cryptographic keys (a public key and a private key) which are long strings of bits (data). The computer user make the public key available to other users that the computer user desires to communicate, while maintaining the private key in a secure location.

[0029] Applying this embodiment of cryptography to the aforementioned use of a digital signature by agent 308, session manager 304 is provided the public key for agent 308. Applying a mathematical formula (e.g., a hash function) to a message which includes unique processor identification 310, agent 308 creates a message digest. Agent 308 then encrypts the message digest with its private key to create the digital signature. Agent 308 sends this message along with the digital signature to application 302.

[0030] Subsequently, using the public key from agent 308, session manager 304 decrypts the digital signature which provides the original message digest sent from agent 308. Session manager 304 then applies the hash function to the message and compares the message with the message digest to verify that they are the same. Once this verification is complete, session manager 304 is assured that this message containing unique processor identification 310 is free from tampering and is from agent 308. Therefore, because the private key of agent 308 is being sent with agent 308 across to computer 204 and because of the dependency of session manager 308 that this message is secure, agent 308 and its private key must be secure because access to its private key allows someone to create of a false message. In one embodiment, security of the private key is provided by tamper-resistant software. In another embodiment, a particular private key is sent (used only once), and a response must be given by agent 308 within a certain time frame (e.g., 10 seconds) or the response is not accepted. This limited time frame precludes someone having sufficient time to intercept the private key and use it to send a false message. Session manager 304 then validates computer 204.

[0031] FIG. 4 is a block diagram of a complete environment for hosting an embodiment of the system of FIG. 1. The system of FIG. 4 includes computer 402, first application 404, second application 406 and network 408. Computer 402 has a processor which includes a unique processor identification. In one embodiment, this unique processor identification is a unique number tied to or associated with an individual processor such that no two processors have the same processor identification. In another embodiment, the processor is a central processing unit (CPU). Network 408 is a network which is defined as a group of two or more computer systems linked together.

[0032] Computer 402 is operatively coupled to first application 404 through network 408. Computer 402 includes a unique processor identification associated with its particular processor. Computer 402 provides this unique processor identification associated with the processor of computer 402 to first application 404 through network 408 allowing first application 404 to authenticate the unique processor identification of computer 402.

[0033] FIG. 5 is a diagram of this authentication process in accordance with an embodiment of the invention. In particular, FIG. 5 illustrates an embodiment of the present invention wherein the unique processor identification for a computer is used for security validation across a network. One example of this security validation would involve Internet clubs across multiple web sites on the Internet. These clubs provide their members the advantages involved with cross-company agreements including free and discounted merchandise from one company's web site based on the buying of merchandise from another company's web site. The use of a computer's processor identification provides a secure mechanism through which these Internet clubs can be assured that these advantages and benefits of being a club member are being distributed to their members only.

[0034] FIG. 5 includes computer 402, processor 524 server 522, first application 404, registration pages 502, registration database 504, session manager 506, agent database 508, registration information 510, registration 512, digital wallet 514, agent 516, unique processor identification 518 and digital membership card 520. In one embodiment, first application 404, registration pages 502, registration database 504, session manager 506 and agent database 508 reside on server 522. In another embodiment, processor 524 resides on computer 402.

[0035] Using registration pages 502, first application 404 residing on server 522 formulates and sends registration information 510 to computer 402. Computer 402 receives registration information 510 from first application 404. A user of computer 402 completes registration 512 based on registration information 510 and sends registration 512 back to first application 404. First application 404 then inputs registration 512 into registration database 504. Subsequently, session manager 506 through first application 404 downloads digital wallet 514 to computer 402. In one embodiment, session manager 506 through first application 404 is a software module which monitors the session (i.e., the interaction) that first application 404 is having with a particular computer (e.g., computer 402). This monitoring includes which agents have been sent out to a particular computer (e.g., computer 402) and how long that a particular computer takes to respond a request (e.g., a request for the computer's unique processor identification). In one embodiment, digital wallet 514 is a software module which provides an environment for agent 516 to operate and also executes agent 516, thereby allowing access to unique processor identification 518 of computer 402 by agent 516.

[0036] Using agent database 508, session manager 506 through first application 404 sends agent 516 to computer 402. In one embodiment, agent 516 is a software module or script that accesses unique processor identification 518 from processor 524 of computer 402 by executing a supervisory instruction from a set of instructions on computer 402 to provide unique processor identification 518 to first application 404. From computer 402 using a digital signature, agent 516 sends unique processor identification 518 back to session manager 506 through first application 404.

[0037] Once verification is complete, application 504 is assured that this message containing unique processor identification 518 is free from tampering and is from agent 516. Subsequent to this verification of unique processor identification 518, session manager 506 downloads digital membership card 520 which, in one embodiment, is a file containing a unique membership number along with unique processor identification 518, both of which indicate (i.e., represent) the identity of computer 402. Additionally, digital membership card 520 and the unique membership number are signed with the private key of application 404 to demonstrate that they were generated by application 404.

[0038] Additionally, computer 402 is operatively coupled to second application 406 through network 408. Subsequent to registration with first application 404, computer 402 communicates with second application 406 through network 408 without communicating through or being transferred by application 404 (i.e., the communication between computer 402 and application 406 is independent of application 404).

[0039] FIG. 6 is a diagram of this communication process between computer 402 and second application 406 in accordance with an embodiment of the invention. FIG. 6 includes computer 402, processor 524, server 604, second application 406, session manager 606, agent database 608, agent 602, unique processor identification 518 and digital membership card 520. In one embodiment, second application 406, session manager 606 and agent database 608 reside on server 604. In another embodiment, processor 524 resides on computer 402.

[0040] With digital wallet 514 already residing on computer 402 from the prior interaction with first application 404, session manager 606 sends agent 602 from agent database 608 through second application 406 to computer 402 to retrieve unique processor identification 518 from processor 524 of computer 402 along with digital membership card 520. Unique processor identification 518 is digitally signed by agent 602 and sent to second application 406. Second application 406 verifies that digital membership card 520 is valid by using the public key of application 404 and verifies that unique processor identification 518 has been signed by agent 602. Second application 406 then recognizes computer 402 and its user as a valid club member to enjoy the benefits therein.

[0041] FIG. 7 shows an example of the invention operating in the environment of FIG. 4. The system of FIG. 7 includes computer 402, first application 404, second application 406, network 408, first domain of 702 and second domain 704. First domain 702 and second domain 704 of network 408 are domains within a network which are defined generally as a group of computers and devices on a network that are administered as a unit with common rules and procedures.

[0042] As described for FIG. 4, computer 402 includes a processor which has a unique processor identification. In one embodiment, the processor is a CPU. Computer 402 is operatively coupled to first application 404 which resides in first domain 702 of network 408. Computer 402 registers with first application 404 through network 408 wherein first application 404 performs authentication of computer 402 based on the unique processor identification associated with the processor of computer 402. This authentication of computer 402 is consistent with the description for FIG. 5.

[0043] Additionally, computer 402 is operatively coupled to second application 406 which resides in second domain 704 through network 408. Subsequent to registration with first application 404, computer 402 communicates with application 406 through network 408. In one embodiment, this communication between computer 402 and second application 406 occurs without communicating through or being transferred by application 404 (i.e., the communication between computer 402 and application 406 is independent of application 404). Second application 406 validates digital membership card 520 and unique processor identification 518 through network 408, consistent with the description of FIG. 6.

[0044] In one embodiment network 408 is the Internet, which is a growing network globally connecting currently millions of computers and more than 100 million users to provide an information exchange using standardized communication protocols. In another embodiment, first application 404 is an Internet web site and in another embodiment, second application 406 is an Internet web site. An Internet web site is defined as a location on the World Wide Web (WWW), which is a system of Internet servers for communicating text, graphics and other multimedia objects supporting documents specially formatted in such languages as Hypertext Markup Language (HTML), described in RFC 1886, HyperText Markup Language2.0, T. Bemers-Lee and D. Connolly, November 1995.

[0045] FIG. 8 shows example of the invention operating in the environment of FIG. 4. A computer user of computer 402 logs onto the Internet and communicates with an Internet web site, web site 802. The computer user registers with web site 802 thereby becoming a member of the club for web site 802. Consistent with the description for FIG. 5, web site 802 performs secure validation by reading the unique processor identification for computer 402. After validating the unique processor identification for computer 402, web site 802 sends a file (i.e., a digital membership card) back to computer 402 containing a unique membership number for computer 402 along with the unique processor identification read from the processor of computer 402. This digital membership card resides locally on computer 402.

[0046] Subsequently, the computer user of computer 402 connects with another Internet web site affiliated with web site 802, web site 804. In one embodiment, this communication between computer 402 and web site 804 occurs without communicating through or being transferred by web site 802 (i.e., the communication between computer 402 and web site 804 is independent of web site 802). Web site 804 retrieves the digital membership card from computer 402. Consistent with the description for FIG. 6, web site 804 validates the digital membership card along with the unique membership number contained therein. Moreover, web site 804 retrieves the unique processor identification and verifies that this unique processor identification matches the unique processor identification contained in the “digital membership card.” Once the validation process is complete, the computer user of computer 402 is recognized as a club member allowing them to enjoy the benefits of being a member of that particular club (e.g., free or discounted items). This system of operation does not rely on the computer user entering a username and password but rather the validation process is tied to a physical aspect of the computer user's machine.

[0047] FIG. 9 is a diagram of the hardware and operating environment of a representative computer for practicing embodiments of the invention. In particular, the computer of FIG. 9 may represent either a client or server with which embodiments of the invention may be practiced. Computer 902 includes, but is not limited to, processor 904, system memory 906, network interface 908, serial port interface 910, hard disk 912 and system bus 922. Additionally, FIG. 9 includes modem 914, remote computer 916, network 918 and network 920. System bus 922 operatively couples processor 904, system memory 906, network interface 908, serial port interface 910 and hard disk 912 of computer 902.

[0048] Moreover, computer 902 is operatively coupled to remote computer 916 through network 918 and network 920. In particular, computer 902 is operatively coupled to remote computer 916 using network 918 through network interface 908. Also computer 902 is operatively coupled to remote computer 916 using network 920 through modem 914 and serial port interface 910. System memory 906, hard disk 912, as well as floppy disks, etc., are types of computer-readable media. The invention is not particularly limited to any type of computer 902. Residing on computer 902 is a computer readable medium storing a computer program which is executed on computer 902. The use of the unique processor identification across a network is performed by the computer program is in accordance with an embodiment of the invention.

[0049] The invention includes computerized systems, methods, computers, and computer-readable media of varying scope. Although specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that any arrangement which is calculated to achieve the same purpose may be substituted for the specific embodiments shown. This application is intended to cover any adaptations or variations of the invention. It is manifestly intended that this invention be limited only by the following claims and equivalents thereof.