Link Communications RLC-CLUB, User Manual

Page: 264 / 329

18-4
Version 1.73 Copyright © 1997 Link Communications Inc. 1/18/97
Method #3 - Challenge Passwords:
When a user with a challenge password logs in, it takes two steps. First you enter the logon
command (Command 187) followed by their user number excluding the password information.
The controller looks the user number, finds out that the user is configured for a challenge
password entry, and issues the challenge by requesting the user to enter certain randomly
selected digits of his password. The user then re-executes Command 187 followed by those
digits of the users password that the controller asked for. An example will probably make this a
lot more clear. You will have to logon before trying this example, since command 186 is a
level 6 command.
Example:
186 003 1 6 3 ABCABC ; user 003, enabled, level 3, password ABCABC
187 003 ; request to login
; controller responds with "Please enter 2, 6, 3"
187 B C C ; enter 2nd, 6th, and 3rd digit of password
; controller responds with logon message
Command 186 told the controller that user 003 wanted a 3 digit challenge password of
ABCABC. "Command 187 003" told the controller that user 003 was trying to login. The
controller knew (because of command 186) that user 003 needed a three digit challenge. It
randomly chose to ask for the 2nd, 6th, and 3rd digit of the password. After the controller
issues such a challenge, the next time command 187 is executed, it should be the answer to the
challenge. In this case, user 003 entered the three digits that the challenge asked for, as you can
see below:
Requested digits: 1 2 3 4 5 6
Password digits: A B C A B C
The 2nd, 6th and 3rd digit of the password are "B C C".
The challenge password method is more secure than the fixed password method, because if
someone decodes your DTMF digits as you enter your password, they don't learn your entire
password, but only those digits they you enter. If they try to logon using your password, the
challenge will likely ask for a digits they don't know.
The challenge will never ask for the same digit twice, so the challenge can't ask for more digits
than the length of your password. For the most security, it is recommended that you use at least
six and preferably eight digits (the maximum length) for your password and have the challenge
ask for three or four digits.