Key distribution for unconnected one-time password tokens
AssigneeGemalto SA
InventorsJerome Denis, Amol Deshmukh
Life of this patent
Estimating the term…
Abstract
A system and method for distributing symmetric keys in a system including an end-user computer operated by an end-user, a service provider server of a service provider having a service provider identifier, and a manufacturer backend server operated by the manufacturer of the OTP token. The manufacturer backend server operates to verify one-time passwords generated by the OTP tokens and upon verifying the authenticity of the OTP token based on the generated passwords, transmitting the symmetric key to a service provider server or an authentication server. Other systems and methods are disclosed.
Claims23
A method for distributing a symmetric key for a one-time password token, having a unique identifier, in a system including an end-user computer operated by an end-user, a service provider server of a service provider having a service provider identifier, and a manufacturer backend server operated by the manufacturer of the OTP token, the method operating to distribute the symmetric key from the manufacturer backend server to the service provider server and comprising:
- operating the end-user computer and service provider server to authenticate the end-user with the service provider;
- transmitting a message containing the token unique identifier and a token possession confirmation from the end-user computer to the service provider server;
- in response to receiving the response with the token unique identifier and the token possession confirmation, transmitting an authentication message having the service provider identifier, the token unique identifier, and the token possession confirmation from the service provider server to the manufacturer backend server;
- in response to receiving the authentication message, operating the manufacturer backend server to independently verify the token possession confirmation as belonging to a token corresponding to the token unique identifier and upon successful verification, transmitting a symmetric key corresponding to the token corresponding to the token unique identifier from the manufacturer backend server to the service provider server;
- and
- in response to receiving the symmetric key, operating the service provider to securely store the token key and associate the token unique identifier and the symmetric key received from the manufacturer backend server.
A method for authenticating an end-user to a second party, wherein the end-user operates an end-user computer to access a resource of a second party server operated by the second party, using a third-party issued One-Time Password (OTP) token having a unique identifier and associated with a backend server, the method comprising:
- operating the second party server to request the end-user computer to return the unique identifier and two one-time passwords generated by the OTP token;
- operating the end-user computer to return the unique identifier and two one-time passwords generated by the OTP token;
- operating the second party server to request the manufacturer backend server associated with the OTP token to return contact information corresponding to the third party that registered the OTP token having the unique identifier;
- operating the manufacturer backend server to return the contact information for the third party to the second party server;
- and
- operating the second party server to use the contact information for the third party to request a third party server operated by the third party to return a verification of the OTP passwords generated by the OTP token.
A manufacturer backend server for distributing one-time password keys to a server verifying one-time passwords produced by one-time password tokens having token ids, the manufacturer backend server comprising
- a processor and storage means,
- the storage means including:
- a datastore storing one-time password token keys corresponding to one-time password ids;
- instructions to cause the manufacturer backend server processor to:
- receive a token authentication and registration request message from a service provider server, wherein the token authentication message contains a token id and at least one one-time password purported to have been generated by the one-time token corresponding to the token id;
- retrieve the token key corresponding to the at least one one-time password purported to have been generated by the one-time password token corresponding to the received token id;
- using the retrieved token key to verify that the one-time password purported to have been generated by the one-time password token corresponding to the received token id corresponds to the token associated with the received token id;
- upon verifying that the one-time password purported to have been generated by the one-time password token corresponding to the received token id corresponds to the token associated with the received token id, transmitting the token key to an authentication server.
A system for distributing one-time passwords keys for one-time password tokens, comprising:
- a service provider server operable to:
- receive a message containing a token unique identifier associated with a one-time password token and a token possession confirmation from an end-user computer;
- and
- upon receipt of a message containing a token unique identifier associated with a one-time password token and a token possession confirmation from an end-user computer, transmitting an authentication message having the service provider identifier, the token unique identifier, and the token possession confirmation from the service provider server to the manufacturer backend server;
- and
- a manufacturer backend server operable to:
- to independently verify the token possession confirmation as belonging to a token corresponding to the token unique identifier and upon successful verification, transmitting a symmetric key corresponding to the token corresponding to the token unique identifier from the manufacturer backend server to an authentication service provider server;
- and
- an authentication service provider server operable to
- receive the symmetric key from the manufacturer backend server;
- and
- upon receiving the symmetric key, to securely store the token key and associate the token unique identifier and the symmetric key received from the manufacturer backend server.
Dependencies are inferred from the claim text.