Multi-user strong authentication token

A method for loading an additional token instance into a multi-instance target authentication token adapted to generate dynamic credentials, the method comprising a first loading process stage for transferring to a target authentication token a value of a user instance group master key and a second loading process stage for transferring to the target authentication token a set of instance data values,

• whereby the target authentication token is comprised in at least one of a plurality of token batches, whereby with each token batch of said plurality of token batches a value of a batch master key is associated and whereby the target authentication token comprises the value of the batch master key of said at least one of said plurality of token batches that comprises
• the target authentication token;
• the first loading process stage comprising:
• generating a first stage loading message, said generating of said first stage loading message comprising:
• determining for each of said token batches a batch related value such that it is possible that the same value of a user instance group master key that is associated with a particular instance user group that the additional token instance belongs to, can be calculated as a function of any pair of a batch master key of any particular one of said token batches and the batch related value corresponding to that particular token batch,
• including said batch related values into the first stage loading message;
• at the target authentication token receiving and processing said first stage loading message, processing said first stage loading message comprising:
• the target authentication token retrieving from the first stage loading message that it has received a batch related value that corresponds to the same token batch that said batch master key, the value of which is comprised in the target authentication token, also corresponds to;
• the target authentication token calculating the value of the user instance group master key as a function of said batch master key comprised in the target authentication token and said batch related value that the target authentication token has retrieved from the first stage loading message;
• and
• the target authentication token storing the calculated value of the user instance group master key;
• the second loading process stage comprising:
• generating a second stage loading message, said generating of said second stage loading message comprising:
• generating a set of instance data values for the additional token instance;
• including the generated set of instance data values in the second stage loading message;
• and
• securing the second stage loading message with said user instance group master key or a key derived from the user instance group master key;
• at the target authentication token receiving and processing the second stage loading message, processing said second stage loading message comprising:
• the target authentication token retrieving said set of instance data values from the second stage loading message it has received by using the value of the user instance group master key that the target authentication token has calculated in the first loading process stage;
• and
• the target authentication token determining the values of a set of secret keys of said additional token instance by using said retrieved set of instance data values, whereby said set of secret keys of the additional token instance comprises a secret credential generation key for the authentication token to subsequently use when generating dynamic credentials for said additional token instance.

A method for loading an additional token instance into a multi-instance target authentication token adapted to generate dynamic credentials, the method comprising a first loading process stage for transferring to a target authentication token a value of a user instance group master key and a second loading process stage for transferring to the target authentication token a set of instance data values,

• whereby the target authentication token is comprised in at least one of a plurality of token batches, whereby with each token batch of said plurality of token batches a value of a batch master key is associated and whereby the target authentication token comprises the value of the batch master key of said at least one of said plurality of token batches that comprises the target authentication token;
• the first loading process stage comprising:
• generating a first stage loading message, said generating of said first stage loading message comprising:
• determining for each of said token batches a batch related value such that it is possible that the same value of a user instance group master key that is associated with a particular instance user group that the additional token instance belongs to, can be calculated as a function of any pair of a batch master key of any particular one of said token batches and the batch related value corresponding to that particular token batch, and
• including said batch related values into the first stage loading message;
• sending said first stage loading message to said target authentication token;
• the second loading process stage comprising:
• generating a second stage loading message, said generating of said second stage loading message comprising:
• generating a set of instance data values for the additional token instance;
• including the generated set of instance data values in the second stage loading message;
• and
• securing the second stage loading message with said user instance group master key or a key derived from the user instance group master key;
• sending said second stage loading message to said target authentication token.

A method for receiving an additional token instance into a multi-instance target authentication token adapted to generate dynamic credentials, the method comprising a first loading process stage for transferring to a target authentication token a value of a user instance group master key, and a second loading process stage for transferring to the target authentication token a set of instance data values for the additional token instance,

• whereby the target authentication token is comprised in at least one of a plurality of token batches, whereby with each token batch of said plurality of token batches a value of a batch master key is associated and whereby the target authentication token comprises the value of the batch master key of said at least one of said plurality of token batches that comprises the target authentication token;
• the first loading process stage comprising the target authentication token receiving and processing a first stage loading message that comprises a set of batch related values, one batch related value for each of said token batches, wherein the value of each batch related value has been determined such that it is possible to calculate the same value of said user instance group master key, as a function of any pair of a batch master key of any particular one of said token batches and the batch related value corresponding to that particular token batch, processing said first stage loading message comprising:
• the target authentication token retrieving from the first stage loading message that it has received a batch related value that corresponds to the same token batch that said batch master key, the value of which is comprised in the target authentication token, also corresponds to;
• the target authentication token calculating the value of the user instance group master key as a function of said batch master key comprised in the target authentication token and said batch related value that the target authentication token has retrieved from the first stage loading message;
• and
• the target authentication token storing the calculated value of the user instance group master key;
• the second loading process stage comprising the target authentication token receiving and processing a second stage loading message that includes said set of instance data values for the additional token instance and that is secured with said user instance group master key or a key derived from the user instance group master key, processing said second stage loading message comprising:
• the target authentication token retrieving said set of instance data values from the second stage loading message it has received by using the value of the user instance group master key that the target authentication token has calculated in the first loading process stage;
• and
• the target authentication token determining the values of a set of secret keys of said additional token instance by using said retrieved set of instance data values, whereby said set of secret keys of the additional token instance comprises a secret credential generation key for the authentication token to subsequently use when generating dynamic credentials for said additional token instance.