Token provisioning
AssigneeSymantec Corporation
InventorNicolas Popp
Life of this patent
Estimating the term…
Abstract
A method for provisioning a device such as a token. The device issues a certificate request to a Certification Authority. The request includes a public cryptographic key uniquely associated with the device. The Certification Authority generates a symmetric cryptographic key for the device, encrypts it using the public key, and creates a digital certificate that contains the encrypted symmetric key as an attribute. The Certification Authority sends the digital certificate to the device, which decrypts the symmetric key using the device's private key, and stores the decrypted symmetric key.
Claims15
A method for reprovisioning a token having a first secret, comprising:
- sending a request for a certificate;
- receiving a certificate comprising:
- a second secret encrypted with a public key of the token, the second secret distinct from the first secret;
- a public key received from the token;
- and
- a digital signature based upon a secret asymmetric key of the recipient of the request for the certificate;
- decrypting the second secret with a private key of the token;
- replacing the first secret with the second secret;
- generating a one time password based on the second secret;
- and
- sending the one time password based on the second secret to an authentication server to authenticate a user.
A token for generating one time passwords, comprising:
- a processor;
- and
- a memory coupled to the processor, the memory storing a first secret and token instructions adapted to be executed by the processor to send a message that includes a request for a certificate, receive a certificate, replace the first secret with a second secret including storing the second secret in memory, generate a one time password based on the second secret, and send the one time password based on the second secret to an authentication server to authenticate a user,
- wherein the certificate comprises:
- the second secret encrypted with a public key of the token, the second secret distinct from the first secret;
- a public key received from the token;
- and
- a digital signature based upon a secret asymmetric key of the recipient of the request for the certificate.
A token for generating one time passwords, comprising:
- a processor;
- and
- a memory coupled to the processor, the memory separately storing;
- a first secret for generating one time passwords;
- a private key;
- a public key;
- and
- token instructions adapted to be executed by the processor to send a message that includes a request for a certificate, receive a certificate, decrypt a second secret with the private key of the token, replace the first secret with the second secret, generate a one time password based on the second secret, and send the one time password to an authentication server to authenticate a user,
- wherein the certificate comprises:
- the second secret encrypted with the public key of the token, the second secret distinct from the first secret;
- a public key received from the token;
- and
- a digital signature based upon a secret asymmetric key of the recipient of the request for the certificate.
Dependencies are inferred from the claim text.