Detecting soft token copies

A server for detecting unauthorized copies of a soft token that runs on a mobile device, comprising:

• a set of processors;
• and
• memory, coupled to the set of processors, the memory constructed and arranged to store instructions executable by the set of processors,
• wherein the set of processors executing instructions from the memory forms a specialized circuit constructed and arranged to:
• receive, from a user, multiple authentication requests including token codes generated by the soft token;
• receive, from the mobile device and in connection with the authentication requests, multiple samples of a set of random bits;
• generate multiple predicted samples of the set of random bits based on at least one sample of the set of random bits previously received from the mobile device;
• test whether the received samples of the set of random bits match the predicted samples of the set of random bits;
• and
• identify the use of an unauthorized soft token copy in response to the testing indicating that the received samples of the set of random bits do not match the predicted samples of the set of random bits,
• wherein each of the received samples conveys only partial information for identifying the set of random bits.

A non-transitory computer readable medium including instructions which, when executed by a set of processors of a server, cause the set of processors to perform a method for detecting unauthorized copies of a soft token that runs on a mobile device, the method comprising:

• receiving, from a user, multiple authentication requests including token codes generated by the soft token;
• receiving, from the mobile device and in connection with the authentication requests, multiple samples of a set of random bits;
• generating multiple predicted samples of the set of random bits based on at least one sample of the set of random bits previously received from the mobile device;
• testing whether the received samples of the set of random bits match the predicted samples of the set of random bits;
• and
• identifying the use of an unauthorized soft token copy in response to the testing indicating that the received samples of the set of random bits do not match the predicted samples of the set of random bits,
• wherein each of the received samples conveys only partial information for identifying the set of random bits.

A method for enabling detection of unauthorized copies of a soft token that runs on a mobile device, comprising:

• storing a seed value shared with a server;
• generating a set of random bits;
• subjecting one of (i) the seed value and (ii) a value derived from the seed value and the set of random bits to a forward secure function to produce a multi-bit value;
• storing state information on the mobile device indicating that the forward-secure function has been run;
• generating multiple samples of the multi-bit value;
• generating multiple token codes;
• and
• providing the token codes and samples for transmission to the server in connection with multiple authentication requests,
• wherein each of the samples of the multi-bit value conveys only partial information for identifying the multi-bit value.