Security-aware split-server passcode verification for one-time authentication tokens

An apparatus, comprising:

• a memory;
• and
• at least one hardware device, coupled to the memory, operative to:
• receive an authentication passcode generated by a token associated with a user, wherein said authentication passcode is based on (i) at least one protocode;
• and (ii) auxiliary information embedded in said authentication passcode when said authentication passcode is generated, wherein said embedded auxiliary information is distinct from said at least one protocode;
• and
• process the received authentication passcode using at least a first authentication server and a second authentication server, wherein at least one of said first authentication server, said second authentication server and a relying party extract said embedded auxiliary information from the received authentication passcode, wherein said embedded auxiliary information comprises one or more of two different signals, and wherein said embedded auxiliary information is not previously known to said at least one of said first authentication server, said second authentication server and said relying party that extracts said embedded auxiliary information, wherein said extraction of said embedded auxiliary information comprising one or more of a silent alarm signal and a drifting key signal is performed by one of said first authentication server, said second authentication server and said relying party.

An article of manufacture comprising a non-transitory machine readable recordable medium containing one or more programs which when executed implement the steps of:

• receiving an authentication passcode generated by a token associated with a user, wherein said authentication passcode is based on (i) at least one protocode;
• and (ii) auxiliary information embedded in said authentication passcode when said authentication passcode is generated, wherein said embedded auxiliary information is distinct from said at least one protocode;
• and
• processing the received authentication passcode using at least a first authentication server and a second authentication server, wherein at least one of said first authentication server, said second authentication server and a relying party extract said embedded auxiliary information from the received authentication passcode, wherein said embedded auxiliary information comprises one or more of two different signals, and wherein said embedded auxiliary information is not previously known to said at least one of said first authentication server, said second authentication server and said relying party that extracts said embedded auxiliary information, wherein said extraction of said embedded auxiliary information comprising one or more of a silent alarm signal and a drifting key signal is performed by one of said first authentication server, said second authentication server and said relying party.