Secure authentication using hardware token and computer fingerprint
View Patent ↗A method and apparatus for secure authentication of a hardware token is disclosed. In one embodiment, a host computer fingerprint is used to generate a partial seed for a challenge-response authentication which is performed on the hardware token. In another embodiment, the host computer fingerprint is used as a personal identification number for the hardware token.
1. A method of authenticating a hardware token for operation with a host, comprising:
retrieving a value X from a memory separate from the hardware token, the memory accessible to an authenticating entity, the value X generated from a non-varying computer fingerprint F of a host and an identifier P securing access to the hardware token, wherein the fingerprint F is computed at least in part from non-varying host information C based on a unique characteristic of the host;
regenerating the same identifier P at least in part from the value X and the fingerprint F; and
transmitting the regenerated identifier P to the hardware token to authenticate the hardware token for operation with the host.
2. The method of claim 1 , wherein the fingerprint F is computed at least in part from the host information C and a non-varying server specific value V.
3. The method of claim 2 , wherein the fingerprint F is computed at least in part from the host information C, the non-varying server specific value V, and a non-varying string Z.
4. The method of claim 1 , wherein the value X is computed in the hardware token.
5. The method of claim 1 , wherein the value X is computed according to X =ƒ(P, F), wherein ƒ(P, F) is a reversible function such that ƒ(ƒ(P, F), F) =P.
6. The method of claim 5 , wherein ƒ(P, F) comprises P XOR F.
7. The method of claim 1 , wherein the value X is further computed at least in part from a user identifier U.
8. The method of claim 7 , wherein the value X is computed according to X =ƒ(P, U, F), wherein ƒ(P, U, F) is a reversible function such that ƒ(ƒ(P, U, F), U, F) =P.
9. The method of claim 8 , wherein ƒ(P, U, F) is P XOR U XOR F.
10. The method of claim 1 , wherein:
the authenticating entity is the host computer, communicatively coupleable to the hardware token; and
the value X is stored in the host computer.
11. An apparatus for authenticating a hardware token for operation with a host, comprising:
a memory separate from the hardware token, the memory accessible to an authenticating entity, the memory storing a value X, the value X generated from a non-varying computer fingerprint F of the host and an identifier P securing access to the hardware token, wherein the fingerprint F is computed at least in part from non-varying host information C based on a unique characteristic of the host;
the host, adapted to:
compute the fingerprint F,
send the fingerprint F to the hardware token,
receive the value X from the hardware token,
store the value X in the memory,
retrieve the value X from the memory,
regenerate the same identifier P at least in part from the retrieved value X and the fingerprint F, and
transmit the regenerated identifier P to the hardware token to authenticate the hardware token for operation with the host; and
the hardware token, adapted to:
receive the fingerprint F from the host,
generate the value X from the fingerprint F and the identifier P,
transmit the value X to the host for storage in the memory, and
receive the regenerated value P from the host, whereby the hardware token is authenticated for operation with the host.
12. The apparatus of claim 11 , wherein the fingerprint F is computed at least in part from the host information C and a non-varying server specific value V.
13. The apparatus of claim 12 , wherein the fingerprint F is computed at least in part from the host information C, the non-varying server specific value V, and a non-varying string Z.
14. The apparatus of claim 11 , wherein the value X is computed in the hardware token.
15. The apparatus of claim 11 , wherein the value X is computed according to X =ƒ(P, F),wherein ƒ(P, F) is a reversible function such that ƒ(ƒ(P, F), F) =P.
16. The apparatus of claim 15 , wherein ƒ(P, F) comprises P XOR F.
17. The apparatus of claim 11 , wherein the value X is further computed at least in part from a user identifier U.
18. The apparatus of claim 17 , wherein the value X is computed according to X =ƒ(P, U, F) ,wherein ƒ(P, U, F) is a reversible function such that ƒ(ƒ(P, U, F), U, F) =P.
19. The apparatus of claim 18 , wherein ƒ(P, U, F) is P XOR U XOR F.
20. The apparatus of claim 11 , wherein:
the authenticating entity is the host computer, communicatively coupleable to the hardware token; and
the value X is stored in the host computer.
21. An apparatus for authenticating a hardware token for operation with a host, the apparatus comprising a processor and a computer readable storage medium storing instructions for performing steps comprising:
retrieving a value X from a memory separate from the hardware token, the memory accessible to an authenticating entity, the value X generated from a non-varying computer fingerprint F of a host and an identifier P securing access to the hardware token, wherein the fingerprint F is computed at least in part from non-varying host information C based on a unique characteristic of the host;
regenerating the same identifier P at least in part from the value X and the fingerprint F; and
transmitting the regenerated identifier P to the hardware token to authenticate the hardware token for operation with the host.
22. The apparatus of claim 21 , wherein the fingerprint F is computed at least in part from the host information C and a non-varying server specific value V.
23. The apparatus of claim 22 , wherein the fingerprint F is computed at least in part from the host information C, the non-varying server specific value V, and a non-varying string Z.
24. The apparatus of claim 21 , wherein the value X is computed in the hardware token.
25. The apparatus of claim 21 , wherein the value X is computed according to X =ƒ(P, F), wherein ƒ(P, F) is a reversible function such that ƒ(ƒ(P, F), F) =P.
26. The apparatus of claim 25 , wherein ƒ(P, F) comprises P XOR F.
27. The apparatus of claim 21 , wherein the value X is further computed at least in part from a user identifier U.
28. The apparatus of claim 27 , wherein the value X is computed according to X =f (P, U, F) ,wherein ƒ(P, U, F) is a reversible function such that ƒ(ƒ(P, U, F), U, F) =P.
29. The apparatus of claim 28 , wherein ƒ(P, U, F) is P XOR U XOR F.
30. The apparatus of claim 21 , wherein:
the authenticating entity is the host computer, communicatively coupleable to the hardware token; and
the value X is stored in the host computer.