System and method for securely provisioning and generating one-time-passwords in a remote device
View Patent ↗A secure processor such as a TPM generates one-time-passwords used to authenticate a communication device to a service provider. In some embodiments the TPM maintains one-time-password data and performs the one-time-password algorithm within a secure boundary associated with the TPM. In some embodiments the TPM generates one-time-password data structures and associated parent keys and manages the parent keys in the same manner it manages standard TPM keys.
1. A system for securing access to information or processes, comprising:
a verification server comprising:
a verification module configured to receive a first one-time password from a user device,
a verification server trusted platform module configured to generate a second one-time password within a security boundary of the verification server trusted platform module using a processing device and a seed value included in a one-time password blob, and
a data memory external to the verification server trusted platform module configured to store said one-time password blob,
wherein said verification module is further configured to compare said first one-time password and said second one-time password.
2. The system of claim 1 , wherein said user device comprises a user device trusted platform module that generates said first one-time password.
3. The system of claim 2 , further comprising a service provider configured to permit said user device to access services or data provided by said service provider if said first and second one-time passwords match.
4. The system of claim 2 , wherein said first one-time password is generated within a security boundary.
5. The system of claim 2 , wherein said verification server trusted platform module is configured to generate said second one-time password using a hashing function.
6. The system of claim 1 , wherein said seed value is stored in encrypted form.
7. The system of claim 6 , wherein said verification server trusted platform module is configured to encrypt said seed value using a key from a hierarchy of trusted platform module keys.
8. The system of claim 1 , wherein said verification server trusted platform module is configured to be controlled using standard trusted platform module commands.
9. The system of claim 8 , wherein said verification server trusted platform module is configured to receive said trusted platform module commands via a trusted software stack.
10. The system of claim 8 , wherein said verification server trusted platform module is configured to receive said trusted platform module commands via middleware.
11. The system of claim 2 , wherein a network interface card comprises said verification server trusted platform module.
12. The system of claim 2 , wherein a LAN-on-motherboard comprises said verification server trusted platform module.
13. The system of claim 1 , wherein said one-time password blob further includes at least one of a one-time password identifier and an algorithm definition.
14. A method of producing a one-time password in a trusted platform module, comprising:
receiving, at the trusted platform module, a command to generate a one-time password;
retrieving, from a memory external to the trusted platform module, a one-time password blob, wherein the one-time password blob includes a seed value;
creating in a security boundary of the trusted platform module the one-time password using the seed value in the one-time password blob; and
outputting the generated one-time password.
15. The method of claim 14 , further comprising:
certifying the one-time password blob prior to creating the one-time password.
16. The method of claim 15 , wherein certifying the one-time password blob comprises:
signing the one-time password blob; and
sending the signed one-time password blob and the one-time password to a verification server.
17. The method of claim 14 , further comprising:
configuring the trusted platform module for one-time password generation.
18. The method of claim 17 , wherein configuring the trusted platform module comprises loading code into the trusted platform module, wherein the code represents logic for execution of commands that are specific to one-time password processing.
19. The method of claim 14 , further comprising:
creating the one-time password blob.
20. The method of claim 19 , wherein creating the one-time password blob comprises:
encrypting the one-time password blob; and
storing the encrypted one-time password blob in the external memory.
21. The method of claim 20 , further comprising:
generating the seed value; and
loading the seed value into the one-time password blob.
22. The method of claim 21 , wherein at least one of a one-time password identifier and an algorithm definition is loaded into the one-time password blob along with the seed value.
23. The method of claim 20 , wherein creating the one-time password comprises:
decrypting the one-time password blob; and
executing a one-time password generation algorithm.