Tokencode exchanges for peripheral authentication

1. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

generating a first code in the peripheral;

transmitting the first code from the peripheral to the host device, the first code being presentable by the host device to an authentication server for authentication;

receiving in the peripheral from the host device a second code provided to the host device by the authentication server; and

authenticating the second code in the peripheral;

wherein authenticating the second code comprises authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the authentication server authenticates the first code before providing the second code to the host device.

2. The method of claim 1 wherein the authentication server generates the second code responsive to presentation of the first code by the host device.

3. The method of claim 1 wherein the peripheral is a transient storage device.

4. The method of claim 1 wherein the host device comprises a computer.

5. The method of claim 1 wherein the peripheral is configured for physical attachment to the host device via a USB port of said device.

6. The method of claim 1 wherein the first and second codes comprise one-time passwords generated in the respective peripheral and authentication server.

7. The method of claim 1 wherein the second code is generated as a function of at least the first code.

8. The method of claim 7 wherein the second code is generated as a function of at least the first code and a seed stored by the authentication server.

9. The method of claim 7 wherein the second code is generated as a function of at least the first code and a current output of a time-of-day clock.

10. The method of claim 1 wherein the first and second codes are derived from respective first and second seeds stored in both the peripheral device and the authentication server.

11. The method of claim 10 wherein the first and second seeds are derived from a common master seed.

12. The method of claim 10 wherein the first and second codes are generated in the respective peripheral and authentication server as a function of the respective first and second seeds and a current output of a time-of-day clock.

13. The method of claim 1 further including the step of applying a key derivation function to a combination of the first and second codes to generate session keys for protecting data communicated between the peripheral and the authentication server.

14. The method of claim 10 wherein one or more session keys are generated as a function of a combination of at least the first and second codes and the first and second seeds.

15. The method of claim 1 further including the step of caching at least first and second sets of future codes in the host device for use in a period of off-line operation when the host device is unable to communicate with the authentication server.

16. A non-transitory machine-readable storage medium storing one or more software programs, wherein the one or more software programs when executed by a processor of the peripheral implement the steps of the method of claim 1 .

17. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

generating a first code in the peripheral;

transmitting the first code from the peripheral to the host device, the first code being presentable by the host device to an authentication server for authentication;

receiving in the peripheral from the host device a second code provided to the host device by the authentication server; and

authenticating the second code in the peripheral;

wherein authenticating the second code comprises authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the peripheral generates the first code responsive to receipt of the second code from the host device.

18. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

generating a first code in the peripheral;

transmitting the first code from the peripheral to the host device, the first code being presentable by the host device to an authentication server for authentication;

receiving in the peripheral from the host device a second code provided to the host device by the authentication server; and

authenticating the second code in the peripheral;

wherein authenticating the second code comprises authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the peripheral authenticates the second code before transmitting the first code to the host device.

19. An apparatus comprising:

a peripheral having a processor coupled to a memory, the peripheral being configured for communication with a host device;

wherein the peripheral is operative to generate a first code and to transmit the first code to the host device, the first code being presentable by the host device to an authentication server for authentication;

wherein the peripheral is further operative to receive from the host device a second code provided to the host device by the authentication server, and to authenticate the second code, the authenticating of the second code comprising authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the authentication server authenticates the first code before providing the second code to the host device.

20. The apparatus of claim 19 wherein the peripheral is a transient storage device.

21. The apparatus of claim 19 wherein the peripheral is a security token.

22. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

receiving in the host device a first code from the peripheral;

transmitting the first code from the host device to an authentication server for authentication;

receiving in the host device a second code from the authentication server; and

transmitting the second code to the peripheral for authentication;

wherein authenticating the second code comprises authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the authentication server authenticates the first code before providing the second code to the host device.

23. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

receiving in an authentication server a first code delivered from the peripheral via the host device;

authenticating the first code in the authentication server; and

transmitting a second code from the authentication server to the host device, the second code being presentable by the host device to the peripheral for authentication;

wherein authenticating the second code comprises authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the authentication server authenticates the first code before transmitting the second code to the host device.

24. A system comprising:

a peripheral;

a host device configured for communication with the peripheral; and

an authentication server configured for communication with the host device;

wherein a first code from the peripheral is delivered to the authentication server via the host device for authentication;

wherein a second code from the authentication server is delivered to the peripheral via the host device for authentication, the authenticating of the second code comprising authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the authentication server authenticates the first code before providing the second code to the host device.

25. An apparatus comprising:

a peripheral having a processor coupled to a memory, the peripheral being configured for communication with a host device;

wherein the peripheral is operative to generate a first code and to transmit the first code to the host device, the first code being presentable by the host device to an authentication server for authentication;

wherein the peripheral is further operative to receive from the host device a second code provided to the host device by the authentication server, and to authenticate the second code, the authenticating of the second code comprising authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the peripheral is further operative to generate the first code responsive to receipt of the second code from the host device.

26. An apparatus comprising:

a peripheral having a processor coupled to a memory, the peripheral being configured for communication with a host device;

wherein the peripheral is operative to generate a first code and to transmit the first code to the host device, the first code being presentable by the host device to an authentication server for authentication;

wherein the peripheral is further operative to receive from the host device a second code provided to the host device by the authentication server, and to authenticate the second code, the authenticating of the second code comprising authenticating the authentication server;

wherein the first code and the second code are generated using a shared symmetric key; and

wherein the peripheral is further operative to authenticate the second code before transmitting the first code to the host device.