Method and apparatus for remote administration of cryptographic devices
View Patent ↗Techniques are disclosed for performing operations in an authentication token or other cryptographic device in a system comprising an authentication server. In one aspect, a code generated by the authentication server is received in the cryptographic device. The code may have associated therewith information specifying at least one operation to be performed by the cryptographic device. The cryptographic device authenticates the code, and responsive to authentication of the code, performs the specified operation. If the code is not authenticated, the operation is not performed. The code may be determined as a function of a one-time password generated by the authentication server. The function may also take as an input an identifier of the operation to be performed.
1. A method of performing at least one operation in a cryptographic device in a system comprising an authentication server, the method comprising receiving in the cryptographic device a code generated by the authentication server; authenticating the code in the cryptographic device; and responsive to authentication of the code, performing said at least one operation in the cryptographic device; wherein the code is received in the cryptographic device in association with a request by the authentication server for the cryptographic device to perform said at least one operation; and wherein the operation to be performed by the cryptographic device comprises resetting a time value or event counter value on the cryptographic device.
2. The method of claim 1 wherein the code has associated therewith information specifying said at least one operation to be performed by the cryptographic device.
3. The method of claim 1 wherein the cryptographic device comprises an authentication token.
4. A method of performing at least one operation in a cryptographic device in a system comprising an authentication server, the method comprising: receiving in the cryptographic device a code generated by the authentication server; authenticating the code in the cryptographic device; and responsive to authentication of the code, performing said at least one operation in the cryptographic device; wherein the code is received in the cryptographic device in association with a request by the authentication server for the cryptographic device to perform said at least one operation;
and wherein the code is determined as a function of at least an identifier of the operation.
5. A method of performing at least one operation in a cryptographic device in a system comprising an authentication server, the method comprising: receiving in the cryptographic device a code generated by the authentication server; authenticating the code in the cryptographic device; and responsive to authentication of the code, performing said at least one operation in the cryptographic device; wherein the code is received in the cryptographic device in association with a request by the authentication server for the cryptographic device to perform said at least one operation; and wherein the code is determined as a function of at least a one-time password generated by the authentication server.
6. The method of claim 5 wherein the one-time password corresponds to a password to be generated by the cryptographic device.
7. The method of claim 6 wherein the password to be generated by the cryptographic device comprises a password to be generated at a designated offset from a current state of the cryptographic device.
8. The method of claim 1 further including providing to the authentication server from the cryptographic device an additional code indicative of success or failure of the operation.
9. The method of claim 1 wherein the operation to be performed by the cryptographic device comprises updating an access code of the cryptographic device.
10. The method of claim 1 wherein the operation to be performed by the cryptographic device comprises unlocking the cryptographic device.
11. The method of claim 1 wherein the operation to be performed by the cryptographic device comprises altering a configurable parameter of the cryptographic device.
12. The method of claim 1 wherein the operation to be performed by the cryptographic device comprises updating a shared secret in the cryptographic device.
13. The method of claim 1 wherein the operation to be performed by the cryptographic device comprises granting administrative access to the cryptographic device or a host associated with the cryptographic device.
14. A method of controlling the performance of at least one operation in a cryptographic device in a system comprising an authentication server, the method comprising: generating a code in the authentication server; and providing the generated code to the cryptographic device;
wherein the code is authenticated in the cryptographic device, and responsive to authentication of the code, the cryptographic device performs said at least one operation; wherein the code is provided to the cryptographic device in association with a request by the authentication server for the cryptographic device to perform said at least one operation; and wherein the authentication server generates the code based at least in part on computation of a one-time password OTP s for a future time specified by an offset o relative to a current time t s :
OTP S =F 1 (( t S +o ), k ),
where F 1 denotes a cryptographic function, and k denotes a secret shared by the server and the cryptographic device.
15. The method of claim 14 wherein the code comprises a code Code s generated by the authentication server based on the one-time password OTP s :
Code S =F 2 ( OTP S , r ),
where F 2 denotes a cryptographic function, and r denotes an identifier of the operation.
16. The method of claim 15 wherein the identifier r of the specified operation is sent by the authentication server with the code Code s to the cryptographic device.
17. The method of claim 15 wherein for each of a plurality of time intervals t within a designated range, the cryptographic device computes
OTP T =F 1 ( t, k ) and Code T =F 2 ( OTP T , r ),
and if Code s =Code T for any one of the intervals in the range, then the operation r is performed.
18. A non-transitory processor-readable storage medium storing one or more software programs, wherein the one or more software programs when executed by a processor of a cryptographic device implement: receiving in the cryptographic device a code generated by an authentication server; authenticating the code in the cryptographic device; and responsive to authentication of the code, performing said at least one operation in the cryptographic device; wherein the code is received in the cryptographic device in association with a request by the authentication server for the cryptographic device to perform said at least one operation; and wherein the operation to be performed by the cryptographic device comprises resetting a time value or event counter value on the cryptographic device.
19. An apparatus comprising:
a cryptographic device having a processor coupled to a memory;
wherein the cryptographic device is configured to receive a code generated by an authentication server; wherein the cryptographic device is further configured to authenticate the code generated by the authentication server, and responsive to authentication of the code, to perform at least one operation; wherein the code is received in the cryptographic device in association with a request by the authentication server for the cryptographic device to perform said at least one operation; and wherein the operation to be performed by the cryptographic device comprises resetting a time value or event counter value on the cryptographic device.
20. The apparatus of claim 19 wherein the cryptographic device comprises an authentication token.
21. A method of controlling the performance of at least one operation in a cryptographic device in a system comprising an authentication server, the method comprising generating a code in the authentication server; and providing the generated code to the cryptographic device; wherein the code is authenticated in the cryptographic device, and responsive to authentication of the code, the cryptographic device performs said at least one operation; wherein the code is provided to the cryptographic device in association with a request by the authentication server for the cryptographic device to perform said at least one operation; and wherein the code is determined as a function of at least one of: an identifier of the operation; and a one-time password generated by the authentication server.
22. A system comprising: a plurality of cryptographic devices; and an authentication server; wherein the authentication server is configured to generate a code; wherein a given one of the cryptographic devices is configured to authenticate the code generated by the authentication server, and responsive to authentication of the code, to perform at least one operation; wherein the code is received in the given one of the cryptographic devices in association with a request by the authentication server for the given one of the cryptographic devices to perform said at least one operation; and wherein the code is determined as a function of at least one of: an identifier of the operation; and a one-time password generated by the authentication server.