Authenticated remote PIN unblock
This invention provides a simple and secure PIN unblock mechanism for use with a security token. A set of one or more passphrases are stored on a remote server during personalization. Likewise, the answers to the passphrases are hashed and stored inside the security token for future comparison. A local client program provides the user input and display dialogs and ensures a secure communications channel is provided before passphrases are retrieved from the remote server. Retrieval of passphrases and an administrative unblock secret from the remote server are accomplished using a unique identifier associated with the security token, typically the token's serial number. A PIN unblock applet provides the administrative mechanism to unblock the security token upon receipt of an administrative unblock shared secret. The remote server releases the administrative unblock shared secret only after a non-forgeable confirmatory message is received from the security token that the user has been properly authenticated. The administrative unblock shared secret is encrypted with the token's public key during transport to maximize security.
1. A system which facilitates an authenticated user to unblock a temporarily blocked security token, comprising:
a security executive software module provided on said security token;
an unblock applet installed in said security token that communicates with said security executive;
a first secret associated with at least one unblock inquiry;
a first shared secret associated with said unblock applet;
a client functionally connected to said security token, the client including at least one client application for initiating an unblock procedure with said security token; and
a remote server, said remote server in remote processing communication with said client and including:
at least one unblock service application, responsive to said at least one client application, and
a second shared secret, wherein said at least one unblock inquiry and said second shared secret are sent from said remote server via the client to said unlock applet to automatically unblock said security token.
2. The system according to claim 1 wherein said first secret is a one way hash of an answer to said at least one unblock inquiry.
3. The system according to claim 2 wherein said security token further includes a private asymmetric key.
4. The system according to claim 3 wherein said server further includes a public asymmetric key counterpart to said private asymmetric key.
5. The system according to claim 4 wherein said at least one unblock inquiry is encrypted with said public asymmetric key.
6. The system according to claim 1 wherein said first shared secret is equal to said second shared secret.
7. The system according to claim 5 wherein said second shared secret is encrypted with said public asymmetric key.
8. The system according to claim 7 wherein said second shared secret is an administrative PIN.
9. The system according to claim 8 wherein said second shared secret is a symmetric key.
10. The system according to claim 7 wherein said second shared secret is decrypted with said private asymmetric key.
11. The remote server according to claim 1 further including means for providing an audit trail of said unblock procedure.
12. The system according to claim 1 wherein said second shared secret is sent to said security token upon receipt of a properly encoded message by said at least one unblock service application.
13. The system according to claim 1 wherein said at least one unblock inquiry includes a passphrase.
14. The system according to claim 1 wherein said processing communications includes a secure communications protocol.
15. A method for facilitating an authenticated user to unblock a temporarily blocked security token, the method comprising:
generating at least one passphrase;
associating said at least one passphrase with a unique identifier;
storing said at least one passphrase on a server in a manner retrievable using said unique identifier;
generating answers associated with said at least one passphrase;
performing a message digest function on said answers associated with said at least one passphrase; and
storing a result of said message digest function in a security token associated with said authenticated user, wherein the security token is used in an access attempt at a site that is remote from the server, wherein processing to unblock the security token is performed at the site using the result of the message digest function stored in the security token and using a security executive software module provided on the security token and an unblock applet installed in the security token that communicates with the security executive and automatically unblocks the security token, and wherein said unique identifier is associated with said security token.
16. The method according to claim 15 further including the step of encrypting said at least one passphrase with a public asymmetric key associated with said security token.