Secure authentication using hardware token and computer fingerprint

1. A method of authenticating a hardware token, comprising the steps of:

providing a hardware token different from and connectable to a host computer;

generating in the host computer a host computer fingerprint F based at least in part on a unique characteristic of the host;

transmitting the host computer fingerprint F to an authorizing device different from the host computer and the hardware token;

establishing a secure communication mechanism between the hardware token and the authorizing device;

thereafter generating a random value R in the authorizing device and providing the random value R to the host computer;

computing in the host computer a challenge R′ derived at least in part from the host computer fingerprint F and the random value R;

transmitting the challenge R′ to the hardware token;

generating a response X in the hardware token, the response X generated at least in part from the challenge R′; and

transmitting the response X from the hardware token to the authorizing device to authenticate the hardware token for operation with the host.

2. The method of claim 1 , wherein the step of generating the host computer fingerprint comprises the steps of:

collecting host information C; and

forming the host computer fingerprint F at least in part from the host information C.

3. The method of claim 2 , wherein the step of forming the host computer fingerprint F from the host information C comprises the step of hashing the host information C.

4. The method of claim 2 , wherein:

the method further comprises the step of receiving authorizing device specific vatic V; and

the step of forming the host computer fingerprint F at least in part from the host information C comprises the step of forming the host computer fingerprint F at least in part from the host information C and the authorizing device specific value V.

5. The method of claim 1 , wherein the step of forming the host computer fingerprint F at least in part from the host information C and the authorizing device specific value V comprises the step of forming the host computer fingerprint F at least in part from a hash of the host information C and the authorizing device specific value V.

6. The method of claim 4 , wherein the step of forming the host computer fingerprint F at least in part from the host information C and the authorizing device specific value V comprises the step of forming the host computer fingerprint F at least in part from a concatenation of the host information C and the authorizing device specific value V.

7. The method of claim 2 , wherein the host computer is communicatively coupleable to the authorizing device and the hardware token, and the host information C includes information selected from the group comprising:

processor serial number;

hard drive serial number;

network interface MAC address;

BIOS code checksum;

operating system; and

system directory timestamp.

8. The method of claim 1 wherein the secure communication mechanism between the hardware token and the authorizing device comprises a shared secret S between the authorizing device and the hardware token.

9. The method of claim 8 , wherein the response X is the challenge R′ encrypted by the shared secret S.

10. The method of claim 1 , wherein the secure communication mechanism between the hardware token and the authorizing device comprises a private key K pr of a key pair having the private key K pr accessible to the token and a public key K pu accessible to the authorizing device.

11. The method of claim 10 , wherein the response X is the challenge R′ encrypted by the private key K pr .

12. An apparatus for authenticating a hardware token, comprising:

a hardware token different from and connectable to a host computer; said host computer generating a host computer fingerprint F based at least in part on a unique characteristic of the host;

means for transmitting the host computer fingerprint F to an authorizing device different from the host computer and the hardware token; the host computer receiving a random value R generated by the authorizing device; the host computer computing a challenge R′, the challenge R′ derived at least in part from the host computer fingerprint F and the random value R;

means for transmitting the challenge R′ to the hardware token; the hardware token generating a response X, the response X generated at least in part from the challenge R′; and

means for securely transmitting the response X from the hardware token to the authorizing device.

13. The apparatus of claim 12 , wherein the host computer fingerprint F is generated at least in part from host computer information C.

14. The apparatus of claim 13 , wherein the host computer fingerprint F is generated by hashing the host information C.

15. The apparatus of claim 13 , wherein:

the apparatus further comprises means for receiving at the host computer an authorizing device specific value V:

wherein the host computer fingerprint F is generated at least in part from the host information C and the authorizing device specific value V.

16. The apparatus of claim 15 , wherein the host computer fingerprint F is generated at least in part from a hash of the host information C and the authorizing device specific value V.

17. The apparatus of claim 15 , wherein the host computer fingerprint F is generated at least in part from a concatenation of the host information C and the authorizing device specific value V.

18. The apparatus of claim 13 , wherein the host computer is communicatively coupleable to the authorizing device and the hardware token, and the host information C includes information selected from the group comprising:

processor serial number;

hard drive serial number;

network interface MAC address;

BIOS code checksum;

operating system; and

system directory timestamp.

19. The apparatus of claim 12 , wherein the means for securely transmitting comprises generating the response X using the challenge R′ and a shared secret S between the authorizing device and the hardware token.

20. The apparatus of claim 19 , wherein the response X is the challenge R′ encrypted by the shared secret S.

21. The apparatus of claim 12 , wherein the means for securely transmitting comprises means for generating the response X using the challenge R′ and a private key K pr of a key pair having the private key K pr accessible to the token and a public key K pu accessible to the authorizing device.

22. The apparatus of claim 21 , wherein the response X is the challenge R′ encrypted by the private key K pr .

23. A computer for authenticating a hardware token different from and connectable to the computer, the computer having a processor communicatively coupled to a memory storing instructions for performing steps of:

generating a host computer fingerprint F based at least in part on a unique characteristic of the host;

transmitting the host computer fingerprint F to an authorizing device different from the computer and the hardware token;

thereafter receiving a random value R from the authorizing device;

computing a challenge R′, the challenge R′ derived at least in part from the host computer fingerprint F and the random value R;

transmitting the challenge R′ to the hardware token;

receiving a cryptographically secured response X from the hardware token, the cryptographically secured response X generated at least in part from the challenge R′; and

transmitting the cryptographically secured response X to the authorizing device.

24. The apparatus of claim 23 , wherein the instructions for generating the host computer fingerprint comprise instructions for collecting host information C and forming the host computer fingerprint F at least in part from the host information C.

25. The apparatus of claim 24 , wherein the instructions for forming the host computer fingerprint F at least in part from the host information C comprise instructions for hashing the host information C.

26. The apparatus of claim 24 , wherein:

the computer includes means for receiving an authorizing device specific value V; and

the instructions for forming the host computer fingerprint F at least in part from the host information C comprise instructions for forming the host computer fingerprint F at least in part from the host information C and the authorizing device specific value V.

27. The apparatus of claim 26 , wherein the instructions for forming the host computer fingerprint F at least in part from the host information C and the authorizing device specific value V comprise instructions for forming the host computer fingerprint F at least in part from a hash of the host information C and the authorizing device specific value V.

28. The apparatus of claim 26 , wherein the instructions for forming the host computer fingerprint F at least in part from the host information C and the authorizing device specific value V comprise instructions for forming the host computer fingerprint F at least in part from a concatenation of the host information C and the authorizing device specific value V.

29. The apparatus of claim 24 , wherein the host computer is communicatively coupleable to the authorizing device and the hardware token, and the host information C includes information selected from the group comprising:

processor serial number;

hard drive serial number;

network interlace MAC address;

BIOS code checksum;

operating system; and

system directory timestamp.

30. The apparatus of claim 23 , wherein the response X is generated from a shared secret S between the authorizing device and the hardware token.

31. The apparatus of claim 30 , wherein the response X is the challenge R′ encrypted by the shared secret S.

32. The apparatus of claim 23 , wherein the response X is generated from a private key K pr of a key pair having the private key K pr accessible to the token and a public key K pu accessible to the authorizing device.

33. The apparatus of claim 32 , wherein the response X is the challenge R′ encrypted by the private key K pr .