Secure authentication using hardware token and computer fingerprint

1. A method of authenticating a hardware token for operation with a host, comprising:

retrieving a value X from a memory accessible to an authenticating entity, the value X generated from a non-varying computer fingerprint F of the host and an identifier P securing access to the hardware token, wherein the fingerprint F is computed at least in part from non-varying host information C based on a unique characteristic of the host;

regenerating the same identifier P at least in part from the value X and the fingerprint F; and

transmitting the regenerated identifier P to the hardware token to authenticate the hardware token for operation with the host,

the value X being computed at least in part from a user identifier U, according to X=f(P, U, F), wherein f(P, U, F) is a reversible function such that f(f(P, U, F), U, F)=P.

2. The method of claim 1 , wherein the fingerprint F is computed at least in part from the host information C and a non-varying server specific value V.

3. The method of claim 1 , wherein the fingerprint F is computed at least in part from the host information C, a non-varying server specific value V and a non-varying string Z.

4. The method of claim 1 , wherein the value X is computed in the hardware token.

5. The method of claim 1 , wherein the value X is computed according to X=ƒ(P, F), wherein ƒ(P, F) is a reversible function such that f(ƒ(P, F), F)=P.

6. The method of claim 5 , wherein ƒ(P, F) comprises P XOR F.

7. The method of claim 1 , wherein f(P, U, F) is P XOR U XOR F.

8. The method of claim 1 , wherein:

the authenticating entity is the host computer, communicatively coupleable to the hardware token; and

the value X is stored in the host computer.

9. The method of claim 1 , wherein the value X is stored in the memory accessible to the authenticating entity by performing steps comprising:

computing a reference value H associated with the value X; and

associably storing the value X and the reference value H in a memory of the hardware token.

10. The method of claim 9 , wherein the step of retrieving the value X comprises:

computing the reference value H at least in part from the fingerprint F; and

retrieving the value X associated with the reference value H.

11. The method of claim 10 , wherein the step of computing the reference value H at least in part from the fingerprint F comprises computing H as a hash of the fingerprint F.

12. The method of claim 9 , wherein the reference value H is computed at least in part from a hash of the fingerprint F.

13. An apparatus for authenticating a hardware token for operation with a host, comprising computer hardware programmed:

for retrieving a value X from a memory accessible to an authenticating entity, the value X generated from a non-varying computer fingerprint F of the host and an identifier P securing access to the hardware token, wherein the fingerprint F is computed at least in part from non-varying host information C based on a unique characteristic of the host;

for regenerating the same identifier P at least in part from the value X and the fingerprint F; and

for transmitting the regenerated identifier P to the hardware token to authenticate the hardware token for operation with the host,

wherein the value X is further computed at least in part from a user identifier U, according to X=f(P, U, F), wherein f(P, U, F) is a reversible function such that f(f(P, U, F), U, F)=P.

14. The apparatus of claim 13 , wherein the fingerprint F is computed at least in part from the host information C and a non-varying server specific value V.

15. The apparatus of claim 13 , wherein the fingerprint F is computed at least in part from the host information C, a non-varying server specific value V and a non-varying string Z.

16. The apparatus of claim 13 , wherein the value X is computed in the hardware token.

17. The apparatus of claim 13 , wherein, the value X is computed according to X=ƒ(P, F), wherein ƒ(P, F) is a reversible function such that f(ƒ(P, F), F)=P.

18. The apparatus of claim 17 , wherein ƒ(P, F) comprises P XOR F.

19. The apparatus of claim 13 , wherein f(P, U, F) is P XOR U XOR F.

20. The apparatus of claim 13 , wherein:

the authenticating entity is the host computer, communicatively coupleable to the hardware token; and

the value X is stored in the host computer.

21. The apparatus of claim 13 , wherein the computer hardware is further programmed for computing a reference value H associated with the value X; and

the hardware token is operative for associably storing the value X and the reference value H in a memory of the hardware token.

22. The apparatus of claim 21 , wherein retrieving the value X comprises:

computing the reference value H at least in part from the fingerprint F; and

retrieving the value X associated with the reference value H.

23. The apparatus of claim 22 , wherein computing the reference value H at least in part from the fingerprint F comprises computing H as a hash of the fingerprint F.

24. The apparatus of claim 21 , wherein the reference value H is computed at least in part from a hash of the fingerprint F.

25. An apparatus for authenticating a hardware token for operation with a host, the apparatus comprising a hardware processor and a non-volatile computer readable storage medium storing instructions for performing steps comprising:

retrieving a value X from a memory accessible to an authenticating entity, the value X generated from a non-varying computer fingerprint F of the host and an identifier P securing access to the hardware token, wherein the fingerprint F is computed at least in part from non-varying host information C based on a unique characteristic of the host;

regenerating the same identifier P at least in part from the value X and the fingerprint F; and

transmitting the regenerated identifier P to the hardware token to authenticate the hardware token for operation with the host,

wherein the value X is further computed at least in part from a user identifier U, according to X=f(P, U, F), wherein f(P, U, F) is a reversible function such that f(f(P, U, F), U, F)=P.

26. The apparatus of claim 25 , wherein the fingerprint F is computed at least in part from the host information C and a non-varying server specific value V.

27. The apparatus of claim 25 , wherein the fingerprint F is computed at least in part from the host information C, a non-varying server specific value V and a non-varying string Z.

28. The apparatus of claim 25 , wherein the value X is computed in the hardware token.

29. The apparatus of claim 25 , wherein the value X is computed according to X=ƒ(P, F), wherein ƒ(P, F) is a reversible function such that f(ƒ(P, F)=P.

30. The apparatus of claim 29 , wherein ƒ(P, F) comprises P XOR F.

31. The apparatus of claim 25 , wherein f(P, U, F) is P XOR U XOR F.

32. The apparatus of claim 25 , wherein:

the authenticating entity is the host computer, communicatively coupleable to the hardware token; and

the value X is stored in the host computer.

33. The apparatus of claim 25 , wherein the value X is stored in a memory of the hardware token, and the processing steps further comprise:

computing a reference value H associated with the value X; and

associably storing the value X and the reference value H in a memory of the hardware token.

34. The apparatus of claim 33 , wherein the instructions for retrieving the value X comprise instructions for performing steps comprising:

computing the reference value H at least in part from the fingerprint F; and

retrieving the value X associated with the reference value H.

35. The apparatus of claim 34 , wherein the instructions for computing the reference value H at least in part from the fingerprint F comprise instructions for computing H as a hash of the fingerprint F.

36. The apparatus of claim 33 , wherein the reference value H is computed at least in part from a hash of the fingerprint F.