Managing seed provisioning
View Patent ↗A method is used in managing seed provisioning. An authentication device having a device value is provisioned with a seed value. The seed value and device value are provided. Based on the seed value and the device value, the method prepares to authenticate the authentication device.
1. A method for use in managing seed provisioning, the method comprising the steps of:
programming a unique device value into an authentication device, the programming performed by a first user;
creating, via the first user, a first user signed token record that includes the unique device value and configuration data;
binding the token record to the authentication device;
provisioning the authentication device with a unique seed value, the authentication device having the unique device value;
programming the seed value into the authentication device, wherein the seed value is generated by the first user and programming the seed value into the authentication device is performed by a second user; and
providing, via the second user, the unique seed value and the first user signed token record to an authentication server to authenticate using the authentication device.
2. The method of claim 1 further including deriving the device value using information associated with the authentication device.
3. The method of claim 2 wherein the information associated with the authentication device includes a signed device value associated with the authentication device.
4. The method of claim 2 wherein the information associated with the authentication device is contained in a signed token record.
5. The method of claim 4 wherein the signed token record is signed by an authentication device vendor.
6. The method of claim 4 further including verifying the signature of the signed token record.
7. The method of claim 4 further including authenticating the authentication device using the seed value and the device value in the signed token record.
8. The method of claim 1 wherein providing the seed value and device value further includes providing the seed value with a token record containing the device value to an authentication server.
9. The method of claim 1 wherein providing the seed value and device value further includes providing the seed value and device value to an authentication server.
10. The method of claim 9 wherein providing the seed value and device value to a server further includes providing to the server a concatenated or combined file comprising the seed value and a device value, signed device value, or signed token record.
11. An apparatus for use in managing seed provisioning, the system comprising:
first hardware logic configured to program a unique device value into an authentication device, the programming performed by a first user;
second hardware logic configured to create, via the first user, a first user signed token record that includes the unique device value and configuration data;
third hardware logic configured to bind the token record to the authentication device;
fourth hardware logic configured to provision the authentication device with a unique seed value, the authentication device having the unique device value;
fifth hardware logic configured to program the seed value into the authentication device, wherein the seed value is generated by the first user and programming the seed value into the authentication device is performed by a second user; and
sixth hardware logic configured to provide, via the second user, the unique seed value and the first use signed token record to an authentication server to authenticate using the authentication device.
12. The apparatus of claim 11 further including seventh hardware logic configured to derive the device value using information associated with the authentication device.
13. The apparatus of claim 12 wherein the information associated with the authentication device includes a signed device value associated with the authentication device.
14. The apparatus of claim 12 wherein the information associated with the authentication device is contained in a signed token record.
15. The apparatus of claim 14 wherein the signed token record is signed by an authentication device vendor.
16. The apparatus of claim 14 further including eight hardware logic configured to verify the signature of the signed token record.
17. The apparatus of claim 14 further including ninth hardware logic configured to authenticate the authentication device using the seed value and the device value in the signed token record.
18. The apparatus of claim 11 wherein providing the seed value and device value further includes providing the seed value with a token record containing the device value to an authentication server.
19. The apparatus of claim 11 wherein providing the seed value and device value further includes providing the seed value and device value to an authentication server.
20. The apparatus of claim 19 wherein providing the seed value and device value to a server further includes providing to the server a concatenated or combined file comprising the seed value and a device value, signed device value, or signed token record.