Method for personalizing an authentication token
An authentication token using a smart card that an organization would issue to its customer, the smart card having a processor for executing a software application that is responsive to a user input to generate a one-time password as an output. The smart card co-operates with an interface device for inputting the user input and displaying the one-time password. The authentication token may be used in combination with a remote authentication server for validation of the password and hence authentication of the user.
1. A system for personalizing an authentication token comprising:
an interface device, the authentication token, and a personalization device, the system configured to establish an encrypted session between the authentication token and the personalization device using a transport key;
the interface device including a processor, a user interface, and an interface for communication with the authentication token;
the authentication token including a personalization mode, and having a serial number; and
the personalization device being configured to encrypt the serial number of the authentication token using a personalization key, and being configured to forward the encrypted serial number to the authentication token;
the authentication token, when in the personalization mode, being configured to:
receive, from the personalization device, a request for the serial number, and return the serial number to the personalization device;
decrypt the encrypted serial number forwarded from the personalization device, and validate that the personalization key is correct;
receive, from said personalization device through the encrypted session, an initial seed value and initial secret key, the initial seed value and the initial secret key being configured to facilitate an initial interaction between the authentication token and the interface device; and
store the initial seed value and the initial secret key after decryption thereof using the transport key;
wherein, once said authentication token is personalized with the initial seed value and the initial secret key, the authentication token is configured to be unable to again enter to the personalization mode.
2. The system of claim 1 , wherein the authentication token is further configured to generate a key for use in generating a secure password used in interacting with the interface device using the initial seed value stored in a memory in the authentication token.
3. The system of claim 2 , wherein the personalization device is further configured to store, for subsequent transfer to a third party, data exchanged between the authentication token and the personalization device for use in generating the secure password.
4. The method of claim 2 , wherein the authentication token is further configured to enter into normal mode after the initial seed value and the initial secret key are stored.