Authentication using security device with electronic interface
View Patent ↗An authentication technique employs a security device that communicates with a software token construct installed on a user device via a connector. The technique includes secure provisioning of an authentication seed and safe storage of the seed in encrypted form on the user device. A key for decrypting the seed is stored within the security device, and token codes are generated by physically connecting the security device to the user device and conveying the encrypted seed from the user device to the security device over the connector.
1. A method of authenticating a user to a computing resource, comprising:
receiving, by a security device, an encrypted authentication seed from a user device over a connector connected between the security device and the user device;
decrypting, by the security device, the encrypted authentication seed received over the connector; and
generating, by the security device, a token code based at least in part on the decrypted authentication seed, the token code providing at least one authentication factor for authenticating the user to the computing resource,
wherein decrypting the encrypted authentication seed is performed using a decryption key that differs from decryption keys assigned to multiple other security devices of like kind, such that the other security devices cannot decrypt the encrypted authentication seed using their decryption keys,
wherein the encrypted authentication seed is received over the connector as an analog electronic signal conveying the encrypted authentication seed, and
wherein the method further comprises—
rendering the analog electronic signal as a digital signal representing the encrypted authentication seed in digital form; and
transmitting the token code from the security device over the connector to the user device, wherein transmitting the token code includes (a) rendering the token code as an analog electronic signal and (b) conveying the analog electronic signal representing the token code to the user device via the connector.
2. The method of claim 1 , further comprising, prior to receiving the encrypted authentication seed for authenticating the user to the computing resource, performing a provisioning operation, the provisioning operating including:
receiving the authentication seed from the user device over the connector connected between the security device and the user device;
encrypting, by the security device, the authentication seed using an encryption key that differs from encryption keys assigned to other security devices of like kind; and
transmitting, by the security device, the encrypted authentication seed to the user device over the connector.
3. The method of claim 2 , wherein the encryption key and the decryption key are implemented together in a symmetric key stored in the security device, the symmetric key differing from symmetric keys assigned to other security devices of like kind.
4. The method of claim 3 , wherein, when receiving the authentication seed during the provisioning operation, the authentication seed is encrypted with a public key, and wherein the method further comprises applying a private key stored in the security device to the received authentication seed to decrypt the authentication seed.
5. The method of claim 2 , wherein encrypting the authentication seed binds the security device to the authentication seed so that no other security device can decrypt the encryption seed.
6. The method of claim 1 , further comprising the security device receiving transaction data from the user device over the connector contemporaneously with receiving the encrypted authentication seed, the transaction data including information relative to an online transaction of the user device with a server that requires the user device to authenticate to the computing resource to complete the online transaction, wherein generating the token code is further based at least in part on the transaction data.
7. The method of claim 1 , wherein the token code has a display, and wherein the method further comprises, after generating the token code, the security device displaying the token code on the display.
8. The method of claim 7 , wherein the method further comprises, prior to the security device receiving the encrypted authentication seed from the user device, a software token construct that runs on the user device directing the user to plug the security device into the user device.
9. The method of claim 8 , wherein the method further comprises, subsequent to the security device receiving the encrypted authentication seed from the user device, the software token construct running on the user device directing the user to disconnect the security device from the user device.
10. The method of claim 1 , further comprising receiving, by the user, the security device via postal service.
11. The method of claim 10 ,
wherein the decryption key is established when the security device is manufactured and becomes a permanent part of the security device, and
wherein, when receiving the security device via postal service, the security device already includes the decryption key.
12. The method of claim 1 , further comprising purchasing, by the user, the security device at a retail store.
13. The method of claim 1 , wherein the decryption key is established in the security device when the security device is manufactured and becomes a permanent part of the security device.
14. The method of claim 13 , wherein the decryption key cannot be accessed from outside the security device.
15. A plurality of security devices, each security device comprising:
a connector;
a set of processors coupled to the connector; and
memory, coupled to the set of processors, the memory storing executable instructions, which when executed by the set of processors cause the set of processors to:
receive an encrypted authentication seed from a user device over the connector;
decrypt the encrypted authentication seed received over the connector by applying a decryption key that differs from decryption key assigned to any other security device of the plurality of security devices, such that none of the other security devices can decrypt the encrypted authentication seed; and
generate a token code based at least in part on the decrypted authentication seed, the token code providing at least one authentication factor for authenticating the user to the computing resource,
wherein each of the plurality of security devices further comprises an analog-to-digital converter constructed and arranged to receive the encrypted authentication seed as an analog signal and to convert the analog signal to a digital signal representing the encrypted authentication seed in digital form, and
wherein each of the plurality of security devices further comprises a digital-to-analog converter constructed and arranged to transmit the token code over the connector to the user device as an analog signal representing the token code in analog form.
16. The plurality of security devices of claim 15 , wherein, the executable instructions, when executed by the set of processors, further cause the set of processors of each of the plurality of security devices to:
receive the authentication seed from the user device over the connector during a provisioning operation;
encrypt the authentication seed using an encryption key that differs from encryption keys assigned to any other security device of the plurality of security devices; and
transmit the encrypted authentication seed to the user device over the connector.
17. The plurality of security devices of claim 15 , wherein each of the plurality of security devices is provided as a key fob, and wherein the decryption key of each of the plurality of security devices is established in the respective security device when the security device is manufactured and becomes a permanent part of the respective security device.
18. A non-transitory computer readable medium including instructions which, when executed by a set of processors of a computing device, cause the set of processors to perform a method of authenticating a user to a computing resource, the method comprising:
receiving, by a security device, an encrypted authentication seed from a user device over a connector connected between the security device and the user device;
decrypting by the security device, the encrypted authentication seed received over the connector; and
generating, by the security device, a token code based at least in part on the decrypted authentication seed, the token code providing at least one authentication factor for authenticating the user to the computing resource,
wherein decrypting the encrypted authentication seed is performed using a decryption key that differs from decryption keys assigned to multiple other security devices of like kind, such that the other security devices cannot decrypt the encrypted authentication seed,
wherein the encrypted authentication seed is received over the connector as an analog electronic signal conveying the encrypted authentication seed, and
wherein the method further comprises—
rendering the analog electronic signal as a digital signal representing the encrypted authentication seed in digital form; and
transmitting the token code from the security device over the connector to the user device, wherein transmitting the token code includes (a) rendering the token code as an analog electronic signal and (b) conveying the analog electronic signal representing the token code to the user device via the connector.
19. The non-transitory computer readable medium of claim 18 , wherein the method further comprises, prior to receiving the encrypted authentication seed for authenticating the user to the computing resource, performing a provisioning operation, the provisioning operating including:
receiving the authentication seed from the user device over the connector connected between the security device and the user device;
encrypting, by the security device, the authentication seed using an encryption key that differs from encryption keys assigned to other security devices of like kind;
transmitting, by the security device, the encrypted authentication seed to the user device over the connector.
20. The non-transitory computer readable medium of claim 19 , wherein the encryption key and the decryption key are implemented together in a symmetric key stored in the security device, the symmetric key differing from symmetric keys assigned to other security devices of like kind.
21. The non-transitory computer readable medium of claim 19 , wherein, when receiving the authentication seed during the provisioning operation, the authentication seed arrives is encrypted with a public key, and wherein the method further comprises applying a private key stored in the security device to the received authentication seed to decrypt the authentication seed.