Authenticated remote pin unblock
This invention provides a simple and secure PIN unblock mechanism for use with a security token. A set of one or more passphrases are stored on a remote server during personalization. Likewise, the answers to the passphrases are hashed and stored inside the security token for future comparison. A local client program provides the user input and display dialogs and ensures a secure communications channel is provided before passphrases are retrieved from the remote server. Retrieval of passphrases and an administrative unblock secret from the remote server are accomplished using a unique identifier associated with the security token, typically the token's serial number. A PIN unblock applet provides the administrative mechanism to unblock the security token upon receipt of an administrative unblock shared secret. The remote server releases the administrative unblock shared secret only after a non-forgeable confirmatory message is received from the security token that the user has been properly authenticated. The administrative unblock shared secret is encrypted with the token's public key during transport to maximize security.
1. Computer software, provided in a non-transitory computer-readable medium, that facilitates an authenticated user to unblock a temporarily blocked security token, the software comprising:
executable code that generates at least one passphrase;
executable code that associates the at least one passphrase with a unique identifier;
executable code that stores the at least one passphrase on a server in a manner retrievable using the unique identifier;
executable code that generates answers associated with the at least one passphrase;
executable code that performs a message digest function on the answers associated with the at least one passphrase; and
executable code that stores a result of the message digest function in a security token associated with the authenticated user, wherein the security token is used in an access attempt at a site that is remote from the server, wherein processing to unblock the security token is performed at the site using the result of the message digest function stored in the security token and using a security executive software module provided on the security token and an unblock applet that communicates with the security executive and automatically unblocks the security token, and wherein the unique identifier is associated with the security token.
2. Computer software, according to claim 1 , further comprising:
executable code that encrypts the at least one passphrase with a public asymmetric key associated with the security token.
3. Computer software, according to claim 1 , wherein the first secret is a one way hash of an answer to the at least one unblock inquiry.
4. Computer software, according to claim 3 , wherein the security token further includes a private asymmetric key.
5. Computer software, according to claim 4 , wherein the server further includes a public asymmetric key counterpart to the private asymmetric key.
6. Computer software, according to claim 5 , wherein the at least one unblock inquiry is encrypted with the public asymmetric key.
7. Computer software, according to claim 6 , wherein the second shared secret is encrypted with the public asymmetric key.
8. Computer software, according to claim 7 , wherein the second shared secret is an administrative PIN.
9. Computer software, according to claim 8 , wherein the second shared secret is a symmetric key.
10. Computer software, according to claim 7 , wherein the second shared secret is decrypted with the private asymmetric key.
11. Computer software, according to claim 1 , wherein the first shared secret is equal to the second shared secret.
12. Computer software, according to claim 1 , wherein the second shared secret is sent to the security token upon receipt of a properly encoded message by the at least one unblock service application.
13. Computer software, according to claim 1 , wherein the at least one unblock inquiry includes a passphrase.
14. Computer software, according to claim 1 , wherein the processing communications includes a secure communications protocol.