Online and offline validation of tokencodes
View Patent ↗An apparatus comprises a processing device configured to receive a request for access to a given protected resource, to receive a tokencode for validating the request for access to the given protected resource, to determine whether the processing device is connected to a network, to send the tokencode to a remote server over the network for validation responsive to determining that the processing device is connected to the network, and to validate the tokencode in the processing device to access the given protected resource responsive to determining that the processing device is not connected to the network.
1. An apparatus comprising:
a processing device configured to:
receive a request for access to a given protected resource;
receive, from an authentication token, a tokencode for validation in conjunction with the request for access to the given protected resource;
determine whether the processing device is connected to a network;
perform online validation responsive to determining that the processing device is connected to the network; and
perform offline validation responsive to determining that the processing device is not connected to the network by validating the received tokencode in the processing device;
wherein the processing device is configured to perform online validation by one of:
generating an additional tokencode in the processing device and sending the received tokencode and the additional tokencode to a server over the network for validation; and
generating an additional tokencode in the processing device based at least in part on the received tokencode and sending the additional tokencode to a server over the network for validation.
2. The apparatus of claim 1 , wherein the processing device comprises an authentication module configured to validate the received tokencode in the processing device.
3. The apparatus of claim 2 , wherein the authentication module runs in a trusted platform module of the processing device.
4. The apparatus of claim 2 , wherein the authentication module runs in a trusted execution environment of the processing device.
5. The apparatus of claim 2 , wherein the apparatus further comprises an embedded secure element, and wherein the authentication module runs on the embedded secure element.
6. The apparatus of claim 5 , wherein the embedded secure element comprises one of a smartcard and a subscriber identity module card.
7. The apparatus of claim 2 , wherein the additional tokencode is generated based at least in part on a cryptographic key provisioned in the authentication module.
8. The apparatus of claim 1 , wherein the received tokencode comprises a time-based tokencode and the processing device is configured to synchronize time with the authentication token for use in validating the received tokencode in the processing device and to synchronize time with the server for use in generating the additional tokencode sent to the server for validation.
9. The apparatus of claim 1 , wherein the received tokencode comprises an event-based tokencode and the processing device is configured to maintain a first counter for use in validating the received tokencode in the processing device and to maintain a second counter for use in generating the additional tokencode sent to the server for validation, the first counter being different than the second counter.
10. The apparatus of claim 1 , wherein the protected resource comprises another processing device.
11. The apparatus of claim 1 , wherein the processing device is configured to:
store data associated with one or more protected resources in a local memory;
sync the data stored in the local memory with data stored on the server over the network;
access the data stored on the server responsive to a successful online validation; and
access the data stored in the local memory responsive to a successful offline validation.
12. The apparatus of claim 11 , wherein the processing device is configured to access the local memory without connecting to the network.
13. The apparatus of claim 1 , wherein the processing device comprises one of: a smartphone, a tablet, a laptop computing device and a desktop computing device.
14. The apparatus of claim 1 , wherein the received tokencode and the additional tokencode are generated using at least one of: independent and unique keys; and different moving factors.
15. A method performed by a processing device comprising:
receiving a request for access to a given protected resource;
receiving, from an authentication token, a tokencode for validation in conjunction with the request for access;
determining whether the processing device is connected to a network;
performing online validation responsive to determining that the processing device is connected to the network; and
performing offline validation responsive to determining that the processing device is not connected to the network by validating the received tokencode in the processing device;
wherein performing online validation comprises one of:
generating an additional tokencode in the processing device and sending the received tokencode and the additional tokencode to a server over the network for validation; and
generating an additional tokencode in the processing device based at least in part on the received tokencode and sending the additional tokencode to a server over the network for validation.
16. The method of claim 15 , further comprising:
storing data associated with one or more protected resources in a local memory of the processing device;
syncing the data stored in the local memory with data stored on the server over the network;
accessing the data stored on the server responsive to a successful online validation; and
accessing the data stored in, the local memory responsive to a successful offline validation;
wherein the local memory is accessible without connecting to the network.
17. An article of manufacture comprising a processor-readable storage medium having processor-readable program code embodied therein, which, when executed by a processor, causes the processor to perform the method of claim 15 .
18. The method of claim 15 , wherein receiving the tokencode further comprises:
sending a challenge to the authentication token; and
receiving the tokencode from the authentication token.
19. A method performed by a processing device comprising:
receiving a request for access to a given protected resource;
receiving a tokencode for validating the request for access;
determining whether the processing device is connected to a network;
sending the tokencode to a server for validation responsive to determining that the processing device is connected to the network; and
validating the tokencode in the processing device responsive to determining that the processing device is not connected to the network;
wherein receiving the tokencode comprises receiving a first tokencode from an authentication token and generating a second tokencode in the processing device;
wherein sending the tokencode to the server comprises sending the first tokencode and the second tokencode to the server; and
wherein validation by the server comprises validating the first tokencode and the second tokencode.
20. The method of claim 19 , wherein the first tokencode and the second tokencode are generated using independent and unique keys and one or more moving factors, the one or more moving factors comprising at least one of a time value and a counter value.