Key provisioning method and apparatus for authentication tokens

1. A method comprising:

obtaining an address associated with an authentication service over a channel not secured by the authentication service, wherein obtaining the address comprises receiving a link, to a secured website administered by the authentication service, that is customized by the authentication service for a given user of an authentication token;

utilizing the customized link to obtain a public key associated with the authentication service via the secured website administered by the authentication service;

generating a symmetric key as a function of the public key and a value generated by the authentication token;

configuring the authentication token to incorporate the symmetric key;

encrypting the symmetric key utilizing the public key; and

binding the symmetric key to an identifier of the authentication token and to an identity of the given user of the authentication token by:

transmitting the encrypted symmetric key to the address associated with the authentication service via the secured website administered by the authentication service;

recording an association between the authentication token and the symmetric key; and

authenticating the given user to the authentication service, in conjunction with recording the association between the authentication token and the symmetric key, utilizing a proof of identity of the given user provided to the authentication service via the secured website administered by the authentication service;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 wherein the authentication token comprises a software authentication token implemented on the processing device.

3. The method of claim 2 wherein the software authentication token implemented on the processing device comprises an application running on the processing device.

4. The method of claim 1 further comprising:

generating a tokencode in the authentication token utilizing the symmetric key; and

transmitting the tokencode to the authentication service for authentication.

5. The method of claim 1 wherein obtaining the address and the public key comprises:

receiving the address in a message;

utilizing the address to establish a connection with a server;

receiving a certificate from the server; and

extracting the public key from the certificate.

6. The method of claim 5 wherein the message comprises one of an email message, a text message and a multimedia message.

7. The method of claim 1 wherein obtaining the address and the public key comprises obtaining the address and the public key utilizing information presented on a display of the processing device.

8. The method of claim 1 wherein obtaining the address and the public key comprises:

decoding a coded representation; and

obtaining the address and the public key from a result of the decoding.

9. The method of claim 8 wherein the coded representation comprises a QR code.

10. The method of claim 1 wherein the address comprises a network address of an authentication server providing the authentication service.

11. The method of claim 1 wherein the address comprises an HTTPS address.

12. The method of claim 1 wherein generating a symmetric key as a function of the public key comprises conditioning the symmetric key on the public key itself.

13. The method of claim 1 wherein generating a symmetric key as a function of the public key comprises conditioning the symmetric key on a certificate containing the public key.

14. The method of claim 1 wherein authenticating the given user to the authentication service in conjunction with recording the association between the authentication token and the symmetric key comprises authenticating the given user to the authentication service prior to recording the association between the authentication token and the symmetric key.

15. The method of claim 1 wherein the proof of identity of the given user comprises a password supplied via an out-of-band channel.

16. The method of claim 1 wherein generating the symmetric key comprises generating the symmetric key as a function of the public key, the value generated by the authentication token and a value supplied by the authentication service.

17. An article of manufacture comprising a non-transitory processor-readable storage medium having embodied therein one or more software programs, wherein the one or more software programs when executed by at least one processing device cause the at least one processing device:

to obtain an address associated with an authentication service over a channel not secured by the authentication service, wherein obtaining the address comprises receiving a link, to a secured website administered by the authentication service, that is customized by the authentication service for a given user of an authentication token;

to utilize the customized link to obtain a public key associated with the authentication service via the secured website administered by the authentication service;

to generate a symmetric key as a function of the public key and a value generated by the authentication token;

to configure the authentication token to incorporate the symmetric key;

to encrypt the symmetric key utilizing the public key; and

to bind the symmetric key to an identifier of the authentication token and to an identity of the given user of the authentication token by:

transmitting the encrypted symmetric key to the address associated with the authentication service via the secured website administered by the authentication service;

recording an association between the authentication token and the symmetric key; and

authenticating the given user to the authentication service, in conjunction with recording the association between the authentication token and the symmetric key, utilizing a proof of identity of the given user provided to the authentication service via the secured website administered by the authentication service.

18. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

wherein said at least one processing device is configured:

to obtain an address associated with an authentication service over a channel not secured by the authentication service, wherein obtaining the address comprises receiving a link, to a secured website administered by the authentication service, that is customized by the authentication service for a given user of an authentication token;

to utilize the customized link to obtain a public key associated with the authentication service via the secured website administered by the authentication service;

to generate a symmetric key as a function of the public key and a value generated by the authentication token;

to configure the authentication token to incorporate the symmetric key;

to encrypt the symmetric key utilizing the public key; and

to bind the symmetric key to an identifier of the authentication token and to an identity of the given user of the authentication token by:

transmitting the encrypted symmetric key to the address associated with the authentication service via the secured website administered by the authentication service;

recording an association between the authentication token and the symmetric key; and

authenticating the given user to the authentication service, in conjunction with recording the association between the authentication token and the symmetric key, utilizing a proof of identity of the given user provided to the authentication service via the secured website administered by the authentication service.

19. The apparatus of claim 18 wherein the processing device comprises one of a mobile telephone and a computer.

20. The apparatus of claim 18 wherein the authentication token comprises a software authentication token implemented on the processing device.

21. A method comprising: providing an address associated with an authentication service over a channel not secured by the authentication service, wherein providing the address comprises sending a link, to a secured website administered by the authentication service, that is customized by the authentication service for a given user of an authentication token; utilizing the customized link to provide a public key associated with the authentication service via the secured website administered by the authentication service; and binding a symmetric key to an identifier of the authentication token and to an identity of the given user of the authentication token by: receiving, via the secured website administered by the authentication service, an encrypted symmetric key generated as a function of the public key and a value generated by the authentication token; recording an association between the authentication token and the symmetric key; and authenticating the given user to the authentication service, in conjunction with recording the association between the authentication token and the symmetric key, utilizing a proof of identity of the given user received by the authentication service via the secured website administered by the authentication service; wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

22. An article of manufacture comprising a non-transitory processor-readable storage medium having embodied therein one or more software programs, wherein the one or more software programs when executed by at least one processing device cause the at least one processing device: to provide an address associated with an authentication service over a channel not secured by the authentication service, wherein providing the address comprises sending a link, to a secured website administered by the authentication service, that is customized by the authentication service for a given user of an authentication token; to utilize the customized link to provide a public key associated with the authentication service via the secured website administered by the authentication service; and to bind a symmetric key to an identifier of the authentication token and to an identity of the given user of the authentication token by: receiving, via the secured website administered by the authentication service, an encrypted symmetric key generated as a function of the public key and a value generated by the authentication token; recording an association between the authentication token and the symmetric key; and authenticating the given user to the authentication service, in conjunction with recording the association between the authentication token and the symmetric key, utilizing a proof of identity of the given user received by the authentication service via the secured website administered by the authentication service.

23. An apparatus comprising: at least one processing device comprising a processor coupled to a memory; wherein said at least one processing device is configured: to provide an address associated with an authentication service over a channel not secured by the authentication service, wherein providing the address comprises sending a link, to a secured website administered by the authentication service, that is customized by the authentication service for a given user of an authentication token; to utilize the customized link to provide a public key associated with the authentication service via the secured website administered by the authentication service; and to bind a symmetric key to an identifier of the authentication token and to an identity of the given user of the authentication token by: receiving, via the secured website administered by the authentication service, an encrypted symmetric key generated as a function of the public key and a value generated by the authentication token; recording an association between the authentication token and the symmetric key; and authenticating the given user to the authentication service, in conjunction with recording the association between the authentication token and the symmetric key, utilizing a proof of identity of the given user received by the authentication service via the secured web site administered by the authentication service.