Systems and methods for detecting cloning of security tokens
View Patent ↗The disclosed computer-implemented method for detecting cloning of security tokens may include (i) logging, at an authentic security token, one-time-use security codes that are derived at the authentic security token from a shared secret that is stored at the authentic security token, (ii) logging, at a validation server, one-time-use security codes that are derived from the shared secret and received at the validation server, (iii) determining that the authentic security token has been cloned by determining that the one-time-use security codes logged at the validation server include at least one additional one-time-use security code that is not included in the one-time-use security codes logged at the authentic security token, and (iv) performing a security action in response to determining that the authentic security token has been cloned. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting cloning of security tokens, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
logging, at an authentic security token, one-time-use security codes that are derived at the authentic security token from a shared secret that is stored at the authentic security token, wherein the authentic security token is the only security token on which the shared secret is intended to be used to generate one-time-use security codes;
logging, at a validation server, one-time-use security codes that are derived from the shared secret and received at the validation server;
determining that the authentic security token has been cloned by determining that the one-time-use security codes logged at the validation server include at least one additional one-time-use security code that is not included in the one-time-use security codes logged at the authentic security token; and
performing a security action in response to determining that the authentic security token has been cloned.
2. The computer-implemented method of claim 1 , further comprising transmitting, from the authentic security token to the validation server, a representation of the one-time-use security codes logged at the authentic security token, wherein the step of determining that the authentic security token has been cloned is performed at the validation server.
3. The computer-implemented method of claim 2 , wherein the representation of the one-time-use security codes logged at the authentic security token comprises the one-time-use security codes logged at the authentic security token.
4. The computer-implemented method of claim 2 , wherein the representation of the one-time-use security codes logged at the authentic security token comprises a timestamp of each of the one-time-use security codes logged at the authentic security token.
5. The computer-implemented method of claim 1 , further comprising transmitting, from the validation server to the authentic security token, a representation of the one-time-use security codes logged at the validation server, wherein the step of determining that the authentic security token has been cloned is performed at the authentic security token.
6. The computer-implemented method of claim 5 , wherein the representation of the one-time-use security codes logged at the validation server comprises the one-time-use security codes logged at the authentic security token.
7. The computer-implemented method of claim 5 , wherein the representation of the one-time-use security codes logged at the validation server comprises a timestamp of each of the one-time-use security codes logged at the authentic security token.
8. The computer-implemented method of claim 5 , wherein the representation of the one-time-use security codes logged at the validation server comprises a hashed timestamp of each of the one-time-use security codes logged at the authentic security token.
9. The computer-implemented method of claim 1 , wherein the one-time-use security codes comprise one-time passwords.
10. The computer-implemented method of claim 1 , wherein the one-time-use security codes comprise payment-transaction-specific dynamic security codes.
11. The computer-implemented method of claim 1 , wherein performing the security action comprises invalidating the shared secret.
12. The computer-implemented method of claim 1 , wherein performing the security action comprises notifying an interested party of the authentic security token having been cloned.
13. A system for detecting cloning of security tokens, the system comprising:
a client-side logging module, stored in memory, that logs, at an authentic security token, one-time-use security codes that are derived at the authentic security token from a shared secret that is stored at the authentic security token, wherein the authentic security token is the only security token on which the shared secret is intended to be used to generate one-time-use security codes;
a server-side logging module, stored in memory, that logs, at a validation server, one-time-use security codes that are derived from the shared secret and received at the validation server;
a determining module, stored in memory, that determines that the authentic security token has been cloned by determining that the one-time-use security codes logged at the validation server include at least one additional one-time-use security code that is not included in the one-time-use security codes logged at the authentic security token;
a security module, stored in memory, that performs a security action in response to determining that the authentic security token has been cloned; and
at least one physical processor that executes the client-side logging module, the server-side logging module, the determining module, and the security module.
14. The system of claim 13 , wherein:
the client-side logging module further transmits, from the authentic security token to the validation server, a representation of the one-time-use security codes logged at the authentic security token; and
the validation server comprises the determining module.
15. The system of claim 13 , wherein:
the server-side logging module further transmits, from the validation server to the authentic security token, a representation of the one-time-use security codes logged at the validation server; and
the authentic security token comprises the determining module.
16. The system of claim 15 , wherein the representation of the one-time-use security codes logged at the validation server comprises the one-time-use security codes logged at the authentic security token.
17. The system of claim 15 , wherein the representation of the one-time-use security codes logged at the validation server comprises a hashed timestamp of each of the one-time-use security codes logged at the authentic security token.
18. The system of claim 13 , wherein the one-time-use security codes comprise at least one of:
one-time passwords; and
payment-transaction-specific dynamic security codes.
19. The system of claim 13 , wherein performing the security action comprises performing at least one of:
invalidating the shared secret; and
notifying an interested party of the authentic security token having been cloned.
20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
log, at an authentic security token, one-time-use security codes that are derived at the authentic security token from a shared secret that is stored at the authentic security token, wherein the authentic security token is the only security token on which the shared secret is intended to be used to generate one-time-use security codes;
log, at a validation server, one-time-use security codes that are derived from the shared secret and received at the validation server;
determine that the authentic security token has been cloned by determining that the one-time-use security codes logged at the validation server include at least one additional one-time-use security code that is not included in the one-time-use security codes logged at the authentic security token; and
perform a security action in response to determining that the authentic security token has been cloned.