Token based authentication
According to an example aspect of the present invention, there is provided an apparatus comprising a memory configured to store a first token and a second token, and at least one processing core configured to obtain a first value based at least in part on the first token and the second token, and to cause the apparatus to participate in a security procedure, based at least in part on the first hash, with a second apparatus.
1. A first apparatus comprising, at least one processor, and at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the first apparatus at least to:
store a first token and a second token;
obtain, from a server, a second hash, the second hash being based on the first token and a third token, wherein the first apparatus does not know the third token when the second hash is obtained;
derive, after the obtaining of the second hash from the server, a first hash value based at least in part on the first token and the second token by providing the second token and the second hash to a hash algorithm as input, wherein the first apparatus does not know the third token when the first hash is derived, and
participate in a security procedure, based at least in part on the first hash value, with a second apparatus, wherein the security procedure comprises an encryption procedure, which comprises the first apparatus encrypting information using the first hash or a key derived from the first hash as an encryption key, and transmitting the encrypted information to the second apparatus for decryption in the second apparatus,
wherein the first apparatus, the second apparatus and the server are three separate devices.
2. The first apparatus according to claim 1 , wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the first apparatus to cause transmission of the first token and the first hash value to the second apparatus.
3. The first apparatus according to claim 1 , wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the first apparatus to obtain the second token from a short-range apparatus.
4. The first apparatus according to claim 3 , wherein the short-range apparatus comprises a radio-frequency tag.
5. The first apparatus according to claim 1 , wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the first apparatus to obtain the first token from the second apparatus.
6. The first apparatus according to claim 1 , wherein the security procedure comprises an authentication procedure, which comprises the first apparatus transmitting the first hash value to the second apparatus.
7. A method comprising:
storing a first token and a second token in a first apparatus;
obtaining, from a server, a second hash, the second hash being based on the first token and a third token, wherein the first apparatus does not know the third token when the second hash is obtained;
deriving, after the obtaining of the second hash from the server, a first hash value based at least in part on the first token and the second token by providing the second token and the second hash to a hash algorithm as input, wherein the first apparatus does not know the third token when the first hash value is derived, and
participating in a security procedure, based at least in part on the first hash value, with a second apparatus, wherein the security procedure comprises an encryption procedure, which comprises the first apparatus encrypting information using the first hash or a key derived from the first hash as an encryption key, and transmitting the encrypted information to the second apparatus for decryption in the second apparatus,
wherein the first apparatus, the second apparatus and the server are three separate devices.
8. The method according to claim 7 , further comprising causing a transmitter to cause transmission of the first token and the first hash value to the second apparatus.
9. The method according to claim 7 , further comprising obtaining the second token from a short-range apparatus.
10. The method according to claim 9 , wherein the short-range apparatus comprises a radio-frequency tag.
11. The method according to claim 7 , further comprising obtaining the first token from the second apparatus.
12. A non-transitory computer readable medium having stored thereon a set of computer readable instructions that, when executed by at least one processor, cause a first apparatus to at least:
store a first token and a second token;
obtain, from a server, a second hash, the second hash being based on the first token and a third token, wherein the first apparatus does not know the third token when the second hash is obtained;
derive, after the obtaining of the second hash from the server, a first hash value based at least in part on the first token and the second token by providing the second token and the second hash to a hash algorithm as input, wherein the first apparatus does not know the third token when the first hash value is derived, and
participate in a security procedure, based at least in part on the first hash value, with a second apparatus, wherein the security procedure comprises an encryption procedure, which comprises the first apparatus encrypting information using the first hash or a key derived from the first hash as an encryption key, and transmitting the encrypted information to the second apparatus for decryption in the second apparatus,
wherein the first apparatus, the second apparatus and the server are three separate devices.