Cryptographic device with administrative access interface utilizing event-based one-time passcodes
A cryptographic device comprises a processor coupled to a memory and is configured to maintain an event counter characterizing a number of successful administrative accesses to the cryptographic device. The cryptographic device is further configured to receive an event-based one-time passcode for a given administrative access attempt, to compare the received event-based one-time passcode to an expected event-based one-time passcode determined as a function of a current value of the event counter, and to grant or deny the given administrative access attempt based at least in part on a result of the comparing. The cryptographic device may store an administrative seed value, with the expected event-based one-time passcode being determined as a function of the administrative seed value and the current value of the event counter. The cryptographic device illustratively comprises a smartcard, a hardware or software authentication token, an Internet-of-Things (IoT) device, or other type of processor-based device having an administrative access interface.
1. An apparatus comprising:
a cryptographic device comprising a processor coupled to a memory;
the cryptographic device being configured:
to maintain an event counter characterizing a number of successful administrative accesses to the cryptographic device;
to receive an event-based one-time passcode for a given administrative access attempt;
to compare the received event-based one-time passcode to an expected event-based one-time passcode determined as a function of a current value of the event counter by:
identifying a window of having a plurality of acceptable event counter values as a function of the current value of the event counter, and,
determining if an event counter value of the received event-based one-time passcode falls within the identified window; and
to grant or deny the given administrative access attempt based at least in part on a result of the comparing.
2. The apparatus of claim 1 wherein the cryptographic device is further configured to store an administrative seed value.
3. The apparatus of claim 2 wherein the expected event-based one-time passcode is determined as a function of the administrative seed value and the current value of the event counter.
4. The apparatus of claim 1 wherein the cryptographic device comprises a smartcard.
5. The apparatus of claim 1 wherein the cryptographic device comprises at least one of a hardware authentication token and a software authentication token.
6. The apparatus of claim 1 wherein the cryptographic device comprises an Internet-of-Things (IoT) device.
7. The apparatus of claim 1 wherein the cryptographic device comprises an administrative access interface via which the event-based one-time passcode is received.
8. The apparatus of claim 7 wherein the administrative access interface does not require submission of a static unlock code for a successful administrative access.
9. The apparatus of claim 1 wherein the event counter is set to an initial value in conjunction with manufacture of the cryptographic device.
10. The apparatus of claim 9 wherein the initial value comprises one of zero and a random value.
11. The apparatus of claim 1 wherein maintaining the event counter comprises incrementing the event counter for each of a plurality of successful administrative accesses to the cryptographic device.
12. The apparatus of claim 1 wherein maintaining the event counter comprises incrementing the event counter responsive to grant of the given administrative access so as to thereby prevent utilization of the event-based one-time passcode in a subsequent successful administrative access to the cryptographic device.
13. The apparatus of claim 1 wherein an initial value of the event counter and an administrative seed value are provided to an administrative entity via an out-of-band channel for use by the administrative entity in generating event-based one-time passcodes for respective administrative access attempts.
14. A method comprising:
maintaining an event counter characterizing a number of successful administrative accesses to a cryptographic device comprising a processor coupled to a memory;
receiving an event-based one-time passcode for a given administrative access attempt;
comparing the received event-based one-time passcode to an expected event-based one-time passcode determined as a function of a current value of the event counter by:
identifying a window having a plurality of acceptable event counter values as a function of the current value of the event counter, and
determining if an event counter value of the received event-based one-time passcode falls within the identified window; and
granting or denying the given administrative access attempt based at least in part on a result of the comparing;
wherein the maintaining, receiving, comparing and granting or denying are performed by the cryptographic device.
15. The method of claim 14 wherein the cryptographic device is further configured to store an administrative seed value.
16. The method of claim 15 wherein the expected event-based one-time passcode is determined as a function of the administrative seed value and the current value of the event counter.
17. A computer program product comprising a non-transitory processor-readable storage medium having embodied therein one or more software programs, wherein the one or more software programs when executed by a cryptographic device comprising a processor coupled to a memory cause the cryptographic device:
to maintain an event counter characterizing a number of successful administrative accesses to the cryptographic device;
to receive an event-based one-time passcode for a given administrative access attempt;
to compare the received event-based one-time passcode to an expected event-based one-time passcode determined as a function of a current value of the event counter by:
identifying a window having a plurality of acceptable event counter values as a function of the current value of the event counter, and
determining if an event counter value of the received event-based one-time passcode falls within the identified window; and
to grant or deny the given administrative access attempt based at least in part on a result of the comparing.
18. The computer program product of claim 17 wherein the cryptographic device is further configured to store an administrative seed value.
19. The computer program product of claim 18 wherein the expected event-based one-time passcode is determined as a function of the administrative seed value and the current value of the event counter.