Token node locking
A system and method for providing secure data to a client device having a token is disclosed. In one embodiment, the method comprises (a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, (b) receiving a request to provide secure data to the client device in a secure data service, (c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp, and (d) providing the requested secure data according to the determination.
1. A method of providing secure data to a client device having a token, comprising:
(a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, comprising:
receiving the first token binding information from the client device in a token binding service;
determining if the first token ID does not match a previously stored token ID;
if the first token ID does not match a previously stored token ID, associatively storing the first token ID with the first client device fingerprint data, and the first timestamp;
(b) receiving a request to provide secure data to the client device in a secure data service;
(c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp, comprising: querying the token binding service for the first timestamp;
comparing the first timestamp with a further timestamp associated with a time that the request to provide secure data was received; and
(d) providing the requested secure data according to the determination.
2. The method of claim 1 , wherein providing the requested secure data according to the determination comprises:
if the request to provide the secure data to the client device was not received within an acceptable temporal range of the first timestamp:
receiving second token binding information from the client device in a token binding service, the second token binding information comprising a second token ID and second client device fingerprint data and a second timestamp;
determining if the second token ID does not match a previously stored token ID;
if the second token ID does not match a previously stored token ID, associatively storing the second token ID with the second client device fingerprint data, and the second timestamp;
if the second token ID matches the first token ID:
determining if the first client device fingerprint data matches the second client device fingerprint data:
if the first client device fingerprint data matches the second client device fingerprint data, updating the stored timestamp to a current timestamp and repeating (b)-(d);
if the first client device fingerprint data does not match the second client device fingerprint data, determining if differences between the first client device fingerprint data and the second client device fingerprint data are acceptable;
if differences between the first client device fingerprint data and the second client device fingerprint data are acceptable:
associatively storing the second token ID with the second client device fingerprint data, and the current timestamp, and repeating (b)-(d).
3. The method of claim 2 , wherein if the differences between the first client device fingerprint data and the second client device fingerprint data are not acceptable, the method further comprises:
performing at least one of:
returning an error to the client device; and
logging the error to the secure data service.
4. The method of claim 2 , wherein:
the first client device fingerprint data comprises N first client device parameters;
the second client device fingerprint data comprises N second client device parameters;
the not acceptable differences between first fingerprint data and the second client device fingerprint data comprises at least one of
an excessive number of changes between the N first client device parameters and the N second client device parameters over a time period;
more than K changes between the N first client device parameters and the N second client device parameters; and
the N first client device parameters are associated with a different token ID than the second client device parameters.
5. The method of claim 2 , wherein the first token binding information and the second token binding information is received via a secure session in a token binding service.
6. The method of claim 2 , wherein the first token ID and the first token binding information is associatively stored in storage of a PKI center.
7. The method of claim 2 , further comprising:
receiving a request from an administrator of the client device to unbind the token from the client; and
unbinding the token from the client device by disassociating the first client device fingerprint data from the token ID.
8. The method of claim 1 , wherein the token comprises a hardware token communicatively coupleable to the client device.
9. An apparatus for providing secure data to a client device having a token, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for:
(a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, comprising:
receiving the first token binding information from the client device in a token binding service;
determining if the first token ID does not match a previously stored token ID;
if the first token ID does not match a previously stored token ID, associatively storing the first token ID with the first client device fingerprint data, and the first timestamp;
(b) receiving a request to provide secure data to the client device in a secure data service;
(c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp, comprising: querying the token binding service for the first timestamp; comparing the first timestamp with a further timestamp associated with a time that the request to provide secure data was received; and
(d) providing the requested secure data according to the determination.
10. The apparatus of claim 9 , wherein the processor instructions for providing the requested secure data according to the determination comprise processor instructions for:
if the request to provide the secure data to the client device was not received within an acceptable temporal range of the first timestamp:
receiving second token binding information from the client device in a token binding service, the second token binding information comprising a second token ID and second client device fingerprint data and a second timestamp;
determining if the second token ID does not match a previously stored token ID;
if the second token ID does not match a previously stored token ID, associatively storing the second token ID with the second client device fingerprint data, and the second timestamp;
if the second token ID matches the first token ID:
determining if the first client device fingerprint data matches the second client device fingerprint data:
if the first client device fingerprint data matches the second client device fingerprint data, updating the stored timestamp to a current timestamp and repeating (b)-(d);
if the first client device fingerprint data does not match the second client device fingerprint data, determining if differences between the first client device fingerprint data and the second client device fingerprint data are acceptable;
if differences between the first client device fingerprint data and the second client device fingerprint data are acceptable:
associatively storing the second token ID with the second client device fingerprint data, and the current timestamp, and repeating (b)-(d).
11. The apparatus of claim 10 , wherein the processor instructions further comprise further processor instructions performed if the differences between the first client device fingerprint data and the second client device fingerprint data are not acceptable, the further processor instructions comprising:
performing at least one of:
returning an error to the client device; and
logging the error to the secure data service.
12. The apparatus of claim 10 , wherein:
the first client device fingerprint data comprises N first client device parameters;
the second client device fingerprint data comprises N second client device parameters;
the not acceptable differences between first fingerprint data and the second client device fingerprint data comprises at least one of
an excessive number of changes between the N first client device parameters and the N second client device parameters over a time period;
more than K changes between the N first client device parameters and the N second client device parameters; and
the N first client device parameters are associated with a different token ID than the second client device parameters.
13. The apparatus of claim 10 , wherein the first token binding information and the second token binding information is received via a secure session in a token binding service.
14. The apparatus of claim 10 , wherein the first token ID and the first token binding information is associatively stored in storage of a PKI center.
15. The apparatus of claim 10 , wherein the processor instructions further comprise processor instructions for:
receiving a request from an administrator of the client device to unbind the token from the client; and
unbinding the token from the client device by disassociating the first client device fingerprint data from the token ID.
16. The apparatus of claim 9 , wherein the token comprises a hardware token communicatively coupleable to the client device.