Method and apparatus for testing authentication tokens

• US 8,190,906 B1
• Filed: 12/16/2008
• Issued: 05/29/2012
• Est. Priority Date: 12/16/2008
• Status: Active Grant

• Current Assignee: RSA Security LLC (Symphony Technology Group LLC)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Elbeery, Stephen, Crossan, Brian, Xiang-Wu, Fu
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US12/336,393
• Time in Patent Office: 1,260 Days
• Field of Search: None
• US Class Current: 713/185
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06Q 20/3555 Personalisation of two or more cards
• CPC Class Codes: G07F 7/0846 On-card display means
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

A process and apparatus for automated testing of authentication tokens is disclosed which verifies the physical functioning of the tokens and the validity of the one-time passcodes (OTPs) displayed by the tokens during testing. The testing is automated to allow for large quantities of tokens to be tested in a single procedure, and also separates rejected tokens according to the particular failed test process identified with the token. In one embodiment, a rotary table is provided for testing, the table having multiple positions for performing different test procedures and for separating rejected tokens according to the particular test failed.

Claims

1. A method for testing authentication tokens that produce a one-time passcode (OTP) from an encryption in a database, the method comprising:

providing a token having a body housing an internal serial number, an activation member supported on the token body and constructed and arranged to trigger the production of the OTP, and a display window constructed and arranged to display the OTP to a user;

performing an initial testing procedure including the steps of;

a) scanning the internal serial number;

b) comparing the scanned internal serial number to an expected serial number stored in the database;

performing OTP authentication testing including the steps of;

c) initiating the activation member to trigger the production of a first produced OTP in the display window;

d) comparing the first produced OTP to a first expected OTP stored in the database; and

wherein if both the scanned internal serial number and the expected serial number match and the first produced OTP and the first expected OTP match, the authentication token passes initial testing and OTP authentication testing.

2. The method of claim 1, further comprising the steps of:

performing OTP verification testing including the steps of;

d) initiating the activation member to trigger the production of a second produced OTP;

e) comparing the second produced OTP to the first produced OTP;

wherein if the first produced OTP and the second produced OTP are different, the authentication token passes OTP verification testing.

3. The method of claim 2, further comprising the step of:

comparing the second produced OTP to a second expected OTP in the database and wherein if the second produced OTP and the second expected OTP match, the authentication token passes testing.

4. The method of claim 3, further comprising the step of rejecting tokens whose second produced OTP and second expected OTP do not match into a third bin.

5. The method of claim 2, further comprising the step of rejecting tokens whose first produced OTP and second produced OTP match into a third bin.

6. The method of claim 1, further comprising the step of engraving the serial number onto the token body.

7. The method of claim 1, further comprising the step of optically reading the serial number on the token body.

8. The method of claim 1, further comprising the step of rejecting tokens whose scanned internal serial number and the expected serial number do not match into a first bin.

9. The method of claim 1, further comprising the step of rejecting tokens whose first produced OTP and first expected OTP do not match into a second bin.

10. The method of claim 1, wherein the internal serial number is disposed in a radio frequency identification tag.

11. The method of claim 1, wherein the activation member is a button constructed and arranged to be depressed by a user to trigger the OTP.

12. A method for testing authentication tokens that produce a one-time passcode (OTP) from an encryption in a database, the method comprising:

providing a token having a body that houses an internal serial number, and an activation member constructed and arranged to trigger the production of the OTP;

providing a testing table constructed and arranged to move the token into various positions during different testing phases, and including a plurality of stations constructed and arranged to hold the token during testing;

placing the token into one of the plurality of stations in a first position;

performing an initial testing procedure including the steps of;

a) scanning the internal serial number;

b) comparing the scanned internal serial number to an expected serial number stored in the database; and

wherein if the scanned internal serial number and the expected serial number match, the authentication token passes the initial testing procedure.

13. The method of claim 12, further comprising the steps of:

moving the token into a second position;

performing OTP authentication testing including the steps of;

c) initiating the activation member to trigger the production of a first produced OTP;

d) comparing the produced OTP to a first expected OTP stored in the database; and

wherein if both the first produced OTP and the first expected OTP match, the authentication token passes OTP authentication testing.

14. The method of claim 13, wherein the token further comprises a display window constructed and arranged to display the first produced OTP to a user.

15. The method of claim 13, further comprising the steps of:

moving the token into a third position;

performing OTP verification testing including the steps of;

e) initiating the activation member to trigger the production of a second produced OTP;

f) comparing the second produced OTP to the first produced OTP;

wherein if the first produced OTP and the second produced OTP are different, the authentication token passes OTP verification testing.

16. The method of claim 12, further comprising the steps of:

moving the token into a fourth position; and

engraving the serial number onto the token body.

17. The method of claim 12, further comprising the steps of:

moving the token into a fifth position; and

optically reading the serial number on the token body.

18. The method of claim 12, wherein the activation member is a button constructed and arranged to be depressed by a user to trigger the OTP.

19. The method of claim 12, wherein the testing table is a rotary table.