Method and system for issuing a kill sequence for a token

• US 8,356,342 B2
• Filed: 08/31/2006
• Issued: 01/15/2013
• Est. Priority Date: 08/31/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Parkinson, Steven William, Kwan, Nang Kon
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): LEWIS, LISA C
• Application Number:
  US11/469,482
• Publication Number:
  US 20080056496A1
• Time in Patent Office: 2,329 Days
• Field of Search: 380/277, 726/9
• US Class Current: 726/9
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

An embodiment relates generally to a method of managing a token. The method includes marking a token to be killed and detecting a presence of the token. The method also includes disabling the token in response to the marking of the token.

Claims

1. A method of managing a token device, the method comprising:

receiving, at an interface of a client device, a request from a user to mark the token device to be disabled;

sending, by the client device to the token device, in response to receiving the request, an electronic message comprising code indicating that the token has been marked to be disabled;

detecting, by the client device, a presence of the token device at the client device;

determining, by the client device, whether the detected token device is marked to be disabled; and

sending, by the client device to the token device, in response to said determining that the detected token device is marked to be disabled, an electronic signal comprising commands to disable the token device.

2. The method of claim 1, wherein the disabling the token device comprises overwriting zeros on at least one private key.

3. The method of claim 1, wherein the disabling the token device comprises:

erasing at least one private key; and

overwriting zeros on a location of the at least one private key.

4. The method of claim 1, wherein the detecting the presence of the token device comprises detecting a requested operation from the token device.

5. The method of claim 4, wherein the requested operation is one of an enrollment, an application, and a personal identification number reset request.

6. The method of claim 4, the method further comprising:

transmitting the requested operation to a server; and

receiving the electronic signal from the server.

7. The method of claim 1, wherein the commands comply with Open Platform requirements.

8. The method of claim 1, further comprising opening a secure channel between the client device and the token device, and wherein said sending the electronic signal comprises sending the electronic signal over the secure channel.

9. The method of claim 1, further comprising initiating an authentication process with the token device after said detecting the presence of the token device, wherein the token device is configured to verify the electronic signal before executing the commands to disable the token device as part of the authentication process.

10. The method of claim 1, wherein the electronic signal comprises a kill sequence to disable the token device.

11. The method of claim 1, wherein a kill sequence is stored in the memory of the token device, and wherein the electronic signal comprises a command to execute the kill sequence stored in the memory.

12. The method of claim 11, wherein the kill sequence is received from a server device.

13. The method of claim 1, wherein the set of operations further comprises initiating an authentication process with the token device after said detecting the presence of the token device, wherein the token device is configured to verify the electronic signal before executing the commands to disable the token device as part of the authentication process.

14. An apparatus for managing a token device, comprising:

a first interface configured to receive a request from a user to mark the token device to be disabled;

a second interface configured to couple to the token device; and

a processor configured to

send to the token device, in response to receiving the request, stored in a memory of the token device an electronic message comprising code indicating that the token has been marked to be disabled;

detect a presence of the token device at the second interface;

determine whether the detected token device is marked to be disabled; and

send, to the token device, in response to said determining that the detected token device is marked to be disabled, an electronic signal comprising commands to disable the token device.

15. A non-transitory computer-readable storage medium comprising computer-executable instructions that when executed by a computing system, cause the computing system to perform a set of operations comprising:

receiving, at an interface of a client device, a request from a user to mark the token device to be disabled;

sending, by the client device to the token device, in response to receiving the request, an electronic message comprising code indicating that the token has been marked to be disabled;

detecting, by the client device, a presence of the token device at the client device;

determining, by the client device, whether the detected token device is marked to be disabled; and

sending, by the client device to the token device, in response to said determining that the detected token device is marked to be disabled, an electronic signal comprising commands to disable the token device.

16. The computer-readable storage medium of claim 15, wherein the set of operations further comprises opening a secure channel between the client device and the token device, and wherein said sending the electronic signal comprises sending the electronic signal over the secure channel.

17. A system for managing a token device, the system comprising:

a server configured to execute a token management system;

at least one client configured to couple with the server, wherein the at least one client is configured to execute a security client configured to;

receive a request from a user to mark the token device to be disabled;

send, to the token device, in response to the request, an electronic message comprising code indicating that the token has been marked to be disabled;

determine whether the detected token device is marked to be disabled;

notify the token management system that the token device is marked to be disabled; and

a token interface adapted to detect a presence of the token device and configured to interface with the security client, wherein the token management system, in response to the notification from the security client, sends an electronic signal comprising commands to disable the token device.

18. The system of claim 17, wherein the security client is configured to delete at least one private key stored on the token device and overwrite zeros on a storage location of the at least one private key.

19. The system of claim 17, wherein the client token interface detects the presence of the token device based on a requested operation from the token device.

20. The system of claim 19, wherein the requested operation is one of an enrollment, an application, and a personal identification number reset request.

21. The system of claim 17, wherein the commands comply with Open Platform requirements.