Method for personalizing an authentication token

• US 8,375,212 B2
• Filed: 12/27/2010
• Issued: 02/12/2013
• Est. Priority Date: 05/10/2002
• Status: Expired due to Term

• Current Assignee: Auth Token LLC (Jeffrey M. Gross)
• Original Assignee: Prism Technologies LLC (Prism Technologies Group, Inc.)
• Inventors: Buck, Peter, Newport, Peter
• Primary Examiner(s): Patel, Nirav B
• Application Number:
  US12/978,754
• Publication Number:
  US 20110093708A1
• Time in Patent Office: 778 Days
• Field of Search: 713168-173, 713181-184, 705 65- 67, 726/9, 726/10, 726/20, 235/380, 235/382, 340/5.81, 340/5.85
• US Class Current: 713/173
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

An authentication token using a smart card that an organization would issue to its customer, the smart card having a processor for executing a software application that is responsive to a user input to generate a one-time password as an output. The smart card co-operates with an interface device for inputting the user input and displaying the one-time password. The authentication token may be used in combination with a remote authentication server for validation of the password and hence authentication of the user.

Claims

1. A method for personalizing an authentication token comprising:

entering by the authentication token into personalization mode;

requesting from the authentication token, by a personalization device in communication with the authentication token, a serial number of the authentication token;

encrypting by the personalization device the serial number using a personalization key, and forwarding the encrypted serial number to the authentication token from the personalization device;

decrypting by the authentication token of the encrypted serial number, and validating by the authentication token that the personalization key is correct;

establishing an encrypted session between the authentication token and the personalization device using a transport key;

sending to the authentication token, by the personalization device, an initial seed value and an initial secret key using the transport key to encrypt the initial seed value and the initial secret key, the initial seed value and the initial secret key for facilitating an initial interaction between the authentication token and an interface device; and

storing by the authentication token the initial seed value and the initial secret key after decryption thereof by the authentication token using the transport key, wherein, once the authentication token is personalized with the initial seed value and the initial secret key, the authentication token can no longer enter the personalization mode.

2. The method of claim 1, wherein after the authentication token is provided the initial seed value and the initial secret key, the initial seed value stored in a memory in the authentication token can be used to generate a key for use in generating a secure password used in interacting with the interface device.

3. The method of claim 2, wherein data exchanged between the authentication token and the personalization device for use in generating the secure password is stored by the personalization device for subsequent transfer to a third party.

4. The method of claim 2, further comprising entering by the authentication token into normal mode after said storing the initial seed value and the initial secret key.