Transferring soft token authentication capabilities to a new device

• US 9,401,905 B1
• Filed: 09/25/2013
• Issued: 07/26/2016
• Est. Priority Date: 09/25/2013
• Status: Active Grant

• Current Assignee: RSA Security LLC (Symphony Technology Group LLC)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Kowalski, Karl G., Ng, Millie K., O'Malley, Michael J., Bailey, Daniel V.
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US14/036,627
• Time in Patent Office: 1,035 Days
• Field of Search: 726/6
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A technique transfers soft token authentication capabilities from an old device to a new device. The technique involves receiving a transfer initiation message from the old device while the old device is currently provisioned with the soft token authentication capabilities. The transfer initiation message includes new device binding information obtained by the old device from the new device. The technique further involves providing a reply message to the old device in response to the transfer initiation message. The reply message directs the old device to supply an authentication code to the new device, the authentication code being based on the new device binding information. The technique further involves receiving, from the new device, a provisioning message including the authentication code, and provisioning the new device with the soft token authentication capabilities in response to receipt of the provisioning message from the new device.

Claims

1. A method of transferring soft token authentication capabilities from an old device to a new device, the method comprising:

receiving, by processing circuitry, a transfer initiation message from the old device while the old device is currently provisioned with a first seed-based data structure as at least some of the soft token authentication capabilities, the transfer initiation message including new device binding information obtained by the old device from the new device;

providing, by the processing circuitry, a reply message to the old device in response to the transfer initiation message, the reply message directing the old device to supply an authentication code to the new device, the authentication code being based on the new device binding information and on the first seed-based data structure;

receiving, by the processing circuitry, a provisioning message from the new device, the provisioning message including the authentication code from the old device; and

provisioning, by the processing circuitry, the new device with a second seed-based data structure as at least some of the soft token authentication capabilities in response to receipt of the provisioning message from the new device;

wherein receiving the transfer initiation message includes;

obtaining, as parts of the transfer initiation message, (i) a first message portion which includes the new device binding information in non-signed form and (ii) a second message portion which includes the new device binding information in a signed form, the second message portion operating as a signature of the old device; and

wherein the processing circuitry resides in an external server which is external to both the old device and the new device, the server being constructed and arranged to communicate with the old device and the new device over a network.

2. The method as in claim 1 wherein the old device stores a token seed;

wherein the old device is under control of a user having a user personal identifier; and

wherein obtaining the second message portion includes;

acquiring, as the second message portion, a signature data element which is based on (i) the new device binding information, (ii) the user personal identifier of the user, and (iii) the token seed stored in the old device.

3. The method as in claim 2, further comprising:

verifying, by the processing circuitry, the signature data element to confirm that the old device is trustworthy.

4. The method as in claim 2 wherein the reply message provided to the old device does not include the authentication code;

and wherein receiving the provisioning message from the new device includes;

acquiring, as the authentication code, the signature data element from the new device.

5. The method as in claim 1 wherein, prior to receiving the transfer initiation message, the processing circuitry performs a first dynamic seed provisioning exchange with the old device to provision the old device with the soft token authentication capabilities;

and wherein provisioning the new device includes;

performing, by the processing circuitry, a second dynamic seed provisioning exchange with the new device.

6. The method as in claim 5 wherein the first dynamic seed provisioning exchange provisions a first seed within the old device;

and wherein performing the second dynamic seed provisioning exchange includes;

provisioning a second seed within the new device, the second seed being different from the first seed within the old device.

7. The method as in claim 1, further comprising:

in response to providing the reply message to the old device, starting a timer to impose a time limit for transferring soft token authentication capabilities to the new device.

8. The method as in claim 7, further comprising:

in response to receiving the provisioning message and prior to provisioning the new device, accessing the timer to confirm that the time limit has not expired.

9. The method as in claim 1, further comprising:

in response to provisioning the new device, disabling the soft token authentication capabilities provisioned on the old device.

10. The method as in claim 1, further comprising:

prior to receiving the transfer initiation message from the old device, performing an authentication operation using the old device to successfully authenticate a user of the old device.

11. The method as in claim 1 wherein, prior to the transfer initiation message being received from the old device, the new device binding information is received by the old device from the new device via a wireless communications session established by the old device and the new device while the old device and the new device are in close physical proximity to each other, each of the old device and the new device operating a respective wireless communications circuit at a reduced transmit power level during the wireless communications session.

12. The method as in claim 1 wherein the new device binding information in the signed form is modified based on at least one of:

(i) a time of day value, (ii) a counter value, and (iii) a random nonce.

13. The method as in claim 1 wherein providing the reply message to the old device includes:

sending, as parts of the reply message, (i) a first message portion which includes a distinguished label from an authentication server and (ii) a second message portion which includes the combination of the new device binding information and the distinguished label in a signed form, the second message portion operating as a signature of the authentication server which the older device is capable of verifying to confirm that the authentication server is trustworthy.

14. The method as in claim 1 wherein provisioning the new device occurs while the new device is in communication with the server over the network.

15. An electronic apparatus, comprising:

a communications interface;

memory; and

control circuitry coupled to the communications interface and the memory, the memory storing instructions which, when carried out by the control circuitry, cause the control circuitry to;

receive a transfer initiation message from an old device through the communications interface while the old device is currently provisioned with a first seed-based data structure as at least some of soft token authentication capabilities, the transfer initiation message including new device binding information obtained by the old device from a new device,

provide a reply message to the old device through the communications interface in response to the transfer initiation message, the reply message directing the old device to supply an authentication code to the new device, the authentication code being based on the new device binding information and on the first seed-based data structure,

receive a provisioning message from the new device through the communications interface, the provisioning message including the authentication code from the old device, and

provision the new device with a second seed-based data structure as at least some of the soft token authentication capabilities in response to receipt of the provisioning message from the new device;

wherein the control circuitry, when receiving the transfer initiation message, is constructed and arranged to;

obtain, as parts of the transfer initiation message, (i) a first message portion which includes the new device binding information in non-signed form and (ii) a second message portion which includes the new device binding information in a signed form, the second message portion operating as a signature of the old device; and

wherein the control circuitry resides in an external server which is external to both the old device and the new device, the server being constructed and arranged to communicate with the old device and the new device over a network.

16. The electronic apparatus as in claim 15 wherein the old device stores a token seed;

wherein the old device is under control of a user having a user personal identifier; and

wherein the control circuitry, when obtaining the second message portion, is constructed and arranged to;

acquire, as the second message portion, a signature data element which is based on (i) the new device binding information, (ii) the user personal identifier of the user, and (iii) the token seed stored in the old device.

17. The electronic apparatus as in claim 16 wherein the reply message provided to the old device does not include the authentication code;

and wherein the control circuitry, when receiving the provisioning message from the new device, is constructed and arranged to;

acquire, as the authentication code, the signature data element from the new device.

18. The electronic apparatus as in claim 15 wherein the control circuitry provisions the new device while the new device is in communication with the server over the network.

19. A computer program product having a non-transitory computer readable medium which stores a set of instructions to transfer soft token authentication capabilities from an old device to a new device, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:

receiving, by the computerized circuitry, a transfer initiation message from the old device while the old device is currently provisioned with a first seed-based data structure as at least some of the soft token authentication capabilities, the transfer initiation message including new device binding information obtained by the old device from the new device;

providing, by the computerized circuitry, a reply message to the old device in response to the transfer initiation message, the reply message directing the old device to supply an authentication code to the new device, the authentication code being based on the new device binding information and on the first seed-based data structure;

receiving, by the computerized circuitry, a provisioning message from the new device, the provisioning message including the authentication code from the old device; and

provisioning, by the computerized circuitry, the new device with a second seed-based data structure as at least some of the soft token authentication capabilities in response to receipt of the provisioning message from the new device;

wherein receiving the transfer initiation message includes;

obtaining, as parts of the transfer initiation message, (i) a first message portion which includes the new device binding information in non-signed form and (ii) a second message portion which includes the new device binding information in a signed form, the second message portion operating as a signature of the old device; and

wherein the computerized circuitry resides in an external server which is external to both the old device and the new device, the server being constructed and arranged to communicate with the old device and the new device over a network.

20. The computer program product as in claim 19 wherein the old device stores a token seed;

wherein the old device is under control of a user having a user personal identifier; and

wherein obtaining the second message portion includes;

acquiring, as the second message portion, a signature data element which is based on (i) the new device binding information, (ii) the user personal identifier of the user, and (iii) the token seed stored in the old device.

21. The computer program product as in claim 20 wherein the reply message provided to the old device does not include the authentication code;

and wherein receiving the provisioning message from the new device includes;

acquiring, as the authentication code, the signature data element from the new device after the new device receives the authentication code from the old device.

22. The computer program product as in claim 19 wherein provisioning the new device occurs while the new device is in communication with the server over the network.