Tokencode Exchanges for Peripheral Authentication

• US 20070061566A1
• Filed: 09/11/2006
• Published: 03/15/2007
• Est. Priority Date: 09/09/2005
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Bailey, Daniel, Szydlo, Michael, Kaliski, Burton, Brainard, John
• Granted Patent: US 8,607,045 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

In a system comprising a transient storage device (TSD) or other type of peripheral configured for communication with a host device, a first one-time password or other type of code is generated in the peripheral and transmitted to the host device. The first code is presented by the host device to an authentication server for authentication. The host device receives a second one-time password or other type of code from the authentication server and transmits it to the peripheral for authentication.

Claims

1. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

generating a first code in the peripheral;

transmitting the first code from the peripheral to the host device, the first code being presentable by the host device to an authentication server for authentication;

receiving in the peripheral from the host device a second code provided to the host device by the authentication server; and

authenticating the second code in the peripheral.

2. The method of claim 1 wherein the authentication server generates the second code responsive to presentation of the first code by the host device.

3. The method of claim 1 wherein the authentication server authenticates the first code before providing the second code to the host device.

4. The method of claim 1 wherein the peripheral generates the first code responsive to receipt of the second code from the host device.

5. The method of claim 1 wherein the peripheral authenticates the second code before transmitting the first code to the host device.

6. The method of claim 1 wherein the peripheral comprises a transient storage device.

7. The method of claim 1 wherein the host device comprises a computer.

8. The method of claim 1 wherein the peripheral is configured for physical attachment to the host device via a USB port of said device.

9. The method of claim 1 wherein the first and second codes comprise one-time passwords generated in the respective peripheral and authentication server.

10. The method of claim 1 wherein the second code is generated as a function of at least the first code.

11. The method of claim 10 wherein the second code is generated as a function of at least the first code and a seed stored by the authentication server.

12. The method of claim 10 wherein the second code is generated as a function of at least the first code and a current output of a time-of-day clock.

13. The method of claim 1 wherein the first and second codes are derived from respective first and second seeds stored in both the peripheral device and the authentication server.

14. The method of claim 13 wherein the first and second seeds are derived from a common master seed.

15. The method of claim 13 wherein the first and second codes are generated in the respective peripheral and authentication server as a function of the respective first and second seeds and a current output of a time-of-day clock.

16. The method of claim 1 further including the step of applying a key derivation function to a combination of the first and second codes to generate session keys for protecting data communicated between the peripheral and the authentication server.

17. The method of claim 13 wherein one or more session keys are generated as a function of a combination of at least the first and second codes and the first and second seeds.

18. The method of claim 1 further including the step of caching at least first and second sets of future codes in the host device for use in a period of off-line operation when the host device is unable to communicate with the authentication server.

19. A machine-readable storage medium storing one or more software programs, wherein the one or more software programs when executed by a processor of the peripheral implement the steps of the method of claim 1.

20. An apparatus comprising:

a peripheral having a processor coupled to a memory, the peripheral being configured for communication with a host device;

wherein the peripheral is operative to generate a first code and to transmit the first code to the host device, the first code being presentable by the host device to an authentication server for authentication; and

wherein the peripheral is further operative to receive from the host device a second code provided to the host device by the authentication server, and to authenticate the second code.

21. The apparatus of claim 20 wherein the peripheral comprises a transient storage device.

22. The apparatus of claim 20 wherein the peripheral comprises a security token.

23. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

receiving in the host device a first code from the peripheral;

transmitting the first code from the host device to an authentication server for authentication;

receiving in the host device a second code from the authentication server; and

transmitting the second code to the peripheral for authentication.

24. An authentication method for use in a system comprising a peripheral configured for communication with a host device, the method comprising the steps of:

receiving in an authentication server a first code delivered from the peripheral via the host device;

authenticating the first code in the authentication server; and

transmitting a second code from the authentication server to the host device, the second code being presentable by the host device to the peripheral for authentication.

25. A system comprising:

a peripheral;

a host device configured for communication with the peripheral; and

an authentication server configured for communication with the host device;

wherein a first code from the peripheral is delivered to the authentication server via the host device for authentication; and

wherein a second code from the authentication server is delivered to the peripheral via the host device for authentication.