Soft Token Transfer via Server-Side Seed Unbinding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software-based token solutions for two-factor authentication are inadequate as they do not allow for seamless transfer of tokens from one mobile device to another, requiring users to undergo inconvenient backup and restore procedures when changing devices, and are not compatible with various device types and platforms.
Innovation Solution
A system and method for securely transferring soft tokens from one mobile device to another by generating a transfer activation code, unbinding the token seed from the original device, and transferring the unbound token data to the new device, enabling seamless authentication across different devices and platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based tokens are bound to a specific mobile device for security, then security is improved, but device compatibility and transferability deteriorate
Solution Approach 1:
The system segments the token binding mechanism by separating the token seed encryption from device-specific identifiers. Instead of binding tokens directly to device IDs, the system encrypts token seeds with a master key stored on the server, allowing tokens to be transferred between devices while maintaining security through cryptographic protection rather than device-specific binding.
Solution Approach 2:
The patent introduces a token provisioning server as an intermediary that manages token seeds and encryption keys. This intermediary decouples the relationship between tokens and specific devices, allowing the server to provision tokens to any authorized device while maintaining security through centralized key management and encrypted token seed storage.
2Reliability
If tokens are bound to original device identifiers, then security is maintained, but ease of operation deteriorates when changing devices
Solution Approach 1:
The system performs preliminary actions by pre-configuring the token provisioning server with encrypted token seeds before device changes occur. When a user wants to transfer tokens, the server already has the encrypted seeds ready to be decrypted and re-provisioned on the new device, eliminating the need for manual backup and restore procedures.
Solution Approach 2:
The patent implements a copying mechanism where token seeds are encrypted and stored on the server, then copied and decrypted on the new device during transfer. This allows seamless token reproduction on different devices without manual intervention, as the server automatically manages the copying and re-provisioning of encrypted token seeds to authorized devices.
3Reliability
If manual backup and restore procedures are required for token transfer, then security control is improved, but productivity deteriorates
Solution Approach 1:
The system implements self-service by enabling automated token transfer through the token provisioning server. Instead of requiring manual backup and restore procedures, the server automatically manages token seed encryption, storage, and re-provisioning on new devices, reducing user effort to simple authentication while maintaining security through automated cryptographic operations.
Solution Approach 2:
The patent changes the parameter of token storage from device-specific binding to server-managed encrypted storage. By transforming how tokens are stored and managed (from local device binding to centralized encrypted seed storage), the system enables automated transfer procedures that maintain security control while dramatically improving transfer efficiency and user productivity.
Data Source
AI summary
Systems and methods for securely transferring tokens from one device to another are provided. According to one embodiment, a token transfer request (TTR), requesting transfer of a soft token stored on a first mobile device to a second mobile device, is received by a provisioning server from the first device. A transfer activation code (TAC) is generated by the provisioning server responsive to receipt of token data associated with the soft token from the first device. The token data includes an encrypted token seed bound to the first device. The TAC is delivered to a user of the first device via an authentication server. Unbound token data for the soft token is created by the provisioning server by unbinding the encrypted token seed from the first device. Upon receipt of the TAC from the second device, the unbound token data is transferred to the second device.