Soft Token Transfer via Authentication Server Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for upgrading authentication tokens from old to new mobile devices require human intervention, such as an Authentication Service administrator, and do not effectively prevent the old device from being restored, allowing multiple simultaneous operations.
Innovation Solution
A method that transfers soft token authentication capabilities between devices through communication involving the old device, new device, and authentication server, relying on the old device's trust to eliminate human involvement and using the authentication server to log and prevent old device restoration by disabling its token capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the existing mobile smart device automatically handovers its authentication token features to the new mobile smart device, then the transfer process is simplified, but the authentication service is not informed of the handover and the old device could be restored from backup enabling simultaneous operation on multiple devices
Solution Approach 1:
The authentication server acts as an intermediary between the old device and new device during the transfer process. The server receives the transfer initiation message, validates the authentication code, and coordinates the provisioning of the new device. This intermediary role ensures that the authentication service is informed of the handover and can prevent restoration of the old device, thereby maintaining security while simplifying the transfer process for users.
Solution Approach 2:
The system implements feedback mechanisms where the authentication server receives status information from both the old and new devices. The server processes the authentication code returned by the old device and uses this feedback to determine whether to proceed with provisioning the new device. This feedback loop ensures that the transfer is properly recorded and the old device's capabilities are appropriately disabled.
2Reliability
If an Authentication Service administrator participates in deploying a new token seed within the new mobile smart device, then the token seed deployment is performed securely and successfully, but the process requires human intervention and is more complex
Solution Approach 1:
The system enables self-service transfer of authentication capabilities without requiring administrator intervention. The old device automatically generates and transmits an authentication code to the authentication server, which then provisions the new device with the token seed. This self-service mechanism maintains security through automated validation while eliminating the need for human administrators to manually deploy token seeds, thereby reducing complexity.
3Reliability
If the authentication server is involved in the transfer process, then the transfer can be logged and old device restoration can be prevented, but the process requires more communication steps
Solution Approach 1:
The authentication server performs multiple functions within the transfer process: it receives the transfer initiation message, validates the authentication code, provisions the new device with token seed, logs the transfer event, and disables the old device's authentication capabilities. By consolidating these multiple functions into a single universal component (the authentication server), the system achieves comprehensive security and logging without proportionally increasing overall system complexity.
Data Source
AI summary
A technique transfers soft token authentication capabilities from an old device to a new device. The technique involves receiving a transfer initiation message from the old device while the old device is currently provisioned with the soft token authentication capabilities. The transfer initiation message includes new device binding information obtained by the old device from the new device. The technique further involves providing a reply message to the old device in response to the transfer initiation message. The reply message directs the old device to supply an authentication code to the new device, the authentication code being based on the new device binding information. The technique further involves receiving, from the new device, a provisioning message including the authentication code, and provisioning the new device with the soft token authentication capabilities in response to receipt of the provisioning message from the new device.