Authentication Token Key Provisioning via Encrypted Symmetric Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The initial provisioning of authentication tokens, especially on mobile devices, is often cumbersome and vulnerable to security attacks, such as man-in-the-middle attacks, due to inadequate security protections in communication channels.
Innovation Solution
A symmetric key is generated on a user device using a public key from an authentication service, encrypted, and transmitted securely to bind it to the authentication token, reducing user involvement and preventing interception by adversaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional provisioning methods are used, then the authentication token can be initialized, but the process is cumbersome and vulnerable to security attacks
Solution Approach 1:
The patent introduces a provisioning server as an intermediary between the authentication token and the user/device. The server automatically generates the secret key, creates the token record file, and handles the provisioning process without requiring direct user involvement in key generation or configuration, thereby improving security while maintaining ease of operation
Solution Approach 2:
The authentication token is configured to automatically receive and process the token record file from the provisioning server without requiring manual user configuration. The token self-provisions by integrating the received credentials into its authentication logic, eliminating cumbersome manual setup steps
2Ease of manufacture
If manual provisioning is used, then the token can be configured, but it requires extensive user involvement and help desk support
Solution Approach 1:
The provisioning server performs preliminary actions by pre-generating secret keys, pre-creating token record files with all necessary credentials, and pre-configuring authentication parameters before the token is activated. This preliminary preparation eliminates the need for time-consuming manual configuration steps during actual token provisioning
Solution Approach 2:
The system enables self-service provisioning where the token automatically receives and processes its configuration data from the server without requiring user intervention or help desk support. The entire provisioning process occurs in the background, significantly reducing the time users need to spend on token setup
3Productivity
If untrusted communication channels are used, then the provisioning can be completed, but it is vulnerable to man-in-the-middle attacks
Solution Approach 1:
The provisioning server acts as a trusted intermediary that mediates all communication between the token and external systems. The server generates and holds the secret key securely, transmitting only encrypted or non-sensitive data over communication channels, thereby preventing adversaries from intercepting or manipulating provisioning data even on untrusted networks
Solution Approach 2:
The patent extracts the sensitive secret key generation and management functions from the user device and communication channels, concentrating them exclusively on the provisioning server. This extraction ensures that sensitive credentials never traverse untrusted communication channels, eliminating vulnerability to man-in-the-middle attacks while maintaining provisioning efficiency
Data Source
AI summary
A processing device is configured to obtain an address and a public key, both associated with an authentication service, to generate a symmetric key as a function of the public key, to configure an authentication token to incorporate the symmetric key, to encrypt the symmetric key utilizing the public key, and to transmit the encrypted symmetric key to the address so as to permit the authentication service to bind the symmetric key to an identifier of the authentication token. By way of example, the authentication token may comprise a software authentication token implemented on the processing device. One or more tokencodes generated by the authentication token utilizing the symmetric key are transmitted to the authentication service for authentication. The authentication by the authentication service is based on the symmetric key bound to the identifier of the authentication token.