Token Reprovisioning via PKI Digital Certificates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token systems face challenges in reprovisioning secrets, especially when compromised, and lack efficient interoperability with Public Key Infrastructure (PKI) systems, limiting their ability to leverage PKI capabilities such as key management and authentication.
Innovation Solution
A token is coupled to a Certification Authority (CA) through a network, allowing it to request and obtain a digital certificate containing an encrypted OTP secret, enabling reprovisioning and secure OTP generation, even in non-PKI environments, by using a PKI-enabled token processor and memory with tamper-resistant features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a token is initialized at the manufacturer with a secret key, then the token can generate One Time Passwords for authentication, but it becomes difficult or impossible to reprovision the token with a new secret if compromised
Solution Approach 1:
The secret provisioning process is segmented into two phases: initial provisioning at manufacturing (embedding secret in ROM) and secondary provisioning through PKI infrastructure (using digital certificates and public key cryptography). This segmentation allows the token to maintain security while enabling reprovisioning through alternative channels when compromise is detected.
Solution Approach 2:
A PKI certification authority acts as an intermediary between the token and the secret provisioning system. The CA issues digital certificates to tokens, enabling secure key distribution and reprovisioning without requiring physical access to the token manufacturing process. This intermediary mechanism resolves the contradiction by providing a trusted third-party channel for secret updates.
2Adaptability or versatility
If non-PKI token systems are used, then they can provide basic OTP authentication, but they cannot efficiently or effectively interoperate with PKI systems or leverage PKI capabilities
Solution Approach 1:
The token is designed with multi-functionality to support both traditional OTP generation and PKI-based operations. The token processor can handle both symmetric key operations (for OTP) and asymmetric key operations (for PKI), allowing a single device to operate in multiple security infrastructures without requiring separate specialized tokens.
Solution Approach 2:
The patent merges PKI capabilities (digital certificate storage, public key cryptography) with traditional OTP functionality within a single token device. This combination allows the token to leverage PKI infrastructure for enhanced key management and authentication while maintaining backward compatibility with legacy OTP systems, thus improving adaptability without proportionally increasing complexity.
3Ease of operation
If the same secret key is reused in a token over time, then the token maintains consistent authentication capability, but the OTPs generated become less secure
Solution Approach 1:
The token implements dynamic key management where secret keys can be updated and rotated over time through the PKI infrastructure. Instead of static key reuse, the system allows periodic key changes facilitated by digital certificate renewal, maintaining operational consistency while continuously refreshing security credentials to prevent degradation.
Data Source
AI summary
A method for provisioning a device such as a token. The device issues a certificate request to a Certification Authority. The request includes a public cryptographic key uniquely associated with the device. The Certification Authority generates a symmetric cryptographic key for the device, encrypts it using the public key, and creates a digital certificate that contains the encrypted symmetric key as an attribute. The Certification Authority sends the digital certificate to the device, which decrypts the symmetric key using the device's private key, and stores the decrypted symmetric key.