Token for securing communication

Abstract

A token includes an interface for communicating with a host, a processor communicably coupled to the interface, and to a persistent storage unit. The processor receives, via the interface, a command from the host; determines whether the command is valid for the token and, if not, returns a result to the host indicating the command is not valid; otherwise, if the command is determined to be valid for the token, performs the command and return a result of performing the command to the host. The command is one of: a command to activate the token, a command to begin authentication, a command to authenticate the host, a command to generate an encryption key, and a command to change a token activation code (TAC) stored by the token, said TAC for use in activating the token.

What is claimed is: 
     
         1 . A token, comprising:
 an interface for communicating with a host;   a processor communicably coupled to the interface and to a persistent storage unit, the persistent storage unit storing computer-executable instructions, which instructions, when executed by the processor, cause the processor to perform steps comprising:
 receive, via the interface, a command from the host; 
 determine whether the command is valid for the token and, if not, return a result to the host indicating the command is not valid; otherwise, if the command is determined to be valid for the token, perform the command and return a result of performing the command to the host; 
   wherein the command comprises one of: a command to activate the token, a command to begin authentication, a command to authenticate the host, a command to generate an encryption key, and a command to change a token activation code (TAC) stored by the token, said TAC for use in activating the token.   
     
     
         2 . The token of  claim 1 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to begin authentication, retrieving from a storage location on the token a static secret and a dynamic secret, the static secret and the dynamic secret each associated with a host identifier received from the host; generating a message digest using the static secret and the dynamic secret as inputs to an n-bit generator; extracting and storing a session encryption key from the message digest; and notifying the host that the command to begin authentication has been executed.   
     
     
         3 . The token of  claim 2 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to authenticate the host, receiving a password from the host; comparing the password received from the host with a one-time password generated by the token; and if the password received from the host matches the one-time password generated by the token, updating the dynamic secret associated with the host identifier and notifying the host it was successfully authenticated, otherwise, if the password received from the host does not match the one-time password generated by the token, notifying the host it was not successfully authenticated   wherein the one-time password generated by the token is extracted from the message digest.   
     
     
         4 . The token of  claim 2 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to generate an encryption key, generating the encryption key using a seed value as an input to the n-bit generator, the n-bit generator producing an output, a least a portion of which output comprises the encryption key, notifying the host that the encryption key was generated, and providing the encryption key to the host.   
     
     
         5 . The token of  claim 1 , wherein the persistent storage unit further stores a plurality of secrets, each secret being associated with a respective host identifier for each of a plurality of hosts. 
     
     
         6 . The token of  claim 2 , where in the dynamic secret and static secret are components of a multi-component secret. 
     
     
         7 . The token of  claim 5 , wherein the persistent storage unit further stores a plurality of encryption key seed values, each encryption key seed value associated with a respective encryption key seed value identifier. 
     
     
         8 . The token of  claim 7 , wherein the encryption key seed value is a component of a multi-component secret. 
     
     
         9 . The token of  claim 7 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to begin authentication, retrieving from a storage location on the token one of the static secret and dynamic secret pairs according to a host identifier received from the host; generating a message digest using the retrieved static secret and dynamic secret pair as an input to an n-bit generator; extracting and storing a session encryption key from the message digest; and notifying the host that the command to begin authentication has been executed.   
     
     
         10 . The token of  claim 9 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to authenticate the host, receiving a password from the host; comparing the password received from the host with a one-time password generated by the token; and if the password received from the host matches the one-time password generated by the token, updating the dynamic secret associated with the host identifier and notifying the host it was successfully authenticated, otherwise, if the password received from the host does not match the one-time password generated by the token, notifying the host it was not successfully authenticated   wherein the one-time password generated by the token is extracted from the message digest.   
     
     
         11 . The token of  claim 9 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to generate an encryption key, generating the encryption key using a seed value as an input to the n-bit generator, the n-bit generator producing an output, a least a portion of which output comprises the encryption key, notifying the host that the encryption key was generated, and providing the encryption key to the host.   
     
     
         12 . The token of  claim 1 , wherein the persistent storage unit further stores a plurality of encryption key seed values, each encryption key seed value associated with a respective encryption key seed value identifier. 
     
     
         13 . The token of  claim 12 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to begin authentication, retrieving from a storage location on the token a static secret and a dynamic secret, the static secret and the dynamic secret each associated with a host identifier received from the host; generating a message digest using the static secret and the dynamic secret as inputs to an n-bit generator;   extracting and storing a session encryption key from the message digest; and notifying the host that the command to begin authentication has been executed.   
     
     
         14 . The token of  claim 13 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to authenticate the host, receiving a password from the host; comparing the password received from the host with a one-time password generated by the token; and if the password received from the host matches the one-time password generated by the token, updating the dynamic secret associated with the host identifier and notifying the host it was successfully authenticated, otherwise, if the password received from the host does not match the one-time password generated by the token, notifying the host it was not successfully authenticated   wherein the one-time password generated by the token is extracted from the message digest.   
     
     
         15 . The token of  claim 13 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to generate an encryption key, generating the encryption key using a seed value as an input to the n-bit generator, the n-bit generator producing an output, a least a portion of which output comprises the encryption key, notifying the host that the encryption key was generated, and providing the encryption key to the host.   
     
     
         16 . The token of  claim 5 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to begin authentication, retrieving from a storage location on the token a static secret and a dynamic secret, the static secret and the dynamic secret each associated with a host identifier received from the host; generating a message digest using the static secret and the dynamic secret as inputs to an n-bit generator; extracting and storing a session encryption key from the message digest; and notifying the host that the command to begin authentication has been executed.   
     
     
         17 . The token of  claim 5 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to authenticate the host, receiving a password from the host; comparing the password received from the host with a one-time password generated by the token; and if the password received from the host matches the one-time password generated by the token, updating the dynamic secret associated with the host identifier and notifying the host it was successfully authenticated, otherwise, if the password received from the host does not match the one-time password generated by the token, notifying the host it was not successfully authenticated   wherein the one-time password generated by the token is extracted from the message digest.   
     
     
         18 . The token of  claim 5 , wherein the persistent storage unit stores further computer-executable instructions, which further instructions, when executed by the processor, cause the processor to perform steps comprising:
 when the command comprises the command to generate an encryption key, generating the encryption key using a seed value as an input to the n-bit generator, the n-bit generator producing an output, a least a portion of which output comprises the encryption key, notifying the host that the encryption key was generated, and providing the encryption key to the host.   
     
     
         19 . A method of authenticating a host to a token, comprising:
 receiving, via an interface of the token, a command from the host;   determining, by a processor of the token, whether the command is valid for the token and, if not, returning a result to the host indicating the command is not valid; otherwise, if the command is determined to be valid for the token, performing the command and returning a result of performing the command to the host;   wherein the command comprises a command to authenticate the host, and performing the command comprises:
 receiving a password from the host; comparing the password received from the host with a one-time password generated by the token; and if the password received from the host matches a one-time password generated by the token, updating a dynamic secret associated with a host identifier and notifying the host it was successfully authenticated, otherwise, if the password received from the host does not match the one-time password generated by the token, notifying the host it was not successfully authenticated; 
 wherein the one-time password generated by the token is extracted from a message digest generated by an n-bit generator of the token, the n-bit generator using as inputs at least a static secret and a dynamic secret, the static secret and the dynamic secret each associated with a host identifier received from the host. 
   
     
     
         20 . The method of  claim 19 , wherein prior to authenticating the host, executing, by the processor, a command from the host to begin authentication by retrieving from a storage location on the token the static secret and the dynamic secret; generating the message digest using the static secret and the dynamic secret as inputs to the n-bit generator; extracting and storing a session encryption key from the message digest; and notifying the host that the command to begin authentication has been executed. 
     
     
         21 . The method of  claim 20 , further comprising, subsequent to authenticating the host, executing, by the processor, a command from the host to generate an encryption key by using a seed value as an input to the n-bit generator, the n-bit generator producing an output, a least a portion of which output comprises the encryption key; notifying the host that the encryption key was generated; and providing the encryption key to the host. 
     
     
         22 . The method of  claim 19 , wherein subsequent to the token authenticating the host, authenticating the token by the host.