One-time passcodes with asymmetric keys

摘要

Protecting the security of an entity by using passcodes is disclosed. A user's passcode device generates a passcode. In an embodiment, the passcode is generated in response to receipt of user information. The passcode is received by another system, which authenticates the passcode by at least generating a passcode from a passcode generator, and comparing the generated passcode with the received passcode. The passcode is temporary. At a later use a different passcode is generated from a different passcode generator. In these embodiments, there are asymmetric secrets stored on the passcode device and by the administrator. This adds more security so that if the backend servers are breached, the adversary cannot generate valid passcodes. In some embodiments, the passcode depends on the rounded time.

主权项

1. A method comprising:
enrolling, by a device, a user in a system based on at least user information, the device including a processor system having at least one processor and a memory system, the memory system having a nontransitory memory; storing the user information in the memory system of the device; and at a completion of the enrolling, generating asymmetric keys and a registration code based on quantum information from a semiconductor that detects the arrival of photons, the registration code being a sequence of symbols or bits; wherein the asymmetric keys include a user key and an administrator key, which are different from one another, the user key being required to perform one or more operations on a physical token or in a secure area of the device, the administrator key being required to perform one or more operations on at least one backend server, the backend server including a second processor system having at least one processor and a second memory system; wherein the administrator key is generated based on information provided by the user; wherein it is mathematically intractable to guess the user key from the administrator key; and wherein it is mathematically intractable to guess the administrator key from the user key.