Software token
Encyclopedia
A software token is a type of two-factor authentication
security device that may be used to authorize the use of computer services. Software tokens are stored on a general-purpose electronic device such as a desktop computer
, laptop
, PDA
, or mobile phone
. This is in contrast to hardware tokens, where the credentials are stored on a dedicated hardware device.
Because software tokens are something one is not physically in possession of, they are exposed to unique threats such as computer virus
es and software
attacks. However, both hardware and software tokens are vulnerable to bot-based man-in-the-middle attack
s, or simple phishing attacks in which the OTP provided by the token is solicited, and then supplied to the genuine website in a timely manner. Software tokens do have unarguable benefits: there is no physical token to carry, they do not contain batteries
that will run out, and they are cheaper than hardware tokens.
and public-key cryptography
.
For a shared secret, an administrator
will typically generate a configuration file
for each end-user. The file will contain a username, a personal identification number
, and the secret
. This configuration file is given to the user.
The shared secret architecture is potentially vulnerable in a number of areas. The configuration file can be compromised if it is stolen and the token is copied. With time-based software tokens, it is possible to borrow an individual's PDA
or laptop, set the clock forward, and generate codes that will be valid in the future. Any software token that uses shared secrets and stores the PIN alongside the shared secret in a software client can be stolen and subjected to offline attacks. Shared secret tokens can be difficult to distribute, since each token is essentially a different piece of software. Each user must receive a copy of the secret, which can create time constraints.
Some newer software tokens rely on public-key cryptography
, or asymmetric cryptography. This architecture
eliminates many of the traditional weaknesses of software tokens. A PIN can be stored on a remote authentication server
instead of with the token client, making a stolen software token no good unless the PIN is known as well. If there are attempts made to guess the PIN, it can be detected and logged on the authentication server, which can disable the token. Using asymmetric cryptography also simplifies implementation, since the token client can generate its own key pair and exchange public keys with the server.
Two-factor authentication
Two-factor authentication is an approach to authentication which requires the presentation of two different kinds of evidence that someone is who they say they are. It is a part of the broader family of multi-factor authentication, which is a defense in depth approach to security...
security device that may be used to authorize the use of computer services. Software tokens are stored on a general-purpose electronic device such as a desktop computer
Desktop computer
A desktop computer is a personal computer in a form intended for regular use at a single location, as opposed to a mobile laptop or portable computer. Early desktop computers are designed to lay flat on the desk, while modern towers stand upright...
, laptop
Laptop
A laptop, also called a notebook, is a personal computer for mobile use. A laptop integrates most of the typical components of a desktop computer, including a display, a keyboard, a pointing device and speakers into a single unit...
, PDA
Personal digital assistant
A personal digital assistant , also known as a palmtop computer, or personal data assistant, is a mobile device that functions as a personal information manager. Current PDAs often have the ability to connect to the Internet...
, or mobile phone
Mobile phone
A mobile phone is a device which can make and receive telephone calls over a radio link whilst moving around a wide geographic area. It does so by connecting to a cellular network provided by a mobile network operator...
. This is in contrast to hardware tokens, where the credentials are stored on a dedicated hardware device.
Because software tokens are something one is not physically in possession of, they are exposed to unique threats such as computer virus
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
es and software
Computer software
Computer software, or just software, is a collection of computer programs and related data that provide the instructions for telling a computer what to do and how to do it....
attacks. However, both hardware and software tokens are vulnerable to bot-based man-in-the-middle attack
Man-in-the-middle attack
In cryptography, the man-in-the-middle attack , bucket-brigade attack, or sometimes Janus attack, is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other...
s, or simple phishing attacks in which the OTP provided by the token is solicited, and then supplied to the genuine website in a timely manner. Software tokens do have unarguable benefits: there is no physical token to carry, they do not contain batteries
Battery (electricity)
An electrical battery is one or more electrochemical cells that convert stored chemical energy into electrical energy. Since the invention of the first battery in 1800 by Alessandro Volta and especially since the technically improved Daniell cell in 1836, batteries have become a common power...
that will run out, and they are cheaper than hardware tokens.
Security architecture
There are two primary architectures for software tokens: Shared secretShared secret
In cryptography, a shared secret is a piece of data, known only to the parties involved, in a secure communication. The shared secret can be a password, a passphrase, a big number or an array of randomly chosen bytes....
and public-key cryptography
Public-key cryptography
Public-key cryptography refers to a cryptographic system requiring two separate keys, one to lock or encrypt the plaintext, and one to unlock or decrypt the cyphertext. Neither key will do both functions. One of these keys is published or public and the other is kept private...
.
For a shared secret, an administrator
Network administrator
A network administrator, network analyst or network engineer is a person responsible for the maintenance of computer hardware and software that comprises a computer network...
will typically generate a configuration file
Configuration file
In computing, configuration files, or config files configure the initial settings for some computer programs. They are used for user applications, server processes and operating system settings. The files are often written in ASCII and line-oriented, with lines terminated by a newline or carriage...
for each end-user. The file will contain a username, a personal identification number
Personal identification number
A personal identification number is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system. Typically, the user is required to provide a non-confidential user identifier or token and a confidential PIN to gain access to the system...
, and the secret
Shared secret
In cryptography, a shared secret is a piece of data, known only to the parties involved, in a secure communication. The shared secret can be a password, a passphrase, a big number or an array of randomly chosen bytes....
. This configuration file is given to the user.
The shared secret architecture is potentially vulnerable in a number of areas. The configuration file can be compromised if it is stolen and the token is copied. With time-based software tokens, it is possible to borrow an individual's PDA
Personal digital assistant
A personal digital assistant , also known as a palmtop computer, or personal data assistant, is a mobile device that functions as a personal information manager. Current PDAs often have the ability to connect to the Internet...
or laptop, set the clock forward, and generate codes that will be valid in the future. Any software token that uses shared secrets and stores the PIN alongside the shared secret in a software client can be stolen and subjected to offline attacks. Shared secret tokens can be difficult to distribute, since each token is essentially a different piece of software. Each user must receive a copy of the secret, which can create time constraints.
Some newer software tokens rely on public-key cryptography
Public-key cryptography
Public-key cryptography refers to a cryptographic system requiring two separate keys, one to lock or encrypt the plaintext, and one to unlock or decrypt the cyphertext. Neither key will do both functions. One of these keys is published or public and the other is kept private...
, or asymmetric cryptography. This architecture
Software architecture
The software architecture of a system is the set of structures needed to reason about the system, which comprise software elements, relations among them, and properties of both...
eliminates many of the traditional weaknesses of software tokens. A PIN can be stored on a remote authentication server
Server (computing)
In the context of client-server architecture, a server is a computer program running to serve the requests of other programs, the "clients". Thus, the "server" performs some computational task on behalf of "clients"...
instead of with the token client, making a stolen software token no good unless the PIN is known as well. If there are attempts made to guess the PIN, it can be detected and logged on the authentication server, which can disable the token. Using asymmetric cryptography also simplifies implementation, since the token client can generate its own key pair and exchange public keys with the server.
See also
- Multifactor authentication
- Security tokenSecurity tokenA security token may be a physical device that an authorized user of computer services is given to ease authentication...
- eAuthenticationEAuthenticationeAuthentication is an Authentication service provided by one remote server to other distributed servers, on the Internet or Intranet.Similar to Credit Cards verification services that are provided by third parties to eCommerce Web Sites, eAuthentication service is providing Identity verification...
- authenticationAuthenticationAuthentication is the act of confirming the truth of an attribute of a datum or entity...