Patent ID: 8640214

Claim:
A method for distributing a symmetric key for a one-time password token, having a unique identifier, in a system including an end-user computer operated by an end-user, a service provider server of a service provider having a service provider identifier, and a manufacturer backend server operated by the manufacturer of the OTP token, the method operating to distribute the symmetric key from the manufacturer backend server to the service provider server and comprising: operating the end-user computer and service provider server to authenticate the end-user with the service provider; transmitting a message containing the token unique identifier and a token possession confirmation from the end-user computer to the service provider server; in response to receiving the response with the token unique identifier and the token possession confirmation, transmitting an authentication message having the service provider identifier, the token unique identifier, and the token possession confirmation from the service provider server to the manufacturer backend server; in response to receiving the authentication message, operating the manufacturer backend server to independently verify the token possession confirmation as belonging to a token corresponding to the token unique identifier and upon successful verification, transmitting a symmetric key corresponding to the token corresponding to the token unique identifier from the manufacturer backend server to the service provider server; and in response to receiving the symmetric key, operating the service provider to securely store the token key and associate the token unique identifier and the symmetric key received from the manufacturer backend server.