The Wikipedia entry for SecurId says they use a scheme where each physical device has a private key that is also stored on the server (and apparently in RSA severs as well).

I wonder why don't they use a public key scheme where the server only needs the public key of the specific user for authentication. This way the private key is stored only on the physical device.