One-time password delivery via in-band unauthenticated channel

1 . A method comprising:

receiving, at an authentication service, a public key of a public-private key pair from an entity, the public-private key pair being specific to the entity and used in connection with one-time password generation for a plurality of different end users;

receiving, at the authentication service, a challenge request from the entity via an unauthenticated communication channel, wherein the challenge request is received from the entity in response to the entity receiving a resource request from a user device of an end user;

generating, at the authentication service, a one-time password to authenticate an identity of the end user;

encrypting, at the authentication service, the one-time password using the public key; and

delivering the encrypted one-time password from the authentication service to the entity via the unauthenticated communication channel,

wherein the entity is separate from the authentication service that generates the one-time password to authenticate the identity of the end user, and wherein the entity is separate from the user device of the end user.

2 . The method of claim 1 , further comprising receiving, from the entity, the one-time password after the one-time password is received by the entity from the user device of the end user.

3 . The method of claim 2 , further comprising validating an identity of the end user at the authentication service based on the one-time password received from the entity.

4 . The method of claim 1 , wherein the entity is a provider of a secure application and the authentication service is a third party identity verification service communicatively connected to the entity via the unauthenticated communication channel.

5 . The method of claim 1 , wherein the unauthenticated communication channel is established across a public network.

6 . A method comprising:

transmitting, from an entity, a public key of a public-private key pair to an authentication service, the public-private key pair being specific to the entity and used in connection with one-time password generation for a plurality of different end users;

receiving, from a user device of an end user, a request for access to a secure resource requiring identity verification;

transmitting, from the entity, a challenge request to the authentication service via an unauthenticated communication channel;

receiving, at the entity, a one-time password encrypted with the public key from the authentication service via the unauthenticated communication channel;

decrypting, at the entity, the one-time password; and

delivering the one-time password to the user device of the end user to authenticate an identity of the end user,

wherein the entity is separate from the authentication service that generates the one-time password to authenticate the identity of the end user, and wherein the entity is separate from the user device of the end user.

7 . The method of claim 6 , further comprising:

receiving the one-time password from the user device of the end user at the entity; and

in response to validating the one-time password with the authentication service, granting access to the secure resource to the user device of the end user.

8 . The method of claim 6 , wherein the secure resource comprises a secure application hosted by the entity.

9 . The method of claim 6 , wherein the authentication service is a third party identity verification service communicatively connected to the entity via the unauthenticated communication channel.

10 . The method of claim 6 , further comprising storing, at the entity, a private key of the public-private key pair.

11 . The method of claim 6 , further comprising generating, at the entity, the public-private key pair.

12 . A system comprising:

an authentication system comprising a processor and a memory storing computer-executable instructions which, when executed by the processor, cause the authentication system to:

receive a public key of a public-private key pair from an entity, the public-private key pair being specific to the entity and used in connection with one-time password generation for a plurality of different end users;

receive a challenge request from the entity via an unauthenticated communication channel, wherein the challenge request is received from the entity in response to the entity receiving a resource request from a user device of an end user;

generate a one-time password to authenticate an identity of the end user;

encrypt the one-time password using the public key; and

deliver the encrypted one-time password to the entity via the unauthenticated communication channel,

wherein the entity is separate from the authentication system that generates the one-time password to authenticate the identity of the end user, and wherein the entity is separate from the user device of the end user.

13 . The system of claim 12 , further comprising a server system at the entity, the server system hosting a secure resource requiring identity verification for access, the server system including a processor and a memory storing computer-executable instructions which, when executed by the processor of the server system, cause the server system to:

transmit the public key of a public-private key pair to the authentication system;

receive, from the user device of the end user, a request for access to the secure resource;

transmit the challenge request to the authentication system via the unauthenticated communication channel;

receive the encrypted one-time password from the authentication system via the unauthenticated communication channel;

decrypt the encrypted one-time password to obtain the one-time password; and

deliver the one-time password to the user device of the end user.

14 . The system of claim 13 , wherein the authentication system is communicatively connected to the server system at the entity via a public network.

15 . The system of claim 13 , wherein the authentication system is remotely located from the server system of the entity.

16 . The system of claim 13 , wherein the authentication system is further configured to validate an identity of the end user at the authentication system based on the one-time password received from the entity.

17 . The system of claim 13 , wherein the authentication system stores a plurality of public keys in a key storage, the plurality of public keys being received from a plurality of different entities.