One time password
View Patent ↗A token calculates a one time password by generating a HMAC-SHA-1 value based upon a key K and a counter value C, truncating the generated HMAC-SHA-1 value modulo 10^Digit, where Digit is the number of digits in the one time password. The one time password can be validated by a validation server that calculates its own version of the password using K and its own counter value C′. If there is an initial mismatch, the validation server compensate for a lack of synchronization between counters C and C′ within a look-ahead window, whose size can be set by a parameter s.
1. A system comprising:
a processor;
a memory coupled to said processor, said memory storing a shared secret key K, a validation server counter value C′, and instructions adapted to be executed by said processor to:
receive a first one time password from a token;
generate a HMAC-SHA-1 value based upon K and C′;
mask the highest-order bit of the generated HMAC-SHA-1 value to generate a masked HMAC-SHA-1 value;
truncate the masked HMAC-SHA-1 value module 10^Digit, where Digit is the number of digits in the first one time password to generate a second one time password; and
compare the calculated second one time password to the first one time password received from the token.
2. The system of claim 1 , said instructions further causing said processor to:
determine that the second one time password does not match the first one time password; and
calculate one or more additional one time passwords based upon key K and counter value C′+n, n being an integer from 1 to s, wherein s is a look-ahead parameter.
3. The system of claim 2 , further comprising sending a signal indicating a failed validation attempt.
4. The system of claim 2 , further comprising sending a signal indicating a successful validation.
5. The system of claim 2 , wherein said memory stores a throttling parameter T, and wherein further validation attempts from the token are suspended after T failed validation attempts.
6. A method comprising:
receiving a first one time password;
generating, by a processor, a HMAC-SHA-1 value based upon a key K and a counter value C′;
masking the highest-order bit of the generated HMAC-SHA-1 value to generate a masked HMAC-SHA-1 value;
truncating the masked HMAC-SHA-1 value module 10^Digit, where Digit is the number of digits in the first one time password to generate a second one time password;
comparing the second one time password to the first one time password; and
based upon the comparison of the first and second one time passwords, determining that the first one time password is valid.
7. The method of claim 6 , further comprising sending a signal indicating a successful validation.
8. The method of claim 6 , further comprising sending a signal indicating a failed validation attempt.
9. The method of claim 6 , further comprising suspending validation attempts if the number of failed attempts exceeds T, a throttling parameter.