Mobile offline authentication using one-time passcodes
View Patent ↗A technique of authenticating a user involves storing a set of expected OTPs in memory of a mobile device, the set of expected OTPs having been previously generated by and acquired from an external authentication server. The technique further involves receiving, after the set of expected OTPs is stored in the memory, an authentication request from a user of the mobile device, the authentication request including a user-provided OTP. The technique further involves performing, by processing circuitry of the mobile device, a local authentication operation which provides an authentication result based on a comparison between the user-provided OTP and an expected OTP of the set of expected OTPs stored in the memory. The authentication result indicates whether authentication of the user is successful or unsuccessful.
1. In a mobile device, a method of authenticating a user, the method comprising:
storing a set of expected one-time passcodes (OTPs) in memory of the mobile device, the set of expected OTPs having been previously generated by and acquired from an external authentication server;
after the set of expected OTPs is stored in the memory of the mobile device, receiving an authentication request from a user of the mobile device, the authentication request including a user-provided OTP; and
performing, by processing circuitry of the mobile device, a local authentication operation which provides an authentication result based on a comparison between the user-provided OTP and an expected OTP of the set of expected OTPs stored in the memory of the mobile device, the authentication result indicating whether authentication of the user is successful or unsuccessful;
wherein storing the set of expected OTPs in the memory of the mobile device includes saving, in the memory of the mobile device, an OTP file holding multiple time-indexed OTPs as the set of OTPs, each time-indexed OTP corresponding to a respective window of time; and
wherein performing the local authentication operation includes:
obtaining a current time value,
identifying, from the OTP file, particular time-indexed OTPs corresponding to windows of time covering the current time value, and
comparing the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful.
2. A method as in claim 1 , further comprising:
prior to saving the OTP file in the memory of the mobile device, acquiring the OTP file indirectly from the external authentication server via proxy equipment.
3. A method as in claim 2 wherein the proxy equipment includes (i) a mobile device module which is constructed and arranged to communicate with mobile devices and (ii) an authentication client module which is constructed and arranged to communicate with the external authentication server, the mobile device module and the authentication client module being linked together;
wherein the authentication client module of the proxy equipment is constructed and arranged to receive the OTP file from the external authentication server and buffer the OTP file while the mobile device is offline from the perspective of the mobile device module of the proxy equipment; and
wherein acquiring the OTP file indirectly from the external authentication server via the proxy equipment includes, after the OTP file is buffered by the authentication client module, establishing a communications channel between the mobile device and the mobile device module of the proxy equipment, and receiving the OTP file over the communications channel between the mobile device and the mobile device module of the proxy equipment.
4. A method as in claim 3 wherein the authentication client module of the proxy equipment is constructed and arranged to receive the OTP file from the external authentication server in encrypted form; and
wherein receiving the OTP file over the communications channel between the mobile device and the mobile device module of the proxy equipment includes obtaining the OTP file from the mobile device module of the proxy equipment in unencrypted form following decryption of the OTP file by the proxy equipment.
5. A method as in claim 2 wherein acquiring the OTP file indirectly from the external authentication server via the proxy equipment includes:
obtaining the OTP file during an authentication session in which the user successfully authenticates with the external authentication server through the proxy equipment.
6. A method as in claim 2 wherein acquiring the OTP file indirectly from the external authentication server via the proxy equipment includes:
obtaining the OTP file during an authentication session in which the user successfully authenticates with the proxy equipment while the external authentication server is offline from the perspective of the mobile device.
7. A method as in claim 2 wherein acquiring the OTP file indirectly from the external authentication server via the proxy equipment includes:
retrieving the OTP file from the proxy equipment automatically in response to the proxy equipment coming online from the perspective of the mobile device.
8. A method as in claim 2 wherein comparing the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful includes:
while the external authentication server is offline from the perspective of the mobile device, generating, as the authentication result, (i) a first authentication value to indicate successful authentication when the user-provided OTP matches one of the particular time-indexed OTPs and (ii) a second authentication value, which is different than the first authentication value, to indicate unsuccessful authentication when the user-provided OTP does not match any of the particular time-indexed OTPs.
9. A method as in claim 2 wherein comparing the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful includes:
while the proxy equipment is offline from the perspective of the mobile device, generating, as the authentication result, (i) a first authentication value to indicate successful authentication when the user-provided OTP matches one of the particular time-indexed OTPs and (ii) a second authentication value, which is different than the first authentication value, to indicate unsuccessful authentication when the user-provided OTP does not match any of the particular time-indexed OTPs.
10. A method as in claim 2 wherein comparing the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful includes:
while the external authentication server and the proxy equipment are both offline from the perspective of the mobile device, generating, as the authentication result, (i) a first authentication value to indicate successful authentication when the user-provided OTP matches one of the particular time-indexed OTPs and (ii) a second authentication value, which is different than the first authentication value, to indicate unsuccessful authentication when the user-provided OTP does not match any of the particular time-indexed OTPs.
11. A method as in claim 2 , further comprising:
caching multiple authentication results within the memory of the mobile device, each of the multiple authentication results indicating whether a respective authentication attempt was successful or unsuccessful.
12. A method as in claim 11 , further comprising:
after the multiple authentication results are cached within the memory of the mobile device, sending the multiple authentication results from the mobile device to the external authentication server through the proxy equipment.
13. A method as in claim 1 wherein saving the OTP file in the memory of the mobile device includes:
writing the OTP file to persistent storage of the mobile device, the written OTP file holding a series of time-indexed OTPs covering at least an upcoming contiguous 24 hour period.
14. A method as in claim 13 saving the OTP file in the memory of the mobile device further includes:
deleting, from the persistent storage, another OTP file holding an earlier series of time-indexed OTPs covering at least an earlier contiguous 24 hour period.
15. A method as in claim 14 wherein at least some of the series of time-indexed OTPs held in the OTP file and at least some of the earlier series of time-indexed OTPs held in the other OTP file cover the same window of time and are the same.
16. A method as in claim 1 wherein the mobile device includes cellular telephone circuitry which is integrated with the processing circuitry; and wherein the method further comprises:
establishing, by the cellular telephone circuitry, a cellular telephone call between the mobile device and an external telephone device independently of whether comparing the user-provided OTP to the particular time-indexed OTPs determines authentication of the user to be successful or unsuccessful.
17. A method as in claim 1 , further comprising:
prior to performing the local authentication operation, operating in an online state in which the mobile device communicates with an authentication server via a wireless network to authenticate the user; and
in response to loss of wireless network access, transitioning from the online state to an offline state in which the mobile device performs the local authentication operation to authenticate the user.
18. A mobile device, comprising:
a mobile device housing having a handheld form factor;
a wireless interface disposed within the mobile device housing;
a user interface supported by the mobile device housing;
memory disposed within the mobile device housing; and
processing circuitry disposed within the mobile device housing, the processing circuitry being coupled to the wireless interface, the user interface and the memory, and the processing circuitry being constructed and arranged to:
store a set of expected one-time passcodes (OTPs) in the memory, the set of expected OTPs having been previously generated by and acquired from an external authentication server through the wireless interface,
after the set of expected OTPs is stored in the memory, receive an authentication request from a user through the user interface, the authentication request including a user-provided OTP, and
perform a local authentication operation which provides an authentication result based on a comparison between the user-provided OTP and an expected OTP of the set of expected OTPs stored in the memory, the authentication result indicating whether authentication of the user is successful or unsuccessful;
wherein the processing circuitry, when storing the set of expected OTPs in the memory, is constructed and arranged to save, in the memory, an OTP file holding multiple time-indexed OTPs as the set of OTPs, each time-indexed OTP corresponding to a respective window of time; and
wherein the processing circuitry, when performing the local authentication operation, is constructed and arranged to:
obtain a current time value,
identify, from the OTP file, particular time-indexed OTPs corresponding to windows of time covering the current time value, and
compare the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful.
19. A computer program product having a non-transitory computer readable medium which stores a set of instructions to authenticate a user, the set of instructions, when carried out by processing circuitry of a mobile device, causing the processing circuitry to perform a method of:
storing a set of expected one-time passcodes (OTPs) in memory of the mobile device, the set of expected OTPs having been previously generated by and acquired from an external authentication server;
after the set of expected OTPs is stored in the memory of the mobile device, receiving an authentication request from the user, the authentication request including a user-provided OTP; and
performing, by the processing circuitry, a local authentication operation which provides an authentication result based on a comparison between the user-provided OTP and an expected OTP of the set of expected OTPs stored in the memory of the mobile device, the authentication result indicating whether authentication of the user is successful or unsuccessful;
wherein storing the set of expected OTPs in the memory of the mobile device includes saving, in the memory of the mobile device, an OTP file holding multiple time-indexed OTPs as the set of OTPs, each time-indexed OTP corresponding to a respective window of time; and
wherein performing the local authentication operation includes:
obtaining a current time value,
identifying, from the OTP file, particular time-indexed OTPs corresponding to windows of time covering the current time value, and
comparing the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful.
20. In proxy equipment, a method of delivering a set of expected one-time passcodes (OTPs) from an external authentication server to a mobile device to enable user authentication, the method comprising:
receiving, by a local authentication client of the proxy equipment, the set of expected OTPs through a first communications channel established between the local authentication client and the external authentication server;
buffering, at least temporarily, the set of OTPs in dedicated memory of the local authentication client of the proxy equipment; and
conveying, by a mobile device module of the proxy equipment, the set of expected OTPs from the dedicated memory of the local authentication client to the mobile device through a second communications channel established between the mobile device module and the mobile device;
wherein conveying the set of expected OTPs includes saving, in memory of the mobile device, an OTP file holding multiple time-indexed OTPs as the set of OTPs, each time-indexed OTP corresponding to a respective window of time; and
wherein the OTP file enables the mobile device to perform a local authentication operation by:
obtaining a current time value,
identifying, from the OTP file, particular time-indexed OTPs corresponding to windows of time covering the current time value, and
comparing a user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of a user is successful or unsuccessful.