Time-based one time password (TOTP) for network authentication
View Patent ↗A Time-based One-Time Password (TOTP) validator is interposed between a principal and a network service. The validator interacts with a mobile application (app) on the mobile device associated with the principal to dynamically supply a validator secret. The secret and, perhaps, other information are processed by the app to generate a TOTP when the principal attempts to access a protected resource of the network service. The validator independently generates the TOTP and compares the app generated TOTP, and on a successful match, a principal's access device is redirected for access to the protected resource.
1. A method, comprising:
receiving, by a Time-based One-Time Password (TOTP) network manager executing on a server, a token request to generate a token;
generating, by the TOTP network manager, the token with identifying information for a principal attempting to access a protected resource of a network service;
supplying the token to a principal;
subsequently receiving, by the TOTP network manager, a token registration request for the token from the principal;
validating, by the TOTP network manager, the token using the identifying information included in the token for the principal;
registering, by the TOTP manager the token upon successful validation of the token;
detecting, by the TOTP network manager, a login by the principal to the network service;
obtaining, by the TOTP network manager, a unique identity for the principal and supplied by the network service to the principal after a successful login;
verifying, by the TOTP network manager, that the token is registered to the principal;
generating, by the TOTP network manager, a TOTP secret based at least in part on the unique identity for the principal, the token being registered to the principal, and a secret held by the TOTP network manager,
providing, by the TOTP network manager, the TOTP secret to a mobile application of a mobile device operated by the principal for authentication when the principal attempts to access the protected resource of the network service, and then removing the TOTP secret from the server;
receiving, by the TOTP network manager, a TOTP authentication request for the principal attempting to access the protected resource of the network service, the request received from a different device being operated by the principal;
regenerating, by the TOTP network manager, the TOTP secret;
obtaining, by the TOTP network manager, a TOTP generated by the mobile application by hashing the TOTP secret with a current Time Of Day (TOD);
receiving, by the TOTP network manager, the TOTP from the different device; generating, by the TOTP network manager, an independent version of the TOTP by using the TOD and the regenerated TOTP secret; and
authenticating, by the TOTP network manager, the principal for access to the protected resource, on behalf of the network service, when the independent version of the TOTP matches the TOTP that was supplied by the different device.
2. The method of claim 1 further comprising, periodically resupplying, by the TOTP network manager, a new TOTP secret to the mobile application based on a policy.
3. The method of claim 1 further comprising, invalidating, by the TOTP network manager, the mobile device for generating a valid TOTP based on the unique identity included in a list.
4. The method of claim 3 , wherein invalidating further includes altering the hash used to generate the TOTP by including a random number to prevent the mobile device from producing a device version of the TOTP that will match an independent version of the TOTP produced by the TOTP network manager.
5. The method of claim 4 , wherein altering further includes sending a new TOTP secret to a different instance of the mobile application on a different mobile device associated with the principal for the different instance to produce a version of the TOTP that will match the independent version of the TOTP produced by the TOTP network manager.
6. The method of claim 3 , wherein validating further includes invalidating the token when received after a time-to-live attribute associated with the token has expired.
7. The method of claim 1 , wherein validating further includes invalidating the token when the token does not identify the network service as an available network service associated with the principal.
8. The method of claim 1 , wherein detecting further includes identifying the login from the mobile device during a registration request by the principal or an administrator for the principal to receive the TOTP secret.
9. The method of claim 8 , wherein obtaining further includes detecting the unique identity as an identity attribute associated with the principal for accessing the network service.
10. The method of claim 1 , wherein generating further includes encrypting the TOTP secret with instructions for generating a TOTP by the mobile application.