System and method for generating one-time password for information handling resource
View Patent ↗In accordance with embodiments of the present disclosure, a method may include generating a random number to be associated with an information handling resource. The method may also include generating a challenge string based at least on the random number. The method may additionally include encrypting the challenge string using a first shared secret. The method may further include receiving a one-time password generated by a vendor associated with the information handling resource, the one-time password generated by decrypting the challenge string using the first shared secret, parsing the random number from the decrypted challenge string, and digitally signing the decrypted challenge string with a digital signature using a second shared secret. The method may also include granting user access to the information handling resource in response to verifying, using the second shared secret, that the digital signature matches the random number.
1. An information handling system comprising:
a processor; and
a one-time password tool associated with the information handling system, the one-time password tool comprising a program of instructions embodied in computer-readable media, and configured to cause the processor to:
generate a random number;
generate a challenge string based at least on the random number;
encrypt the challenge string using a first shared secret;
receive a one-time password generated by a vendor associated with an information handling resource communicatively coupled to the processor, the one-time password generated by decrypting the challenge string using the first shared secret, parsing the random number from the decrypted challenge string, and digitally signing the decrypted challenge string with a digital signature using a second shared secret; and
grant user access to the information handling resource in response to verifying, using the second shared secret, that the digital signature matches the random number.
2. The information handling system of claim 1 , wherein:
the challenge string is further based at least on additional information including at least one of a unique identifier and a key revision value;
the additional information is further parsed from the decrypted challenge string; and
the digital signature is based on the additional information.
3. The information handling system of claim 1 , wherein at least one of the first shared secret and the second shared secret is a public/private key pair.
4. The information handling system of claim 1 , wherein the challenge string is encrypted using a public key of a public/private key pair and the challenge string is decrypted using a private key of the public/private key pair.
5. The information handling system of claim 1 , wherein the digital signature is created using a private key of a public/private key pair and the digital signature is verified using a public key of the public/private key pair.
6. The information handling system of claim 1 , wherein the information handling resource comprises one of a basic input/output system and a storage resource.