Time-based one time password (TOTP) for network authentication
A Time-based One-Time Password (TOTP) validator is interposed between a principal and a network service. The validator interacts with a mobile application (app) on the mobile device associated with the principal to dynamically supply a validator secret. The secret and, perhaps, other information are processed by the app to generate a TOTP when the principal attempts to access a protected resource of the network service. The validator independently generates the TOTP and compares the app generated TOTP, and on a successful match, a principal's access device is redirected for access to the protected resource.
1. A method, comprising:
providing, by a mobile device, an invitation token to a Time-based One-Time Only Password (TOTP) manager that processes on a server;
obtaining, by the mobile device, a TOTP secret that is generated by the TOTP manager, and removed by the TOTP manager once the TOTP secret is provided by the TOTP manager to the mobile device;
storing, by the mobile device, the TOTP secret in a key store on the mobile device;
acquiring, by the mobile device, a request to generate a TOTP from a principal;
processing, by the mobile device, a first factor authentication of the principal attempting to access a protected resource and responsive to the processing obtaining a globally-unique identifier (GUID) for the principal;
generating, by the mobile device, the TOTP by hashing the TOTP secret, the GUID, and current Time-Of-Day (TOD); and
providing, by the mobile device, the TOTP as a second factor authentication for authenticating and accessing the protected resource.
2. The method of claim 1 further comprising, presenting, by the mobile device, the TOTP on a display of the mobile device for access by the principal and accessing the protected resource.
3. The method of claim 1 , wherein providing further includes obtaining the invitation token through an input supplied by the principal on the mobile device.
4. The method of claim 1 , wherein providing further includes obtaining the invitation token through processing of an automated application that interacts with the mobile device.
5. The method of claim 1 , wherein providing further includes periodically receiving a new invitation token to replace the invitation token.
6. The method of claim 1 , wherein providing further includes supplying the invitation token to the TOTP manager when processing for the method is initiated for execution on the mobile device.
7. The method of claim 1 , wherein providing further includes obtaining the invitation token in an email delivered to the mobile device.
8. The method of claim 1 , wherein providing further includes including in the invitation token social identity data for the principal.
9. The method of claim 1 , wherein obtaining further includes periodically obtaining a new TOTP secret from the TOTP manager replacing the TOTP secret.
10. The method of claim 1 , wherein generating further includes adding a random number to a hash value when generating the TOTP based on instructions embedded in the TOTP secret and processed.