Tracking and managing multiple time-based one-time password (TOTP) accounts
A host machine has a web browser. A user of the host machine also has a mobile device. A time-based, one-time password (TOTP) authentication scheme leverages a plug-in associated with the browser to automatically inject a received TOTP code into an element of an HTML-based TOTP authentication page, and to programmatically submit the HTML form (e.g., by mimicking the “click to submit” button on the TOTP form). Typically, the TOTP code is obtained following a successful completion of a push notification interaction between a cloud service, which stores TOTP shared secrets that are used to generate the TOTP codes, and the user of the mobile device. As a further feature, a method to keep track of multiple TOTP accounts and to find the account usable for a given website are also provided.
1 . A method to manage TOTP accounts, comprising:
establishing and maintaining a website-to-TOTP issuer data structure for a first set of websites;
establishing and maintaining a website-to-TOTP issuer data structure for a second set of websites, the second set of websites being distinct from the first set of web sites and being associated with a particular user;
responsive to receipt of a request for a TOTP code, the request being received during an attempt to login to a given website, checking the website-to-TOTP issuer data structure(s) for a match;
responsive to a determination that a match does not exist, issuing a request to obtain a TOTP account; and
responsive to receipt of a response to the request to obtain the TOTP account, updating the website-to-TOTP issuer data structure for the second set of websites.
2 . The method as described in claim 1 wherein the website-to-TOTP issuer data structure for the first set of websites is checked for the match first.
3 . The method as described in claim 2 wherein the website-to-TOTP issuer data structure for the second set of websites is checked if no match is found for the first set of websites.
4 . The method as described in claim 1 wherein the website-to-TOTP issuer data structure corresponds for the first set of websites represents a global mapping table for commonly-used websites.
5 . The method as described in claim 1 wherein the receipt of the request for a TOTP code is received from a browser plug-in.
6 . The method as described in claim 1 wherein the response to the request to obtain the TOTP code is obtained in association with a user selecting from a browser-displayed list an account for the given website from a list of available TOTP accounts.
7 . The method as described in claim 1 wherein the response to the request to obtain the TOTP code is obtained in association with a user entering into a browser a TOTP code obtained from an authenticator app.
8 . The method as described in claim 1 wherein the response to the request to obtain the TOTP code is obtained in associated with a user selecting a TOTP code to user from an authenticator app.
9 . Apparatus to manage TOTP accounts in a backend infrastructure, comprising:
a processor;
computer memory;
a data store storing (a) common URL-to-TOTP issuer mappings; and (b) per-user URL-to-TOTP issuer mappings; and
program code held in the computer memory and executing by the processor to dynamically update the per-user URL-to-TOTP issuer mappings to enable automated and reliable locating of a correct TOTP code for a given website.