Methods and systems for secure user authentication
Methods and systems for secure user authentication using a OTP involve, for example, pre-storing a OTP application on a first computing device for generating a valid OTP value for the user responsive to receiving entry of a valid PIN value of the user, no part of the valid PIN value is stored on the first computing device and pre-storing on a back-end server the valid PIN value and a valid shared secret for the user. Upon receiving entry of a purported PIN value of the user, a purported shared secret is dynamically synthesized on the first computing device by the OTP application based on the purported PIN value of the user and a purported OTP value is generated on the first computing device. When entry of the purported OTP value is received by the back-end server in an attempt to log on the back-end server from a second computing device, the back-end server cryptographically calculates a window of OTP values, and log on to the back-end server from the second computing device is allowed if the calculated window of OTP values corresponds to the received OTP value.
1. A computer-implemented method comprising:
storing, by a computer in communication with a first computing device, a one-time password (OTP) application on the first computing device, wherein the OTP application comprises an algorithm including a moving factor for generating successive different valid OTP values upon the receiving entry of the valid PIN value on the first computing device when the entered PIN value is valid, wherein the algorithm uses one or more of an event-based count or increment, a clock, and a computation of actual time;
responsive to the first computing device receiving an entry of a purported personal identification number (PIN) value and a selection on the first computing device of a web site verifier function of the OTP application, executing, by the first computing device, the web site verifier function of the OTP application to generate a random challenge code for mutual authentication of a web site by the web site verifier function of the OTP application, wherein the generated random challenge code is valid when the entered PIN value is valid;
responsive to a back-end server receiving an entry of an entered random challenge code from a second computing device in communication with the back-end server, executing, by the back-end server, a web site verifier function of the shared secret to cryptographically calculate a time-sensitive response code based at least on the entered random challenge code and to communicate the calculated time-sensitive response code to the second computing device for display, wherein the calculated time-sensitive response code is valid when the entered random challenge code is valid, wherein the cryptographically calculate the time-sensitive response code is based on storage by the back-end server of the entered PIN value;
receiving, by the computer in communication with the first computing device, an entry of the calculated time-sensitive response code from the first computing device; and
generating, by the computer, an indicator for display on the first computing device, wherein the indicator is an affirmative indicator if the entered time-sensitive response code corresponds to the generated random challenge code by the web-site verifier function of the OTP application on the first computing device.
2. The computer-implemented method according to claim 1 , wherein the indicator is a negative indicator if the entered time-sensitive response code fails to correspond to the generated random challenge code by the web-site verifier function of the OTP application on the first computing device.
3. The computer-implemented method according to claim 1 , wherein the cryptographically calculate the time-sensitive response code by the back-end server is based at least on a personalized OTP data stored in a back-end server database.
4. The computer-implemented method according to claim 1 , wherein the first computing device comprises one of a mobile phone, a PDA, a PC, a laptop computer, a hardware token, and an ATM.
5. The computer-implemented method according to claim 1 , wherein the algorithm further comprises an incrementing event counter that is synchronized with an incremental event counter on the back-end server for generating successive different valid OTP values upon the receiving entry of the PIN value on the first computing device when the entered PIN value is valid.
6. The computer-implemented method according to claim 1 , wherein the algorithm further comprises a clock that is synchronized with a clock on the back-end server for generating successive different valid OTP values responsive to receiving entry of the PIN value on the first computing device when the entered PIN value is valid.
7. The computer-implemented method according to claim 1 , wherein the algorithm includes an event-based count or increment.
8. The computer-implemented method according to claim 1 , wherein the algorithm uses a clock.
9. The computer-implemented method according to claim 1 , wherein the algorithm uses a computation of actual time.
10. The computer-implemented method according to claim 1 , further comprising the step, responsive to the first computing device receiving an entry of an update code, of executing an update function of the OTP application on the first computing device configured to initiate any of a token policy change, an OTP algorithm change, and a parameter update.