Time-based one time password (TOTP) for network authentication
A Time-based One-Time Password (TOTP) validator is interposed between a principal and a network service. The validator interacts with a mobile application (app) on the mobile device associated with the principal to dynamically supply a validator secret. The secret and, perhaps, other information are processed by the app to generate a TOTP when the principal attempts to access a protected resource of the network service. The validator independently generates the TOTP and compares the app generated TOTP, and on a successful match, a principal's access device is redirected for access to the protected resource.
1. A method, comprising:
receiving, on a server, an access request initiated by a principal for access to a network resource, wherein the access request comprises a one-time password generated by a device of the principal;
obtaining, by the server, a secret for the principal;
producing, by the server. a second one-time password based at least in part on the secret;
authenticating, by the server, the principal for access to the network resource when the second one-time password matches the one-time password;
changing, by the server, the secret into a changed secret without notifying the principal;
generating, by the server, a base one-time password by hashing a global identifier for the principal and the changed secret; and
providing, by the server, the base one-time password to the principal to use as a seed for generating other one-time passwords that are subsequently provided by the principal for subsequent access requests to the network resource.
2. The method of claim 1 , wherein receiving further includes receiving the one-time password as a second factor authentication for access to the network resource after the principal has successfully authenticated with a first factor authentication for access to the network resource.
3. The method of claim 2 , wherein receiving further includes obtaining an access token returned from the network resource for the principal after the first factor authentication is successfully processed by the network resource.
4. The method of claim 3 , wherein obtaining the secret further includes using the access token to access the network resource and calculating the secret from principal identity data that is maintained for the principal by the network resource.
5. The method of claim 4 , wherein using further includes obtaining the global identifier from the network resource, wherein the global identifier is maintained by the network resource for the principal.
6. The method of claim 5 , wherein producing further includes combining and hashing together the global identifier and the secret and generating a preliminary second one-time password for the principal.
7. The method of claim 6 , wherein combining and hashing further includes hashing the preliminary second one-time password with a time of day and producing the second one-time password.
8. The method of claim 7 , wherein authenticating further includes when the one-time password does not match the second one-time password hashing the preliminary second one-time password with a second time of day that is before the time of day or that is after the time of day and producing a second version of the second one-time password and authenticating the principal when the second version of the second one-time password matches the one-time password.
9. The method of claim 1 , wherein changing further includes producing the changed secret based on evaluation of a policy that dictates when the secret is to be changed by the server.
10. A non-transitory computer-readable medium comprising executable instructions which when executed by a processor of a server cause the processor to perform operations comprising:
receiving an access request initiated by a principal for access to a network resource, wherein the access request comprises a one-time password generated by a device of the principal;
obtaining a secret for the principal;
producing a second one-time password based at least in part on the secret;
authenticating the principal for access to the network resource when the second one-time password matches the one-time password;
changing the secret into a changed secret without notifying the principal;
generating a base one-time password by hashing a global identifier for the principal and the changed secret; and
providing the base one-time password to the principal to use as a seed for generating other one-time passwords that are subsequently provided by the principal for subsequent access requests to the network resource.
11. The non-transitory computer-readable medium of claim 10 , wherein the operations corresponding to the receiving further includes receiving the one-time password as a second factor authentication for access to the network resource after the principal has successfully authenticated with a first factor authentication for access to the network resource.
12. The non-transitory computer-readable medium of claim 11 , wherein the operations corresponding to the receiving further includes obtaining an access token returned from the network resource for the principal after the first factor authentication is successfully processed by the network resource.
13. The non-transitory computer-readable medium of claim 12 , wherein the operations corresponding to the obtaining the secret further includes using the access token to access the network resource and calculating the secret from principal identity data, wherein the principal identity data is maintained by the network resource for the principal.
14. A server, comprising:
a processor;
a non-transitory computer-readable storage medium comprising executable instructions; and
the executable instructions when executed by the processor cause the processor to perform operations comprising:
receiving an access request initiated by a principal for access to a network resource, wherein the access request comprises a one-time password generated by a device of the principal;
obtaining a secret for the principal;
producing a second one-time password based at least in part on the secret; and
authenticating the principal for access to the network resource when the second one-time password matches the one-time password;
changing the secret into a changed secret without notifying the principal;
generating a base one-time password by hashing a global identifier for the principal and the changed secret; and
providing the base one-time password to the principal to use as a seed for generating, other one-time passwords that are subsequently provided by the principal for subsequent access requests to the network resource.
15. The server of claim 14 , wherein the operations corresponding to the receiving further include obtaining a secret from the network resource for the principal after a successful first factor authentication of the principal is processed by the network resource.
16. The server of claim 15 , wherein the operations corresponding to the obtaining the secret further include obtaining a global identifier for the principal from the network resource, wherein the network resource maintains the global identifier for the principal.
17. The server of claim 16 , wherein the operations corresponding to the producing further include hashing the secret, the global identifier, and a time-of-say, and producing the second one-time password.