Authentication based on shared secret seed updates for one-time passcode generation
Techniques are provided for authenticating a user using shared secret seed updates for one-time passcode (OTP) generation. One method comprises, in response to a first authentication of a client using a given OTP derived from a given shared secret seed, updating, by a server, the given shared secret seed using the given OTP and/or a timestamp from the first authentication to generate an updated given shared secret seed; and evaluating a second authentication using a new OTP derived from the updated given shared secret seed. An anomaly may be detected when the client attempts the second authentication using an OTP and the server determines that the OTP was generated by a previously used shared secret seed. The server may store a set of previously accepted OTPs, and evaluate the previously accepted OTPs to validate the new OTP.
1. A method, comprising:
in response to a first authentication of a client using a given one-time passcode derived from a given shared secret seed, updating, using at least one processing device of a server, the given shared secret seed using one or more of the given one-time passcode and a timestamp from the first authentication as part of a secret update protocol to generate an updated given shared secret seed; and
evaluating a second authentication using a new one-time passcode derived from the updated given shared secret seed, wherein an anomaly is detected when the client attempts the second authentication using a one-time passcode and the server determines that the one-time passcode was generated by a previously used shared secret seed.
2. The method of claim 1 , wherein, in response to the anomaly being detected, the server initiates a predefined recovery workflow.
3. The method of claim 1 , wherein the server detects a breach of shared secret seeds of multiple users by monitoring a number of said detected anomalies across a user population.
4. The method of claim 1 , wherein the update comprises one or more of an exclusive OR operation and a hash operation applied to one or more of:
(i) at least a portion of the given shared secret seed, and
(ii) one or more of a timestamp of the first authentication, the given one-time passcode
from the first authentication and an expanded version of the given one-time passcode from the first authentication.
5. The method of claim 1 , wherein a client token displays a result of an exclusive OR operation applied to the given one-time passcode and the new one-time passcode and wherein the server receives the result from the client as part of the second authentication.
6. The method of claim 1 , wherein the server sends the client a notification of one or more of that the first authentication succeeded and that the given shared secret seed needs to be updated.
7. The method of claim 1 , wherein the given shared secret seed and the updated shared secret seed are part of a chain of shared secret seed values.
8. The method of claim 1 , wherein the server stores the timestamp of the first authentication when the given shared secret seed was used, and wherein the server receives, from the client, the timestamp of the first authentication from the client as part of the second authentication and the server uses the timestamp of the first authentication to retrieve the given shared secret seed.
9. The method of claim 1 , wherein a token that generates the given one-time passcode and the new one-time passcode requires a user to authenticate before a one-time passcode is presented and provides a mechanism for the user to indicate whether an authentication was successful.
10. The method of claim 1 , wherein the server stores a set of previously accepted one-time passcodes, wherein the server evaluates one or more of the previously accepted one-time passcodes to validate the new one-time passcode.
11. The method of claim 1 , wherein, in response to an undo operation initiated by the client, the given shared secret seed is restored upon a successful authentication of the client.
12. A system, comprising:
a memory; and
at least one processor, coupled to the memory, operative to implement the following steps:
in response to a first authentication of a client using a given one-time passcode derived from a given shared secret seed, updating, by a server, the given shared secret seed using one or more of the given one-time passcode and a timestamp from the first authentication as part of a secret update protocol to generate an updated given shared secret seed; and
evaluating a second authentication using a new one-time passcode derived from the updated given shared secret seed, wherein an anomaly is detected when the client attempts the second authentication using a one-time passcode and the server determines that the one-time passcode was generated by a previously used shared secret seed.
13. The system of claim 12 , wherein a token that generates the given one-time passcode and the new one-time passcode requires a user to authenticate before a one-time passcode is presented and provides a mechanism for the user to indicate whether an authentication was successful.
14. The system of claim 12 , wherein a token that generates the given one-time passcode and the new one-time passcode requires a user to authenticate before a one-time passcode is presented and provides a mechanism for the user to indicate whether an authentication was successful.
15. The system of claim 12 , wherein, in response to an undo operation initiated by the client, the given shared secret seed is restored upon a successful authentication of the client.
16. A computer program product, comprising a non-transitory machine-readable medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
in response to a first authentication of a client using a given one-time passcode derived from a given shared secret seed, updating, by a server, the given shared secret seed using one or more of the given one-time passcode and a timestamp from the first authentication as part of a secret update protocol to generate an updated given shared secret seed; and
evaluating a second authentication using a new one-time passcode derived from the updated given shared secret seed, wherein an anomaly is detected when the client attempts the second authentication using a one-time passcode and the server determines that the one-time passcode was generated by a previously used shared secret seed.
17. The computer program product of claim 16 , wherein the server stores a set of previously accepted one-time passcodes, wherein the server evaluates one or more of the previously accepted one-time passcodes to validate the new one-time passcode.