One-time password authentication with infinite nested hash claims

1. A method comprising:

providing, by a client computing device registration information to a one-time password (OTP) authentication server; and

generating, by the client computing device via the OTP authentication server, an authenticated OTP with infinite nested hash chains, the generating using a first hash function (h A (•)) for updating a seed chain, a second hash function (h B (•)) for OTP production, an OTP seed number s t OTP for a t th authentication, and two authentication seeds of numbers s 2t-1 Auth and s 2t Auth , for the t th authentication.

2. The method of claim 1 wherein the client computing device is a mobile telephony device.

3. The method of claim 2 wherein registration information comprises an International Mobile Equipment Identity and an International Mobile Subscriber Identity.

4. The method of claim 1 wherein the providing is an initial registration phase with the OTP authentication server, wherein t=1, and wherein the method further comprises receiving, responsive to the providing, the first hash function, the second hash function, the OTP seed number, and the authentication seed number.

5. The method of claim 1 wherein the generating further comprises:

receiving an authentication challenge vector (v t.1 ,v t.2 ) from the OTP authentication server; and

responding to the authentication challenge based at least in part on information associated with the authentication challenge vector.

6. The method of claim 5 wherein responding to the authentication challenge further comprises:

updating the authentication seed according to s 2t Auth =h A 2 (s 2t−1 Auth ); and

wherein responding to the authentication challenge is implemented according to w t =OTP t ⊕h B (h A (s 2t Auth )).

7. The method of claim 5 wherein responding to the authentication challenge further comprises:

calculating a local seed authentication value based on authentication registration information provided to the OTP authentication server;

extracting s 2t−1 Auth from v t.2 (extracted authentication seed for t th authentication); and

if the local seed authentication value is different than the extracted authentication seed, terminating the method with an authentication failure indication.

8. The method of claim 7 wherein extracting is implemented according to v t.2 ⊕h B (h A (s 2t−1 Auth )).

9. The method of claim 7 wherein the local seed authentication value is equal to the extracted authentication seed, and wherein responding to the authentication challenge further comprises:

determining a challenge core (x t ,y t ) from received vector v t.1 ;

calculating an OTP t based on the challenge core; and

communicating the OTP t to the OTP authentication server.

10. The method of claim 9 wherein the challenge core is determined according to

( x t ,y t )= v t.1 ⊕h B ( h A 2 ( s 2t−1 Auth )).

11. The method of claim 5 , further comprising:

receiving, responsive to responding to the authentication challenge, an authentication result from the OTP authentication server;

if the authentication result indicates a successful authentication, for a next authentication:

incrementing authentication count “t”; and

updating the OTP seed number.

12. A computing device comprising a processor operatively coupled to a memory, the memory comprising computer-program instructions executable by the processor to perform operations comprising:

providing a one-time password (OTP) authentication server with registration information; and

generating, with assistance of the OTP authentication server, an authenticated OTP with infinite nested hash chains, the generating using a first hash function (h A (•)) for updating a seed chain, a second hash function (h B (•)) for OTP production, an OTP seed number s t OTP for a t th authentication, and two authentication seeds of numbers s 2t−1 Auth and s 2t Auth for the t th authentication.

13. The computing device of claim 12 wherein the computing device is a mobile telephony device.

14. The computing device of claim 12 wherein the generating further comprises:

receiving an authentication challenge vector (v t.1 ,v t.2 ) from the OTP authentication server; and

responding to the authentication challenge based at least in part on information associated with the authentication challenge vector.

15. A non-transitory computer-readable medium comprising computer-program instructions executable by a processor, the computer-program instructions when executed by the processor for performing the method of claim 1 .

16. A system comprising client-computing device and an OTP authentication server, coupled over a network, and operatively configured to perform the method of claim 1 .

17. A method for a One Time Password (OTP) authentication server device (server), the method comprising:

receiving an OTP authentication request from a client computing device; and

generating an authenticated OTP with infinite nested hash chains, the generating using a first hash function (h A (•)) for updating a seed chain, a second hash function (h B (•)) for OTP production, an OTP seed number s t OTP for a t th authentication, and two authentication seeds of numbers s 2t−1 Auth and s 2t Auth , for the t th authentication; and

wherein the authenticated OTP is based on authentication registration information received from the client-computing device.

18. The method of claim 17 wherein the authentication registration information comprises an International Mobile Equipment Identity and an International Mobile Subscriber Identity pertaining to the client computing device.

19. The method of claim 17 wherein the receiving represents an initial registration phase by the client computing device with the server wherein t=1, and wherein the method further comprises:

combining the authentication registration information to generate the OTP seed number and the authentication seed number; and

sending, responsive to the initial registration phase, the client computing device the first hash function, the second hash function, the OTP seed number, and the authentication seed number.

20. The method of claim 17 , before the step of generating, further comprising:

sending the client computing device in authentication challenge (v t.1 ,v t.2 ); and

receiving, responsive to sending the authentication challenge, a response to the authentication challenge, the response being based at least in part on information provided in the authentication challenge;

if the response is not a valid response to the authentication challenge, communicating, to the client computing device, an authentication failure message;

if the response is a valid response, and for a next authentication:

updating the authentication seed s 2t+1 Auth =h A (s 2t Auth ); and

updating the OTP seed s t+1 OTP =h A x t (s t OTP ).