Username-less and password-less one-time identification and authentication code method and system
A method for a user to access resources within a secure network without inputting a username or password is presented and claimed where the method comprises inputting, by the user, login credentials into an authentication service and obtaining from the authentication service at least one secret code; inputting the at least one secret code into an OTCP to initialize the OTCP; generating within the OTCP a one-time code (OTC) utilizing the at least one secret code but not including the user's login credentials or username; supplying, by the user, the OTC to a secure web portal wherein the secure web portal confirms authenticity of the OTC with the authentication service; and the secure web portal supplying access to the user of the secure web portal resources upon receipt of authentication of the user.
1. A method for a user to authenticate with an authentication service comprising:
generating within a one-time code producer (OTCP) stored on a token, where the OTCP has been previously initialized, a one-time code (OTC) wherein the OTC does not include either of a user's login credentials or the user's username;
receiving at the authentication service the OTC from the OTCP where the OTC is the only authentication information supplied to the authentication service to authenticate the user;
authenticating the user in the authentication service using the OTC;
wherein the OTCP obtains from the authentication service at least one secret code when the OTCP is initialized, the at least one secret code includes at least one of a secret userLink code, a secret userSeed code, a secret groupSeed code, a secret groupPSK code and a secret groupShift code; and
comparing N characters of the secret userLink code to equivalent userLink codes of all entries stored in the authentication service.
2. The method for a user to authenticate with an authentication service according to claim 1 wherein the OTC is generated within the OTCP utilizing the at least one secret code and one of an HOTP or a TOTP.
3. The method for a user to authenticate with an authentication service according to claim 1 wherein the user logs into the authentication service using the user's login credentials only when initializing the OTCP and to obtain the at least one secret code from the authentication service.
4. The method for a user to authenticate with an authentication service according to claim 1 wherein the secret userLink code does not include the user's username but is associated with the user's username within the authentication service.
5. The method for a user to authenticate with an authentication service according to claim 1 wherein the secret userLink code does not include the user's username but is associated with the user within the authentication service through a GUID of the user.
6. A method for a user to authenticate with an authentication service according to claim 1 wherein the authenticating the user in the authentication service using the OTC further comprises determining the N characters match at least one of the equivalent userLink codes.
7. A method for a user to authenticate with an authentication service according to claim 6 wherein authenticating the user in the authentication service using the OTC further comprises comparing the one of an HOTP or a TOTP with a matching one of an HOTP or a TOTP of the matching at least one of the equivalent userLink codes to authenticate the OTC.
8. The method for a user to authenticate with an authentication service according to claim 1 wherein the token is a mobile computing device.
9. A method for a user to authenticate with an authentication service comprising:
generating, within a one-time code producer (OTCP) that is stored on a token where the OTCP has been previously initialized, a one-time code (OTC) wherein the OTC does not include either of a user's login credentials or the user's username;
receiving at the authentication service the OTC from the OTCP where the OTC is the only login credentials supplied to the authentication service;
comparing, at the authentication service, N characters of the OTC to equivalent userLink codes of all entries stored in the authentication service;
determining the N characters match at least one of the equivalent userLink codes; and
comparing one of an HOTP or a TOTP received as part of the OTC with a matching one of an HOTP or a TOTP of the matching at least one of the equivalent userLink codes to authenticate the OTC.
10. A method for a user to authenticate with an authentication service according to claim 9 wherein the user desires authentication from the authentication service in order to access resources within a secure web portal.
11. A method for a user to authenticate with an authentication service according to claim 9 wherein the token is a mobile computing device.
12. A user to authenticate with an authentication service according to claim 9 wherein the OTC is generated within the OTCP utilizing at least one secret code and the one of an HOTP or a TOTP.
13. A method for a user to authenticate with an authentication service according to claim 12 wherein the OTCP is initialized when the user logs into the authentication service using the user login credentials to obtain the at least one secret code from the authentication service prior to generating the OTC, and the at least one secret code is stored in the OTCP.
14. A method for a user to authenticate with an authentication service according to claim 12 wherein the at least one secret code includes at least one of a secret userLink code, a secret userSeed code, a secret groupSeed code, a secret groupPSK code and a secret groupShift code, and further wherein N characters of the to least one secret code are the first few characters of the secret userLink code.