Token based one-time password security
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Graeme David Baer, Brian Irl Pratt
Life of this patent
Estimating the term…
Abstract
A one-time password (OTP) based security scheme is described, where a provider pre-generates a number of verification codes (e.g., OTP codes) which will be valid for a predetermined interval. The provider then encodes the verification codes (e.g., by hashing each code with a time value), and stores the verification codes into a data structure. The data structure can be provided to a verification system that can use the set of pre-generated OTP codes to authenticate requests received from users having personal security tokens.
Claims18
A computer implemented method for securing access in computing systems, the method comprising:
- generating a plurality of one-time password (OTP) codes based at least in part on a seed value;
- encoding the plurality of OTP codes by applying a hash function to the plurality of OTP codes, the hash function for an individual one of the OTP codes based at least in part on a time identifier that indicates a predetermined event duration during which the respective OTP code is valid;
- and
- providing a data structure containing the plurality of encoded OTP codes to a verification system to authenticate one or more access requests to one or more cloud-based services, the seed value being inaccessible to the verification system, and the a plurality of OTP codes being valid during the predetermined event duration.
A computer implemented method comprising:
- transmitting a request for access credentials to one or more cloud-based services;
- receiving first verification materials generated based at least in part on a first seed value;
- generating a plurality of one-time password (OTP) codes generated based at least in part on the first seed value or the first verification materials, wherein the seed value is inaccessible to a verification system for the one or more cloud-based services and the plurality of OTP codes are valid during a predetermined event duration;
- and
- encoding the plurality of OTP codes by applying a hash function individuals of the plurality of OTP codes, the hash function based at least in part on a time identifier that indicates a portion of the predetermined event duration during which the respective OTP code is valid.
A computer implemented method for verifying requests for access in computing systems, comprising:
- receiving, by a verification system, a data structure storing one or more encoded verification codes, the one or more encoded verification codes being valid during a portion of a predetermined event duration and encoded by hashing individual verification codes with a time identifier that indicates the portion of the predetermined event duration during which the respective verification code is valid;
- receiving at least one access request containing a purported verification code generated by a device, the purported verification code generated based at least in part on a seed value embedded in the device, wherein the seed value is inaccessible to the verification system;
- encoding the purported verification code with a current time that the access request was received;
- and
- authenticating, by the verification system, the access request based at least in part on matching the encoded purported verification code contained in the access request to one of the plurality of encoded verification codes stored in the data structure.
Dependencies are inferred from the claim text.