# US 11,115,213 B1 · Thwarting one-time password theft > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,213 B1 - Document ID: US11115213B1 - Status: Granted - Kind: B1 - Application number: 16/774,695 - Filed: 2020-01-28 - Granted: 2021-09-07 - Earliest claimed: 2020-01-28 - Assignees: NortonLifeLock Inc. - Applicants: NortonLifeLock Inc. - Inventors: Venkadesan Marimuthu - Web page: https://patentgrep.com/patent/US11115213B1 ## CPC - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - G06F 21/42: using separate channels for security data - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 63/0838: {using one-time-passwords} - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - H04L 2463/062: applying encryption of the keys - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Thwarting one-time password (OTP) theft. In one embodiment, a method may include receiving, at a messaging application executing on the mobile device, a text message from a website that includes an original OTP. The method may also include encrypting, by the messaging application, the original OTP included in the text message to thwart theft of the original OTP from the text message. ## Claims ### Claim 1 A computer-implemented method for thwarting one-time password (OTP) theft, at least a portion of the method being performed by a mobile device comprising at least one processor, the method comprising: receiving, at a messaging application executing on the mobile device, a text message from a website that includes an original OTP; encrypting, by the messaging application, the original OTP included in the text message to thwart theft of the original OTP from the text message; storing, by the messaging application, the text message including the encrypted OTP; detecting, at an OTP plugin application, entry of the encrypted OTP into the website loaded into a browser application; decrypting, by the OTP plugin application, the encrypted OTP to reveal the original OTP; and replacing, by the OTP plugin application, the encrypted OTP with the original OTP prior to submission of the original OTP to the website. ### Claim 2 (depends on 1) The method of claim 1, wherein the messaging application is a custom messaging application configured to handle all incoming text messages received at the mobile device. ### Claim 3 (depends on 1) The method of claim 1, wherein the encrypting of the original OTP comprises encrypting the original OTP with a format preserving encryption algorithm. ### Claim 4 (depends on 3) The method of claim 3, wherein the format preserving encryption algorithm is configured to cause the encrypted OTP to have the same number of characters as the original OTP. ### Claim 5 (depends on 1) The method of claim 1, wherein the encrypting of the original OTP comprises: generating, by the messaging application, an asymmetric key pair including a private key and a public key; storing, at the mobile device, the private key; sending, from the messaging application to the OTP plugin application, the public key; generating, by the OTP plugin application, an original session key; encrypting, by the OTP plugin application, the original session key using the public key; sending, from the OTP plugin application to the messaging application, the encrypted session key; decrypting, by the messaging application, the encrypted session key using the stored private key to reveal the original session key; and encrypting, by the messaging application, the original OTP using the original session key. ### Claim 6 (depends on 5) The method of claim 5, wherein the public key and the encrypted session key are sent via a first server that is different from a second server that hosts the website. ### Claim 7 (depends on 1) The method of claim 1, wherein the replacing of the encrypted OTP with the original OTP comprises automatically filling in a form field of the website, into which the encrypted OTP was entered, with the original OTP. ### Claim 8 A computer-implemented method for thwarting one-time password (OTP) theft, at least a portion of the method being performed by a mobile device comprising at least one processor, the method comprising: receiving, at a messaging application executing on the mobile device, a text message from a website that includes an original OTP; upon receipt of the text message at the messaging application, automatically encrypting, by the messaging application, the original OTP included in the text message, with a format preserving encryption algorithm, to thwart theft of the original OTP from the text message; storing, by the messaging application, the text message including the encrypted OTP; and displaying, by the messaging application, the text message with the encrypted OTP being visible. ### Claim 9 (depends on 8) The method of claim 8, wherein the messaging application is a custom messaging application configured to handle all incoming text messages received at the mobile device. ### Claim 10 (depends on 8) The method of claim 8, wherein the format preserving encryption algorithm is configured to cause the encrypted OTP to have the same number of characters as the original OTP. ### Claim 11 (depends on 8) The method of claim 8, wherein the encrypting of the original OTP comprises: generating, by the messaging application, an asymmetric key pair including a private key and a public key; storing, at the mobile device, the private key; sharing, by the messaging application, the public key; receiving, at the messaging application, an encrypted session key that was encrypted using the public key; decrypting, by the messaging application, the encrypted session key using the stored private key to reveal an original session key; and encrypting, by the messaging application, the original OTP using the original session key. ### Claim 12 (depends on 11) The method of claim 11, wherein the public key and the encrypted session key are sent via a first server that is different from a second server that hosts the website. ### Claim 13 (depends on 8) The method of claim 8, wherein the text message is a Short Message Service (SMS) text message. ### Claim 14 A computer-implemented method for thwarting one-time password (OTP) theft, at least a portion of the method being performed by a network device comprising at least one processor, the method comprising: detecting, at an OTP plugin application executing on the network device, entry of an encrypted OTP into a website loaded into a browser application executing on the network device; decrypting, by the OTP plugin application, the encrypted OTP to reveal an original OTP; and replacing, by the OTP plugin application, the encrypted OTP with the original OTP prior to submission of the original OTP to the website. ### Claim 15 (depends on 14) The method of claim 14, wherein the encrypted OTP was encrypted with a format preserving encryption algorithm. ### Claim 16 (depends on 15) The method of claim 15, wherein the format preserving encryption algorithm is configured to cause the encrypted OTP to have the same number of characters as the original OTP. ### Claim 17 (depends on 14) The method of claim 14, wherein the encrypted OTP was encrypted using a session key that was generated by the OTP plugin application. ### Claim 18 (depends on 14) The method of claim 14, wherein the replacing of the encrypted OTP with the original OTP comprises automatically filling in a form field of the website, into which the encrypted OTP was entered, with the original OTP. ### Claim 19 (depends on 14) The method of claim 14, wherein the network device is a mobile device at which a text message from the website that includes the original OTP is received.