Method, apparatus, and computer program product for secure two-factor authentication

A computer program product comprising at least one non-transitory computer-readable storage medium having computer-executable program code instructions stored therein, the computer-executable program code instructions comprising program code instructions to:

• receive a request for registration for two-factor authentication from a client;
• receive a username and password;
• provide a request for a mobile device number in response to the username and password corresponding to an account;
• receive the mobile device number and a pre-shared key;
• send, to a mobile device corresponding to the mobile device number, an identity of the client and a server key share;
• receive, from the mobile device, a device key share;
• send information corresponding to an exchange with the mobile device and a challenge derived from the pre-shared key to the client in response to the device key share corresponding to the server key share;
• receive from the client, confirmation of registration with the mobile device;
• establish a shared key in response to verification of the confirmation;
• receive an access request including the username and password;
• select a random string;
• transmit the random string to the mobile device via short message service (SMS);
• receive a one-time password from the mobile device derived from the random string, wherein the one-time password is derived by computing a Media Access Control (MAC) address and truncating the MAC address to obtain the one-time password;
• and
• allow the access request in response to the one-time password corresponding to the random string based on the shared key.

A method for registering two-factor authentication comprising:

• receiving a request for registration for two-factor authentication from a client;
• receiving a username and password;
• providing a request for a mobile device number in response to the username and password corresponding to an account;
• receiving the mobile device number and a pre-shared key;
• sending, to a mobile device corresponding to the mobile device number, an identity of the client and a server key share;
• receiving, from the mobile device, a device key share;
• sending information corresponding to an exchange with the mobile device and a challenge derived from the pre-shared key to the client in response to the device key share corresponding to the server key share;
• receiving from the client, confirmation of registration with the mobile device;
• establishing shared key in response to verification of the confirmation;
• receiving an access request including the username and password;
• selecting a random string;
• transmitting the random string to the mobile device via short message service (SMS);
• receiving a one-time password from the mobile device derived from the random string, wherein the one-time password is derived by computing a Media Access Control (MAC) address and truncating the MAC address to obtain the one-time password;
• and
• allowing the access request in response to the one-time password corresponding to the random string based on the shared key.