One-time password delivery via in-band unauthenticated channel

A method comprising:

• transmitting, from an entity, a public key of a public-private key pair to an authentication service, the public-private key pair being specific to the entity and used in connection with one-time password generation for a plurality of different end users;
• receiving, from a user device of an end user, a request for access to a secure resource requiring identity verification;
• transmitting, from the entity, a challenge request to the authentication service via an unauthenticated communication channel;
• receiving, at the entity, a one-time password encrypted with the public key from the authentication service via the unauthenticated communication channel;
• decrypting, at the entity, the one-time password;
• and
• delivering the one-time password to the user device of the end user to authenticate an identity of the end user,
• wherein the entity is separate from the authentication service that generates the one-time password to authenticate the identity of the end user, and wherein the entity is separate from the user device of the end user.

A system comprising:

• an authentication system comprising a processor and a memory storing computer-executable instructions which, when executed by the processor, cause the authentication system to:
• receive a public key of a public-private key pair from an entity, the public-private key pair being specific to the entity and used in connection with one-time password generation for a plurality of different end users;
• receive a challenge request from the entity via an unauthenticated communication channel, wherein the challenge request is received from the entity in response to the entity receiving a resource request from a user device of an end user;
• generate a one-time password to authenticate an identity of the end user;
• encrypt the one-time password using the public key;
• and
• deliver the encrypted one-time password to the entity via the unauthenticated communication channel,
• wherein the entity is separate from the authentication system that generates the one-time password to authenticate the identity of the end user, and wherein the entity is separate from the user device of the end user.