One-time password authentication employing local testing of candidate passwords from one-time password server

A computerized device operable as a one-time password (OTP) server, comprising:

• non-transitory memory operative to store computer instructions;
• and
• a processor coupled to the memory operative to execute the computer instructions to cause the computerized device to perform a method by which the computerized device provides a one-time password service to an authentication server coupled to the OTP server by a communications channel, the method comprising:
• maintaining, in the memory, a set of associations between a plurality of users and corresponding user-specific secret data used in a one-time-password (OTP) process to generate OTPs for use in authenticating the users;
• receiving an authentication request from the authentication server via the communications channel, the authentication request identifying one of the users, the authentication server having separately received a first hashed OTP value resulting from application of a hash function to a user-generated OTP for authenticating the identified user;
• in response to receiving the authentication request, executing the OTP process using the secret data for the identified user to generate a set of candidate OTPs, any one of the candidate OTPs being expected to match the user-generated OTP for a valid authentication of the identified user;
• generating and returning a response to the authentication server via the communications channel, the response including second hashed OTP values each generated by applying the hash function to a respective candidate OTP;
• subsequent to returning the response to the authentication server, receiving an informational message from the authentication server (a) indicating whether any of the second hashed OTP values has matched the first hashed OTP value, and (b) identifying which one, if any, of the second hashed OTP values has matched the first hashed OTP value;
• and
• conditionally taking further user-specific action based on the indication in the informational message whether any of the second hashed OTP values has matched the first hashed OTP value,
• wherein the user-specific action includes (a) maintaining a count of recent occurrences of OTP requests for the user for which the informational message from the authentication server indicates that none of the second hashed OTP values has matched a hashed OTP value for the user, and (b) taking count-based action based on whether the count of recent occurrences is greater than a predetermined threshold.