Mobile offline authentication using one-time passcodes

A mobile device, comprising:

• a mobile device housing having a handheld form factor;
• a wireless interface disposed within the mobile device housing;
• a user interface supported by the mobile device housing;
• memory disposed within the mobile device housing;
• and
• processing circuitry disposed within the mobile device housing, the processing circuitry being coupled to the wireless interface, the user interface and the memory, and the processing circuitry being constructed and arranged to:
• store a set of expected one-time passcodes (OTPs) in the memory, the set of expected OTPs having been previously generated by and acquired from an external authentication server through the wireless interface,
• after the set of expected OTPs is stored in the memory, receive an authentication request from a user through the user interface, the authentication request including a user-provided OTP, and
• perform a local authentication operation which provides an authentication result based on a comparison between the user-provided OTP and an expected OTP of the set of expected OTPs stored in the memory, the authentication result indicating whether authentication of the user is successful or unsuccessful;
• wherein the processing circuitry, when storing the set of expected OTPs in the memory, is constructed and arranged to save, in the memory, an OTP file holding multiple time-indexed OTPs as the set of OTPs, each time-indexed OTP corresponding to a respective window of time;
• and
• wherein the processing circuitry, when performing the local authentication operation, is constructed and arranged to:
• obtain a current time value,
• identify, from the OTP file, particular time-indexed OTPs corresponding to windows of time covering the current time value, and
• compare the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful.

A computer program product having a non-transitory computer readable medium which stores a set of instructions to authenticate a user, the set of instructions, when carried out by processing circuitry of a mobile device, causing the processing circuitry to perform a method of:

• storing a set of expected one-time passcodes (OTPs) in memory of the mobile device, the set of expected OTPs having been previously generated by and acquired from an external authentication server;
• after the set of expected OTPs is stored in the memory of the mobile device, receiving an authentication request from the user, the authentication request including a user-provided OTP;
• and
• performing, by the processing circuitry, a local authentication operation which provides an authentication result based on a comparison between the user-provided OTP and an expected OTP of the set of expected OTPs stored in the memory of the mobile device, the authentication result indicating whether authentication of the user is successful or unsuccessful;
• wherein storing the set of expected OTPs in the memory of the mobile device includes saving, in the memory of the mobile device, an OTP file holding multiple time-indexed OTPs as the set of OTPs, each time-indexed OTP corresponding to a respective window of time;
• and
• wherein performing the local authentication operation includes:
• obtaining a current time value,
• identifying, from the OTP file, particular time-indexed OTPs corresponding to windows of time covering the current time value, and
• comparing the user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of the user is successful or unsuccessful.

In proxy equipment, a method of delivering a set of expected one-time passcodes (OTPs) from an external authentication server to a mobile device to enable user authentication, the method comprising:

• receiving, by a local authentication client of the proxy equipment, the set of expected OTPs through a first communications channel established between the local authentication client and the external authentication server;
• buffering, at least temporarily, the set of OTPs in dedicated memory of the local authentication client of the proxy equipment;
• and
• conveying, by a mobile device module of the proxy equipment, the set of expected OTPs from the dedicated memory of the local authentication client to the mobile device through a second communications channel established between the mobile device module and the mobile device;
• wherein conveying the set of expected OTPs includes saving, in memory of the mobile device, an OTP file holding multiple time-indexed OTPs as the set of OTPs, each time-indexed OTP corresponding to a respective window of time;
• and
• wherein the OTP file enables the mobile device to perform a local authentication operation by:
• obtaining a current time value,
• identifying, from the OTP file, particular time-indexed OTPs corresponding to windows of time covering the current time value, and
• comparing a user-provided OTP to each time-indexed OTP of the particular time-indexed OTPs to determine whether authentication of a user is successful or unsuccessful.