Token based one-time password security

Patent metadata

Field	Value
Publication number	US-12526276-B2
Application number	US-202318194891-A
Country	US
Kind code	B2
Filing date	Apr 3, 2023
Priority date	Nov 7, 2012
Publication date	Jan 13, 2026
Grant date	Jan 13, 2026

Abstract

A one-time password (OTP) based security scheme is described, where a provider pre-generates a number of verification codes (e.g., OTP codes) which will be valid for a predetermined interval. The provider then encodes the verification codes (e.g., by hashing each code with a time value), and stores the verification codes into a data structure. The data structure can be provided to a verification system that can use the set of pre-generated OTP codes to authenticate requests received from users having personal security tokens.

First claim

What is claimed is:

1 . A computer implemented method for verifying a one-time password (OTP), comprising:
receiving, by a verification system that is responsible for authenticating resource requests, a data structure containing a plurality of encoded OTP codes each valid for a specified duration, wherein the plurality of encoded OTP codes comprises encoded versions of initial OTP codes generated utilizing a seed value; receiving a request OTP code and a resource request from an OTP device; verifying, by the verification system, that the request OTP code matches a decoded OTP code from one of the plurality of encoded OTP codes, wherein the seed value is not accessed by the verification system during the verification; and authenticating the resource request based at least in part on verifying the request OTP.

2 . The computer implemented method of claim 1 , wherein the OTP device is configured to:
generate the request OTP code based on the seed value; and provide the request OTP code to the verification system for authentication.

3 . The computer implemented method of claim 2 , further comprising:
decoding the plurality of encoded OTP codes to provide a plurality of decoded OTP codes; verifying that the request OTP code matches one of the plurality of decoded OTP codes; and authenticating the resource request in response to verifying the request OTP code.

4 . The computer implemented method of claim 3 , wherein the verification system is further configured to:
identify a current time, wherein decoding the plurality of encoded OTP code is based on the current time.

5 . The computer implemented method of claim 1 , wherein the specified duration is a time interval that a respective code is valid.

6 . The computer implemented method of claim 1 , wherein the plurality of encoded OTP codes is encoded, as the encoded versions, using a hash function applied to the initial OTP codes.

7 . The computer implemented method of claim 1 , further comprising:
generating a second plurality of encoded OTP codes based in part at least in part on the seed value and based at least in part on an identifier that indicates a second specified duration during which a respective OTP code of the second plurality of encoded OTP codes is valid; and providing a second data structure containing the second plurality of encoded OTP codes.

8 . The computer implemented method of claim 7 , further comprising:
decoding the second plurality of encoded OTP codes to provide a second plurality of decoded OTP codes; sending a notification to advance to the second specified duration; receiving the request OTP code; determining that one of the second plurality of decoded OTP codes matches the request OTP code; and authenticating the resource request.

9 . The computer implemented method of claim 1 , further comprising:
associating one of the plurality of encoded OTP codes with a time identifier that indicates a portion of a predetermined interval during which a respective OTP code is valid; calculating a value of a cryptographic function based at least in part on the respective OTP code and the time identifier; and storing the value as an entry in the data structure.

10 . A computer implemented method for verifying a one-time password (OTP), comprising:
requesting, by a verification system that is responsible for authenticating requests, a plurality of OTP codes and specifying a duration; receiving, by the verification system, a data structure containing a plurality of encoded OTP codes, wherein the plurality of encoded OTP codes comprises encoded versions of initial OTP codes generated utilizing a seed value, and wherein the plurality of encoded OTP codes in the data structure are each encoded based on the specified duration; receiving a request OTP code and a resource request from an OTP device; verifying that the request OTP code matches a decoded OTP code from one of the plurality of encoded OTP codes, wherein the seed value is not accessed by the verification system during the verification; and authenticating the resource request based at least in part on verifying the request OTP.

11 . The computer implemented method of claim 10 , further comprising:
sending a notification to the OTP device that the specified duration has expired; requesting a second plurality of OTP codes and specifying a second duration; and receiving a second data structure containing a second plurality of encoded OTP codes, wherein the second plurality of encoded OTP codes comprises encoded versions of second initial OTP codes generated utilizing the seed value, and wherein the second plurality of encoded OTP codes in the second data structure are encoded based on the second specified duration.

12 . The computer implemented method of claim 10 , further comprising:
sending verification materials in response to authenticating the resource request.

13 . The computer implemented method of claim 12 , wherein the verification materials are valid for an interval.

14 . The computer implemented method of claim 10 , wherein the data structure is a bloom filter.

15 . The computer implemented method of claim 10 , wherein the seed value is embedded in the OTP device.

16 . A provider computing system for verifying one-time passwords, comprising:
memory having instructions that when executed by the provider computing system enables the provider computing system to:
generate a plurality of encoded one-time password (OTP) codes to each be valid for a specified duration and to each comprise an encoded version of a initial OTP code; and
provide a data structure to a verification system, the data structure containing the plurality of encoded OTP codes to authenticate one or more access requests to one or more cloud-based resources, the plurality of encoded OTP codes being generated utilizing a seed value, the one or more access requests being authenticated based, at least in part, on a comparison of at least one of the plurality of encoded OTP codes to a request OTP code associated with an access request of the one or more access requests, and on the seed value not being accessed by the verification system during the authentication.

17 . The provider computing system of claim 16 , wherein the instructions, when executed by the provider computing system, enables the provider computing system to further:
generate the request OTP code based on the seed value; and provide the request OTP code for authentication.

18 . The provider computing system of claim 16 , wherein the verification system is configured to:
receive the data structure from the provider computing system; receive the request OTP code with the access request to access one or more resources from an OTP device; decode the plurality of encoded OTP codes to provide a plurality of decoded OTP codes; verify that the request OTP code matches one of the plurality of decoded OTP codes; and authenticate the access request in response to verifying the request OTP code.

19 . The provider computing system of claim 16 , wherein the data structure is a bloom filter.

20 . The provider computing system of claim 16 , wherein the instructions when executed by the provider computing system further enables the provider computing system to:
provide the seed value to an OTP device to allow the OTP device to provide the request OTP code with an access request of the one or more access requests.

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek
• Baer Graeme David
• Pratt Brian Irl

Classifications

• G06F21/34 Primary

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• H04L63/0838 Primary

  using one-time-passwords · CPC title