Patent ID: 11870908
Assignee: nan
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 16:
17. A method of One Time Password (OTP) authentication and encryption, comprising:
a first operator choosing a first identifier and OTP generation parameters, recording to a first memory of a first device the OTP generation parameters under the first identifier; and,
choosing a first password;
the first operator communicating the first password and the first identifier to a second operator in one of a face-to-face meeting, a voice conversation, or over a secondary out-of-band network;
establishing a first communication channel between the first device and a second device over a primary network, wherein the second device is pre-programmed with the first password and the first identifier;
performing a data exchange between the first device and the second device over the established first communication channel, wherein the data exchange comprises:
transmitting, from the second device to the first device, an authentication request comprising the first identifier and a first set of parameters of a pre-determined Password Authenticated Key Exchange (PAKE) protocol, wherein the first set of parameters of the pre-determined PAKE protocol are derived from the first password;
computing, on the first device, a first PAKE symmetric cryptographic key based on the first password and the first set of parameters of the pre-determined PAKE protocol received from the second device;
transmitting, from the first device to the second device, a second set of parameters of the pre-determined PAKE protocol, a first message authentication code (MAC) derived from the computed first symmetric cryptographic key, the first and second sets of parameters of the pre-determined PAKE protocol, and a first command containing OTP generation parameters, wherein the first command is encrypted with the computed first symmetric cryptographic key;
computing, on the second device, the first symmetric cryptographic key based on the first set of parameters of the pre-determined PAKE protocol and the received second set of parameters of the pre-determined PAKE protocol;
deriving, on the second device, a first candidate MAC based on the first and second parameters of the pre-determined PAKE protocol, the first encrypted command, and the computed first symmetric cryptographic key;
validating, on the second device, that the derived first candidate MAC and the received first MAC match;
wherein based on the first candidate MAC and the first MAC matching, the second device (i) processes the received first command and generates a second command containing confirmation of acceptance of OTP generation parameters, and (ii) transmits to the first device the generated second command wherein the second command is encrypted with the first symmetric cryptographic key, and a second MAC derived from (a) the computed first symmetric cryptographic key, (b) the first and second sets of parameters of the pre-determined PAKE protocol; (c) the encrypted first and second commands;
deriving, on the first device, a second candidate MAC based on (a) the computed first symmetric cryptographic key, (b) the first and second sets of parameters of the predetermined PAKE protocol; (c) the encrypted first and second commands;
validating, on the first device, that the second candidate MAC and the received second MAC match;
wherein based on the derived second candidate MAC and the received second MAC matching, the first device (i) decrypts and processes the received second command; and,
the first device recording OTP generation parameters under the first identifier; and,
the second device recording OTP generation parameters under the first identifier; and,
until a second round of authentication, the devices use the first symmetric key for authentication or encryption of any additional data exchanges; and, in future rounds of authentication each of the first operator and the second operator generates the same OTP and uses it as the password.