Patent ID: 9332008
Filing Date: 2016-05-03
CPC Classification: G06F,H04L,H04W

Claim Text:
1. A method, comprising: receiving, by a Time-based One-Time Password (TOTP) network manager executing on a server, a token request to generate a token; generating, by the TOTP network manager, the token with identifying information for a principal attempting to access a protected resource of a network service; supplying the token to a principal; subsequently receiving, by the TOTP network manager, a token registration request for the token from the principal; validating, by the TOTP network manager, the token using the identifying information included in the token for the principal; registering, by the TOTP manager the token upon successful validation of the token; detecting, by the TOTP network manager, a login by the principal to the network service; obtaining, by the TOTP network manager, a unique identity for the principal and supplied by the network service to the principal after a successful login; verifying, by the TOTP network manager, that the token is registered to the principal; generating, by the TOTP network manager, a TOTP secret based at least in part on the unique identity for the principal, the token being registered to the principal, and a secret held by the TOTP network manager, providing, by the TOTP network manager, the TOTP secret to a mobile application of a mobile device operated by the principal for authentication when the principal attempts to access the protected resource of the network service, and then removing the TOTP secret from the server; receiving, by the TOTP network manager, a TOTP authentication request for the principal attempting to access the protected resource of the network service, the request received from a different device being operated by the principal; regenerating, by the TOTP network manager, the TOTP secret; obtaining, by the TOTP network manager, a TOTP generated by the mobile application by hashing the TOTP secret with a current Time Of Day (TOD); receiving, by the TOTP network manager, the TOTP from the different device; generating, by the TOTP network manager, an independent version of the TOTP by using the TOD and the regenerated TOTP secret; and authenticating, by the TOTP network manager, the principal for access to the protected resource, on behalf of the network service, when the independent version of the TOTP matches the TOTP that was supplied by the different device.