Patent ID: 12199975

DETAILED DESCRIPTION OF THE DISCLOSURE

It is an object of this disclosure to provide apparatus and methods for automating replacement and disablement of one-time password (“OTP”) generators.

An apparatus for automating certain aspects of a one-time password (“OTP”) generator is provided. The apparatus may include an OTP generator which may be assigned to a user. The OTP generator may include a battery, a display, a form factor, a processor, and a non-transitory memory, one or more sensors, as well as other components such as a communication link and a power button.

Standard OTP generators may display a series of digits as the OTP. The more digits, the more secure the OTP may be. In other embodiments, OTP generators may generate codes other than digits, for example, a QR code, a drawing/figure, a series of lights, or a sound. A user may hold the OTP generator up to a camera, QR code reader, or a microphone to authenticate. Additional information may be added to these types of OTP generators by modifying the QR code, the figure, or the sound, to include additional information beyond the standard authentication code. In these various embodiments, an OTP may not be limited to numerical digits.

In an embodiment, the OTP generator may include a biometric scanner, a microphone, or a speaker. In an embodiment, the display may be an LCD screen, an LED screen, and/or an OLED screen. The display may be capable of displaying various colors.

In various embodiments, the form factor may be any suitable form factor, such as a keyfob, credit card, USB thumb drive, or other form factors. Different form factors may have various benefits and drawbacks. For example, a larger form factor may be able to include a larger battery, a larger screen, a more powerful processor, more sensors, or more memory. However, a larger form factor may be more expensive, and more capabilities may reduce battery power faster.

The non-transitory memory may be configured to store executable instructions that run on the processor. The instructions may include software or firmware that receives and analyzes a sensor reading from the one or more sensors, generates an OTP for the user, and displays the OTP or otherwise presents the OTP for the user to use to authenticate herself. The OTP may be generated based on a seed value, a timer, a counter, and/or a formula. The more complex the formula, the more secure the OTP may be.

In an embodiment, the executable instructions may include firmware embedded in the hardware, as opposed to software. Hardwired instructions may be more secure, as long as the physical OTP generator is not tampered with and opened. In an embodiment, the OTP generator may include an encryption controller.

The term “non-transitory memory,” as used in this disclosure, is a limitation of the medium itself, i.e., it is a tangible medium and not a signal, as opposed to a limitation on data storage types (e.g., RAM vs. ROM). “Non-transitory memory” may include both RAM and ROM, as well as other types of memory.

The processor(s) may control the operation of the apparatus and its components, which may include RAM, ROM, an input/output module, and other memory. The microprocessor may also execute all software running on the apparatus. Other components commonly used for computers, such as EEPROM or Flash memory or any other suitable components, may also be part of the apparatus.

The apparatus may include an authentication server. The authentication server may include a communication link that is configured to receive the OTP from the user, a server processor, and a server non-transitory memory configured to store at least an operating system and an authentication engine.

In an embodiment, the server may be centralized. In an embodiment, the server may be distributed, to utilize a larger pool of computing resources and provide redundancy. Centralized servers may be easier to secure but also provide a single failure point. Distributed servers may be more robust but may provide multiple avenues for malicious actors to target.

The communication link may enable communication with any device where the user may input the OTP as well as with the OTP generator. The communication link may include any necessary hardware (e.g., antennae) and software to control the link. The server may utilize the communication link to communicate, over a network, with any device the user is inputting the OTP into or with the OTP generator itself. Any appropriate communication link may be used. In an embodiment, the network may be the Internet. In another embodiment, the network may be an internal intranet.

The authentication engine may run on the server processor. The authentication engine may receive the OTP, analyze the OTP in order to authenticate the user (or deny authentication to the user), and analyze the OTP to determine if it includes any additional information. Authentication may be denied if the OTP does not match an expected OTP and if it does not contain any additional information. Authentication may be granted if the OTP matches an expected OTP and/or contains additional information. The server may generate an expected OTP using the same formula and methods as the OTP generator.

In an embodiment, every OTP generator may be unique and have a unique seed value or formulae/formula values. A unique value may be used to identify a particular user from a group of users.

In various embodiments, the executable instructions (i.e., software or firmware) may include instructions for analyzing sensor inputs and determining if the sensor readings require additional information to be communicated to the user or the authentication server. For example, if the sensor reading indicates a failing battery, the instructions may conclude that the fact of a failing battery may need to be communicated to the authentication server so that the server may automatically order a new OTP generator for the user.

When the sensor input requires, according to the executable instructions, a datum of information (i.e., additional information) to be transmitted to the authentication server, the OTP generator may modify the OTP to include a representation of the datum of information that may be received by the authentication engine.

Table 1 includes exemplary conditions and formula that may be included in the executable instructions to generate a OTP with or without additional information.

ConditionFormulaResultStandardf(OTP) = (seed)(counter and/or timer)Standard OTPBattery isf(OTP + battery) = (seed)(counterEnhanced OTP1failingand/or timer)(battery)Device hasf(OTP + tampered) = (seed)(counterEnhanced OTP2been tamperedand/or timer)(tampered)withDevice hasf(OTP + attack) = (seed)(counterEnhanced OTP3been attackedand/or timer)(attack)User is underf(OTP + duress) = (seed)(counterEnhanced OTP4duressand/or timer)(duress)Multiplef(OTP + condition1 + condition2) =Enhanced OTP5conditions(seed)(counter and/ortimer)(condition1)(condition2)

In general, the more complex the algorithm to generate an OTP, the more secure the OTP generator may be. A simplistic formula may be to generate a standard OTP and replace one digit (or one part if it is a non-numerical OTP) with a different digit/part for each condition.

When the authentication engine receives the OTP, analyzes it, and determines that the OTP includes additional information beyond a standard OTP, the engine may analyze the additional information and execute an operation in response to the additional information.

In an embodiment, the authentication engine may generate an expected OTP, which may be the standard OTP. The engine may do so by having identical algorithms and values as the OTP generator. If the received OTP matches the expected OTP, the authentication engine may authenticate the user. If the received OTP does not match the expected OTP, the authentication engine may run the expected OTP through every formula for every condition until it finds a match (in essence, working backwards from the received OTP to determine if it is a possible OTP and what additional information it may include). If it finds a match, the engine will then be aware of the additional information and may be able to execute further operations based on that information. If there is no match, it may indicate to the engine that the received OTP is incorrect and was not generated by the OTP generator, and the engine may deny authentication.

In various embodiments, the one or more sensors may include one or more of a physical state sensor, a battery power level sensor, a light sensor, a GPS/location sensor, as well as other sensors. The physical state sensor may determine if the OTP generator has been tampered with, opened, and/or hacked. The battery power level sensor may determine the remaining charge in the OTP generator's battery. The light sensor may determine environmental conditions.

In an embodiment, the user may indicate duress by modifying a sensor input. For example, the user may cover the light sensor, or cover it in a particular pattern (e.g., cover for two seconds, remove the cover, then cover again for three seconds).

The GPS/location sensor may determine the location of the OTP generator. In an embodiment, if the OTP generator is outside of an expected location (e.g., outside a company's campus), that information may be included as additional information in the enhanced OTP.

In an embodiment, the instructions may require additional information to be transmitted by the OTP to the authentication server if the sensors (i.e., the sensor readings) indicate one or more of the following conditions: 1) the battery needs to be replaced or the charge level is low; 2) the OTP generator has been tampered with; 3) the OTP generator has been opened; 4) the OTP generator has been subject to malicious activity; 5) the OTP generator is located outside an acceptable radius from an expected location; and/or 6) the user is under duress. In an embodiment, the additional information may include the one or more conditions above. Multiple conditions may be included as additional information depending on the algorithm(s) used to generate the enhanced OTPs.

In an embodiment, the operation in response to the additional information may be the server ordering and initiating the sending of a new OTP generator to the user, without any user input. For example, if the additional information indicates that the OTP generator has been damaged or the battery is low, the engine may determine that the user requires a new OTP generator. The engine may autonomously and proactively initiate the process of sending a new OTP generator to the user. The user may be informed that a new OTP generator is being sent.

In various embodiments, additional operations executed by the authentication engine in response to receiving additional information with an OTP code may include disabling the OTP generator, alerting an administrator, flagging the user, flagging the OTP generator, alerting security, contacting the user, or other operations.

In an embodiment, the enhanced OTP may be hidden from a malicious actor, so that the malicious actor may not be aware that it has been caught in the malicious activity. A covert enhanced OTP may be accomplished when the standard OTP is random and unknowable, therefore any change in the standard OTP may be undetectable.

In an embodiment, the enhanced OTP may be a second OTP, and the standard OTP may be a first OTP. In this embodiment, the enhanced OTP may be hidden in that it may not appear on a display until the user activates the OTP generator a second time. For example, if the OTP generator is activated by a user pressing a power button, the first button press may generate a standard OTP and the second button press may generate the enhanced OTP. In this embodiment, the OTP generator may store any additional information gathered at the first button press until the second button press. Performing this action twice may confuse a malicious actor, or it may be useful when the additional information is not urgent. For example, if the additional information is that the battery is failing, but the OTP generator still has the capability to produce a significant number of OTPs before the battery fails, the OTP generator may determine that the additional information can wait for a future generator activation.

A method for increasing information communicated by a one-time password (“OTP”) generator is provided. The method may include receiving, at a processor in the OTP generator, a sensor reading from one or more sensors included with the OTP generator. The sensors may include one or more of a physical state sensor, a battery power level sensor, a light sensor, a GPS/location sensor, as well as other sensors. The method may include analyzing the sensor reading and determining whether the sensor reading requires (additional) information to be transmitted to an authentication engine at a server. For example, if a battery sensor reads that the battery charge is low, that low battery information may need to be sent to the authentication engine.

In an embodiment, the OTP generator (or its components, such as a processor) may make the determination through a machine learning algorithm. For example, a machine learning algorithm may learn the expected location(s) of the OTP generator over a pre-determined amount of time, and if the OTP is outside a pre-determined radius from an expected location, the machine learning algorithm may determine that the OTP generator has been lost or stolen. In another example, a machine learning algorithm may analyze data from multiple OTP generators to determine (i.e., learn) when malicious activity has occurred or is occurring.

In an embodiment, the OTP generator may make the determination through a standard algorithm, such as by comparing the sensor readings to stored and expected values, and if the sensor readings are outside the expected values, determining that additional information may need to be transmitted to the authentication engine.

When the OTP generator determines that no additional information is required to be transmitted to the authentication engine, the OTP generator may generate and display to a user a standard OTP. In various embodiments, the standard OTP may be a string of digits, a drawing, a QR code, and/or a sound.

When the OTP generator determines that additional information may be required to be transmitted to the authentication engine, the OTP generator may generate an enhanced OTP that may include a representation of the additional information, and then display that enhanced OTP for the user. The representation may simply be a modified standard OTP, modified through a particular formula that is correlated with the additional information. For example, if the standard OTP is 123456, the additional information is that the battery charge level is low, the formula may state that the fifth digit of the standard OTP is increased by three, generating an enhanced OTP. Any formula may be utilized, and the more complex the formula, the more secure the OTP may be. If multiple sensor readings need to be reported (e.g., a low battery and a suspicion of tampering), any appropriate formula may be utilized. For example, there may be a specific formula for every possible combination of additional information. Or there may be an algorithm that runs the standard OTP through first one formula for one piece of additional information, and then runs that result through a second formula for a second piece of additional information and continuing for further additional information. The order of information may be a distinct algorithm.

The method may include an authentication engine receiving the OTP from the user. This OTP may be referred to as a received OTP. The received OTP may be either the standard OTP or the enhanced OTP. The authentication engine may be located on a server. The server may be centralized or decentralized.

The method may include the authentication engine comparing the received OTP to an expected OTP. The expected OTP may be equivalent to the standard OTP. When the received OTP is equivalent to/favorably compared to the expected OTP, the authentication engine may authenticate the user. When the received OTP is different from the expected OTP, the authentication engine may determine if the received OTP is an enhanced OTP, meaning that it may include additional information. When the authentication engine determines that the received OTP is an enhanced OTP, it may execute an operation in response to the additional information.

In various embodiments, the operation may include one or more of: authenticating the user, ordering and initiating the sending of a new OTP generator to the user, issuing an alert to an administrator, issuing an alert to a security administrator, contacting the user, requiring further authentication, disabling the OTP generator, refusing to authenticate the user, and other operations.

In various embodiments, the additional information may include an indication of one or more of the following conditions: a battery in the OTP generator needs to be replaced, the OTP generator has been tampered with, the OTP generator has been opened, the OTP generator has been subject to malicious activity, the OTP generator is located outside an acceptable radius from an expected location, or the user is under duress. Further conditions may be included.

In an embodiment, the enhanced OTP may be the standard OTP mathematically adjusted according to a distinct formula for each of the conditions.

A method for proactively replacing a one-time password (“OTP”) generator is provided. The method may include receiving, at an authentication engine located at a server, an OTP from a user. The server may be centralized or distributed. The method may include the authentication engine decrypting the OTP. When the authentication engine determines that the OTP includes information indicating that the OTP generator needs to be replaced, the authentication engine may initiate the sending of a new OTP generator to the user. In an embodiment, the information indicating that the OTP generator needs to be replaced may include information that a battery powering the OTP generator is failing.

In an embodiment, when the authentication engine determines that the OTP includes data indicating that the user is in duress, the authentication engine may alert an administrator.

In an embodiment, when the authentication engine determines that the OTP includes data indicating that the OTP generator has been tampered with, the authentication engine may alert a security administrator. The method may include the authentication engine sending a signal to the OTP generator to deactivate the OTP generator.

One of ordinary skill in the art will appreciate that the steps shown and described herein may be performed in other than the recited order and that one or more steps illustrated may be optional. Apparatus and methods may involve the use of any suitable combination of elements, components, method steps, computer-executable instructions, or computer-readable data structures disclosed herein.

Illustrative embodiments of apparatus and methods in accordance with the principles of the invention will now be described with reference to the accompanying drawings, which form a part hereof. It is to be understood that other embodiments may be utilized, and that structural, functional, and procedural modifications may be made without departing from the scope and spirit of the present invention.

As will be appreciated by one of skill in the art, the invention described herein may be embodied in whole or in part as a method, a data processing system, or a computer program product. Accordingly, the invention may take the form of an entirely hardware embodiment, or an embodiment combining software, hardware and any other suitable approach or apparatus.

Furthermore, such aspects may take the form of a computer program product stored by one or more computer-readable storage media having computer-readable program code, or instructions, embodied in or on the storage media. Any suitable computer readable storage media may be utilized, including hard disks, CD-ROMs, optical storage devices, magnetic storage devices, and/or any combination thereof. In addition, various signals representing data or events as described herein may be transferred between a source and a destination in the form of electromagnetic waves traveling through signal-conducting media such as metal wires, optical fibers, and/or wireless transmission media (e.g., air and/or space).

In accordance with principles of the disclosure,FIG.1shows an illustrative block diagram of apparatus100that includes an OTP generator101. OTP generator101may alternatively be referred to herein as a “computing device.” Elements of apparatus100, including OTP generator101, may be used to implement various aspects of the apparatus and methods disclosed herein. A “user” of apparatus100or OTP generator101may include other computer systems or servers or a human.

OTP generator101may have one or more processors/microprocessors103for controlling the operation of the device and its associated components, and may include RAM105, ROM107, input/output module109, and a memory115. The microprocessors103may also execute all software running on the OTP generator101—e.g., the operating system117and applications119such as the OTP generation engine and security protocols. Other components commonly used for computers, such as EEPROM or Flash memory or any other suitable components, may also be part of the OTP generator101.

The memory115may be comprised of any suitable permanent storage technology—e.g., a hard drive or other non-transitory memory. The ROM107and RAM105may be included as all or part of memory115. The memory115may store software including the operating system117and application(s)119(such as the OTP generation engine) along with any other data111(e.g., seed value(s) and algorithms) needed for the operation of the apparatus100. Memory115may also store applications and data. Alternatively, some or all of computer executable instructions (alternatively referred to as “code”) may be embodied in hardware or firmware (not shown). The microprocessor103may execute the instructions embodied by the software and code to perform various functions.

The network connections/communication link may include a local area network (LAN) and a wide area network (WAN or the Internet) and may also include other types of networks. When used in a WAN networking environment, the apparatus may include a modem or other means for establishing communications over the WAN or LAN. The modem and/or a LAN interface may connect to a network via an antenna. The antenna may be configured to operate over Bluetooth, wi-fi, cellular networks, or other suitable frequencies.

Any memory may be comprised of any suitable permanent storage technology—e.g., a hard drive or other non-transitory memory. The memory may store software including an operating system and any application(s) (such as the authentication engine) along with any data needed for the operation of the apparatus and to allow authentication of a user. The data may also be stored in cache memory, or any other suitable memory.

An input/output (“I/O”) module109may include connectivity to a button and a display. The input/output module may also include one or more speakers for providing audio output and a video display device, such as an LED screen and/or touchscreen, for providing textual, audio, audiovisual, and/or graphical output.

In an embodiment of the OTP generator101, the microprocessor103may execute the instructions in all or some of the operating system117, any applications119in the memory115, any other code necessary to perform the functions in this disclosure, and any other code embodied in hardware or firmware (not shown).

In an embodiment, apparatus100may consist of multiple OTP generators101, along with other devices.

Apparatus100may be connected to other systems, computers, servers, OTP generators, and/or the Internet131via a local area network (LAN) interface113.

Apparatus100may operate in a networked environment supporting connections to one or more remote computers and servers, such as terminals141and151, including, in general, the Internet and “cloud”. References to the “cloud” in this disclosure generally refer to the Internet, which is a world-wide network. “Cloud-based applications” generally refer to applications located on a server remote from a user, wherein some or all of the application data, logic, and instructions are located on the internet and are not located on a user's local device. Cloud-based applications may be accessed via any type of internet connection (e.g., cellular or wi-fi).

Terminals141and151may be personal computers, smart mobile devices, smartphones, or servers that include many or all of the elements described above relative to apparatus100. The network connections depicted inFIG.1include a local area network (LAN)125and a wide area network (WAN)129but may also include other networks. OTP generator101may include a network interface controller (not shown), which may include a modem127and LAN interface or adapter113, as well as other components and adapters (not shown). When used in a LAN networking environment, OTP generator101is connected to LAN125through a LAN interface or adapter113. When used in a WAN networking environment, OTP generator101may include a modem127or other means for establishing communications over WAN129, such as Internet131. The modem127and/or LAN interface113may connect to a network via an antenna (not shown). The antenna may be configured to operate over Bluetooth, wi-fi, cellular networks, or other suitable frequencies.

In an embodiment, the OTP generator101may not operate in a networked environment.

It will be appreciated that the network connections shown are illustrative and other means of establishing a communications link between computers may be used. The existence of various well-known protocols such as TCP/IP, Ethernet, FTP, HTTP, and the like is presumed, and the system can be operated in a client-server configuration. The OTP generator may transmit data to any other suitable computer system. The OTP generator may also send computer-readable instructions, together with the data, to any suitable computer system. The computer-readable instructions may be to store the data in cache memory, the hard drive, secondary memory, or any other suitable memory.

Application program(s)119(which may be alternatively referred to herein as “plugins,” “applications,” or “apps”) may include computer executable instructions for generating OTPs. In an embodiment, the authentication engine or OTP generator may use AI/ML algorithm(s). The various tasks may be related to using an OTP generator and a server to proactively and automatically replacing and disabling OTP generators in response to various conditions the OTP generator may be in.

OTP generator101may also include various other components, such as a battery (not shown), speaker (not shown), a network interface controller (not shown), and/or antennas (not shown).

Terminal151and/or terminal141may be portable devices such as a laptop, cell phone, tablet, smartphone, server, or any other suitable device for receiving, storing, transmitting and/or displaying relevant information. Terminal151and/or terminal141may be other devices such as remote OTP generators or authentication servers. The terminals151and/or141may be computers where the user is interacting with an application that requires a OTP to be input by the user for access.

Any information described above in connection with data111, and any other suitable information, may be stored in memory115. One or more of applications119may include one or more algorithms that may be used to implement features of the disclosure, and/or any other suitable tasks.

In various embodiments, the invention may be operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use with the invention in certain embodiments include, but are not limited to, personal computers, servers, hand-held or laptop devices, tablets, mobile phones, smart phones, other OTP generators, and/or other personal digital assistants (“PDAs”), multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

Aspects of the invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network, e.g., cloud-based applications. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

FIG.2shows illustrative apparatus200that may be configured in accordance with the principles of the disclosure. Apparatus200may be a server or OTP generator with various peripheral devices206. Apparatus200may include one or more features of the apparatus shown inFIGS.1,3, and4. Apparatus200may include chip module202, which may include one or more integrated circuits, and which may include logic configured to perform any other suitable logical operations.

Apparatus200may include one or more of the following components: I/O circuitry204, which may include a transmitter device and a receiver device and may interface with fiber optic cable, coaxial cable, telephone lines, wireless devices, PHY layer hardware, a keypad/display control device, an display (LCD, LED, OLED, etc.), a touchscreen or any other suitable media or devices; peripheral devices206, which may include other computers; logical processing device208, which may compute data information and structural parameters of various applications; and machine-readable memory210.

Machine-readable memory210may be configured to store in machine-readable data structures: machine executable instructions (which may be alternatively referred to herein as “computer instructions” or “computer code”), applications, signals, recorded data, and/or any other suitable information or data structures. The instructions and data may be encrypted.

Components202,204,206,208and210may be coupled together by a system bus or other interconnections212and may be present on one or more circuit boards such as220. In some embodiments, the components may be integrated into a single chip. The chip may be silicon-based.

FIG.3shows an illustrative apparatus in accordance with principles of the disclosure. An OTP generator300may have the form factor of a credit card306. OTP generator300may include a display302that may display a digital OTP304. The OTP generator300may include a power or other button308. The button308may act as a counter for an embedded algorithm that may generate an OTP based on a seed value and the number of times the button308has been pressed by a user. Button308may be a pressure sensitive button. Button308may be a touch sensitive button. Actuation of button308may provide an electronic signal to the processor or other component of the OTP. A user (not shown) may press button308to activate, power on, as a counter, or for another use of the OTP304. A user (not shown) may read the OTP304and input it into an application that is requesting the OTP304. The application may then send the OTP304to an authentication engine to authenticate (or refuse to authenticate) the user. The OTP304may include additional information based on various algorithms. Any suitable algorithm may be used.

FIG.4shows an illustrative apparatus in accordance with principles of the disclosure. OTP generator400may have the form factor of a credit card406. OTP generator400may include a numerical display402that may display a numerical OTP404.

OT generator400may also include a second display408that may display a figure, drawing, or picture or QR code pictorial OTP410. In an embodiment, one single screen408may display both a numerical OTP404and a pictorial OTP410. The displays402and408may be any suitable display, such as, for example, an LCD, LED, or OLED.

OTP generator400may also include a power button412, a microphone414, and a speaker416. OTP generator400may also include various sensors (not shown) and a battery (not shown), among other components. A user (not shown) may speak into the microphone414to activate the generator400. The OTP generator400may ‘display’ a code by emitting a sound through speaker416. The user may place generator400near a microphone and use the sound emitted through speaker416as the code. Additional information may be embedded within the sound.

FIG.5shows an illustrative flowchart in accordance with principles of the disclosure. Methods may include some or all of the method steps numbered501through525. Methods may include the steps illustrated inFIG.5in an order different from the illustrated order. The illustrative method shown inFIG.5may include one or more steps performed in other figures or described herein. Steps501through525may be performed on the apparatus shown inFIGS.1-4, or other apparatus.

At step501, an OTP generator may receive a sensor reading from one or more sensors included with the OTP generator. Sensors may include, inter alia, a light sensor, a location sensor, a sound sensor, a radiation sensor, a temperature sensor, a physical state sensor, and/or a battery charge level sensor, among other sensors.

At step503, the OTP generator may analyze the sensor reading and determine, at step505, whether the reading requires additional information to be transmitted to an authentication engine at a server. For example, the battery charge level sensor may detect that the battery is failing and the OTP generator may determine that that information should be sent to the authentication engine, in addition to the OTP.

At step507, if the OTP generator determines that no additional information needs to be sent to the authentication engine, it may generate a standard OTP. At step509, the generator may display that standard OTP to the user. In a various embodiments, the generator may prompt the user to place the generator before a QR code scanner, a computer camera, a computer microphone, instead of or in addition to displaying the OTP for the user.

At step511, if the OTP generator determines that additional information does need to be sent to the authentication engine, it may generate an enhanced OTP that includes the additional information. At step513, the OTP generator may display that enhanced OTP to the user. In a various embodiments, the generator may prompt the user to place the generator before a QR code scanner, a computer camera, a computer microphone, instead of or in addition to displaying the OTP for the user.

The user may then input either the standard OTP or the enhanced OTP in an application requesting an OTP. At step515, an authentication engine located at a server remote from the user may receive the OTP input by the user as a received OTP. The received OTP should be either the standard OTP or the enhanced OTP.

At step517, the authentication engine may analyze the received OTP and determine if it is equivalent to the standard OTP. If yes, at step519the engine may authenticate the user.

If the received OTP is not the standard OTP, the authentication engine at step521may determine if the received OTP is an enhanced OTP that includes additional information. If the received OTP includes additional information, at step523the engine may execute an operation in response to the additional information. The operation may be to send a new OTP generator to the user, to authenticate the user, to alert security or an administrator, to deny authentication, to disable the OTP generator, or any other appropriate operation.

If the received OTP is not the standard OTP and does not contain additional information, at step525, the engine may refuse to authenticate the user.

FIG.6shows an illustrative flowchart in accordance with principles of the disclosure. Methods may include some or all of the method steps numbered601through609. Methods may include the steps illustrated inFIG.6in an order different from the illustrated order. The illustrative method shown inFIG.6may include one or more steps performed in other figures or described herein. Steps601through609may be performed on the apparatus shown inFIGS.1-4, or other apparatus.

At step601, an authentication engine at a server may receive an OTP from a user. At step603, the engine may decrypt the OTP.

At step605, the engine may determine whether the OTP includes information indicating that the OTP generator needs to be replaced. If not, at step607, the engine may authenticate the user if the received OTP matches the OTP the engine expected to receive.

At step609, if the engine determines that the OTP includes information indicating the OTP generator needs to be replaced, the engine may initiate the sending of a new OTP generator to the user. Information indicating the OTP generator needs to be replaced may include that the battery is failing or the OTP generator has been damaged.

Thus, apparatus and methods for automating replacement and disablement of one-time password (“OTP”) generators are provided. Persons skilled in the art will appreciate that the present invention can be practiced by other than the described embodiments, which are presented for purposes of illustration rather than of limitation.